Kia ora. Thank you for trusting us with your information. We know that privacy policies are usually long, so here is a one-page summary of what matters most. The full policy follows.
- We are a sport psychology practice. Our directors, Jason Yuill Proctor and James Orritt, are registered psychologists with the New Zealand Psychologists Board.
- Anything you share with us in a one-to-one session is treated as health information, even if it is about performance rather than clinical concerns. We explain why in Section 3.
- We store your clinical records in Carepatron, a dedicated practice management platform built for the health sector. We do not store your records on personal devices, in email, on paper, or on Google Drive.
- We use WhatsApp only for adult programmes, only for logistics, and only with your consent. We never share clinical content there.
- We never share your information with a coach, school, club, parent, or sporting organisation without your explicit consent, except in the limited circumstances required by law (for example, where there is a serious risk to safety).
- Young people aged 16 and over can give their own consent. For those under 16, we work in partnership with parents and guardians, while still protecting the young person's right to a private therapeutic space.
- You have the right to see what we hold about you, ask us to correct it, and ask us to delete it. You can complain to us, and to the Office of the Privacy Commissioner if you remain unhappy.
- We keep clinical records for at least ten years after our last session with you, as required by NZ law. For records about young people, we keep them until they turn 25 or for ten years, whichever is longer.
- We do not currently use any AI-assisted note-taking or transcription tools in your care. If we ever introduce one, we will tell you first and ask for your consent.
- If anything in this policy is unclear, please email James at info@performance-act.com or call 027 513 8435. We genuinely want you to understand it.
Introduction and Our Commitment to Hauora
Kia ora, and welcome to The Performance Act. We are a sport psychology practice based in Aotearoa New Zealand. Our work supports athletes through one-to-one sessions, group programmes, and consultation with the coaches, parents, and organisations around them. Our mission is to support the hauora (holistic wellbeing) of athletes, coaches, whānau, and sporting communities through evidence-informed psychological practice.
Our directors, Jason Yuill Proctor and James Orritt, are registered psychologists with the New Zealand Psychologists Board. This Privacy Policy explains in plain language how we collect, use, store, share, and dispose of your personal and health information, and what your rights are.
Our practice is governed by the Privacy Act 2020, the Health Information Privacy Code 2020 (HIPC), the Health (Retention of Health Information) Regulations 1996, the Care of Children Act 2004, the NZ Psychologists Board Code of Ethics, and the principles of Te Tiriti o Waitangi.
If anything in this policy is unclear, please get in touch using the details in Section 19. We genuinely want you to understand it.
Who This Policy Applies To
This policy applies to anyone whose personal or health information we collect or hold. That includes:
- Adults and young people (tamariki and rangatahi) who engage in one-to-one sport psychology sessions or clinical support.
- Athletes participating in our group programmes, academies, or team-based performance work, such as The Green Standard.
- Parents, caregivers, and whānau who contact us, or whose information is provided to us in connection with a young person we are working with.
- Coaches, teachers, and sporting organisation staff who engage us for education or consulting.
- Visitors to our website and individuals who submit an inquiry through our online contact form.
- Third parties such as schools, clubs, or coaches who provide us with information about a person we are engaged to support.
Why We Treat Your Information as Health Information
You may be wondering why information you share during a sport psychology session focused on performance — rather than a session focused on a clinical concern — is treated as health information. It is a fair question, and we want to answer it clearly so you understand exactly why we handle your information the way we do.
The law defines health information broadly
Under the Health Information Privacy Code 2020, "health information" is defined broadly. It includes any information about a person's physical or mental health, any disability, or any health service provided to them. The critical phrase is "in connection with." The law does not require a formal clinical diagnosis or a severe mental health presentation. If information is gathered in the context of a service that relates to someone's mental functioning or wellbeing, even in a performance context, it is captured by that definition.
The information itself is inherently psychological
Even when we are working purely on performance — helping an athlete manage nerves before a game, build focus, or develop a stronger pre-performance routine — the information we record reflects something about that person's psychological state. A psychometric snapshot, a Mental Gym plan, notes about self-talk patterns or emotional responses under pressure: all of these relate to how a person thinks and feels. The fact that the goal is performance rather than treatment does not change what the information actually is.
Performance and mental health sit on a continuum
Performance anxiety, confidence challenges, focus difficulties, and difficulty bouncing back all exist on a continuum. We deliberately limit our scope to moderate challenges and refer on when something falls outside our expertise. Even so, the information we gather along the way still relates to a person's psychological functioning.
Our registration carries its own obligations
Jason and James are registered psychologists. That registration attaches to them as practitioners, not to a specific type of session. When a registered psychologist gathers information about a person in a professional context, the full protections of the Health Information Privacy Code follow.
What this means for you
In practice, any information you share with us in a one-to-one context is handled to the same high standard, whether the session is clinical or performance focused. Group workshops, public events, and general education sessions where we do not collect or retain individual data are different. But any time we are working with you individually, we treat your information as health information, because that is what it is.
The Laws and Standards That Govern Our Practice
Two laws sit at the foundation of how we handle your information.
The Privacy Act 2020 sets out general information privacy principles that apply to every organisation in New Zealand. The Health Information Privacy Code 2020 (HIPC) layers thirteen tailored rules on top of that, specifically for health agencies like us. Together, they govern every stage of how we handle your information, from the moment we collect it to the moment we destroy it.
Amendment No. 2 to the HIPC, in force since 1 May 2026, strengthened our duty to be transparent when we collect information about you from someone other than you (for example, a school or a club). We address this in Section 6.
Alongside these laws, we are bound by the NZ Psychologists Board Code of Ethics, its Best Practice Guidelines on Record Keeping, the Health (Retention of Health Information) Regulations 1996, and the Board's 2025 guidelines on the responsible use of artificial intelligence.
We do not currently use any AI-assisted tools (clinical scribes, transcription software, or note-generation tools) in your care. If we ever introduce such a tool, we will complete a Privacy Impact Assessment first, update this policy, and ask for your consent before any AI tool is used in your care.
The Information We Collect
We collect only the information we need to deliver safe and high-quality services. All collection is proportionate to the purpose for which it is needed.
5.1 Administrative and contact information
When you make an inquiry or register for a programme, we collect basic details. These are your full name, age bracket, contact phone number, billing information, and the general category of support you are seeking (selected from a dropdown on our inquiry form).
5.2 Clinical and health information
During the course of one-to-one sessions or specialist athlete support, we collect more sensitive information. This may include clinical session notes and assessment results, psychometric snapshots, Mental Gym plans, what you tell us about your mental, emotional, and physical performance, and any relevant history of previous psychological or health support where it is pertinent to your goals.
5.3 Information regarding tamariki and rangatahi
For clients under 18, we collect the contact details of a parent or legal guardian and maintain signed consent records. We respect the developing autonomy of young people, and where appropriate, information may also be collected directly from them in a confidential one-to-one setting. Our approach to consent for young people is described in Section 9.
5.4 Digital and platform data
We collect a small amount of information through our digital platforms to support service delivery. Within our GROW online learning hub, we collect module progress and engagement data. In programme-specific WhatsApp groups (used only with adult programmes, with consent: see Section 8.4), we collect the messages sent within those groups. On our website, we collect anonymised analytics about how visitors use our pages.
5.5 Identifiers
We do not assign you a unique client number beyond what is required by our practice management system. We do not require you to disclose identifiers issued by other agencies (such as your NHI number) unless this is necessary for safe care or required by law. This is consistent with HIPC Rule 12.
How and From Whom We Collect Your Information
We collect information directly from you wherever possible. This is both an ethical commitment and a legal one (under HIPC Rule 2).
6.1 Directly from you
The majority of information we hold comes directly from you, through one of these channels:
- Our website inquiry form, hosted by Tally.so, used for administrative inquiries only.
- Our Carepatron client portal, used for secure intake forms, signed consent, and clinical questionnaires.
- Conversation and interaction during workshops, sport psychology sessions, or kōrero with Jason or James.
6.2 From third parties
Sometimes we collect information about you from a third party, but only with your prior authorisation, or where the HIPC permits it. Third-party sources can include sports clubs, academies, or National Sporting Organisations who have commissioned our services; schools or teachers in charge of athlete development; parents or guardians acting on behalf of a young athlete; and other health practitioners where a coordinated care arrangement is in place.
When we receive information about you from a third party, we will tell you (or your parent or guardian, if you are under 16) at our first opportunity what was provided, by whom, and why. This commitment reflects IPP 3A under HIPC Amendment No. 2.
How We Use Your Information
We use your information only for the purposes for which it was collected. We do not repurpose health or clinical data for marketing, research, or any other secondary purpose without your explicit, informed consent.
We use your information to:
- Deliver tailored sport psychology assessment, intervention, and performance support.
- Design and facilitate athlete development workshops, parent education, and coach education programmes.
- Manage bookings, billing, and administrative communications.
- Ensure the physical and psychological safety of all programme participants.
- Fulfil our professional obligations for clinical supervision, record-keeping, and quality assurance.
Accuracy
Before we use or disclose information about you, we take reasonable steps to make sure it is accurate, up to date, complete, relevant, and not misleading. If you tell us something has changed, we will update our records promptly. This commitment reflects HIPC Rule 8.
Marketing
We do not send marketing emails or operate a newsletter. We do publish a blog on our website, but you do not need to give us any personal information to read it.
How We Protect and Store Your Information
As registered health professionals, we maintain rigorous, multi-layered safeguards to protect your information against unauthorised access, accidental loss, or misuse.
8.1 Clinical records: Carepatron
All of your clinical notes, psychometric results, and health-related records are stored in Carepatron, a practice management platform built specifically for the health sector. We do not store clinical records on personal devices, in email, on paper, or on Google Drive.
Carepatron is independently certified as compliant with the New Zealand Privacy Act 2020, HIPAA (USA), GDPR (EU), SOC 2 Type 1 and Type 2, ISO 27001, and PIPEDA. Carepatron hosts data on Amazon Web Services, Microsoft Azure, and Google Cloud. Data hosting regions are aligned with applicable local regulatory requirements.
Data is encrypted in transit (TLS) and at rest (AES-256). We use multi-factor authentication on all practitioner accounts, and access to clinical session notes is restricted by role to our registered psychologists. You can review Carepatron's Trust Center at trust.carepatron.com.
Because Carepatron may host data on infrastructure located outside New Zealand, this constitutes a cross-border disclosure under Principle 12 of the Privacy Act 2020. We are satisfied that Carepatron's contractual safeguards, certifications, and the privacy laws applying in the relevant hosting jurisdictions provide comparable protections to those in New Zealand.
8.2 Website inquiry forms: Tally.so
Our website contact form is hosted by Tally.so, a Belgian company whose data is stored on servers within the European Union. Because Tally.so operates under the GDPR (which the Office of the Privacy Commissioner considers comparable to the NZ Privacy Act 2020), this arrangement is consistent with Principle 12. We apply strict data minimisation to these forms: only administrative contact details and a pre-selected support category are collected. Submissions are transferred to our secure Carepatron system and then deleted from the Tally dashboard periodically.
8.3 GROW online learning hub
Access to our GROW online hub is password-protected. Engagement and progress data are kept confidential between the athlete and their psychologist and are not shared with coaches, organisations, or other athletes without explicit consent.
8.4 WhatsApp groups
We use WhatsApp only as a logistical and content-sharing channel, and only for programmes where every participant is aged 18 or over. We do not use WhatsApp for any programme involving young people, and we do not use it for clinical communication of any kind.
Before you join a WhatsApp group, we ask for your consent through your intake form. You can decline, and we will provide an alternative communication channel.
- WhatsApp is operated by Meta Platforms, Inc., and its data is processed on servers in the United States.
- We never share clinical content in WhatsApp. If a clinical or personal disclosure happens in a group, we redirect it to a confidential one-to-one channel within Carepatron.
- You can leave a WhatsApp group at any time without affecting your participation in our services.
8.5 Mobile devices and remote practice
Sport psychology is inherently mobile. Any device we use to access Carepatron, send communications, or hold work-related information is encrypted, password-protected, and configured with remote-wipe capability, in line with the Privacy Commissioner's guidance on mobile health practice.
8.6 Other systems we use
We use Google Drive to store organisational documents, such as signed terms of service with sports clubs and schools. We do not store any individual private health information on Google Drive.
Our website is hosted by Vercel.
Working With Tamariki and Rangatahi
We frequently work with young people, and we take our obligations to them — and to their whānau — seriously. Our approach is guided by the Care of Children Act 2004, the HIPC 2020, and the NZ Psychologists Board's ethical guidelines on working with minors.
9.1 Initial meetings and consent
For any client under 18, we begin by meeting with their parents or legal guardians, either separately or alongside the young person. This is when we explain our approach, walk through this Privacy Policy, and obtain signed consent through our Terms of Service. Only after this conversation do one-to-one sessions begin.
9.2 Legal capacity to consent
Under section 36 of the Care of Children Act 2004, a young person aged 16 or over is legally able to give their own informed consent for psychological services. For those under 16, we typically require written consent from a parent or legal guardian.
That said, NZ courts have recognised the principle of "Gillick competence." A young person under 16 who demonstrates a mature understanding of the nature, purpose, and consequences of the service may, in the practitioner's clinical judgement, be able to consent independently to certain aspects of that support.
9.3 Privacy and confidentiality for young athletes
Parents and whānau are vital partners in a young athlete's growth. They do not, however, have an automatic right to access the content of their child's psychological sessions. The young person is entitled to a confidential therapeutic space.
At the start of our work, we establish a clear and documented agreement with both the young person and their whānau. This agreement sets out what high-level themes may be shared with the home environment, and what specific details will remain strictly between the young person and the psychologist.
We will not share a young person's clinical information with a parent or guardian without that young person's consent, except where there is a serious and imminent risk to safety, or where we are required to do so by law.
9.4 A young person's right to their own information
Under HIPC Rule 6, young people have the right to access information we hold about them, regardless of who paid for the service. If a parent or guardian requests access to a young person's records, we will consider the request in light of the young person's age, maturity, expressed wishes, and best interests, and we will normally seek the young person's input before responding.
9.5 When a young person turns 18
When a young person we are working with turns 18, they are an adult under the law and the rights and obligations under this policy transfer fully to them. In practice, this means:
- From the date of their 18th birthday, we no longer share any information with their parents or guardians without their explicit consent, even if we previously did so by agreement.
- We will have a conversation with the young person before or shortly after their 18th birthday to confirm their preferences for ongoing communication, share-back arrangements, and family involvement.
- We will refresh their consent through Carepatron so that the new arrangements are documented.
This approach reflects both the Code of Ethics for Psychologists and the principle that consent must always belong to the person whose information it is.
Confidentiality: The Limits and the Exceptions
Confidentiality is a cornerstone of the therapeutic relationship, and we do not take any exception to it lightly. Your information is accessed only by our practising psychologists, Jason Yuill Proctor and James Orritt. We will never sell, rent, or trade your personal data to any third party.
10.1 Professional supervision and peer consultation
Jason and James are required by the NZ Psychologists Board to engage in regular clinical supervision. Your case may be discussed within that supervisory or peer consultation context, with identifying information anonymised. Our supervisor is an external registered psychologist who is bound by the same Code of Ethics.
10.2 Team and organisational settings: need-to-know
In high-performance and team environments, such as The Green Standard, our psychologists may work alongside coaches, sport scientists, or other members of a performance team. In these settings, we work on a strict need-to-know basis.
A coach may be told that an athlete is working through a personal issue that affects their availability (the "what"), but specific clinical details (the "why" and "how") remain entirely private unless you give us explicit written consent to share them. Where a third party such as an NSO or sports organisation is the commissioning body for our services, we will explain the limits of confidentiality with you before those services begin.
10.3 Mandatory exceptions
Under HIPC Rule 11 and our professional ethical obligations, there are a small number of circumstances in which we are legally or ethically required to disclose information without your prior consent:
- Where there is a serious and imminent threat to your safety or the safety of an identifiable other person, and disclosure is necessary to prevent that harm.
- Where we hold a genuine concern that a child or vulnerable person is at risk of abuse, neglect, or serious harm.
- Where we are compelled to disclose information by a court order, statutory summons, or other valid legal requirement.
In every case where it is safe and practicable, we will discuss the intended disclosure with you before it is made.
Bicultural Governance: Te Tiriti o Waitangi and Māori Data Sovereignty
The Performance Act acknowledges the unique and foundational status of Māori as Tangata Whenua of Aotearoa. We are committed to upholding the principles of Te Tiriti o Waitangi in our practice and in our governance of your information.
Guided by the principles of Māori Data Sovereignty as articulated by Te Mana Raraunga, we recognise that data about an individual can hold significance for their whānau, hapū, and iwi. Health and performance information about a Māori person is not just an individual asset; it can be a taonga of collective importance. We commit to:
-
Rangatiratanga — Authority
We respect and uphold the right of Māori to exercise authority and control over their own data and wellbeing.
-
Whakapapa — Relationships
We acknowledge that all data exists within a context of relationships, and that its collection, use, and storage must be understood within that relational framework.
-
Manaakitanga — Responsibility
We treat all information entrusted to us with the highest respect, ensuring its use never stigmatises, diminishes, or causes collective harm.
-
Kaitiakitanga — Guardianship
We act as kaitiaki, stewards, of the data we hold — not as owners.
On request, we will provide a summary of this policy or related correspondence in Te Reo Māori, and we will work to identify a kaupapa Māori practitioner or service for any client who would prefer one.
We aspire, in time, to conduct periodic cultural reviews of our data governance to ensure it remains genuinely responsive to the needs of tamariki Māori and their whānau.
How Long We Keep Your Information
We do not retain your information for longer than is necessary, subject to the minimum retention periods required by law.
Under the Health (Retention of Health Information) Regulations 1996, clinical health records must be retained for at least ten years from the day after we last provide a service to you. For records relating to a young person, best practice guidance recommends retention until the young person reaches the age of 25, or for ten years from the last service date, whichever is longer.
Other records:
- Administrative data submitted through our Tally.so inquiry form is transferred to Carepatron and then deleted from the Tally dashboard periodically.
- GROW hub engagement logs are retained for the duration of your active participation in a programme, and then anonymised for quality improvement.
- WhatsApp group messages are deleted when the group is closed at the end of a programme.
- Organisational documents on Google Drive (such as signed terms of service with clubs) are retained for the duration of the engagement and for seven years afterwards, in line with general business record-keeping practice.
Once mandatory retention periods have expired, we delete digital clinical records ourselves from Carepatron and from any associated cloud backups. We confirm in writing that this has been done.
Reports for Schools, Clubs, and Sporting Organisations
When a school, club, or NSO commissions us to deliver a programme, they sometimes ask for a report at the end. Our standard practice is as follows:
- Standard reports do not contain individual identifiable information about athletes. They focus on programme delivery, themes, and aggregate observations.
- We will always tell athletes if a report is being prepared for the commissioning organisation.
- If an individual athlete's experience or input is referred to in any way in a report, we will ask that athlete for explicit consent first.
- If the athlete does not consent, we will remove their information from the report.
This applies equally to written reports, verbal debriefs, and any other form of feedback we provide to a commissioning organisation.
Your Rights Under the Privacy Act 2020 and HIPC 2020
You have important rights in relation to the personal and health information we hold about you. We are committed to upholding these rights promptly.
- Right of access. You can request a copy of the personal and health information we hold about you at any time. We will respond within twenty working days, as required by the Privacy Act 2020.
- Right to correction. If anything we hold about you is inaccurate, incomplete, or misleading, you can ask us to correct it. If we disagree, we will note your request on the relevant record.
- Right to withdraw consent. You can withdraw your consent for certain types of data processing at any time. We will explain the consequences if doing so affects our ability to continue providing services to you.
- Right to object. You can object to specific uses of your information (for example, being approached for service feedback). We will respect that objection unless we are required by law to process the information.
- Right to complain. If you believe we have breached your privacy or failed to honour your rights, please contact our Privacy Officer first. We will respond within ten working days. If you remain dissatisfied, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz, by phone on 0800 803 909, or through their online complaint form.
Third-Party Tools, Cookies, and Website Analytics
We use a small number of third-party platforms to deliver our services. These third parties are subject to contractual obligations to handle your data appropriately. We encourage you to review their privacy policies.
- Carepatron Practice management and clinical records Privacy Policy
- Tally.so Website inquiry form Privacy Policy
- Vercel Website hosting and Vercel Analytics Privacy Policy
- Google Analytics Website analytics Privacy Policy
- Google Workspace Organisational documents only — no individual health information Privacy Policy
- WhatsApp / Meta Logistics for adult programmes only Privacy Policy
Cookies and analytics
Our website uses Vercel Analytics and Google Analytics to understand how visitors use our site. These tools use cookies and may collect information such as your approximate location, the pages you visit, and the type of device you are using. The data is used in aggregate and does not personally identify you. You can disable cookies through your browser settings at any time, and you can opt out of Google Analytics specifically by installing Google's Analytics Opt-out browser add-on.
We do not use targeted advertising. We do not share your information with advertising networks or data brokers.
Privacy Breaches
Despite the precautions we take, no digital system can guarantee absolute security.
If a privacy breach occurs that is likely to cause serious harm to any affected person, we are required by the Privacy Act 2020 to notify both the affected person(s) and the Office of the Privacy Commissioner as soon as practicable. We will use the Privacy Commissioner's NotifyUs online tool, and our notification will tell you what happened, what information was involved, what we are doing in response, and what steps you can take to protect yourself.
If you become aware of, or suspect, any unauthorised access to your information held by us, please contact us immediately using the details in Section 19.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legislative requirements, or best practice guidance. When we update, we will revise the "Last Updated" date at the top of the policy. Where the changes are material, we will take reasonable steps to notify clients directly. We encourage you to review this policy periodically.
Important Notice: Crisis Support
The Performance Act is not a crisis or emergency service
Our website and email are not monitored around the clock. If you are in immediate distress or require urgent mental health support:
Call or text 1737 — free, 24/7 mental health support in Aotearoa New Zealand.
For an emergency, dial 111.
This policy does not constitute legal advice. For specific legal guidance regarding your privacy rights, we recommend consulting a qualified New Zealand privacy lawyer or the Office of the Privacy Commissioner.
Contact Our Privacy Officers
For any questions, concerns, access requests, or complaints regarding your personal or health information, please contact us:
Lead Privacy Officer
James Orritt
Director & Registered Clinical Psychologist
Designated under s.201 of the Privacy Act 2020
Co-Privacy Officer
Jason Yuill Proctor
Director & Registered Psychologist
The Performance Act (Performance Act Limited) | Aotearoa New Zealand