Privacy Policy

1. Information We Collect

• Account information: name, email address, and role (clinician or facilitator) when you register.
• Campaign and template data: the survey campaigns and configuration you create.
• Survey responses: answers submitted by respondents (which may include colleagues or patients) to feedback surveys, including free-text comments.
• Self-assessment data: where enabled, your own self-ratings on the same items your respondents complete.
• Usage data: basic technical information such as login timestamps and audit trail events (e.g. when a survey was released or closed), used to maintain the integrity and security of the platform.

2. How Anonymity Works

Individual survey responses are not linked to an identifiable respondent in a way that is visible to the clinician being assessed. Collated results are only released once a minimum number of responses has been received, to reduce the risk that a small number of respondents could be individually identified from the pattern of results.

Note that while we take steps to protect anonymity at a systems level, free-text comments may sometimes contain information that could indirectly identify the respondent (for example, describing a specific unique incident). Respondents should be advised of this when providing free-text feedback.

3. How We Use Information

We use the information described above to:

• Operate the platform (distributing surveys, collating results, generating reports)
• Maintain an audit trail for campaign integrity and dispute resolution
• Communicate with you about your account or campaigns (e.g. notification emails)
• Improve and maintain the security of the platform

We do not sell your personal information, and we do not use survey response content for any purpose other than delivering the service you have requested.

4. Where Your Information Is Stored

Your information is stored using Supabase, with our database hosted in the Sydney, Australia (ap-southeast-2) region. This means your personal information is stored outside New Zealand. Under Information Privacy Principle 12 of the Privacy Act 2020, disclosure of personal information overseas requires either that the overseas recipient is subject to comparable privacy safeguards, or your authorisation.

5. Who We Share Information With (Subprocessors)

We use the following third-party service providers to operate the platform, each of which processes data on our behalf:

• Supabase — database hosting and authentication (Sydney, Australia)
• Vercel — application hosting
• Resend — transactional email delivery
• Browserless — PDF report generation
• Anthropic — used only for the optional AI-assisted survey template import feature, which processes the content of uploaded documents to extract survey questions

We do not share your personal information with any other third party except where required by law, or with your consent.

6. Facilitators

Where a campaign has a nominated Facilitator, that person has access to certain campaign management functions (such as releasing results) but does not have access to information that would let them identify individual respondents.

7. Data Retention

Account data, campaign data, and survey responses are retained after a campaign closes to allow you to review responses. If you close your account, account data, campaign data, and survey responses are retained for six months and then deleted permanently.

8. Your Rights

Under the Privacy Act 2020, you have the right to:

• Ask us to confirm what personal information we hold about you
• Request access to that information
• Request correction of information you believe is inaccurate
• Request deletion of your account and associated personal information, subject to any legal obligation we may have to retain certain records

To exercise these rights, contact us at support@hypnos.one

If you believe we have not handled your personal information appropriately, you may also complain to the Office of the Privacy Commissioner (privacy.org.nz).

9. Security

We take reasonable steps to protect your information, including role-based access controls and database-level security policies (Row Level Security) restricting access to only what each user role requires.

10. Children's Privacy

Nexus360 is intended for use by registered healthcare professionals and is not directed at children. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will make reasonable efforts to notify existing users of material changes.

12. Contact Us

For any questions about this Privacy Policy or to exercise your privacy rights, contact privacy@hypnos.one