Privacy Policy

Introduction and scope

YouthCHAT is an electronic screening and decision-support tool used to help identify mental health, lifestyle, and other issues faced by young people in Aotearoa New Zealand. It is used by authorised health professionals as part of routine care and, in some settings, research.

This Privacy Policy explains how information collected through YouthCHAT is used, stored, shared, and protected, and outlines your rights under the Privacy Act 2020 and the Health Information Privacy Code 2020.

This Policy applies to use of the YouthCHAT web application and associated services available at youthchat.co.nz.

YouthCHAT is provided as a clinical and research tool to help clinicians understand and support young people. It is typically used in schools, primary care, youth health services, and research settings.

This Privacy Policy applies to:

young people who complete a YouthCHAT screen (including remote/online screens)
clinicians and authorised staff who use YouthCHAT to invite young people and view results
research and evaluation activities that use YouthCHAT data in anonymised or de-identified form.

Use of YouthCHAT is also governed by the YouthCHAT Terms of Service, which set out additional service, security, and availability commitments.

Clinicians and services using YouthCHAT must also comply with their own organisational policies and with New Zealand privacy and health information laws.

On this page

Key Terms
What Information We Collect
How We Use Your Information
Legal Basis and Compliance (New Zealand)
Storage and Security
Who Can Access Your Information
Research Use and Anonymised Data
Data Retention
Your Rights
Third-Party Services and No Marketing Use
Changes to This Privacy Policy
Contact and Complaints
Last Updated

Data
“Data” means any information collected, generated, or stored through YouthCHAT. This includes:

information entered into YouthCHAT screening assessments (screens)
information about when and where screens were completed
limited information about clinicians and services using YouthCHAT
audit logs and technical information needed to operate the system securely.

Screen
A “Screen” is a YouthCHAT survey (screening assessment) completed by a young person, either in a clinic or remotely.

Young Person
A “Young Person” is the person completing a YouthCHAT screen. In some contexts they may also be referred to as a patient, student, client, or respondent, depending on the setting.

Clinician
A “Clinician” is a health professional or authorised staff member who:

creates YouthCHAT screen invites, and
reviews and uses YouthCHAT results as part of a young person’s care or a research protocol.

We / Us
“We” or “us” refers to the organisations responsible for operating and supporting YouthCHAT, including the University of Auckland and Kekeno Tech Ltd (the approved technical provider), working with participating services.

YouthCHAT is a psychosocial and health screening tool that was developed independently but has been evaluated as mapping closely to the key domains of the HEEADSSS framework. As a result, the information it collects is health information and can be sensitive in nature.

The information we may collect includes:

a) Information about the young person
Depending on what the inviting clinician records, this may include:

first name and surname
date of birth
school or service identifiers (for example, student ID)
National Health Index (NHI) number
contact details such as mobile phone number or email address (especially for remote screens).

Clinicians are asked to record only the minimum personal information needed to correctly link YouthCHAT results to the young person and to contact them where appropriate.

b) Responses to YouthCHAT questions
YouthCHAT screens ask questions about areas such as:

home and family life
school and peer relationships
alcohol and drug use
sexual health
mood, anxiety, and other mental health concerns
exposure to risky or unsafe situations
other lifestyle factors that may affect wellbeing.

The answers to these questions form part of the young person’s health information.

c) Information about clinicians and services
We record limited information about clinicians and services to:

manage user accounts and authentication
link screens to the correct clinic/site
support auditing and system monitoring.

d) Technical and audit information
To operate YouthCHAT safely and reliably, we may also collect:

log and audit data about who accessed which screen and when
basic technical information such as IP address, browser type, and timestamps
system performance and error information.

This technical and audit information is primarily used to keep the service secure, to ensure appropriate access, and to support quality improvement.

We use information collected through YouthCHAT to:

support clinical care, by providing clinicians with structured, timely information about a young person’s wellbeing and risk
help clinicians plan, deliver, and review appropriate follow-up or support
maintain and improve YouthCHAT as a clinical tool (for example, quality improvement, service monitoring, troubleshooting, and training)
conduct approved research and evaluation using anonymised or de-identified data
meet legal, regulatory, and audit obligations, including those relating to health records and privacy
ensure system security, including investigating suspected misuse or unauthorised access.

We do not use YouthCHAT data for advertising, commercial profiling, or other marketing purposes.

YouthCHAT operates under New Zealand privacy and health information law, including:

the Privacy Act 2020, and
the Health Information Privacy Code 2020.

YouthCHAT data is health information. Clinicians and services using YouthCHAT remain responsible for complying with these laws and with any additional obligations under their own professional and organisational standards.

Where YouthCHAT data is used for research, this is subject to appropriate ethics approvals and governance, as required.

YouthCHAT is hosted on secure, cloud-based infrastructure.

We take reasonable steps to protect your information from loss, misuse, and unauthorised access, use, modification, or disclosure. These steps include:

encryption of data at rest and in transit
controlled access to the system, with user authentication and role-based permissions
audit logging of access to YouthCHAT screens and key actions
secure backup and disaster recovery procedures
administrative and technical safeguards, such as staff access controls and monitoring.

YouthCHAT maintains short-term backup copies (generally covering the preceding 7 days) to support disaster recovery and service continuity. Backup data is subject to the same security protections as production data.

While no system can be completely risk-free, we regularly review our security controls to ensure they remain appropriate for the sensitivity of YouthCHAT data.

a) Clinicians and authorised staff

The main people who access YouthCHAT results are the authorised clinicians involved in a young person’s care. This can include:

the clinician who invited the young person to complete a YouthCHAT screen
other authorised staff at the same clinic or service who are involved in the young person’s care, or in managing the service.

Clinicians can only access YouthCHAT if their clinic or service is registered to use the system, and sign-in with full authentication is always required.

Access to YouthCHAT screens is logged and auditable, including which user accessed which record and when.

b) Young Person

A young person has rights under New Zealand law to:

request access to the health information held about them
request correction of that information if they believe it is inaccurate, incomplete, or misleading
request removal of personal identifiers (for example, name, contact details, NHI) from their YouthCHAT record, where this is consistent with legal and clinical record-keeping obligations.

These requests can be made:

directly to support@youthchat.co.nz, or
through the clinician or service that invited them to complete YouthCHAT.

A young person (or their authorised representative) may also request a summary of who has accessed their YouthCHAT information, to the extent this can reasonably be provided.

c) Researchers

Approved researchers from the University of Auckland may be granted access to YouthCHAT data in anonymised or de-identified form, where:

all direct personal identifiers (such as name, date of birth, NHI, student ID, phone number, email address) have been removed, and
the use is covered by appropriate ethics approvals and agreements.

Researchers do not use research data sets to directly identify or contact young people as part of routine YouthCHAT clinical use.

Anonymised or de-identified YouthCHAT data may be used for research and evaluation purposes, for example to:

understand patterns of youth mental health and wellbeing
assess how YouthCHAT is working in practice
inform improvements to youth health services.

The research data sets used for this purpose:

consist primarily of answers to YouthCHAT screening questions and non-identifiable characteristics (for example, age band or general service type)
do not include direct personal identifiers such as name, date of birth, contact details, NHI number, or student ID.

Where required, research use is reviewed and approved by appropriate ethics committees and governed by relevant legal and institutional requirements.

Screening Data and Young Person Records

YouthCHAT data that can identify a young person is retained only for as long as it is needed for:

providing or supporting health care to that young person
meeting legal, regulatory, and record-keeping obligations; and
supporting approved quality improvement, audit, and accountability processes.

In New Zealand, health information is generally required to be kept for a minimum period (for example, 10 years from the date of last clinical contact), unless the law allows or requires a different approach. Actual retention periods may also be influenced by the policies of the clinic, service, or institution responsible for the young person's care.

When identifiable YouthCHAT data is no longer required for the above purposes, it will be:

securely deleted, or
de-identified so that individuals are no longer reasonably identifiable.

Anonymised data used for research and evaluation may be retained for longer periods, because it no longer identifies individuals.

Clinician and Staff User Accounts

User accounts for clinicians and staff are retained for as long as the account is active or needed to provide services and maintain audit trails.

Inactive Accounts:

Accounts that remain inactive for extended periods may be locked for security purposes to prevent unauthorised access.
Locked accounts are retained to preserve audit logs and maintain data integrity for associated clinical records.

Account Deletion and Anonymisation:

When a user account is deleted (either by request or due to account closure):

The account is immediately deactivated
All personal information associated with the account (name, email address, phone number, etc.) is immediately anonymized through our soft delete procedure
De-identified audit logs and system records are retained to maintain data integrity and support ongoing clinical record-keeping requirements
This approach ensures we protect your privacy while maintaining the integrity of clinical data and audit trails

Automatic Account Management:

To maintain security, accounts that remain inactive for 18 months will receive an alert notification. If no login occurs following this notification, the account will be automatically deleted and all personal information immediately anonymised as described above.

If you have questions about how long your YouthCHAT data is held in a particular service, you can contact that service directly or email support@youthchat.co.nz.

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, young people and (where applicable) their authorised representatives have the right to:

request access to personal information held about them in YouthCHAT
request correction of that information if they believe it is inaccurate, incomplete, or misleading
ask for personal identifiers to be removed from YouthCHAT records, where this is consistent with legal, clinical, and record-keeping obligations
be informed about how their information is being collected, used, and shared
raise a concern or complaint if they believe their information has not been handled appropriately.

To exercise these rights, you can:

contact the clinician or service that invited you to complete YouthCHAT, and/or
email support@youthchat.co.nz.

In some cases, legal or clinical obligations may limit what changes can be made. Where this occurs, we will explain the reasons as clearly as we can.

YouthCHAT does not sell data and does not share YouthCHAT information with third parties for marketing, advertising, or other commercial profiling.

We may use trusted third-party service providers (for example, cloud hosting providers and technical support vendors) to help operate and support YouthCHAT. Where this occurs:

these providers act under contract and only on our instructions
they must keep information secure and confidential
they are not permitted to use YouthCHAT data for their own independent purposes, including marketing or building advertising profiles.

YouthCHAT screening data is not used to deliver targeted advertising.

We may update this Privacy Policy from time to time, for example to:

reflect changes in law or regulatory guidance
reflect changes in how YouthCHAT operates
clarify wording or provide more detail where needed.

When we make significant changes, we will:

update the “Last updated” date shown with this policy, and
where appropriate, notify registered clinical sites or update supporting information materials.

By continuing to use YouthCHAT after changes take effect, you are taken to have accepted the updated Privacy Policy.

If you have questions, concerns, or requests relating to this Privacy Policy or to your YouthCHAT data, you can contact us at:

Email: support@youthchat.co.nz

You can also contact the clinic, school, or service that invited you to complete YouthCHAT if your question relates to how they are using and storing your YouthCHAT results.

If you are not satisfied with the response you receive, you may contact the Office of the New Zealand Privacy Commissioner for independent advice or to make a complaint. Information about how to do this is available on the Privacy Commissioner’s website.

Last updated: 13 January 2026