Privacy Policy
Last updated: 12 February 2026
1. About this policy
1.1 Heart and Brain Works Limited (NZBN 9429048932189), trading as HeartBrain Works (we, us, our), is committed to protecting your privacy. This policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have.
1.2 This policy applies to personal information we collect through our website at www.heartbrainworks.org, the Alice platform, our training, the Healthy Work Community of Practice, and our dealings with clients, prospective clients and the public.
1.3 We comply with the New Zealand Privacy Act 2020. Where the privacy law of another country applies to our handling of your information, we comply with that law too.
1.4 Words that are defined in our Terms of Use have the same meaning in this policy.
1.5 This policy forms part of our Terms of Use. To the extent the law permits, the limits on our liability in the Terms of Use apply to anything arising under this policy.
2. Whose information we hold, and in what capacity
2.1 We hold personal information in two different capacities.
2.2 For ourselves. We decide why and how we use information about Website visitors, people who contact us, contacts at our Clients, Members of the Community and people who book Training directly with us.
2.3 On behalf of a Client. When an organisation uses Alice or our Training for its workers, we collect and hold information about those workers on that organisation's behalf and in order to provide the Services to it. The organisation remains responsible for telling its workers why the information is being collected.
2.4 Whichever capacity applies, we protect the information in the way this policy describes, and we never give an employer an individual's survey, focus group or interview responses (see clause 5).
3. What we collect
3.1 The information we collect depends on how you deal with us.
| Who you are | What we collect |
| Website visitor | Device and browser type, IP address, pages viewed, referring site, and cookie data. Name and email address if you subscribe to updates or download a resource. |
| Person making an enquiry or booking a call | Name, email address, phone number, job title, organisation and the content of your message. |
| Contact at a Client | Name, job title, work contact details, account login details, billing contact details, and records of our communications and meetings. |
| Alice user at a Client | Name, work email address, role, login details and a record of activity in the platform. |
| Survey Participant | Your survey responses, your answers to demographic questions, and any free-text comments. |
| Focus group or interview participant | Your name and role (where you give them), what you tell us, and our notes of the session, which may be recorded if we tell you so. |
| Training attendee | Name (if applicable), work email address (if applicable), job title (if applicable), organisation, attendance record, and anything you choose to share during a session, which may be recorded if we tell you so. |
| Community Member | Name, email address, job title, organisation, country, profile details, posts and messages in the Community, event attendance, and payment and billing records. |
3.2 Payment information. Online payments are handled by our payment provider. We receive confirmation of payment and limited details such as the card type and last four digits. We do not collect or store full card numbers.
3.3 Survey content. Alice surveys ask about your experience of work. They also ask demographic questions such as team or location, as applicable. We treat all information as confidential.
3.4 Information you do not have to give. Taking part in a survey is voluntary. If you choose not to give us information, we may not be able to provide the relevant Service to you.
4. How we collect it
4.1 From you. We collect most information directly from you, when you fill in a form, create an account, complete a survey, attend a session, post in the Community or contact us.
4.2 From your employer. If your employer is our Client, it may give us your name and work email address so that we can enrol you in Training, if applicable. Your employer is responsible for telling you that it has done so.
4.3 Automatically. We collect some technical information automatically when you use the Website and our online Services, through cookies and similar technologies (see clause 12).
4.4 From others. We may receive information from the person who referred you to us, or from publicly available professional sources such as your organisation's website.
5. Surveys, focus groups and interviews
5.1 Your employer does not see your answers. We do not give your employer your individual survey responses. We do not know, and so cannot tell your employer, whether you took part in a survey.
5.2 How responses are stored. Survey responses are stored without any name, email address or other direct identifier attached, and we are not able to link a response to a named individual.
5.3 Group-level reporting. We report results to your employer for groups of at least 8 respondents. Where a group is smaller than that, its results are combined with another group or withheld. We take reasonable steps to protect the confidentiality of responses, but we cannot guarantee that an individual can never be identified, for example from an inference an employer draws from information it already holds.
5.4 Free-text comments. We never give your employer your written comments and we never share direct quotes. Our team reads free-text comments, together with what is said in focus groups and interviews, and identifies the common themes. Your employer receives those themes only, at group level, described in our words and not yours. This protects the identity of the people who contributed.
5.5 Focus groups, interviews and messages to us. If you take part in a focus group or interview, or contact us directly about a survey or your workplace, we know who you are, but we treat what you tell us as confidential. We do not share direct quotes, we do not attribute a comment to you, and we do not tell your employer who said what or who contacted us. We may disclose information where the law requires it, or where the law permits it in order to prevent a serious threat to someone's life or health. Other people in a focus group will hear what you say there. We ask all participants to keep the discussion confidential, but we are not responsible for what other participants do.
5.6 Not monitored for individual risk. We do not review individual responses in order to identify or contact a person who may be at risk. A survey is not a way to report an urgent concern. If you need help, please contact a health professional or, in an emergency, call 111 in New Zealand or 000 in Australia.
5.7 Aggregated data. We combine survey data in aggregated, de-identified form, including across organisations, to produce benchmarks, to carry out research, to improve our Services and for our other business purposes, as set out in our Terms of Use. We do not publish or share anything from which an individual can reasonably be identified.
6. How we use personal information
6.1 We use personal information to:
- provide the Services, including administering surveys, producing reports, delivering Training and running the Community;
- create and manage accounts, and verify eligibility for the Community;
- process payments and issue invoices;
- respond to enquiries and provide support;
- send service messages, such as booking confirmations, renewal notices and notices of changes to our terms;
- send marketing communications where you have agreed to receive them (see clause 13);
- produce de-identified benchmarks and research, and improve and develop our Services;
- keep our Services secure, and detect and prevent misuse;
- meet our legal, tax and regulatory obligations, and establish or defend legal claims.
6.2 We will not use personal information for a purpose that is not described in this policy or directly related to one that is, unless you have agreed or the law allows or requires it.
6.3 We do not sell personal information.
7. Artificial intelligence
7.1 Alice includes features that allow Clients to use artificial intelligence to summarise results, draft documents and identify trends in their data.
7.2 These features work on group-level results and themes, not individual responses or free-text comments. They are provided using a third-party artificial intelligence service that processes the data on our behalf under contractual confidentiality and security obligations.
7.3 We do not use Client Data to train artificial intelligence models.
7.4 We do not use artificial intelligence to make decisions about any individual.
8. Who we share personal information with
8.1 Your employer. If you are a Participant, we give your employer group-level results and themes as described in clause 5, and Training attendance records where your employer has paid for your place.
8.2 Service providers. We use trusted providers to help us deliver the Services, including providers of website and membership hosting, cloud hosting for Alice, email and messaging, payment processing, appointment booking, video conferencing, accounting, and artificial intelligence services. They may access personal information only to provide their service to us, and they are required to keep it confidential and secure.
8.3 Our team. Our employees and contractors, including facilitators and consultants, access personal information only as needed for their role and are bound by confidentiality obligations.
8.4 Other Community Members. Your name, organisation, profile and posts are visible to other Members.
8.5 Professional advisers and insurers. We may share information with our lawyers, accountants, auditors and insurers where reasonably necessary.
8.6 Where the law requires or permits. We may disclose information where we are required to by law, or where the Privacy Act 2020 or another law permits it.
8.7 Business transfer. If we sell or restructure all or part of our business, personal information may be transferred to the new owner, who may continue to use it as described in this policy.
9. Storing and sending information overseas
9.1 Some of our service providers store or process information outside New Zealand, including in Australia, the United States and the European Union. Client Data in Alice is hosted in the region appointed by the Client, including New Zealand, Australia or other available locations.
9.2 Before we send personal information overseas, we take reasonable steps to make sure it will be protected by safeguards comparable to those under the Privacy Act 2020, for example through our contract with the provider or because the provider is subject to comparable privacy laws.
10. How we protect personal information
10.1 We maintain reasonable technical and organisational measures designed to protect personal information against loss and against unauthorised access, use, modification or disclosure.
10.2 No system can be guaranteed to be completely secure. If you believe your account or information has been compromised, please contact us straight away.
10.3 If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Privacy Commissioner and the affected individuals where the Privacy Act 2020 requires us to. Where the information is held on behalf of a Client, we will tell the Client as described in our Terms of Use.
11. How long we keep personal information
11.1 We keep personal information only for as long as we need it for the purposes described in this policy, or as the law requires. In general:
| Information | How long we keep it |
| Survey responses (held without names or other direct identifiers) | For the Client’s subscription and up to 90 days afterwards. After that, only in aggregated, de-identified form that is not linked to the Client |
| Focus group and interview notes, and messages Participants may send us | 12 months after the final report is delivered |
| De-identified survey data | Indefinitely, for benchmarking and research |
| Client reports and risk register | For the subscription period and up to 90 days afterwards |
| Client and Member account details | For the life of the account and 2 years afterwards |
| Training attendance records | 12 months |
| Session recordings | 12 months |
| Enquiries from people who do not become clients | 2 years after last contact |
| Financial and tax records | 7 years, as required by law |
11.2 When we no longer need personal information, we delete it securely or de-identify it.
12. Cookies and analytics
12.1 Our Website uses cookies and similar technologies to make it work, to remember your preferences, to keep you logged in and to understand how the Website is used.
12.2 We use analytics tools, including Google Analytics, to understand how the Website is used. We also use advertising technologies, including the Meta pixel, which collect information about your visit so that we can measure and show advertising on other platforms. These tools are not used inside Alice surveys.
12.3 You can block or delete cookies in your browser settings. If you do, some parts of the Website or the Services may not work properly.
12.4 We do not use cookies or tracking technologies inside Alice surveys to identify Participants.
13. Marketing
13.1 We send marketing emails, such as newsletters and notices of upcoming training, only to people who have agreed to receive them or where the law otherwise allows.
13.2 You can unsubscribe at any time using the link in any marketing email or by contacting us. We will still send you service messages that are necessary for a Service you use.
14. Your rights
14.1 Seeing your information. You may ask us whether we hold personal information about you and ask for a copy of it.
14.2 Correcting your information. You may ask us to correct personal information about you that you think is wrong. If we do not agree that it is wrong, you may ask us to keep a note with the information recording the correction you asked for, and we will do so.
14.3 Survey responses. Survey responses are collected without your name, email address or any other direct identifier, so we cannot tell which responses are yours. This means that once you submit a survey we cannot give you a copy of your responses, correct them, withdraw them or delete them. Please take this into account before you submit.
14.4 Focus groups, interviews and messages to us. If you took part in a focus group or interview, or sent us a message, we can identify our record of what you told us, and clauses 14.1 and 14.2 apply to it. You may also ask us to delete that record. We cannot withdraw themes that have already been reported to your employer, because they are not attributed to you.
14.5 Accounts and other information. You may ask us to close your account or to delete other personal information we hold about you. We will do so unless we need to keep it for a lawful reason, such as our tax and record-keeping obligations, and we will tell you if that is the case.
14.6 How to make a request. Contact us using the details in clause 19. We may need to confirm your identity first. We will respond as soon as we reasonably can, and no later than 20 working days after we receive your request. We do not usually charge for this.
14.7 When we may refuse. The law allows us to refuse a request in limited circumstances, for example where giving you access would disclose information about another person. If we refuse, we will tell you why and how you can complain.
15. If you are in Australia
15.1 If the Australian Privacy Act 1988 applies to our handling of your personal information, we will handle it in accordance with the Australian Privacy Principles as well as this policy.
15.2 If we are to collect any information about your health or wellbeing in a survey, we will do so only with your consent, which you give by choosing to complete the survey after reading the information provided with it.
15.3 We are based in New Zealand, so your information will be held in or accessed from New Zealand and the other places described in clause 9.
15.4 You may make a complaint to the Office of the Australian Information Commissioner at www.oaic.gov.au if you are not satisfied with our response to a privacy concern.
16. Children
Our Services are intended for adults in a workplace or professional setting. We do not knowingly collect personal information from anyone under 18 years of age.
17. Links to other sites
Our Website and Services may link to websites or services operated by others. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.
18. Changes to this policy
We may update this policy at any time by publishing the updated version on the Website with a new "last updated" date. Changes take effect when published.
19. Contact us and complaints
19.1 Our privacy officer is Alaica Ranchez. If you have a question, a request or a complaint about your privacy, please contact us:
| Company | Heart and Brain Works Limited, trading as HeartBrain Works |
| NZBN | 9429048932189 |
| Address | 7A Heathglen Place, Bayview, Auckland, New Zealand |
| support@heartbrainworks.org | |
| Website | www.heartbrainworks.org |
19.2 We aim to acknowledge a complaint within 5 working days and to resolve it within 20 working days.
19.3 If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at www.privacy.org.nz.