Version: Live version 1 · Authorised for publication · Last updated: 1 November 2026
SOAR Care is operated by This Is Legacy Ltd in Auckland, New Zealand. We recognise that SOAR Care may hold highly sensitive personal, family, disability, care and health-related information. This policy explains what we collect and why.
1. Information we may collect
Depending on how SOAR Care is used, information may include:
- account details such as name, email address, authentication information (including multi-factor authentication settings, where turned on) and an optional account-holder profile image
- information about the person receiving care, including an optional profile photo
- the person's National Health Index (NHI) number, which is required for every Care Profile, and optional IRD and MSD numbers
- answers about the account holder's authority and relationship to the person, and authority evidence uploaded for review
- an optional programme code showing which SOAR Care Caregiver Programme group an account holder came from
- contact details for family, whānau, caregivers and professionals
- health, disability, allergy, medication and care information
- appointments, tasks, notes, routines, goals and wellbeing information
- care plans, respite plans and emergency information
- documents and information users upload
- Care Circle invitations, roles and permissions
- communications and activity needed to operate the service
- technical/security information such as login events, device/browser information, IP address and security logs where collected by SOAR Care or its service providers.
IP addresses are processed to limit repeated sign-up, sign-in and password-reset attempts and to protect accounts.
SOAR Care should collect only information reasonably needed for the service and legitimate operational, security and legal purposes.
2. Where information comes from
Information may come directly from the account holder, another authorised user, the person receiving care, an invited Care Circle member, or integrations/features that the user deliberately chooses to use.
Where a user provides information about someone else, that user is responsible for having appropriate authority or another lawful basis to provide it.
3. Why we use information
We may use information to:
- create and operate accounts
- create and maintain Care Profiles
- review and approve Care Profiles before they are used for care coordination
- prevent more than one active Care Profile being created for the same person, using the NHI number
- display and synchronise care information across authorised SOAR Care features
- allow authorised users to coordinate care
- process invitations and permissions
- provide emergency/QR or sharing features deliberately enabled by users
- send service, security, verification and account communications
- provide support and troubleshoot problems
- protect accounts, detect misuse and maintain security
- maintain backups, audit records and service reliability
- comply with legal obligations
- understand and improve SOAR Care using appropriately limited data
- produce anonymised or aggregated insights where individuals are not reasonably identifiable.
We will not sell personal or health information.
We will not use identifiable health or care information for third-party advertising.
If we later introduce a materially different use of identifiable information, we will provide appropriate notice and obtain consent where required.
4. Sharing within SOAR Care
Information is shared with other SOAR Care users only according to the sharing features, permissions and access controls available to the account/profile.
Users decide whom they invite. SOAR Care cannot choose Care Circle members on a user's behalf.
Founder review. Every Care Profile is reviewed and approved by a SOAR Care founder before it can be used for sharing, invitations, appointments, identifiers or the Emergency QR. For that review, the founders can see the person's name and date of birth, the profile's status, the owner's name, the owner's answers about their authority and relationship to the person, and any authority evidence uploaded. To help spot a mistyped NHI number, the founders are also told whether another active profile has the same name and date of birth, without being shown that profile. The founders do not have access to care records such as notes, medications, appointments, documents or identifiers through that review.
Duplicate profiles. Only one active Care Profile can exist for each NHI number. If someone tries to create a Care Profile for a person who already has an active profile, they see only a general message asking them to contact SOAR Care; they are not told whether a profile exists or who holds it. The founders are notified and keep a record, visible only to them, that links the attempt to the existing profile, so they can contact the existing profile owner outside the app.
Emergency QR. If the profile owner turns on the Emergency QR, the information the owner chooses is shown on a public page to anyone with the QR code or link. The owner sees a preview before turning it on. The NHI number is not shown unless the owner chooses to show it, and IRD and MSD numbers are never shown.
Demonstration family. SOAR Care includes one clearly labelled fictional family used to demonstrate the app. It contains no information about real people and is kept separate from real accounts and Care Profiles.
5. Service providers and third parties
SOAR Care uses the following service providers, which process information as needed to provide their services to us:
- Supabase provides SOAR Care's database, account authentication and private file storage. SOAR Care's Supabase project is hosted in Sydney, Australia.
- Netlify hosts the SOAR Care website and runs its server functions.
- Resend sends SOAR Care's service emails, such as sign-in codes, email verification, password resets and Care Circle invitations. These emails are sent from soarapp@saasycookies.com and do not contain care details.
We may also disclose information where required or permitted by law, to protect safety or legal rights, or with appropriate authorisation.
6. Overseas processing
Information may be stored or processed outside New Zealand. SOAR Care's database, authentication records and private files are stored with Supabase in Sydney, Australia. Netlify may process website requests and server functions outside New Zealand and Australia. Resend's published information states that account data, including email metadata and logs, is stored in the United States.
We do not claim that all SOAR Care information is stored in New Zealand. We remain responsible for personal information our service providers process on our behalf, and we take the steps required by the Privacy Act 2020 for information that is sent or held outside New Zealand.
7. Storage
Care Profile information is stored in a PostgreSQL database provided by Supabase. Uploaded documents and authority evidence are stored in private file storage. The application applies authenticated access, server-side permission checks and profile-specific database access rules to private information.
NHI, IRD and MSD numbers are stored encrypted (AES-256-GCM). A separate keyed code (HMAC-SHA256) derived from the NHI number is used only to detect duplicate Care Profiles. The NHI number is shown masked in the app (only its last characters are visible) and is never written to application logs.
Where database backups are kept, they are kept for a target of 7 days and no longer than 28 days. A backup must not be used to put deleted information back into active use.
8. Security
The application implements account authentication by email and password or by a one-time code sent by email, verified email addresses, server-side authorisation and database access rules for private information, limits on repeated sign-up, sign-in and password-reset attempts, multi-factor authentication (required for SOAR Care founders and available to all users), founder approval of every Care Profile before it is used for care coordination, encryption of NHI, IRD and MSD numbers, Care Circle invitations that expire after 7 days and can only be accepted by a signed-in user whose verified email address matches the invitation, and audit records of significant actions.
No internet service can guarantee absolute security. We will take reasonable safeguards and respond to suspected incidents in accordance with applicable law.
9. User access and correction
Users may request access to and correction of personal information held about them, subject to applicable law. Some information may also be viewed or corrected directly in the app.
Contact: soarcare@thisislegacy.co.nz
10. Retention and deletion
We keep personal information only for as long as reasonably required for the purposes for which it is held, legal requirements, security, dispute resolution and legitimate backup/recovery needs.
SOAR Care follows the separate Data Retention, Deletion and Account Closure Policy, which sets class-specific periods. In summary: account data is deleted 30 days after a verified account closure; audit events, approval decisions, legal acceptances, programme records, closure records and authority evidence uploaded in the app are kept for 12 months after the profile or account is closed; invitation records are kept for 90 days after they expire or are revoked; and database backups are kept for a target of 7 days and no longer than 28 days. Our service providers keep their own operational logs and email records for limited periods under their own policies. Account closure or deletion does not guarantee that every provider or disaster-recovery copy disappears immediately.
11. Children and people who cannot manage their own information
SOAR Care may contain information about children, older people, disabled people or people who cannot independently manage their care information. The person creating/managing a profile must have appropriate authority or another lawful basis to do so.
SOAR Care should not assume that being a relative automatically gives a person unlimited authority to access or disclose another person's information.
12. Privacy breaches
If a privacy/security incident occurs, we will assess it and take appropriate containment, investigation, remediation and notification steps required by applicable law.
13. Changes
We may update this Privacy Policy when SOAR Care, its providers or legal requirements change. Material changes will be communicated where appropriate, and users will be asked to accept the new version before continuing to use SOAR Care.
14. Contact and complaints
Privacy contact: soarcare@thisislegacy.co.nz
SOAR Care contacts: Stephanee Paulo and Crystal Nooroa.
You may also have the right to complain to the New Zealand Office of the Privacy Commissioner.