Privacy Policy
What we collect, why we collect it, and how we look after it.
Draft, needs legal review. This notice was written to reflect how the site actually handles data, but it has not been reviewed by a legal professional. Please have it checked against POPIA before publishing, and complete the Information Officer and retention details marked TO CONFIRM.
Who we are
The Aimee Howard Foundation funds mental health therapy for young people aged 13 to 25 who face financial barriers to care. This policy covers personal information collected through aimeehowardfoundation.org.
Our Information Officer for the purposes of POPIA is Michael Larter. To ask a privacy question or exercise any of the rights below, please use our contact form, which reaches the team directly. Formal requests for access to records are handled under PAIA, and our PAIA manual sets out how to make one.
What we collect
We only collect information you choose to give us through the forms on this site. Depending on the form, that includes:
- Contact and partnership enquiries: name, email address and your message.
- Event signups: name, email address, phone number and whether you want to volunteer or support.
- Therapy funding applications:the applicant's name, date of birth, contact details and home address; who submitted the form and their relationship to the applicant; emergency contact details; information about their mental health, any diagnosis and medication; details of any current therapist; employment, income, dependents and financial obligations; medical aid details; and a copy of an identity document.
- Partner therapist registrations: professional contact details, regulatory body and registration number, qualifications, experience, pricing and availability.
Special personal information
Therapy funding applications include information about a person's health, which POPIA treats as special personal information, and often relate to children. We ask for it only because we cannot assess an application for funded therapy without understanding the need. We collect the minimum required to make that assessment, and you can leave optional fields blank.
By submitting an application you confirm you have the applicant's consent to share their information with us, or that you are their parent or legal guardian. Where the applicant is under 18, POPIA requires the consent of a competent person, normally a parent or guardian.
Why we use it
- To assess eligibility for funded therapy against our published criteria.
- To match an applicant with a suitable therapist and arrange and pay for sessions.
- To verify information with a named therapist or healthcare provider, where you have consented to that.
- To verify a therapist’s registration with their professional body before matching any clients.
- To reply to enquiries and to contact you about events you signed up for.
We do not sell personal information, and we do not use it for advertising or automated decision-making.
Who can see it
Access is limited to the small team who review applications and arrange care. Where you have consented, we may share relevant details with a therapist in order to arrange sessions.
We use the following processors to run the site:
- Supabase hosts the database where submissions are stored.
- monday.com is our case management system, where applications are reviewed and tracked.
- Resend sends notification and confirmation emails.
- Vercel hosts the website.
Some of these providers store data outside South Africa. We rely on their contractual data protection commitments for those transfers.
How long we keep it
We keep applications for as long as needed to administer support and to meet our record-keeping obligations, then delete or anonymise them. Identity documents are only needed to verify an application and should be deleted once verification is complete. Enquiries and event signups are kept only as long as they are useful.
To confirm before publishing: the Foundation should decide and state specific retention periods here, in particular how long identity documents are held after verification.
How we protect it
- The database is not publicly reachable. Row level security is enabled with no public access policies, so only our server can read or write submissions.
- All traffic to and from this site is encrypted in transit.
- Credentials are held as server-side environment variables and are never exposed to your browser.
Cookies
This site does not set advertising or tracking cookies, and does not use third-party analytics.
Your rights
Under POPIA you have the right to:
- Ask what personal information we hold about you.
- Ask us to correct or delete information that is inaccurate, irrelevant, excessive or out of date.
- Withdraw consent you have given, though this may mean we can no longer process an application.
- Object to our processing of your information.
- Complain to the Information Regulator of South Africa.
Requests for access to records are handled under PAIA. See our PAIA manual for how to make one.
Changes to this policy
If this policy changes we will update the date at the foot of this page.
Last reviewed: 21 August 2026