Privacy Policies For Childcare Booking Platforms

Do you really need a privacy policy for a childcare booking platform in New Zealand? Yes. If your platform collects information about parents, children, carers or childcare providers, you need to be clear about what you collect, why you collect it, and who you share it with.

The good news is that this doesn't have to become a legal maze. A well-written privacy policy can help parents trust your platform, help providers understand their responsibilities, and keep your business aligned with the Privacy Act 2020.

Childcare platforms deal with everyday booking details, but they also handle very personal information: child profiles, allergies, emergency contacts, photos, attendance records, pick-up permissions and payment details. That mix needs careful handling from day one.

Do You Need A Privacy Policy For A Childcare Booking Platform?

Yes, you should have a privacy policy if your childcare booking platform collects personal information from users in New Zealand. The Privacy Act 2020 applies to agencies that collect, store, use or disclose personal information, including many online platforms and apps.

A privacy policy is the practical way to tell users how your platform handles their information. It also helps you meet your transparency obligations under the information privacy principles in the Privacy Act 2020.

For a childcare app or marketplace, personal information may include:

• Parent or guardian names, emails, phone numbers and addresses
• Child names, dates of birth, photos and care preferences
• Sensitive information, such as health details, allergies, medication notes or disability support needs
• Emergency contacts and authorised pick-up people
• Attendance records, booking history and cancellation notes
• Payment information and billing records
• Messages between parents and childcare providers
• Device data, app usage data and location data, if your platform collects it

New Zealand privacy law doesn't treat all child-related information as a separate legal category in the same way some overseas laws do. Still, information about children is high trust and high risk in practice. Parents will expect you to be careful, clear and respectful.

You also need to appoint a privacy officer for your business. This doesn't have to be a full-time role, but someone must be responsible for privacy questions, access and correction requests, privacy complaints and breach response.

What Child And Parent Information Can You Collect?

You can collect child and parent information if it's needed for a lawful purpose connected with your platform, but you should only collect what you reasonably need. The Privacy Act 2020 expects you to limit collection to information that's necessary for your business purpose.

This matters because childcare platforms can easily collect too much information. A profile field may feel useful when you're building the product, but if you can't explain why you need it, you should think twice.

Information You Will Usually Need

Your platform may have a good reason to collect:

• Parent contact details so bookings can be managed
• Child age or date of birth so care can be matched to the right age group
• Allergy and medical notes so providers can care for the child safely
• Emergency contact details for urgent situations
• Authorised pick-up details so providers know who can collect the child
• Attendance records so bookings, staffing and invoices can be checked

Information To Be Careful With

You should be more cautious with information that's sensitive in real life, even if the Privacy Act doesn't use that exact label for every item. This includes:

• Photos or videos of children
• Detailed health or disability information
• Behavioural notes or incident records
• Location tracking or live check-in data
• Family situation notes, custody arrangements or protection concerns
• Identity documents for parents, carers or providers

If you need this information, explain the purpose clearly. For example, you may need authorised pick-up information to help a provider release a child to the right person. You probably don't need to collect broad family background information unless it directly affects care, safety or booking administration.

Say you run a platform called LittleLoop that lets parents book casual care sessions with approved providers. You might ask for a child's name, age, allergy notes and an emergency contact. You would likely struggle to justify asking for the child's school reports or unrelated family history just to process a booking.

What Should Your Privacy Policy Say?

Your privacy policy should explain, in plain English, how your platform collects, uses, stores and shares personal information. It should be specific to your product, because childcare platforms have privacy issues that a generic website policy often misses.

At a minimum, your policy should cover:

• Who you are, including your business name and contact details
• What information you collect, including parent, child, provider, payment and technical data
• How you collect it, such as account sign-up, booking forms, messages, app permissions, cookies, provider uploads and information provided by one person about someone else
• Direct and indirect collection notices, including the notices you give when you collect information from the person concerned, and when you collect information about a child, emergency contact, authorised pick-up person, carer or provider from someone else
• Why you collect it, such as managing bookings, child safety, payments, customer support, fraud prevention and platform improvement
• Who you share it with, including childcare providers, payment processors, software suppliers and support providers
• Whether information may go overseas, such as cloud hosting or support tools based outside New Zealand
• How users can access or correct information
• How users can contact your privacy officer
• How long you keep information and when you delete or de-identify it
• How you handle complaints

Direct and indirect collection both matter. Since 1 May 2026, Information Privacy Principle 3A has applied when you collect personal information from someone other than the person the information is about. For example, a parent might enter a child's medical notes, an emergency contact's phone number or an authorised pick-up person's details. A provider might also upload child attendance records or care notes. Unless an exception applies, you must take reasonable steps to make the individual aware of the required IPP3A matters, including what is being collected, why, who will receive it, who is holding it, whether it's required, what happens if it isn't provided, and access and correction rights.

Your privacy policy should explain this, but don't stop there. Build it into the product. For example, your collection screens can prompt parents to confirm they have authority to provide emergency contact and pick-up details. Your provider upload workflows can remind providers to give required notices where they upload information about children or carers.

The policy should also match what your app actually does. If your privacy policy says you don't collect location data, but your app collects GPS location for check-ins, that's a problem. Under the Fair Trading Act 1986, misleading privacy statements can also create consumer law risk, not just privacy risk.

Templates can be a useful starting point, but they often miss the operational details that matter for childcare. Your policy should reflect your real data flows, your suppliers, your provider model and your consent process.

How Should You Handle Photos, Attendance And Emergency Contacts?

You should handle photos, attendance records and emergency contacts with extra care because they can affect a child's safety, dignity and privacy. These aren't just admin details.

Photos And Videos

If your platform allows providers to upload photos or videos of children, your privacy policy and provider terms should be very clear about when this is allowed.

You may need rules covering:

• Whether parent or guardian consent is needed before photos are uploaded
• Whether photos can be shared only inside the parent account, not on public profiles
• Whether providers can use photos, CCTV footage or videos for marketing
• How parents can request removal of photos
• How long photos are stored after an account closes

Be especially careful with marketing use. A parent may be comfortable with a private photo update showing their child painting during a session, but not with that same photo appearing in advertising or social media.

Attendance Records

Attendance records can show where a child was, when they arrived, when they left and who collected them. That information can be sensitive, especially if there are family safety concerns.

Your platform should make clear:

• Who can see attendance records
• Whether parents, providers and your admin team have different access levels
• How records are corrected if a check-in or check-out is wrong
• How long records are kept for booking, payment, safety and compliance purposes

If a licensed early childhood education service uses your platform, the provider may also have its own record-keeping duties under education and licensing rules. Your platform terms should make clear which records you manage and which records the provider remains responsible for.

Emergency Contacts And Authorised Pick-Ups

Emergency contact and authorised pick-up details should be collected for safety reasons, but they still need privacy protection. You should tell parents that they're responsible for making sure they have authority to provide those people's details.

Your platform should also avoid exposing emergency contact details more widely than needed. For example, a provider caring for the child may need those details during the booking. Another provider with no booking shouldn't be able to browse them.

Can You Share Information With Childcare Providers And Third Party Tools?

Yes, you can share personal information with childcare providers and third party tools where it's needed for your platform, but you need to be transparent and careful about the terms. Parents shouldn't be surprised about who receives their child's information.

Common sharing arrangements include:

• Sharing booking and child profile details with the selected childcare provider
• Using payment processors to take card payments, manage refunds and support payment security
• Using cloud hosting providers to store app data
• Using email, SMS or push notification tools to send booking updates
• Using analytics tools to understand app performance and user behaviour
• Using customer support tools to manage support tickets
• Sharing limited information with insurers, professional advisers or regulators where needed

You should map these data flows before finalising your privacy policy. Write down what information goes where, why it's shared, where it's stored and who can access it.

If personal information is disclosed to an overseas recipient, Information Privacy Principle 12 under the Privacy Act 2020 can apply. In simple terms, you may need to take reasonable steps to make sure the overseas recipient has acceptable privacy protections, unless another exception applies.

This is especially relevant if your platform uses overseas hosting, offshore development support, global analytics tools or customer service software. You don't need to name every individual support worker, but your policy should be honest about overseas storage or access where it occurs.

Your contracts with providers and suppliers should also support your privacy policy. For example, your provider terms might say that a childcare provider can only use child profile information to deliver the booked care, manage safety and meet legal obligations. They shouldn't use parent contact details to market unrelated services unless they have a proper basis to do so.

What Happens If There Is A Privacy Breach?

If there's a privacy breach that has caused, or is likely to cause, serious harm, you must notify the Privacy Commissioner and affected individuals as soon as practicable. This is a key requirement under the Privacy Act 2020.

A privacy breach can include:

• Personal information being accessed by someone who shouldn't see it
• A provider downloading child profiles and using them outside the platform
• An email or notification being sent to the wrong parent
• A security issue exposing attendance records or photos
• A lost device containing unprotected user data
• A supplier compromise affecting your platform data

Not every mistake is a notifiable privacy breach. The serious harm assessment can depend on the sensitivity of the information, who accessed it, whether it was protected, what harm could result and whether you can reduce the risk quickly.

Childcare data can raise the stakes. For example, if an app bug lets one parent view another child's emergency contacts, allergy notes and attendance records, you would need to treat that seriously and act quickly.

A practical breach response plan should cover:

• Who makes the call on breach response
• How your team contains the issue
• How you assess serious harm
• When and how you notify affected users
• When and how you notify the Privacy Commissioner
• How you record the breach and fix the underlying problem

You should also make sure your internal team knows what to do. A breach response plan that sits unread in a folder won't help much when a parent calls in a panic about another family seeing their child's details.

Common Mistakes To Avoid

The most common mistake is treating a childcare booking platform like a standard eCommerce site. You may be taking payments online, but you're also handling information about children and care arrangements.

Watch out for these issues:

• Collecting too much information: Don't ask for details just because they might be useful one day. Tie each field to a real purpose.
• Using vague consent wording: If photos, marketing or data sharing are involved, make the consent clear and specific.
• Forgetting emergency contacts: These people have personal information too. Tell parents they need authority to provide those details.
• Letting providers reuse data: Your provider terms should limit how providers use parent and child information.
• Ignoring offshore tools: Many app tools involve overseas storage or support access. Check this before promising all data stays in New Zealand.
• Keeping records forever: Set sensible retention periods for inactive accounts, old bookings, photos and support tickets.
• Having no process for access and correction requests: Parents can ask to access or correct their own personal information. They may also be able to make access or correction requests for a child where they're acting as the child's representative, but you should assess authority, the child's age and maturity, and any safety or guardianship concerns before releasing information.
• Not checking your app against your policy: Your product, permissions and supplier stack can change quickly. Your privacy policy should keep up.

It also helps to design privacy into the platform rather than patching it later. Use role-based access, an information security policy, limited admin permissions, multi-factor authentication, and avoid showing child details to anyone who doesn't need them.

If your platform uses AI features, automated matching or profiling, get tailored advice and consider an AI governance policy before launching those features. Parents will want to know if technology is making recommendations about care options, availability, risk flags or provider suitability.

Key Takeaways

• A childcare booking platform in New Zealand should have a privacy policy that reflects the Privacy Act 2020 and your real app features.
• Your privacy process should cover both direct collection and indirect collection under IPP3A, including child, emergency contact, pick-up person, carer and provider information supplied by someone else.
• Child profiles, emergency contacts, photos, attendance records and health notes need careful handling because they can affect child safety and family privacy.
• Your policy should explain what you collect, why you collect it, who you share it with, overseas storage or access, retention, access and correction rights, and complaint options.
• Your provider terms and supplier contracts should support your privacy promises, especially where providers or third party tools handle child information.
• If a breach is likely to cause serious harm, you must notify the Privacy Commissioner and affected people as soon as practicable.

If you'd like help with your childcare platform privacy policy, provider terms, customer terms or data handling processes, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.