Legal

Privacy Policy

Last updated: April 13, 2026

Maika'i Health operates Wayfinder, a free recovery services directory for the Big Island of Hawai'i. We are committed to protecting your privacy. This policy explains what information we collect, how we use it, and your choices — whether you are searching for services or registering as a provider.

Information We Collect

A. Public Users (People Searching for Services)

We do not require you to create an account or provide any personal information to search the directory or view provider listings.

We collect the following anonymous usage data:

Anonymous session ID

A randomly generated identifier stored in your browser's session storage. Not linked to your identity and cleared when you close your browser.

Usage events

Actions such as page views, search queries, filter selections, provider views, direction requests, call taps, shares, and quiz interactions.

Device type

Whether you are on a mobile or desktop device.

Outcome responses

If you respond to the optional 'Did you find what you were looking for?' prompt, your response (yes, not quite, or no) is recorded anonymously alongside your session ID and the provider you viewed. You are never identified.

This data contains no personally identifiable information. We cannot identify who you are from this data.

B. Contact Form (Warm Referral Messages)

If you use the contact form on a provider listing to send a message, we collect:

Your first name

Optional. You may leave this blank to remain anonymous.

Topic

The topic chip you selected (e.g. MAT / Suboxone, Counseling, Walk-in today).

Message body

The text of your message to the provider.

Contact preference

Whether you'd like the provider to reach you by phone, email, or no reply needed.

Contact value

If you provided a phone number or email address, that information is stored with your message and shared with the provider. It is deleted within 30 days.

Contact information you provide through the contact form is shared only with the specific provider you are messaging. It is not used for marketing, not sold to third parties, and is automatically deleted within 30 days.

C. Providers (Organizations Registering a Listing)

When a provider submits a listing through the Partner Portal, we collect:

Contact info

First and last name, email address, phone number

Business info

Practice name, NPI number, address, city, ZIP code, website

Service details

Service types, insurance accepted, languages, hours, beds available, telehealth and walk-in availability

Media

Logo image (if uploaded)

Description

A text description of your organization and services

Credentials

Email and password for the Partner Portal — passwords are stored using Supabase's secure authentication. We never store plain-text passwords.

Event submissions

Event title, date, time, location, description, and any flyer or image uploaded. Approved events are displayed publicly.

Uploaded files

Logo images, event flyers, and other media are stored in Supabase Storage and may be publicly accessible via URL. Do not upload files containing sensitive or personal information.

Engagement stats

Aggregate anonymous interaction data (views, direction requests, calls, shares) for your waypoint is accessible to you through the Partner Portal. This data is drawn from the same anonymous usage events described above.

D. SMS / Text Sharing

When you use the "Text to myself" feature, your device's native messaging app is opened with a pre-filled message. We do not send the SMS on your behalf, collect your phone number, or have access to your messaging activity. Standard message and data rates from your mobile carrier may apply.

E. Correction Submissions

If you use the "Suggest a Correction" feature, we collect the text of your message and the name of the provider it relates to. You are not required to provide your name or email address.

F. Language Preference

If you select a display language other than English, your preference is stored in your browser's local storage. This data never leaves your device and is not transmitted to our servers.

G. Admin Team Members

Maika'i Health staff who are granted access to the Admin Portal have an account that stores:

Account info

Full name, email address, role (Admin or Staff), and account creation date

Profile info

Optionally: job title, phone number, bio, and profile photo — visible only to other admin team members

Sign-in data

Date and time of last sign-in, for security purposes

How We Use Your Information

Anonymous usage data

Used to understand which services are most useful, improve the directory, identify gaps in resources, and generate aggregate non-identifiable reports for grant reporting and program evaluation.

Outcome responses

Used in aggregate to understand whether the directory is successfully connecting people to care. Never linked to any individual.

Contact form messages

Forwarded to the specific provider the message was sent to. Stored temporarily (up to 30 days) to allow the partner to respond. Not used for any other purpose.

Provider information

Used to display your listing publicly (for approved listings), contact you regarding your listing status, and allow you to manage your listing.

Provider engagement stats

Displayed to the provider through the Partner Portal to help them understand how people are engaging with their listing.

Correction submissions

Used to review and update provider listings for accuracy.

Event submissions

Used to display approved community events publicly and notify partners of approval or denial decisions.

Admin team data

Used to authenticate admin team members, manage role-based access, and display team member profiles within the portal.

We do not use any information for advertising, marketing to third parties, or any commercial purpose unrelated to operating the directory.

Information We Do Not Collect

We want to be explicit about what we do not collect from public users:

We do not collect your name, email, or contact details (unless you voluntarily provide them through the contact form)
We do not collect information about what conditions or substances you are seeking help for
We do not collect your location or GPS data
We do not use tracking cookies for advertising
We do not build profiles on individual users

How We Share Your Information

Provider listings that have been approved are displayed publicly. This includes your practice name, address, phone, website, services, hours, and other submitted information.

Contact form messages are shared with the specific provider you messaged. Contact information you include is shared with that provider only and is not visible to other partners or the general public.

We do not sell, rent, or trade your personal information to third parties.

We share information with the following service providers who help us operate the Service:

Supabase

Database, authentication, and file storage hosting

Policy ↗

Vercel

Web hosting and deployment

Policy ↗

Resend

Email delivery for provider notifications

Policy ↗

Data Retention

Anonymous usage data

Retained indefinitely in aggregate form. Individual session identifiers are not linked to any identity.

Outcome responses

Retained indefinitely in anonymous aggregate form. Cannot be linked to any individual.

Contact form messages

Retained for up to 30 days, then automatically deleted. Partners are responsible for saving any information they wish to retain.

Provider account data

Retained for as long as your listing exists. If you close your account or request removal, we will delete your data within a reasonable time.

Correction submissions

Retained until the relevant listing has been reviewed and updated.

Event data

Past events are removed from public display automatically but may be retained in the database for administrative reference.

Admin team data

Retained for as long as the team member has an active account.

Uploaded files

Images and flyers are stored in Supabase Storage. Files associated with deleted listings or accounts may be retained for a period before permanent deletion.

Language preference

Stored only in your browser local storage. Never transmitted to our servers. Cleared when you clear your browser data.

Security

We take reasonable technical and organizational measures to protect your information, including encrypted data transmission (HTTPS), secure password storage through Supabase authentication, and access controls limiting who can view provider and message data.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

Children's Privacy

Wayfinder is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has submitted personal information through the Service, please contact us and we will promptly delete it.

Your Choices and Rights

Public users: Because we do not collect personally identifiable information from public users, there is no personal data to access, correct, or delete. If you submitted a contact form message and wish to have it deleted before the 30-day automatic deletion, contact us at the address below.

Providers: You may access, update, or delete your listing information at any time through the Partner Portal. To close your account or request deletion of your data, contact us at the address below.

Admin team members: You may update your profile information at any time through the Admin Portal. To request account deletion or data removal, contact your Super Admin or reach out to us at the address below.

If you are a resident of Hawai'i or California, you may have additional rights regarding your personal information under applicable state law.

Cookies and Local Storage

Wayfinder uses session storage (not cookies) to store your anonymous session ID. Session storage is cleared automatically when you close your browser tab.

Wayfinder uses local storage to remember your language preference across visits. This data never leaves your device.

We do not use third-party advertising cookies or tracking pixels.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

Maika'i Health Community Clinic

740 Kilauea Avenue · Hilo, Hawai'i 96720
info@maikaihealth.org

Maika'i means "good" or "well" in ʻŌlelo Hawaiʻi. We are committed to handling your information with the same care and respect we bring to our community.