Privacy Policy

This Privacy Policy applies to all patients treated at our clinic (Patients), authorised representatives acting on behalf of Patients (including where an enduring power of attorney (EPA) is in place).

All necessary steps will be taken to preserve your privacy. Patients will have access to private consulting rooms with the clinical staff, and phone calls discussing issues will be taken in a consulting room away from the waiting rooms. All matters pertaining to the Patient's health will be given priority in the area of privacy.

The Information we collect will depend on the services we provide to you, and your interactions with us. For example, we may collect:

• Your name, email address and telephone number;
• Your residential & postal addresses;
• Your age/date of birth;
• Your gender, ethnicity and spoken languages;
• Your identity verification such as your driver’s licence, passport or birth certificate and other information which assists us to meet our obligations as your health provider.
• Details relating to your authorised representatives, including copies of any EPA(s), together with relevant contact details of appointed representative(s);
• The names and contact details of your family members which have been provided to us;
• Details of any enquiries you have made to us, and our response to you;
• When you visit our social media pages, we may collect more Information, such as the address of your Internet service provider, the name of the web page directing you, and your clicks and activity on our site; and
• Any other Information that we request, or you provide to us or authorise us to collect.

Collection of Health Information

We will collect the Health Information of our Patients, including medical history, prescription details, clinical notes, and health services currently being provided or previously provided, to the extent that we need the Health Information to provide our services. Our facility may use the National Health Index (NHI) numbering system in accordance with Rule 13 of the Code, meaning we will only assign an NHI number to a Patient where it is necessary to provide services to them and/or carry out one of our functions.

Collection of Personal Information

Where possible, we collect Information directly from you when you interact with us, including when you access or use our online services. However, information may also be collected about you from third parties.

When we collect Health Information from third parties, we will only do so in accordance with the Act and Code. Accordingly, we may collect your Health Information from third parties in certain instances including but not limited to where:

• The collection of Health Information directly from you would be prejudicial to your interests;
• The collection of Health Information directly from you would not be reasonably practicable in the circumstances; or
• It is necessary to avoid breaching the law.

Third parties who we may collect your Information from include:

• National health systems, such as the National Health Index (NHI), Aotearoa Immunisation Register (AIR) and national screening programmes;
• Electronic systems or referrals, e.g. radiology or pharmacy providers;
• Hospitals or specialists (e.g. referrals, discharge summaries);
• Family members or caregivers where appropriate — for example, if a Patient is unable to provide the required Information due to memory loss;
• Shared care systems, e.g. Your Health Summary or Primary Health Organisation;
• Third-party agencies such as ACC or insurance providers; and
• Community service providers e.g. Plunket (Whānau Awhina).

If we collect your Information from a third party not listed above we will take reasonable steps to make sure you are aware of the fact and purpose of the collection and your rights of access and correction for the Information, unless an exception under the Act applies.

Information you provide about third parties

If you provide us with or authorise us to collect Information about a third party, you confirm you have obtained their consent to provide us with, or that they have authorised us to collect, their Information and that you have informed them of their rights to access and request a correction of their Information in accordance with this Privacy Policy.

Promotional material

We do not collect Information for the purposes of marketing without your consent. From time to time, for promotional purposes we may, with your written consent ask you to answer a survey. You are under no obligation to provide your consent, and this will not affect your relationship with us.

Where we collect your Information, we will only use it:

• To perform a contract with you or to provide our services to you;
• To contract with your authorised representatives;
• To verify your details;
• To provide Health Information where validly requested under the Act or the Code;
• To comply with all applicable laws and regulations;
• To communicate with you, your authorised representatives; or
• For any other purpose for which you have consented to.

You acknowledge that:

• All consultations are recorded for the benefit of the staff and the Patient.
• Your full medical history may be required to assist in your treatment.
• Your medical history will not be recorded for research purposes unless we have your authorisation to do so.

We do not sell, trade or rent your Information to others.

We may disclose your Information if:

• you have provided us with your authorisation to do so;
• disclosure is necessary to provide you with our services;
• we are required to disclose your Information under the Act or Code; or
• we are required to disclose your Information without your consent to comply with any court orders, subpoenas or other legal process. Where possible and appropriate, we will notify you if we are required to disclose your Information.

We may use other companies and individuals to perform services on our behalf. They will have access to your Information needed to perform these services, but we will not authorise them to use your Information for other purposes.

We provide statistics about our patients, to reputable third parties that will not directly identify you.

You accept that your Information may be collected or held in New Zealand and be disclosed to recipients in, or transferred to, or processed in, countries other than New Zealand. We will only provide your Information to third parties in countries other than New Zealand if we have reasonable grounds to believe the recipient is required to protect your Information in a way that, overall, provides comparable safeguards to those required by New Zealand's privacy laws.

If we do not, we will only provide your Information to recipients in those locations if you authorise us to do so.

For further information, please contact us using the details set out in the section below headed “Privacy Officer”.

We are committed to protecting the security of your Information. We take all reasonable precautions to protect your Information from loss, unauthorised or accidental access, disclosure, alteration, destruction, other misuse, and actions which prevent us from accessing your Information on a temporary or permanent basis (each event being a Privacy Breach).

We use industry standard administrative, physical and technical protections to safeguard the security, privacy, confidentiality and integrity of your Information.

If your Information is subject to a Privacy Breach that is likely to cause you serious harm, we will notify you and the Privacy Commissioner in accordance with our obligations under the Act, and in accordance with our internal procedures for reporting and managing a Privacy Breach.

The length of time we keep your Information depends on what it is and whether we have an ongoing business need to retain it, for example, to comply with legal requirements such as under the Act or Code, or money laundering and financial reporting legislation. We will retain your Information for as long as we have a relationship with you and for a period of time afterwards, in accordance with our internal retention policies and practices. Following that period, we will make sure it is deleted or anonymised.

Under the Health (Retention of Health Information) Regulations 1996, we are required to hold your Health Information for at least 10 years from the time we last provided services to you. This does not prevent us from transferring your Health Information to another provider, to you, or to your authorised representative if you pass away. If we transfer your Health Information to another provider and no longer hold it, these retention requirements no longer apply to us. If we hold your Health Information, after this 10 year period we will make sure it is deleted or anonymized unless otherwise required by law.

We conduct annual reviews of the Information held by us and delete or anonymize Information, as set out in this Policy.

Our online services such as our social media pages may contain links to other websites that are not under our control. These websites may use cookies. It is the responsibility of those third parties to collect appropriate consents from you in order to permit their own cookies (to the extent this is required by law) and to inform you about the cookies they use. You should check the privacy policy on all third-party websites to ensure you are comfortable with third party cookies.

We have no responsibility for linked websites and provide them solely for your Information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or warranties about their accuracy, content or thoroughness. Your disclosure of Information to third party websites is at your own risk.

We are committed to complying with the Unsolicited Electronic Messages Act 2007.

By subscribing to emails and/or text communications, or otherwise providing your email address and/or mobile number, you consent to receiving emails and/or texts (as the case may be) which promote and market our products and services, or the products and services of others, from time to time.

You can unsubscribe from our email communications and/or text communications at any time by clicking the “Unsubscribe” link in any promotional or marketing email or text received or by emailing admin@healthclinic.org.nz or call us on (09) 292 2812.

Once you have unsubscribed from the email or text communications, you will be removed from the corresponding marketing list within 5 working days.

You may request access to the Information we hold about you, or request that we update or correct any Information we hold about you, by setting out your request in writing and sending it to us at admin@healthclinic.org.nz or call us on (09) 292 2812.

We will review your request as soon as reasonably practicable. If we are unable to give you access to the Information you have requested, we will give you reasons for this decision when we respond to your request.

Generally, individuals are entitled to know that their Information is being held by the facility, and to have access to that information.

Generally, individuals can only request to access Information about themselves e.g. a Patient can only request access their own Information. There are some exceptions to this rule, which can be found under Information Privacy Principle 11 of the Act, such as to prevent a serious threat to public or individual health and/or safety.

We require a signed document or verbal instruction when a Patient requests that their Information be shared with another party.

Where Patients request access to their Information, we will grant access to this information unless there are valid reasons for refusing access, which must be clearly documented. Valid reasons for denying a request to access Information are contained in Part 4 of the Act.

A request to access Information is forwarded to the Privacy Officer. The Privacy Officer is the only person entitled to release this information. The Admin/Reception Role is the person with the delegated authority and are the facility's authorised Privacy Officer. The Privacy Officer will be familiar with all regulations relating to the release of information as per the Act, the Code, and Health and Disability Commissioner (Code of Health and Disability Services Consumers' Rights) Regulations 1996.

The Privacy Officer is responsible for ensuring that any references to third parties in the requested information are removed where necessary.

Release of the requested information must take place within 20 working days after the date of the request.

A Patient has the right to request we correct any information that is held about them. We may choose not to change the Information; in which case a statement should be attached to the record setting out the individual's requested changes.

Destruction of a hard copy file must be by either shredding or placement in the secure paper destruction bin.

We take your concerns seriously. If you have any concerns about privacy or the use or collection of your Information by us, please contact our Privacy Officer at admin@healthclinic.org.nz and include the words “ATT: THE PRIVACY OFFICER” or call us on (09) 292 2812.

We will respond within 20 working days and handle all complaints in a way that is fair and consistent. However, if you remain dissatisfied, you can make a formal complaint with the Office of the Privacy Commissioner.

This represents our Privacy Policy as at 25 May 2026.