Privacy Statement

We collect your information directly from you or from others you’ve authorised us to speak to, such as a whānau member, caregiver, or health provider.

We may also receive information about you from other health organisations, such as Te Whatu Ora | Health New Zealand or your general practice, when you are referred to one of our services.

We will always try to talk with you first before collecting your information from another person or organisation, unless this is not possible (for example, in an emergency or where required by law).

To provide health services to you, your information is collected from Te Whatu Ora and other health care providers when you are referred to one of our services. These providers will have their own policies for sharing your information with us. Health providers we work with and receive information from can include general practice, community, and social service providers; social workers, and other health professionals such as dental and optometry providers. We will tell you when we have collected information from another health care provider. 

Examples include collecting contact details, health history, or referral information to provide services like the Here Toitū or RIMA Wellbeing programmes.

Collection of information is authorised under the Health Information Privacy Code 2020 and Privacy Act 2020 and related health legislation like the Health Act 1956.

We only use and share your information when we have a lawful reason to do so — for example, because you have given consent, it’s necessary for your care or to provide you with a service, or the law requires it.

In programmes such as Here Toitū and RIMA Wellbeing, we may share your information with partner organisations that deliver services with us.

Your information is also used to report on the services we provide to you and other people across the MidCentral region, and to help improve health services. You will not be identified in these reports unless that is required, for example by Te Whatu Ora in our funding contracts.

We have access to information from general practices for clinical and administrative purposes, and to support them in their work and to provide health services.

There are times when by law we are required to share information, for example when requested by Manatū Hauora | Ministry of Health.

To provide you with health or wellbeing services 

We collect information from you to provide you with health services. For example, we will collect your information when you: 

• Use one of THINK Hauora’s community-based services.

• When another health provider, such as your general practice refers you to a THINK Hauora service, we will receive information from them.  

You can talk to the healthcare provider about the information they are collecting and using for that service. 

For billing and administration 

We use your information for administration purposes such as billing and Accident Compensation Corporation (ACC) referrals. 

To improve the health of our communities 

As a health organisation, we need to understand our population and how people use health services. We collect and use information to make sure people can access health services, and that community needs are met. The information used to improve the health of our communities will not identify you individually. 

For quality improvements, education and research 

Information that is used by us to improve our processes and systems, and for education and training will not identify you individually.  Information for research will have ethics approval and will not be published in a way that can identify you. 

To support general practice

We support general practice in the delivery of health care to patients and improving health outcomes for communities. Information that identifies you will only be used when it is required.

For recruitment and employment

We use your information during the recruitment process and once you have entered an employment arrangement with us. We handle all information in accordance with New Zealand employment legislation. 

For our business operations 

We use certain third-party tools and systems as part of our day-to-day business. We take steps to ensure personal information is protected, including conducting privacy impact assessments. 

For health 

We share your information with someone else when they need it to provide you with health services. For example, if we need to refer you to another health service provider, or to provide information back to your general practitioner if you have been referred to one of our services or programmes. 

We will usually tell you before we share your information, although we might need to share information without telling you first, for example, because you are unconscious, or we are concerned about your or someone else’s life or health. 

Auditing and monitoring processes are used to check that only those directly involved in your care are accessing your information. 

To meet a legal requirement and our obligations 

We may also share your information if required by law — for example, reporting infectious diseases under the Health Act 1956, or if requested by the Health and Disability Commissioner. Where possible, we will tell you when your information has been shared or requested by another organisation. 

We provide information to organisations like Manatū Hauora | Ministry of Health, and Health New Zealand | Te Whatu Ora as a requirement of our contracts with them to provide health services and programmes to the community.

Where possible, we will provide information that does not identify you. 

Sharing because we have been asked to 

When we are asked to provide information to someone else, or we consider there might be a legal requirement for us to provide information to another organisation, we follow the Privacy Act 2020 and other relevant Rules under the Health Information Privacy Code 2020.

THINK Hauora uses secure systems and privacy-by-design principles to protect your information throughout its lifecycle.

Some information is stored using secure cloud-based services such as Microsoft 365 and Microsoft Azure. For a number of the health services we provide, we use a patient management system. We have agreements and safeguards in place to ensure these providers protect your information to New Zealand privacy standards.

All reasonable steps are taken to ensure the personal information we collect is protected against loss, unauthorised access and disclosure or any other misuse. We have a number of security measures, including data encryption where possible and role-based access controls.  We follow the relevant health standards and guidelines for storing and sending information.

We keep your information only as long as necessary to provide our services and meet legal requirements. Health information is generally kept for at least ten years after your last health service.

You have the right to:

• Ask us to see any of your personal or health information that we hold.

• Ask us to correct or update your information if you think it is wrong.

• Be told why your information has been collected or shared. 

• Make a complaint if you’re unhappy with how your information has been handled. 

Your caregiver or representative can also ask for information about you.

To make a request to see or correct your information, please contact:

• Email privacy@thinkhauora.nz  

• Call (06) 354 9017 and ask to speak with the Privacy Advisor 

• Privacy Advisor, THINK Hauora, PO Box 2075, Palmerston North 4440

How to request information

You can make your request to us by emailing privacy@thinkhauora.nz or by calling (06) 354 9017 and ask to speak with the Privacy Advisor. 

What we will do 

If we are not the right people to respond, we will let you know and transfer your request to the right place. For example, it might be better that we ask your general practitioner to respond to you directly. 

We will acknowledge your request within 5 working days and respond to you as soon as we can. If a response is going to take longer than 20 working days from the date of your request, we will let you know and keep you updated. 

Providing the information 

We will talk to you about how to give you the information, for example, if you want this as hard copy printed documents, or if we can email it to you. It is important that you receive your information safely. This may mean that we agree with you to send documents by courier requiring your signature, or the information is collected in person. 

If the information is collected in person, then you will need to provide identity information, such as your driver’s licence. This is so we ensure we provide the information to the right person. We only need to see the identity information, and don’t keep a copy. 

If your caregiver or representative asks us for information, we must provide this, unless a specific legal circumstance applies. These circumstances most commonly are: 

• We don’t think it is in your best interests to provide the information 

• We believe that you do not want the information to be provided 

• There is a reason under the Privacy Act why the information should not be provided. 

We may first ask your representative for some further information so that we know we are speaking to the right person and that they are authorised to talk to us on your behalf.