Privacy Policy

Waipapa Eyecare respects your privacy and is committed to protecting your personal and health information.

This policy explains how we collect, use, store, disclose, retain, and protect personal information and health information in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020.

1. Purpose of this policy

Waipapa Eyecare respects your privacy and is committed to protecting your personal and health information.

This policy explains how we collect, use, store, disclose, retain, and protect personal information and health information in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020.

For the purposes of this policy:

Personal information means information about an identifiable individual.

Health information includes information about your health, eyesight, prescriptions, clinical care, treatment, test results, referrals, medical history, medicines, NHI number, and other information collected or used in providing optometry and eye care services.

2. Information we collect

We collect only the information we reasonably need to provide eye care services, manage our relationship with you, meet legal and professional obligations, and operate our practice.

This may include:

  • your name, date of birth, address, phone number, email address, and emergency contact details;
  • your NHI number, where relevant;
  • information about your eyesight, eye health, medical history, medications, allergies, family history, symptoms, test results, scans, photographs, prescriptions, clinical notes, referrals, reports, and treatment recommendations;
  • information from other health providers, such as GPs, ophthalmologists, hospitals, specialists, ACC, or other optometrists, where relevant to your care;
  • information about glasses, contact lenses, frames, products, warranties, repairs, orders, and purchases;
  • payment, invoice, account, insurance, ACC, Southern Cross, or other funding information where relevant;
  • communications with us, including emails, text messages, phone notes, forms, and appointment history;
  • CCTV footage if you attend premises where CCTV is operating;
  • website or online booking information, if you use our website, online booking system, or third-party booking platforms.

3. How we collect information

Where practical, we collect information directly from you.

We may also collect information from another source where this is necessary or appropriate, including from:

  • another health provider involved in your care;
  • a parent, guardian, caregiver, attorney, welfare guardian, or authorised representative;
  • ACC, or government agencies where relevant;
  • online booking, recall, reminder, or patient communication systems.

Where we collect personal or health information from someone other than you, we will take reasonable steps to ensure you are aware of that collection where required.

4. Why we collect and use your information

We collect and use your information for purposes connected with providing optometry and eye care services, including to:

  • identify you and maintain accurate clinical records;
  • assess, diagnose, treat, and monitor your eye health and vision;
  • prescribe glasses, contact lenses, or other optical products;
  • order, supply, repair, adjust, or warranty optical products;
  • refer you to, or communicate with, other health providers;
  • receive referrals, reports, results, and clinical correspondence;
  • provide appointment reminders, recalls, follow-up care, and important clinical notices;
  • manage accounts, payments, invoices, quotes, refunds, debt recovery, and insurance or ACC claims;
  • respond to your questions, complaints, access requests, or correction requests;
  • meet legal, professional, ethical, audit, insurance, and record-keeping obligations;
  • protect the safety, security, and rights of clients, staff, and the practice.

We will not use your information for a purpose that is unrelated to your care or our lawful business requirements unless we have your consent or are otherwise permitted or required by law.

5. Appointment reminders, recalls, and communications

We may contact you by phone, text message, email, letter, or online communication system about:

  • appointments;
  • recalls and routine eye examination reminders;
  • glasses, contact lenses, or other orders;
  • clinical follow-up;
  • invoices, payments, or account matters;
  • important practice or health-related information.

You may ask us not to send non-essential reminders or marketing-type communications. However, we may still contact you where this is necessary for your health care, safety, account management, legal obligations, or another permitted purpose.

6. Sharing your information

We treat your information as confidential. We may disclose personal or health information where necessary and lawful, including to:

  • optometrists, ophthalmologists, GPs, hospitals, specialists, or other health providers involved in your care;
  • optical laboratories, lens suppliers, and contact lens suppliers;
  • ACC, payment providers, or funding agencies where relevant;
  • IT, software, cloud, booking, payment, email, text, recall, or records management providers who support our systems;
  • debt recovery providers, or legal advisers where necessary;
  • a parent, guardian, caregiver, welfare guardian, attorney, or authorised representative, where appropriate and lawful;
  • government, regulatory, law enforcement, or professional bodies where required or permitted by law.

We may also disclose information where necessary to prevent or lessen a serious threat to someone’s life, health, or safety, or where another legal exception applies.

We will not sell your personal or health information.

7. Referrals and reports

If we believe you need further assessment or treatment, we may refer you to another health provider. This may involve sending relevant clinical information, images, scans, prescriptions, test results, and contact details to that provider.

We may also receive information back from that provider and add it to your clinical record.

8. Website, online booking, and cookies

If you use our website, online booking system, online forms, or links to third-party services, information may be collected about your visit or interaction. This may include your IP address, browser type, device type, operating system, approximate location, pages visited, forms submitted, and the time and date of your visit.

We may use cookies or similar technologies to help our website work properly, improve website performance, understand how people use our website, and support communication or marketing where lawful.

Third-party services we use may have their own privacy policies. We encourage you to review those policies when using their services.

9. Children and young people

Where a child or young person is our patient, we collect and use their information for their care.

Depending on the child’s age, maturity, circumstances, and the nature of the information, we may communicate with a parent or guardian. We will also consider the child or young person’s own privacy rights and best interests.

10. Security of information

We take reasonable safeguards to protect personal and health information against loss, unauthorised access, use, modification, disclosure, or other misuse.

Our safeguards may include:

  • password-protected systems;
  • restricted staff access based on role;
  • secure storage of paper records;
  • staff confidentiality obligations;
  • secure disposal of records when no longer required;
  • antivirus, backup, and system security measures;
  • optometrists being registered with the Optometrists and Dispensing Opticians Board and following relevant professional standards, including the Standards of Clinical Competence for Optometrists and guidance on internet and electronic communication;
  • taking care when emailing, texting, printing, or discussing client information.

While we take reasonable care, no system can be guaranteed completely secure.

11. Staff confidentiality

All staff, contractors, and health professionals working with Waipapa Eyecare are expected to keep client information confidential and to access, use, or disclose information only for authorised work purposes.

12. Use of cloud systems and overseas service providers

Some of the software, booking, email, payment, storage, security, or communication systems we use may store or process information using cloud services or providers located outside New Zealand.

Where information may be disclosed, stored, or processed overseas, we will take reasonable steps to ensure appropriate privacy and security protections are in place, as required by the Privacy Act 2020.

13. Accuracy of information

We take reasonable steps to ensure the information we hold is accurate, complete, relevant, up to date, and not misleading before we use or disclose it.

Please tell us if your contact details, health information, medications, GP, specialist, or other relevant details change.

14. Access to your information

You have the right to request access to personal and health information we hold about you.

To request access, please contact our Privacy Officer.

We may need to verify your identity before releasing information. We will respond within the timeframes required by law.

In some limited cases, we may refuse access or provide limited access where the law allows or requires this, for example where releasing information would create a serious risk to someone’s health or safety, breach another person’s privacy, or where another legal reason applies.

15. Correction of your information

You may ask us to correct information we hold about you.

If we agree the information is incorrect, we will correct it.

If we do not agree, you may ask us to attach a statement of correction to your record.

16. Retention and disposal

We keep personal and health information only for as long as we reasonably need it for the purposes for which it was collected, including clinical, legal, professional, insurance, accounting, and business record-keeping requirements.

When information is no longer required, we will securely destroy it, delete it, or de-identify it where appropriate.

17. Privacy breaches

A privacy breach may occur if personal or health information is lost, accessed, used, disclosed, altered, or destroyed without authorisation, or if we are prevented from accessing information when needed.

If a privacy breach occurs, we will assess the breach, take steps to contain it, reduce harm, and decide whether notification is required.

If a breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

18. Complaints or concerns

If you have a privacy concern or complaint, please contact us first so we can try to resolve it.

Privacy Officer

Waipapa Eyecare

Address: 12 Klinac Lane, Waipapa, Kerikeri 0230

Phone: 09 407 1065

Email: [email protected]

We will acknowledge your complaint and aim to respond within a reasonable timeframe.

You may also contact the Office of the Privacy Commissioner if you are not satisfied with our response.

You may also contact the Optometrists and Dispensing Opticians Board.

19. Changes to this policy

We may update this privacy policy from time to time.

The latest version will be available from Waipapa Eyecare on request and, where applicable, on our website.

Last updated: June 2026

Become a Client New Client