Effective Date 10/03/2026
Next Review Date 10/03/2027

1. Our commitment to your privacy

Hemisphere Health Ltd (Hemisphere Health) is committed to protecting your privacy and ensuring that your personal and health information is collected, stored, used and shared safely and appropriately.

We manage your information in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020 (HIPC), as well as our professional and ethical obligations.

This Privacy Policy explains how we collect, use, store, access, share and protect your information, and your rights in relation to the information we hold about you.

2. Information we collect

We collect information that is necessary and relevant to the services we provide.

This may include:

• Personal and contact details
• Referral information
• Medical and health information
• Clinical notes and assessment information
• Reports, correspondence and other information relevant to your care
• Information required for administration, quality assurance, education and training.

Where possible, health information is collected directly from you. We may also receive information from your referrer, funder (such as ACC), another healthcare provider or another authorised person where this is permitted or necessary.

We take reasonable steps to ensure information obtained from other sources is checked for accuracy, particularly where it will be used in a formal report.

2.1 Use of AI transcription

On some occasions, Hemisphere Health may use Heidi, an AI transcription tool, to assist a clinician in generating accurate clinical notes.

Before using this technology, the clinician will explain how it will be used and obtain your informed and explicit consent. AI transcription is not compulsory, and you may choose not to have your consultation recorded.

Where used, the transcription is retained for up to 30 days for the purpose of completing the relevant appointment documentation or report, after which it is deleted. Information incorporated into your clinical record is retained securely as part of your health record.

3. How we protect your information

We take reasonable steps to protect your personal and health information from loss, unauthorised access, misuse, modification or disclosure.

Your electronic health information is stored securely in our electronic patient management system, Gensolve. Our systems and devices are password protected, and appropriate security measures are used when information is accessed or transferred.

Paper records containing personal information are securely stored, scanned into your electronic record where required, and securely destroyed when no longer needed.

We also take steps to protect information when communicating electronically. For example, email addresses are checked before personal information is sent, and staff take care to ensure information is sent only to the intended recipient.

Our staff are required to maintain confidentiality and receive privacy training as part of their employment and ongoing professional responsibilities.

4. Who can access your information?

Access to your information is limited to people who need it for your care or for an authorised organisational purpose.

Our staff will generally only access your information when they are directly involved in your care. Limited access may also occur for legitimate purposes such as clinical supervision, quality assurance, auditing or other authorised functions.
You have the right to request access to information we hold about you, subject to the provisions of the Privacy Act.

You may also ask us to correct information that you believe is inaccurate. If information has been provided to another party and is subsequently corrected, appropriate steps will be taken to provide the updated information or a statement of correction.

5. Sharing your information

We only share personal and health information where this is permitted or required by law, is necessary for your care, or where you have provided consent.
Information may be shared with:

• Other healthcare providers involved in your care
• ACC or relevant third-party administrators where legally authorised and relevant to a claim
• Referrers or other parties where appropriate and authorised
• Other parties where you have specifically consented to the disclosure.

When sharing information with another healthcare provider, we consider whether the information is relevant to your care and whether you would reasonably expect it to be shared. Where there is uncertainty, we will seek and document your consent.

Vocational rehabilitation and employers

Where we are providing vocational rehabilitation or return-to-work services, we may communicate with your employer about matters such as:

• Functional capacity
• Work duties
• Workplace adjustments
• Return-to-work planning.

Clinical or medical information will only be shared where necessary and with your consent.

6. HealthOne

HealthOne is a South Island-based secure electronic health record that allows registered healthcare providers directly involved in your healthcare to access relevant information, such as:

• Test results
• Allergies
• Medications
• GP summaries
• Hospital information.

HealthOne operates in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020. Access is only available through an approved, highly secure healthcare information network that is regularly audited and tested.
Privacy auditing is used to help ensure that only healthcare providers directly involved in your care are accessing your information.

You can find out more about HealthOne at: https://healthone.org.nz/

You have the right to restrict the sharing of your healthcare records through HealthOne. To do this, contact HealthOne on 0508 837 872 or email HealthOne.privacy@pegasus.health.nz.

7. How long we keep your information

We retain health information securely in accordance with the Health (Retention of Health Information) Regulations 1996.

Generally, client health information is retained for at least 10 years from the day following the last date of service.

Longer retention periods apply to certain health monitoring records, including:

• 40 years for asbestos-related health monitoring
• 30 years for other health monitoring services, such as biological monitoring, audiometry, lung function and chemical exposure surveillance.

In some circumstances, information may be retained for longer where there is a lawful and appropriate reason to do so.

8. Privacy breaches

A privacy breach may occur when personal information is accidentally or unlawfully accessed, disclosed, altered, lost or destroyed.

Hemisphere Health takes reasonable steps to prevent privacy breaches. If a breach occurs, we will act promptly to contain the breach, assess the potential impact and take steps to minimise any harm.

Where required, serious or notifiable privacy breaches will be reported to the Office of the Privacy Commissioner, and affected individuals will be notified where appropriate.

We also investigate breaches and near misses and implement corrective actions where necessary to reduce the risk of recurrence.

9. Your privacy rights

You have rights under the Privacy Act 2020, including the right to:

• Ask what personal or health information we hold about you
• Request access to your information
• Ask for inaccurate information to be corrected
• Ask questions about how your information is collected, used or shared
• Raise concerns or make a complaint about our handling of your information.

Requests for access to your information can be made verbally or in writing and will be managed by our Privacy Officer. You may be asked to complete a Request for Information form and, where someone is acting on your behalf, provide appropriate written authority.

Under the Privacy Act, requests for access are generally responded to within 20 working days, although urgent requests may be prioritised where appropriate.

10. Privacy concerns and complaints

If you have a concern or complaint about the privacy of your information, please contact Hemisphere Health through our complaints process.

We will investigate privacy concerns appropriately and aim to resolve them fairly and promptly.

You can contact us at:
Hemisphere Health Ltd
8 Cambridge Street
PO Box 3130
Richmond 7050
New Zealand
Phone: 03 928 0080
Email: admin@hemispherehealth.co.nz
Website: www.hemispherehealth.co.nz

For more information about your privacy rights in New Zealand, you can also visit the Office of the Privacy Commissioner.

11. Related legislation

Our privacy practices are guided by:

• Privacy Act 2020
• Health Information Privacy Code 2020
• Health (Retention of Health Information) Regulations 1996
• Other applicable legal, professional and ethical requirements.

This Privacy Policy is reviewed regularly and updated when required.