Updated September 2026

Browns Bay Family Doctors is committed to protecting your privacy and ensuring your personal and health information is collected, used, stored and shared safely and lawfully. This policy explains how we manage your information under the Privacy Act 2020 and the Health Information Privacy Code 2020, including Rule 3A for information collected from sources other than you.

1. Who we are and how to contact us

Browns Bay Family Doctors is the health agency collecting and holding your patient information unless we tell you otherwise for a particular service or information flow.

Practice	Browns Bay Family Doctors
Address	Level 1, 65 Clyde Road, Browns Bay, Auckland 0630
Phone	09 479 4834
Email
Privacy enquiries	Please contact our Business Manager through the practice using the details above.

2. The information we collect

We collect only the personal and health information that is reasonably necessary to provide care, operate the practice, meet funding and reporting requirements, and comply with our legal and professional obligations. This may include:

• identifying and contact information, such as your name, date of birth, address, phone number, email address, gender, ethnicity, citizenship details and National Health Index (NHI) number;
• your medical history, health conditions, diagnoses, symptoms, allergies, family history, measurements and clinical observations;
• information about medicines, immunisations, screening, investigations, laboratory and radiology results, referrals and other services provided to you;
• consultation, billing, funding, subsidy, ACC and other claim information; and
• other information relevant to your care, safety or the administration of health services.

3. Why we collect and use your information

We collect and use your information for purposes including:

• documenting your health history, assessments, treatment and ongoing management in your medical record;
• providing safe and effective healthcare and coordinating your care;
• receiving results and information from other providers involved in your care;
• making referrals for investigations, specialist care, allied health, hospital services and screening programmes;
• managing appointments, recalls, prescriptions, patient communications and follow-up;
• processing billing, funding, subsidies and claims;
• meeting contractual, clinical governance, quality improvement, reporting and legal requirements; and
• supporting approved population health, prevention, service improvement and research activities where permitted.

4. Where we collect your information from

We collect information directly from you wherever practicable, for example during consultations, enrolment, forms, phone calls and secure digital communications.

We may also receive health information about you from other people, agencies and systems involved in your care or where otherwise permitted by law. Examples include:

• hospitals, after-hours services, specialists, allied health providers, community providers and previous general practices;
• laboratories, radiology providers, pharmacies and other clinicians who send or copy results to us;
• authorised national or regional health information systems, including hospital information, prescribing information, results and the Aotearoa Immunisation Register;
• national screening programmes, including bowel, breast and cervical screening services;
• Comprehensive Care, our Primary Health Organisation (PHO), and other health sector agencies where relevant to your care or funding;
• ACC, the Ministry of Social Development / Work and Income, insurers and employers where relevant and permitted;
• Police, legal representatives and Oranga Tamariki where information is lawfully provided to us; and
• a family member, caregiver or other third party where they provide information relevant to your care.

5. Indirect collection and HIPC Rule 3A

From 1 May 2026, Rule 3A of the Health Information Privacy Code 2020 applies when we collect health information about you from someone other than you or your representative, unless an exception applies.

Where Rule 3A applies, Browns Bay Family Doctors will take reasonable steps, as soon as reasonably practicable after the information is collected, to make sure you or your representative are aware of:

• the fact that the information has been collected and the kind of information involved;
• the purpose for which it was collected;
• the intended recipients of the information;
• the name and contact details of the health agency that collected the information and the agency holding it;
• the particular law, where the collection is authorised or required by law; and
• your rights to access and request correction of your health information.

We may provide this information through this Privacy Policy, our enrolment materials, patient portal communications, correspondence, notices, discussions during consultations or another reasonable method appropriate to the circumstances.

6. When you have already been informed

We may not need to repeat a Rule 3A notification where we reasonably believe you have already been made aware of all the information required by Rule 3A, whether by Browns Bay Family Doctors or another health agency. We will consider the circumstances and the information flow rather than assuming that a patient already knows.

7. Information received outside normal care pathways

If we receive information about you unexpectedly from a family member, employer, Police, insurer, legal representative or another third party outside a routine healthcare information flow, we will assess whether Rule 3A requires an additional notification and whether any exception applies. We will also consider patient safety, the purpose of the collection and any legal obligations.

8. AI-Assisted Clinical Documentation

Browns Bay Family Doctors may use approved artificial intelligence tools, including Heidi Health, to assist clinicians with documenting consultations and preparing clinical notes.

Where AI-assisted transcription is proposed, patients will be informed and given the choice to consent to or decline its use. A patient may also withdraw their consent at any time.

Choosing not to use AI-assisted transcription will not affect the healthcare or treatment provided. If a patient declines, the clinician will document the consultation using the practice’s usual clinical documentation methods.

These tools support accurate record keeping and allow clinicians to focus more on patient care. AI tools do not replace the professional judgement of healthcare practitioners. All diagnoses, treatment decisions and medical records remain the responsibility of the treating clinician.

Information processed through approved AI tools is handled in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020.

Where a patient consents to AI-assisted transcription, the consultation is transcribed to generate clinical documentation. Heidi Health does not retain audio recordings of consultations following transcription. The generated transcription is securely stored within the Heidi Health platform and may be retained for a period determined by Browns Bay Family Doctors in accordance with our clinical, legal and operational requirements. Once no longer required, transcriptions will be securely deleted.

Only the final clinical notes entered into the patient’s medical record form part of the permanent health record.

9. Comprehensive Care Primary Health Organisation

Browns Bay Family Doctors is part of Comprehensive Care, our Primary Health Organisation (PHO). Enrolment with the PHO supports access to funded and subsidised primary healthcare services. We may provide information to Comprehensive Care for purposes including:

• obtaining, reconciling and processing funding and subsidy claims;
• reporting on funded services and the use of funding;
• measuring and improving healthcare quality and service delivery;
• supporting population health monitoring and work to reduce health inequities;
• identifying and providing prevention and health-promotion opportunities, including follow-up where appropriate;
• supporting health research that has appropriate ethics approval; and
• investigating adverse events, complaints and concerns relating to care.

Comprehensive Care may in turn provide information to health sector agencies, contracted data intermediaries and national health programmes where this is required for funded services, reporting or other lawful health purposes.

10. Who we may share your information with

We may share information where this is necessary for your care, was one of the purposes for which the information was collected, you have authorised it, or disclosure is otherwise permitted or required by law. Recipients may include:

• laboratories, radiology providers, hospitals, specialists, allied health providers, community services and screening programmes;
• pharmacies and other healthcare professionals involved in your care;
• Comprehensive Care and authorised health sector agencies for funding, reporting and health programme purposes;
• ACC and other agencies involved in claims or entitlements;
• regulators, insurers, indemnity providers and legal advisers where relevant to managing a concern, claim or legal matter;
• Police, Oranga Tamariki, courts, legal representatives or other agencies where disclosure is authorised or required by law; and
• MSD / Work and Income, an employer or another external agency where you request a certificate, report or other information to be provided to them.

11. Patient communications

We may use the contact details you provide to communicate with you by text message (SMS), email, phone or secure patient portal about your healthcare. This may include appointment information, recalls, screening reminders, prescriptions, test results, follow-up and other care-related communications.

Please keep your contact details up to date and tell us if there is a communication method that is not safe or appropriate for you. Where clinically necessary, we may need to contact you using another appropriate method.

12. Marketing and service updates

From time to time, Browns Bay Family Doctors may offer new or additional health services. We will only send marketing or service-update communications where this is permitted and, where required, where you have opted in. You may opt out of marketing communications at any time. Opting out of marketing does not stop healthcare-related communications such as recalls, appointment information or other clinically necessary contact.

13. Storage, security and service providers

We take reasonable safeguards to protect health information against loss, unauthorised access, use, modification, disclosure and other misuse. Access to patient information is limited to authorised people who need it for their role.

We use secure electronic and administrative systems and may use contracted technology or service providers to support healthcare delivery, communications, hosting, backup, reporting and other practice functions. Providers are expected to protect information in accordance with applicable New Zealand privacy requirements and contractual safeguards.

Comprehensive Care advises that information it holds is stored in secure systems and that some information may be stored with cloud service providers in Australia or processed on approved overseas cloud infrastructure, subject to security and privacy safeguards.

14. Overseas disclosures

If Browns Bay Family Doctors discloses personal information to a person or organisation outside New Zealand, we will comply with the overseas disclosure requirements of the Privacy Act 2020. This may include ensuring comparable privacy safeguards are in place or obtaining informed authorisation where appropriate. Different rules may apply where an overseas service provider processes information on our behalf rather than receiving it as an independent recipient.

15. Retention and disposal

We retain health records for at least the minimum period required by New Zealand law and professional standards, and for longer where there is a lawful or clinical reason to do so. Information that is no longer required is disposed of securely.

16. Telehealth

We take reasonable steps to protect your privacy during phone and video consultations. We will tell you if a consultation is being recorded and will manage any recording in accordance with applicable privacy, clinical and consent requirements.

17. Accessing and correcting your information

Under Rules 6 and 7 of the Health Information Privacy Code 2020, you have the right to request access to the health information we hold about you and to ask us to correct information that you believe is inaccurate, incomplete or misleading.

If we do not make a correction you request, you may ask us to attach a statement of the correction sought to your record, as provided for by the Health Information Privacy Code. Access requests will be handled within the statutory timeframes, subject to any lawful grounds for withholding information.

18. Representatives and children

In some circumstances, a representative may exercise privacy rights or receive information on behalf of a patient. Requests involving children and young people, parents or guardians, people who lack capacity, powers of attorney or deceased patients will be considered under the Health Information Privacy Code, the Privacy Act and other applicable health law. The patient’s interests, wishes and safety will be considered where required.

19. If you do not want information collected or shared

You may talk to us if you have concerns about a particular collection, use or disclosure of your information. Depending on the information and its purpose, limiting information collection or sharing may affect our ability to provide safe and effective care or may affect access to PHO funding or subsidies. Some information may also need to be collected or disclosed because the law requires or authorises it. We will explain the implications where relevant.

20. Privacy breaches

We assess and manage privacy breaches promptly. Where a breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020. We also take steps to contain breaches, reduce harm and prevent recurrence.

21. Questions, concerns and complaints

If you have a question, concern or complaint about how Browns Bay Family Doctors has collected, used, stored or shared your information, please contact our Privacy Officer through the practice contact details at the start of this policy. We encourage you to raise concerns with us so we have an opportunity to address them.

You may also contact the Office of the Privacy Commissioner, Te Mana Matapono Matatapu, on 0800 803 909 or through www.privacy.org.nz.

22. Changes to this policy

We may update this policy when privacy law, health sector requirements, our services or our information practices change. The current version will be published on our website and made available from the practice on request.

Legal framework

This policy is intended to operate alongside the Privacy Act 2020 and the Health Information Privacy Code 2020 (including Rule 3A, in force from 1 May 2026). If there is any inconsistency, the applicable law prevails.