This statement explains how Dudley Creek Health (DCH, we, us or our) collects, uses, stores and shares personal information, including health information. It applies to our patients, representatives, website visitors and people who contact us.

We are a health agency under the Health Information Privacy Code 2020. We handle information in accordance with the Privacy Act 2020, the Code and other applicable New Zealand laws. This statement does not limit your rights under those laws.

1. Who collects and holds your information
 

Dudley Creek Health collects and holds the information described in this statement. Our address and Privacy Officer details are at the end of this statement. A specialist practising through DCH may also hold clinical information as a separate health agency where applicable.
 

2. What information we collect

When you use our website or contact us

• Your name, email address, phone number and the contents of your enquiry or message.

• Technical information such as IP address, device and browser type, pages viewed, approximate location, cookie identifiers, and security or diagnostic logs.

• Any information you choose to provide through an online form. Please do not include urgent or highly sensitive clinical information in a general website enquiry.
   

When we provide or coordinate care

• Identity and contact details, including date of birth, NHI number and details of a representative or support person where relevant.

• Referral information, medical history, medications, allergies, examination findings, investigations, images, diagnoses, treatment plans, consent records, clinical notes and correspondence.

• Appointment, procedure, theatre, follow-up and care-coordination information.

• Funding, ACC, insurer, billing and payment information relevant to your care.

• Communications with you and with people or organisations involved in your care.
   

3. Where information comes from
 

We usually collect information directly from you or your authorised representative. We may also lawfully receive information from:

• your GP, referrer, specialist, hospital, allied health provider, laboratory, imaging provider or pharmacy;

• Health New Zealand, shared health records or other health-sector systems;

• ACC, an insurer, funder or another organisation involved in arranging or paying for your care; and

• public sources or another person, where authorised by you or permitted by law.

When we collect personal or health information about you from someone else, we will take reasonable steps to tell you that it has been collected, why we collected it, who may receive it, and how to access or correct it, unless an exception in the Privacy Act or Health Information Privacy Code applies or you have already been told.
 

4. Why we collect and use information
 

We collect and use information where reasonably necessary to:

• respond to enquiries and communicate with you;

• assess referrals, provide, coordinate and document your care, and support clinical safety;

• arrange appointments, funding, procedures, follow-up, claims, invoices and payments;

• verify identity, maintain accurate records and manage authorised representatives;

• operate, secure, audit and improve our services and systems;

• meet legal, regulatory, contractual, professional and reporting obligations; and

• produce statistics or service-improvement information that does not identify individuals, where practicable.

We will not use information for a different purpose unless that use is authorised by you, directly related to the original purpose, or otherwise permitted by law. We do not sell personal information.
 

5. Is providing information optional?
 

Providing information through a general website form is voluntary, but we may be unable to respond if we do not have suitable contact details or enough information to understand your enquiry.

For healthcare, some information is necessary to identify you, assess whether and how we can provide care, keep you safe, obtain funding or meet legal and professional duties. If you do not provide requested information, we will explain any likely consequences. These may include delay, inability to arrange funding or an appointment, or inability to provide a particular service safely.
 

6. AI-assisted and digital tools
 

DCH may use approved digital and AI-assisted tools to support administrative and clinical workflow tasks, such as extracting selected details from documents, organising information or preparing a draft summary. These tools support staff; they do not replace professional judgement. A trained staff member or clinician must review relevant outputs before they are used for care.

DCH does not permit an AI tool to autonomously diagnose, choose treatment, prioritise a patient, make a funding or consent decision, or book surgery. Where a pilot or particular tool requires specific patient notification or consent, we will provide that information and choice separately.

 

 

7. Who we may share information with
 

We may disclose relevant information, only where lawful and reasonably necessary, to:

• specialists, nurses, allied health professionals, hospitals, laboratories, imaging providers, pharmacies and others involved in your care;

• your authorised representative, support person or another person you ask us to involve;

• ACC, insurers, funders and payment providers where relevant;

• technology, hosting, communications, document, accounting, audit and other service providers acting for us under privacy and security obligations;

• regulators, courts, law-enforcement agencies or other bodies where disclosure is required or permitted by law; and

• another healthcare provider where needed for continuity of care or where you request a transfer.

We limit disclosures to information relevant to the purpose and take reasonable steps to ensure it is accurate, complete, up to date and not misleading before use or disclosure.
 

8. Overseas storage, processing and disclosure
 

Some approved service providers may store or process information outside New Zealand on our behalf. We assess privacy and security risks and use contractual, technical and organisational safeguards appropriate to the information and service.

Where we disclose personal information to an overseas person or organisation for its own use and Information Privacy Principle 12 applies, we will ensure there is a permitted basis for the disclosure. This may include comparable legal safeguards, contractual safeguards, or your authorisation after we have expressly told you if comparable New Zealand protections may not apply.

9. Security and privacy breaches
 

We take reasonable safeguards against loss, unauthorised access, misuse, modification or disclosure. Measures include role-based access, staff confidentiality obligations, secure systems, access controls, logging, backups, physical security, and due diligence and agreements for service providers, as appropriate. No system can be guaranteed completely secure.

If a privacy breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, unless a legal exception applies.
 

10. How long we keep information
 

Health records we hold are generally retained for at least 10 years from the day after the most recent date on which services were provided, as required by the Health (Retention of Health Information) Regulations 1996, unless the records are lawfully transferred or another requirement applies.

Other personal information is kept only for as long as it may lawfully be used or is needed for legal, clinical, accounting, audit, security or dispute-resolution purposes. When information is no longer required, we securely delete, destroy or de-identify it.

11. Accessing or correcting your information
 

You may ask for access to personal or health information we hold about you and ask us to correct it. If we do not make a requested correction, you may ask us to attach a statement of correction to the information.

Contact our Privacy Officer using the details below. We may need to verify your identity or authority before releasing information. We will respond within the time required by law and will explain any lawful reason for withholding information. Access is usually free, although a lawful charge may apply in limited circumstances.
 

12. Cookies and website analytics
 

Our website is hosted using Wix and uses cookies and similar technologies that are necessary for site operation, security and performance. We may also use aggregated analytics to understand how the site is used. We do not use patient health information for advertising.

You can control cookies through your browser and, where available, our cookie settings. Blocking some cookies may affect how the website works. If we introduce non-essential advertising or tracking technologies, we will update this statement and provide appropriate notice or choice.
 

13. Questions and complaints
 

Please contact our Privacy Officer first if you have a question, access or correction request, or concern about how we handled your information. We will acknowledge and investigate privacy concerns fairly and promptly.

You may also complain to the Office of the Privacy Commissioner. Visit privacy.org.nz or call 0800 803 909.
 

14. Contact details

PRIVACY OFFICER

Dr J Saravana Ganesh
Dudley Creek Health
447 Papanui Road, Strowan, Christchurch 8052
Phone: 03 666 7447 Email: jsg@dchealth.co.nz
 

15. Changes to this statement
 

We may update this statement when our practices, systems or legal obligations change.Material changes will be communicated in an appropriate way.
 

Official New Zealand sources

• Privacy Act principles and IPP 3A

• Health Information Privacy Code 2020

• Health information retention requirements