West Coast Health Privacy Statement
Last updated: 1 May 2026 — v1.1
Summary
- We collect and use your personal and health information to provide and improve your care
- We usually collect information directly from you, but sometimes from other health providers and agencies
- We share information with the people involved in your care and where required by law
- We take steps to keep your information safe
- You have the right to access and correct your information, and to make a complaint
About this statement
West Coast Health (WCH) is a Primary Health Organisation. We hold personal and health information about people enrolled in our member practices and those who use our services. Your ‘Personal Information’ is any information that can identify you as an individual. Your ‘Health Information’ includes information about your health or disabilities and medical history. In this statement when we say ‘information’, we mean both your Personal Information and your Health Information.
This statement explains:
- what information we collect
- where we get it from
- how we use and share it
- how we keep it safe
- your rights
We comply with the Privacy Act 2020 and the Health Information Privacy Code 2020.
Who we are
West Coast Health is responsible for collecting and holding your information.
- Registered address: Top Floor, 163 Mackay Street, Greymouth
- Postal address: P O Box 544, Greymouth, 7805
- Privacy Officer: Caro Findlay – Contactable at: 0800 004 696
If another agency collected your information before sharing it with us, you can contact them or your healthcare provider for their details.
What information we collect
We collect and hold health information about you, including:
- your name, date of birth, contact details, and National Health Index (NHI) number
- your enrolment with a member practice
- services and programmes you receive or are referred to
- clinical information needed to provide or coordinate your care
- information needed to claim funding for services provided to you
- demographic information (such as ethnicity), where you choose to provide it
Where we get your information
From you
We collect information directly from you when you:
- enrol with a practice
- register for or use our services
- speak with us or your healthcare provider
From other sources
We also collect information from other sources involved in your care, including:
- your general practice, when you enrol, when a service is provided to you, or when you are referred to a WCH programme;
- hospitals and specialists, through discharge summaries, specialist letters and shared care records;
- Health New Zealand | Te Whatu Ora and Manatū Hauora (the Ministry of Health), including from the National Health Index, the National Immunisation Register / Aotearoa Immunisation Register, and national screening registers;
- ACC, where they are involved in funding or coordinating your care;
- other PHOs, when you change enrolment;
- your family, whānau or carer, where they are acting on your behalf or assisting with your care; and
- other agencies or people involved in your care, where this is permitted by law.
When we collect information from others
Sometimes we collect your information from sources other than you.
Under the Privacy Act 2020 (Information Privacy Principle 3A) and the Health Information Privacy Code 2020 (Rule 3A), we must take reasonable steps to make sure you are aware of this.
This privacy statement is part of how we meet that obligation. It explains:
- that we collect information from other sources
- what we collect
- why we collect it
- who we share it with
- your rights
Service providers
We may use service providers (for example, cloud hosting or analytics providers) to store or process information on our behalf.
They:
- act only on our instructions
- do not use your information for their own purposes
Legally, this information is treated as being held by West Coast Health.
Why we collect and use your information
We collect and use your information to:
- provide, coordinate, and improve your healthcare
- deliver services and programmes you are enrolled in or referred to
- support your GP and other providers involved in your care
- claim funding for services from Health New Zealand
- plan, fund, and evaluate primary health services for our population
- improve quality and equity of care, including by carrying out clinical audits and reporting on performance;
- carry out approved research and produce statistics (usually de-identified)
- meet our legal, audit, and reporting obligations
Who we share your information with
We may share your information with:
- your enrolled general practice and the clinicians providing your care;
- West Coast Health staff and contractors who need it to do their job
- Health New Zealand | Te Whatu Ora and Manatū Hauora
- other PHOs and health agencies involved in your care
- ACC, where relevant
- auditors acting under legal or contractual obligations
- approved researchers (where allowed by law)
- any person or organisation you authorise
- any other person or agency where sharing is required or permitted by law
Legal basis for collection, use, and sharing
We collect, use, and share your information in accordance with:
- the Privacy Act 2020 (including amendments)
- the Health Information Privacy Code 2020, including:
- Rule 2 (collection, including from other sources)
- Rule 10 (use of information)
- Rule 11 (disclosure of information)
Our role is also governed by:
- our agreement with Health New Zealand | Te Whatu Ora
- the Health Act 1956
- the Pae Ora (Healthy Futures) Act 2022
How we keep your information safe
We store your information in secure systems, including trusted cloud services.
We take reasonable steps to protect your information from:
- loss
- unauthorised access
- misuse or disclosure
This includes:
- access controls (only authorised people can access your information who need it to perform their roles)
- monitoring and auditing access
- encryption where appropriate
We follow Rule 5 of the Health Information Privacy Code 2020.
How long we keep your information
We keep your information for at least 10 years after your last contact, as required by the Health (Retention of Health Information) Regulations 1996.
We may keep it longer where needed for healthcare, legal, or reporting purposes.
Your rights
You have the right to:
- access your information and request a copy
- ask us to correct your information
- provide a statement of correction if we do not agree to a change
- ask how your information is being used and shared
- make a complaint
You can also authorise someone (such as a caregiver or representative) to act on your behalf.
To make a request, contact
0800 004 696
We will respond as soon as reasonably practicable and no later than 20 working days, as required by law.
In some situations, we may refuse a request (for example, where this is permitted under sections 49–53 of the Privacy Act 2020). If we do, we will tell you the reason for any refusal and explain your right to complain to the Privacy Commissioner.
Complaints
If you have concerns about your privacy and the handling of your personal information, please let us know. We will work with you and do our best to resolve your concern. We are always open to improving our processes and systems.
If we are unable to resolve your concern, you have the right to complain to the Office of the Privacy Commissioner. Options for contacting the Privacy Commissioner are on the Commissioner’s website.
Changes to this statement
We may update this statement from time to time.
The date at the top shows when it was last updated. We will notify you of any significant changes on our website.