Privacy Statement

West Coast Health Privacy Statement

Version 2.0  ·  Effective [17 September 2026]  ·  Supersedes v1.1 (1 May 2026)

In brief

•      We collect and use your personal and health information to provide, coordinate and improve your care.

•      We usually collect information directly from you, but we also collect it from your general practice, hospitals, Health New Zealand and other agencies involved in your care.

•      We share information with the people involved in your care, and where the law requires or allows it.

•      Your information is stored in secure systems, and we keep it only as long as we are permitted or required to.

•      You have the right to see your information, ask us to correct it, ask how it is used, and make a complaint.

•      You have choices about how your information is shared through national systems such as the Shared Digital Health Record.

1. About this statement

West Coast Health (WCH) is a Primary Health Organisation (PHO) serving Te Tai Poutini, the West Coast. We hold personal and health information about people enrolled with our member practices and people who use our services and programmes.

•      Personal information is any information that identifies you as an individual.

•      Health information is information about your health, disabilities, and the health and disability services you have received.

In this statement, "information" means both.

This statement explains what we collect, where we get it, why we use it, who we share it with, how we protect it, and what rights you have.

We are a "health agency" under the Health Information Privacy Code 2020. We comply with that Code and with the Privacy Act 2020, including the changes introduced by the Privacy Amendment Act 2025 which took effect on 1 May 2026.

2. Who we are and how to contact us

West Coast Health is the agency responsible for collecting and holding your information.

If another agency collected your information before sharing it with us, you can ask us who they are, or contact your healthcare provider for their details.

Accessibility. If you need this statement, or a response to a request, in another format — large print, Easy Read, te reo Māori, or with an interpreter or New Zealand Sign Language interpreter — please ask us. There is no charge.

3. Te Tiriti o Waitangi and Māori data

West Coast Health is committed to giving effect to Te Tiriti o Waitangi in the way we govern and use health information, consistent with our obligations under the Pae Ora (Healthy Futures) Act 2022.

We recognise that health data about Māori is a taonga. In practice this means we:

•      collect and record ethnicity, Māori descent and iwi affiliation in line with national standards (HISO 10001 Ethnicity Data Protocols and HISO 10094:2022 Māori Descent and Iwi Affiliation Data Protocols), and only where you choose to provide it;

•      use ethnicity information to identify and address inequities in access, quality and outcomes of care — not to limit or ration your care;

•      involve Māori in decisions about how health information about our population is governed, analysed and reported; and

•      apply Māori data sovereignty principles when we report on, share or approve research use of information about our population.

You do not have to tell us your ethnicity, descent or iwi. If you do, you can ask us to change or remove it at any time.4. What information we collect

We collect and hold information including:

•      Identity and contact details — your name, date of birth, address, phone numbers, email address, and your National Health Index (NHI) number.

•      Enrolment information — the practice you are enrolled with, your enrolment history and status.

•      Service information — the services, programmes and referrals you receive from us or through us, including appointment and attendance information.

•      Clinical information — information needed to provide or coordinate your care, such as conditions, medications, allergies, results, assessments, care plans and clinical notes relevant to the services we provide.

•      Funding and claiming information — information needed to claim funding for services provided to you.

•      Demographic information — such as ethnicity, Māori descent, iwi affiliation, gender, and disability status, where you choose to provide it.

•      Correspondence — records of your contact with us, including emails, letters, feedback and complaints.

•      Website information — see section 15.

We collect only what we need for the purposes set out in section 6.

5. Where we get your information

From you

We collect information directly from you when you enrol with a member practice, register for or use our services, complete a form or survey, or speak with us or your healthcare provider.

From other sources

We also collect information about you from other people and agencies involved in your care, including:

•      your general practice, when you enrol, when a service is provided, or when you are referred to a WCH programme;

•      hospitals and specialists, through discharge summaries, specialist letters and shared care records;

•      Health New Zealand | Te Whatu Ora and Manatū Hauora (the Ministry of Health), including from the National Health Index, the National Enrolment Service, the Aotearoa Immunisation Register, national screening registers and other national collections;

•      ACC, where it is involved in funding or coordinating your care;

•      other PHOs, when you change enrolment;

•      pharmacies, laboratories, imaging providers, ambulance and other health and disability service providers involved in your care;

•      your family, whānau, carer or representative, where they are acting on your behalf or assisting with your care; and

•      other agencies or people, where this is authorised or required by law.

When we collect information about you from somewhere other than you

Under Rule 3A of the Health Information Privacy Code 2020 — which applies to health agencies the new Information Privacy Principle 3A introduced by the Privacy Amendment Act 2025, and which is in force from 1 May 2026 — where we collect information about you from a source other than you, we must take reasonable steps to make sure you are aware of that collection.

This privacy statement is a key part of how we do that. It tells you:

•      that we collect information about you from other sources, and what those sources are (section 5);

•      what we collect (section 4);

•      why we collect it (section 6);

•      who we share it with (sections 7 and 8);

•      who we are and how to contact us (section 2); and

•      your rights of access and correction (section 18).

We may also tell you at the time — for example, when you are referred to one of our programmes, or when we first contact you about a service.

We do not have to notify you in every case. Rule 3A sets out limited exceptions, including where you are already aware, where the information is publicly available, where notifying you would not be reasonably practicable or would prejudice the purpose of collection, or where notifying you would create a serious threat to public health or public safety or to the health or safety of another individual. Rule 3A also does not apply to information we collected before 1 May 2026. Where we rely on an exception, we record the reason.

Service providers

We use service providers — for example, cloud hosting, clinical software and analytics providers — to store or process information on our behalf. They act only on our instructions under written agreements, and must not use your information for their own purposes. In law, information held by an agent on our behalf is treated as held by West Coast Health, and we remain accountable for it.

6. Why we collect and use your information

We collect and use your information to:

•      provide, coordinate and improve your healthcare;

•      deliver the services and programmes you are enrolled in or referred to;

•      support your GP, nurse and other providers involved in your care;

•      contact you about your care, including appointments, recalls, reminders and results;

•      claim and reconcile funding for services provided to you;

•      plan, fund, commission and evaluate primary health services for our population;

•      improve the quality and equity of care, including clinical audit, quality improvement and performance reporting;

•      carry out approved research and produce statistics (usually using de-identified information — see section 16);

•      respond to your questions, feedback and complaints; and

•      meet our legal, contractual, audit and reporting obligations.

We do not sell your information, and we do not use it for advertising.

7. Who we share your information with

We may share your information with:

•      your enrolled general practice and the clinicians providing your care;

•      WCH staff and contractors who need it to do their job;

•      Health New Zealand | Te Whatu Ora and Manatū Hauora, including through national collections (see section 8);

•      other PHOs and health and disability providers involved in your care;

•      ACC, where relevant to your care or a claim;

•      our service providers, on the terms described in section 5;

•      auditors acting under legal or contractual obligations;

•      approved researchers, where permitted by law and with ethics approval where required (see section 16);

•      any person or organisation you authorise; and

•      any other person or agency where sharing is required or permitted by law — for example, to prevent or lessen a serious threat to someone's life or health, or under a statutory notification or reporting duty.

Sharing that goes beyond these purposes requires your authorisation, unless the law provides otherwise.

8. National health information systems, and your choices

Some of your information forms part of national health systems run by Health New Zealand | Te Whatu Ora. These help your care follow you, and help plan and monitor services.

Shared Digital Health Record (SDHR). Health New Zealand is building a national connector that lets approved healthcare providers — general practices, urgent care, telehealth, hospitals, ambulance services, pharmacies and residential facilities — see key information about you when they are caring for you. It is being introduced progressively, with information from national datasets such as immunisations and prescribed medications from late 2026, and information from medical practice systems expected from mid-2027. These timings are set by Health New Zealand and may change.

You have choices. You can allow sharing, mark some or all information from a provider as private so other providers cannot see it, or block all sharing through the SDHR. Your care will not be affected by what you choose. To make or change a choice, talk to your practice, or contact Health New Zealand on 0800 144 751 or customerservice@health.govt.nz. Privacy questions can go to hnzprivacy@tewhatuora.govt.nz.

National Primary Care Dataset. Health New Zealand collects encounter and appointment information from general practices to measure and improve access to primary care, including the national target for people to be able to see a primary care provider within one week. West Coast Health supports our member practices to take part and to meet their obligations to you.

Other national collections. These include the National Health Index, the National Enrolment Service, the Aotearoa Immunisation Register, national screening registers, and pharmaceutical and laboratory collections.

Health New Zealand is the agency responsible for these systems. Their privacy information is on the Health New Zealand website, and you can contact them at the details above. If you would like help understanding your choices, please contact us or your practice.

9. Sending information outside New Zealand

Some of the systems we use are provided by companies that store or process information outside New Zealand, or that may access it from overseas for support purposes.

Where a provider acts only as our agent — for example, a cloud host that stores or processes information on our instructions and does not use it for its own purposes — that is not a disclosure under Rule 12. The information remains legally held by West Coast Health and we remain accountable for it. We require comparable protections by contract, including security, breach notification, access, deletion, sub-processing and audit obligations, and we assess those controls before a system is used.

Where we do disclose information to an overseas person or organisation, we comply with Rule 12 of the Health Information Privacy Code 2020. We only do so where at least one of the following applies:

•      you or your representative authorise the disclosure, after being told that the recipient may not be required to protect the information in a way that provides comparable safeguards;

•      the overseas recipient is carrying on business in New Zealand and is subject to the Code;

•      the recipient is subject to privacy laws that provide comparable safeguards;

•      the recipient is a participant in a prescribed binding scheme;

•      the recipient is subject to the privacy laws of a prescribed country;

•      the recipient is required by binding contractual terms to protect the information to a comparable standard; or

•      the disclosure is otherwise authorised under section 30 of the Privacy Act 2020.

Rule 12 also allows disclosure where it is not reasonably practicable to meet those conditions and the disclosure is necessary to prevent or lessen a serious threat, or for the maintenance of the law.

You can ask us where information about you is held and which countries are involved.

10. Our legal framework

We collect, use, hold and share your information in accordance with:

•      the Privacy Act 2020, as amended by the Privacy Amendment Act 2025 (which introduced Information Privacy Principle 3A);

•      the Health Information Privacy Code 2020 (including Amendment No. 2, in force 1 May 2026), which replaces the information privacy principles for health agencies such as us, in particular:

•      Rule 1 — purpose of collection

•      Rule 2 — source of health information

•      Rule 3 — what we tell you when we collect from you

•      Rule 3A — what we tell you when we collect from other sources

•      Rule 4 — manner of collection

•      Rule 5 — storage and security

•      Rules 6 and 7 — access and correction

•      Rule 8 — accuracy before use or disclosure

•      Rule 9 — retention

•      Rule 10 — limits on use

•      Rule 11 — limits on disclosure

•      Rule 12 — disclosure outside New Zealand

•      Rule 13 — unique identifiers;

•      the Health Act 1956, including section 22F (providing information to those involved in your care or acting on your behalf);

•      the Pae Ora (Healthy Futures) Act 2022;

•      the Health and Disability Commissioner Act 1994 and the Code of Health and Disability Services Consumers' Rights;

•      the Health (Retention of Health Information) Regulations 1996;

•      the Health Practitioners Competence Assurance Act 2003, and other statutes that require or permit disclosure; and

•      our service agreement with Health New Zealand | Te Whatu Ora.

We also apply national health information standards, including the Health Information Governance Guidelines (HISO 10064) and the Health Information Security Framework (HISO 10029).

11. How we keep your information safe

We store your information in secure systems, including trusted cloud services, and we take reasonable steps to protect it against loss, unauthorised access, use, modification, disclosure or misuse, as required by Rule 5 of the Health Information Privacy Code 2020.

Our controls include:

•      role-based access control — only authorised people who need information to do their job can see it;

•      multi-factor authentication for access to clinical and administrative systems;

•      encryption of information in transit and at rest, where appropriate;

•      logging, monitoring and auditing of access to identifiable information, including proactive audit of unusual access;

•      contractual security obligations on our service providers, and assurance over their controls;

•      staff and contractor obligations — confidentiality agreements, privacy and security training, and access removed promptly when a role ends;

•      secure disposal of information and media at end of life; and

•      business continuity and backup arrangements, tested regularly.

We assess and improve our security against the Health Information Security Framework and recognised cyber security maturity models, and we complete privacy impact assessments for new systems and significant changes to how information is used.

12. If something goes wrong — privacy breaches

If a privacy breach happens and it has caused, or is likely to cause, serious harm, we will:

•      notify the Office of the Privacy Commissioner as soon as practicable after we become aware of the breach, as required by Part 6 of the Privacy Act 2020. In line with the Privacy Commissioner's expectation, we aim to do this within 72 hours, even if we are still investigating;

•      notify you as soon as we can, unless a limited legal exception applies;

•      tell you what happened, what information was involved, what we are doing about it, and what you can do; and

•      review what happened and make changes to prevent it happening again.

We maintain a privacy breach register and investigate every reported incident, whether or not it meets the notification threshold.

13. Keeping your information accurate

Before we use or disclose your information, we take reasonable steps to check that it is accurate, up to date, complete, relevant and not misleading, as required by Rule 8.

Please tell us if your contact details change, or if you think anything we hold about you is wrong. See section 18 for how to ask for a correction.

14. How long we keep your information

We keep health information for at least 10 years from the date we last provided services to you, as required by the Health (Retention of Health Information) Regulations 1996.

We may keep it longer where it is needed for your ongoing care, for legal, audit or reporting purposes, or where another law requires it. We do not keep information for longer than it can lawfully be used, as required by Rule 9.

When information is no longer required, it is securely destroyed or de-identified.

15. Our website

When you visit westcoasthealth.nz we may collect technical information such as your IP address, browser and device type, the pages you visit and the time of your visit. We use this to keep the site secure and to understand how it is used.

•      We use cookies and similar technologies. Where cookies are not strictly necessary for the site to work, we ask for your consent and you can change or withdraw it at any time through your browser or our cookie settings.

•      We use website analytics, configured to minimise the information collected and with IP addresses anonymised where the tool supports it.

•      If you send us information through a form or by email, we treat it under this statement. Please do not send clinical information by email unless we have agreed a secure method with you.

•      Our site may link to other websites. We are not responsible for their privacy practices.

16. Research, audit and statistics

We use information to improve care through clinical audit, quality improvement and reporting on the health of our population. Wherever possible we use de-identified or aggregated information.

Where identifiable information is used for research, it is only with your authorisation, or where the research is approved by an accredited ethics committee (such as a Health and Disability Ethics Committee) and permitted under the Health Information Privacy Code. Results are published in a form that does not identify you, and we apply small-number suppression so individuals cannot be identified in reports.

Māori data governance arrangements apply to research and reporting involving information about Māori (see section 3).

17. How we contact you, and automated tools

How we contact you. We may contact you by phone, text, email or post about your care, appointments, recalls, screening, immunisations and health programmes you are eligible for. You can ask us to change how we contact you, or to stop non-clinical communications, at any time. Some communications are part of your care and we may still need to reach you.

Automated tools and artificial intelligence. We use software tools that help identify people who may benefit from a service — for example, screening or long-term-condition recalls — and tools that help our team work more efficiently. We do not make decisions about your care solely by automated means. A clinician or authorised staff member reviews and is accountable for decisions that affect your care. Where we use tools that process health information, we assess them for privacy, security, safety, bias and equity before use, and require providers to meet our contractual protections, including that your information is not used to train their models unless we have specifically agreed and it is lawful.

18. Your rights

You have the right to:

•      access the information we hold about you and ask for a copy (Rule 6);

•      ask us to correct it if you think it is wrong (Rule 7);

•      attach a statement of correction if we do not agree to make a change;

•      ask how your information is being collected, used, shared and stored;

•      choose how your information is shared through national systems (see section 8);

•      authorise someone else to act on your behalf; and

•      complain if you are unhappy (see section 21).

How to make a request. Contact our Privacy Officer on 0800 004 696 or privacy@westcoasthealth.nz, or write to PO Box 544, Greymouth 7805. Tell us what information you want and how you would like to receive it.

What happens next. We will confirm your identity — this protects you. We will decide on your request and respond as soon as reasonably practicable and no later than 20 working days after we receive it, as required by sections 44 and 45 of the Privacy Act 2020. We may extend that time under section 48 if the request is large or requires consultation; if we do, we will tell you before the 20 working days are up and explain why, and you can complain to the Privacy Commissioner about the extension.

Cost. We do not usually charge for access to your own information. If a charge is permitted and we intend to make one, we will tell you before we do the work.

If we say no. We may refuse a request in limited circumstances, including the grounds in sections 49 to 53 of the Privacy Act 2020 — for example, where releasing the information would endanger someone's safety, would disclose someone else's information, or where information was given in confidence. If we refuse, we will tell you why and tell you about your right to complain to the Privacy Commissioner.

19. Acting for someone else

Children and young people. A parent or guardian can usually access information about a child. Young people who are able to understand the decision may make their own choices about their health information, and in some cases we will not release their information to a parent or guardian without their agreement. We follow recognised professional practice and the Health Information Privacy Code when deciding these requests, and we act in the best interests of the young person.

Representatives. You can authorise someone — a family or whānau member, carer, support person, advocate or lawyer — to act for you. We will ask for written authority. Where a person has a welfare guardian, an enduring power of attorney for personal care and welfare that is in effect, or is otherwise a representative under the Privacy Act, they can act on that person's behalf. Representatives, and other providers who are providing or are about to provide services to you, may also request information under section 22F of the Health Act 1956.

Family and whānau involved in your care. Under Rule 11 of the Health Information Privacy Code 2020, we may share information with your principal caregiver, a near relative or others involved in your care where this is in accordance with recognised professional practice and you have not objected. Tell us if you do not want information shared with a particular person.

20. Information about people who have died

We continue to protect health information about people who have died. Requests are usually made by the person's personal representative (for example, the executor or administrator of their estate), and we may release information to family or whānau where this is consistent with the Health Information Privacy Code, section 22F of the Health Act 1956, and what we believe the person would have wanted.

21. Complaints

If you are concerned about how we have handled your information, please tell us first. We take complaints seriously and will work with you to put things right, and to improve our systems.

Contact our Privacy Officer: 0800 004 696 | privacy@westcoasthealth.nz | PO Box 544, Greymouth 7805

We will acknowledge your complaint promptly, tell you who is handling it, and keep you informed.

If we cannot resolve your concern, or you would prefer to go elsewhere:

You can complain to any of these at any time. You do not have to come to us first.

22. Changes to this statement

We review this statement at least every two years, and whenever the law or the way we use information changes materially. The version and date at the top show when it was last updated. We will publish significant changes on our website and, where appropriate, tell you directly.

Version history