This Policy governs how Royal District Nursing Service New Zealand Limited NZCN 2231468 (we, us, our) collect, store, use, disclose and manage personal information. This Policy also outlines and explains the types of personal information we collect, the purposes for which it is collected, how you can request access to and correct personal information that we hold about you and how you can make a privacy complaint or contact us with your enquiries or concerns.

We take your privacy seriously and are committed to open and transparent management of personal information. When dealing with personal information, we comply with the Privacy Act 2020 (Act), the Privacy Principles in the Act, the Health Information Privacy Code 2020 and all other applicable legislation including health records legislation.

Our suppliers and contractors are required to enter into written contracts ensuring their strict compliance with privacy laws.

Personal information is any information about an identifiable individual, and includes information relating to a death that is maintained by the Registrar-General pursuant to the Births, Deaths, Marriages, and Relationships Registration Act 2021.

Health information is a subset of personal information and includes:

(a) information about the health of that individual, including his or her medical history;

(b) information about any disabilities that individual has, or has had;

(c) information about any health services or disability services that are being provided, or have been provided, to that individual;

(d) information provided by that individual in connection with the donation by that individual of any body part or any bodily substance of that individual or derived from the testing or examination of any body part, or any bodily substance of that individual; or

(e) information about that individual which is collected before or in the course of, and incidental to, the provision of any health service or disability service to that individual.

What constitutes personal information will vary, depending on whether any individual can be identified or is reasonably identifiable in the particular circumstances.

We will not collect personal information unless it is reasonably necessary for one of our functions or activities. All personal and health information will only be collected through lawful and fair means. Collection of personal or health information will primarily be collected with your consent. However, such information may also be collected in a manner that is required or authorised by law (for example, where it is necessary to prevent or minimise a serious or imminent threat to a person’s life or health).

The sources from which we collect personal information will depend on the circumstances of the collection and may include the following:  

5.1    From you or with your consent 
We will try to collect your personal information directly from you, or alternatively, with your consent. We will collect personal information from you:

(a) if you provide us with information about yourself and, if necessary, your medical condition;

(b) if you complete relevant agreements, applications, forms, surveys, competitions, questionnaires or you communicate with us by taking part in a discussion or forum or by email, telephone, in writing (including through the “contact us” page on our website), in person or by audio visual means;

(c) if you are providing services or goods to us or our clients; 

(d) if you apply for employment or engagement with us; or

(e) if you are employed with or engaged by us. 

5.2    From other people

Where it is not reasonably practicable to collect information directly from you, we may obtain personal information about you from a third party.  For example, we may collect personal information about you:

(a) from your general practitioner or another healthcare provider who has information about you to assist us in providing services to you;

(b) from a member of your family, a private carer, a close friend, your authorised representative or responsible person, next of kin, your nominated emergency contact person or the police;

(c) from any person or organisation that assesses health status or care requirements;

(d) from relevant government departments such as District Health Board (DHB), Accident Compensation Corporation (ACC) or Ministry of Health (MoH) to assist us in providing services or processing billing for services provided to you;;

(e) from third parties who you have asked to provide your personal information to us; or

(f) from a reference or referral identified in your application for employment or engagement with us.

5.3    From our website
When you visit our website, our web server may download a cookie to your computer.  A cookie is a small piece of information sent by our server to your browser.  Cookies do not contain personal information about you but can identify a user's browser.  We use cookies to capture information about a user's browser. If you do not wish to receive cookies, you may set your browser to refuse them.

Our website may contain links to a variety of third party website sources. Some of these links may request or record information from users or use cookies or other methods to collect information from you. We have no control over the content or privacy policy practices of those sites and encourage you to review the privacy policies of those sites before using them.

If you are receiving home care or child wellbeing services from us, it is not practical for you to remain anonymous because we need to keep a record of the care and services provided to you.

We may be able to accommodate you using a pseudonym. However, if you choose not to provide your real identity this may impact the quality of the services provided to you and relevant billing and claiming. If you wish to use a pseudonym that is linked confidentially to your real identity, please let us know and we will discuss with you any arrangements that can be made.

On our website, we automatically gather anonymous information to monitor use. For example, the numbers and frequency of website visitors. This aggregated, anonymous information does not contain your personal information, and helps us determine how our audiences use parts of our website, so we can improve our services. We may publish or provide this aggregated information to other people or organisations.

It is not mandatory for you to provide your personal information to us. However, if you do not provide your personal information to us, we may not be able to provide care or services to you, or potentially engage or employ you.

If we are able to provide care and services to you, engage or employ you, choosing not to provide your personal information may impact upon the administration and management of our services (including billing and claiming), or our potential engagement or employment of you. 

We may use and disclose personal information for the particular purpose for which it was collected (Primary Purpose).  

For clients, this will include the use and disclosure necessary to provide home care or child wellbeing services including health care or wellness services, and where relevant, accommodation. We may also use or disclose your personal information:

(a) to staff or other service or healthcare providers involved in providing services to you or your care (including your general practitioner, nurses, physiotherapists, occupational therapists) or administrative staff (involved in preparation of documentation, billing and other administrative and management duties);

(b) in assessing whether you are eligible for our services;

(c) to Health NZ – Te Whatu Ora, Accident Compensation Corporation (ACC) or Whaikaha Ministry of Disabled People, Oranga Tamariki or your private health insurer for the purposes of billing;

(d) to government authorities for the purposes of providing home care, child wellbeing or other healthcare services;

(e) to the Health Quality & Safety Commission for the purposes of client experience surveys;

(f) to funding bodies and government agencies;

(g) to a member of your family, or your authorised representative or responsible person, next of kin, your nominated emergency contact person or the police; or

(h) any third party that you request or authorise us to.
For prospective employees, this may be for assessing and processing employment applications.

If you are our employee, we may disclose your personal information to our funders, clients, contractors or other third parties in connection with your employment activities.

We will only generally use or disclose personal information collected for a Primary Purpose. However, it may be necessary in some cases to disclose personal information for a secondary purpose, including:

(a) if we have your consent for the secondary purpose use;

(b) the disclosure is made to your caregiver or near relative in accordance with recognised professional practice in circumstances where it is not practicable or desirable to obtain your authorisation and the disclosure is not contrary to your express wishes;

(c) if required for the management of our services. For example:

(i) billing or debt-recovery, service-monitoring, funding, complaint-handling, incident reporting, developing and planning services, evaluation and improvement, quality assurance or audit activities, and accreditation activities;

(ii) education and training of our staff, where de-identified information is not sufficient for this purpose; and

(iii) disclosure to our advisors and contractors who provide services to us, for example IT and database management service providers;

(d) for research, compilation or analysis of statistics;

(e) if use or disclosure is necessary to lessen or prevent a serious or imminent threat to someone's life, health or safety or a serious threat to public health and safety; or

(f) if we are required or authorised by or under a New Zealand law or a court or tribunal order. 

We will take reasonable steps to ensure that the personal information we collect is accurate, complete, up to date and relevant to the purpose for which it is to be used, both at the time of collection and use. Please refer to section 12 below for details on how you may access or correct your personal information.

All personal information collected is securely stored on our electronic databases. In some instances, it may also be held in hard copy files in secure and locked facilities. 

Client care records may also be held at your home. Access to and security of client care records left in your home are your responsibility. 

We will take reasonable steps to ensure that the personal information we hold is protected from misuse, loss, interference, unauthorised access, modification or disclosure. Authorised staff have controlled access to computer systems, electronic databases and telephone recordings containing personal and health information. 

If we find that there has been any unauthorised access, disclosure or loss of your personal information that has resulted in or is likely to result in serious harm to you, we will:

(a) take remedial action (where reasonably possible) to minimise risk of harm to you; and

(b) notify you and the Office of the Privacy Commissioner.
as soon as reasonably practicable.

For adult clients, personal and health information is retained for 12 years following the date of the most recent service provision. For minors, personal and health information is retained for up to 25 years following the date of the most recent service provision. Personal and health information is disposed of in line with our policies and procedures.   

If requested, we will let you know what kind of personal information of yours we hold, for what purpose, and how we handle that information. We will also make this Policy available to anyone who requests a copy of it.

You can request access to your personal information held by us, upon written request to our Privacy Officer (see section 15 for details). We may charge statutory fees for carrying out your request.

To obtain access to personal information, we must be satisfied that you are legally authorised to make the request. We will ask you to verify your identification or authority. This is necessary to ensure that your personal information is provided only to the correct individuals and that the privacy of others is protected.

If, upon receiving access to your personal information or at any other time, you believe your personal information is inaccurate, incomplete or out of date, you can notify our Privacy Officer to correct your personal information.  We will take reasonable steps to correct the information so that it is accurate, complete and up to date.

We may decline a request for personal information in circumstances prescribed in the Act, including:

(a) disclosure would pose a serious threat to your life or health or that of any other person;

(b) disclosure would breach the privacy of others;

(c) the personal information is not readily retrievable;

(d) the personal information has been given in confidence by another person;

(e) disclosure would be unlawful; or

(f) disclosure would breach legal professional privilege.

If we decline to provide access, we will give you a written notice setting out the reasons for refusal and the complaint mechanisms available to you.

We may disclose personal information to entities outside of New Zealand (including our related entities operating in Australia), in which case we will ensure that the overseas recipient is obliged to protect your personal information with comparable safeguards to those contained under New Zealand law, or otherwise we will obtain your express consent to disclose the personal information.

There may be occasions where personal information is used for direct marketing purposes including direct contact, telephone enquiries, email, SMS, letters, internet and web interactions, surveys and other forms of communication. Any such use will be limited to circumstances where you would reasonably expect us to use or disclose your personal information for that purpose and it has been collected from you, or if you have otherwise consented or requested this information.

You have the right: 

(a) to contact us to ‘opt-out’ of receiving direct marketing communications; or

(b) to request that we provide the source of your personal information where reasonable and practicable.

If you have consented to us providing direct marketing to you and you wish to stop receiving such marketing, please contact us at reporting@rdns.org.nz or as provided in the marketing communication.

If you believe we have at any time breached this Policy, you may lodge a written complaint with our Privacy Officer using the contact details in this Policy.

We will endeavour to acknowledge your complaint within 14 days of its receipt, and to make a determination on the complaint within 30 days of its receipt.

If you are not happy with our response, you may lodge a written complaint with the Office of the Privacy Commissioner.

Privacy Officer

Royal District Nursing Service New Zealand, P.O Box 17122, Greenlane, Auckland 1546

Email: reporting@rdns.org.nz

Further information about the Privacy Principles and the application of the Act to us can be found at the website of the Office of the Privacy Commissioner at https://www.privacy.org.nz.

This Policy will be reviewed every two years or when changes to legislation and regulation or the operating environment occur. We may change this policy at any time by publishing the amended policy on our website. We will endeavour to inform you of any changes to the policy by email or on the website.