Privacy Policy — Ultra Health Physiotherapy

Ultra Health Physiotherapy Limited

1. Introduction

Ultra Health Physiotherapy Limited ("Ultra Health Physiotherapy", "we", "us", "our") provides physiotherapy services to members of the public, including children and young people, at our clinic in Parnell, Auckland. This Privacy Policy explains what personal information we collect from you, why we collect it, how we use and store it, who we may share it with, and the rights you have in relation to it.

This policy applies to anyone who interacts with us as a patient, a prospective patient, or a visitor to our website, including parents and guardians who provide information on behalf of a child or young person in our care. It covers information collected in the clinic, over the phone, by email, through our online booking system, and through our website.

We take the privacy and confidentiality of your health information seriously. As a healthcare provider, we are bound not only by New Zealand privacy law but by our professional and ethical obligations as physiotherapists to handle your information responsibly and only for proper purposes.

Please also note that any information, advice, or exercise programme we provide is intended to support your care and is not a substitute for advice from your General Practitioner (GP) or other medical specialist, and we cannot guarantee particular clinical outcomes or results from treatment. This Privacy Policy deals only with how we handle your personal information; it does not form part of, and does not limit, any separate terms of treatment or consent you agree to with us.

2. Who We Are

The clinic responsible for your personal information is:

• Legal name: Ultra Health Physiotherapy Limited

• Business structure: Limited liability company (NZ registered company / NZBN 9429053549044)

• Registered clinic address: Suite 2, 7 Windsor Street, Parnell, Auckland, 1052, New Zealand

• Website: https://www.ultrahealthphysio.co.nz/

• Email: ultrahealthphysiotherapy@gmail.com

• Phone: 022 057 5554

Under the Privacy Act 2020, Ultra Health Physiotherapy Limited is the "agency" responsible for deciding how and why your personal information, including your health information, is collected, used, stored, and disclosed. This is the equivalent of what other privacy laws (such as the UK and EU GDPR) call a "data controller." Because we collect and hold health information about identifiable individuals, we are also a "health agency" for the purposes of the Health Information Privacy Code 2020, which sits alongside the Privacy Act 2020 and applies specifically to health information in New Zealand.

3. What Personal Data We Collect

Because physiotherapy assessment and treatment is a hands-on, clinical service, we need to collect a range of personal information to treat you safely and effectively, manage your appointments, and meet our legal and professional obligations. The categories of information we collect include:

Identity data

Your full name, date of birth, gender, and (where relevant, for patients under 18) the name and relationship of a parent or guardian.

Contact data

Your home address, email address, and phone number(s), and emergency contact details where you choose to provide them.

Health and clinical data

This is the most sensitive category of information we hold, and includes: your presenting complaint and injury history; relevant medical and surgical history; medications and allergies; details of previous treatment, including from other physiotherapists, doctors, or specialists; clinical notes, assessment findings, outcome measures, and treatment plans recorded during your physiotherapy consultations; images or video taken for the purpose of assessing movement, posture, or progress, where you have agreed to this; correspondence with your GP, referring practitioner, or other treatment providers; and, where relevant, ACC claim information (such as your claim number and injury details) or private health insurance details.

Financial data

Payment details needed to process your treatment fees, such as the amount charged, invoices, and receipts. We accept payment in clinic by card or cash. We do not store your full card number or card security code; card payments are processed through our in-clinic card payment terminal.

Technical data

When you visit our website or use our online booking system, we (or our service providers) may automatically collect technical information such as your IP address, browser type, device type, and how you interact with our website, as described further in the Cookies and Website Tracking section below.

Communications data

Records of your communications with us, including emails, phone calls, appointment booking and reminder messages, and any marketing communications you have agreed to receive.

4. How We Collect Your Data

We collect personal information from a number of sources, depending on how you interact with us:

• Directly from you, when you complete a new patient or intake form, speak with us in person or by phone, or attend a physiotherapy consultation.

• Through our online booking system, Nookal, when you book, reschedule, or cancel an appointment online, or complete any pre-appointment forms through that platform.

• From payment processing at the time you pay for treatment in clinic, by card or cash.

• From referral sources, such as your GP, specialist, ACC, or an insurance company, when they refer you to us or provide clinical information relevant to your care.

• From your interactions with our website, such as pages visited or forms submitted, and through cookies as described later in this policy.

• From any marketing sign-up or enquiry form you complete, if you choose to receive communications from us via our email marketing platform, GoHighLevel.

5. Why We Collect Your Data and Our Legal Basis

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, we may only collect personal information for a lawful purpose connected with a function or activity of our clinic, and the information must be necessary for that purpose. Health information, being particularly sensitive, is collected primarily so that we can provide you with safe, appropriate physiotherapy care, with your knowledge and, where required, your specific consent. The main purposes for which we collect and use your information, and the basis on which we do so, are set out below.

Providing clinical treatment

We collect and use your health information to assess your condition, plan and deliver physiotherapy treatment, and monitor your progress. This is collected directly from you (or, for patients under 18, from a parent or guardian) with your knowledge and consent, and is necessary for us to provide the healthcare service you have asked us to provide.

Booking and appointment management

We use your contact and identity data through Nookal to schedule, confirm, reschedule, and send reminders for your appointments. This is necessary to operate our clinic and to provide you with the service you have requested.

Processing payment

We use your financial data to charge and process fees for treatment provided, issue receipts, and maintain accurate financial records, as we are legally required to do for tax and accounting purposes.

Sending appointment reminders

We use your contact details to send appointment confirmations and reminders by text message and/or email, to help reduce missed appointments and support continuity of your care.

Compliance with legal obligations

We collect, retain, and, where required, disclose information to comply with our obligations under New Zealand law, including the Health (Retention of Health Information) Regulations 1996, our professional registration and conduct requirements as physiotherapists, and any lawful request from a regulator, ACC, or a court.

Marketing communications

Where you have opted in, we use your contact details through our email marketing platform, GoHighLevel, to send you information such as clinic news, health tips, and service updates. We only send marketing communications with your consent, and you may withdraw that consent and unsubscribe at any time, as explained further in the Marketing Communications section below. Marketing communications are always separate from, and will never be a condition of, receiving clinical treatment from us.

6. Who We Share Your Data With

We do not sell your personal information. We only share your information with third parties where it is necessary to provide your care, where you have asked us to, or where we are legally required to. The organisations and individuals we may share your information with are set out below.

Within our clinic

Ultra Health Physiotherapy Limited operates as a sole-practitioner clinic. Your clinical and personal information is accessed only by the treating physiotherapist (the practice owner) in the course of providing your care and running the clinic. We do not have other clinical or administrative staff with routine access to your file.

ACC (Accident Compensation Corporation)

If your treatment relates to an accident or injury covered under New Zealand's accident compensation scheme, we share relevant clinical and claim information with ACC as required to lodge, manage, and support your claim, and to be paid for treatment provided under that claim. This sharing is required by, and permitted under, the ACC legislative framework and the Health Information Privacy Code 2020.

Insurance companies

If you hold private health insurance and wish to claim the cost of treatment, we may share relevant clinical and billing information with your insurer, but only to the extent necessary to process your claim, and generally only with your knowledge or at your request.

Referral partners and your GP

Where appropriate for your ongoing care, we may share relevant clinical updates, assessment findings, or discharge information with your General Practitioner, the health professional who referred you to us, or another treatment provider involved in your care, such as a specialist you are also seeing. This is standard practice in multidisciplinary healthcare and supports continuity and safety of your treatment.

Nookal (online booking system)

We use Nookal to manage bookings, appointment records, and clinical notes. Nookal is a cloud-based practice management platform; as with any cloud software provider, we recommend confirming directly with Nookal exactly where your data is hosted and stored, and updating this section of the policy to reflect that once confirmed.

GoHighLevel (email marketing platform)

If you have opted in to marketing communications, your name and contact details are held in GoHighLevel, a customer relationship management and email marketing platform based in the United States. This means your information may be processed on servers located outside New Zealand. We only share the minimum information necessary (your name and email address, and/or phone number) for this purpose, and only for patients who have opted in.

Payment terminal provider

Card payments taken in clinic are processed through our card payment (EFTPOS) terminal provider Verifone. We do not store your full card details ourselves; these are handled directly by the terminal provider and your bank in line with standard card industry security requirements.

Regulators and legal requirements

We may disclose information where required by law, for example to the Physiotherapy Board of New Zealand, the Office of the Privacy Commissioner, or a court, or where disclosure is necessary to prevent a serious threat to someone's health or safety.

Some of the providers listed above, such as Nookal and GoHighLevel, may store or process information outside New Zealand. Where personal information is sent overseas, the Privacy Act 2020 requires us to take reasonable steps to ensure it will be subject to similar privacy protections as it would receive in New Zealand, for example by relying on the provider's own privacy and security commitments, or contractual protections where these are available. We recommend obtaining written confirmation of data handling and security practices from each provider and keeping this on file.

7. How Long We Keep Your Data

We keep your personal and clinical information for as long as necessary to provide your care, to meet our legal obligations, and to support any future treatment you may need with us.

Under the Health (Retention of Health Information) Regulations 1996, health information must generally be retained for a minimum of 10 years from the date of the last service provided to you. Ultra Health Physiotherapy Limited retains clinical records digitally for at least this minimum period. For patients who are under 18 at the time of treatment, as a matter of good practice we retain records for at least 10 years from the date of last treatment, or until the patient turns 25, whichever period is longer, so that records remain available if needed later in that person's life.

Financial and billing records are generally kept for at least 7 years, in line with standard New Zealand tax record-keeping requirements.

Once the applicable retention period has passed, we will securely delete or permanently de-identify your information, unless we are required or permitted by law to retain it for longer, or you have asked us to delete it sooner and we are able to do so consistently with our legal obligations.

8. How We Keep Your Data Safe

We take reasonable and appropriate steps to protect your personal information from loss, misuse, unauthorised access, and disclosure. Because our clinical records are held digitally, our safeguards include:

• Storing clinical records in Nookal, a password-protected, cloud-based clinical software system, rather than in unsecured paper files. Any paper files such as Client Consent Forms are uploaded to our cloud-based nookal system and then shreeded instantly and are not stored

• Restricting access to patient records to the treating physiotherapist, as Ultra Health Physiotherapy Limited operates as a sole-practitioner clinic with no other staff routinely accessing patient files.

• Using unique logins and passwords for our clinical, booking, and marketing software, and keeping these details confidential.

• Only sharing information with third parties (such as ACC, insurers, GPs, or referral partners) on a need-to-know basis and for the specific purpose described in this policy.

• Taking care when disposing of any information no longer needed, including secure deletion of digital records at the end of the applicable retention period.

• Reviewing our software providers' security and privacy practices, and seeking confirmation from providers such as Nookal and GoHighLevel about how they protect information they hold on our behalf.

No system can guarantee absolute security. If we become aware of a privacy breach involving your information that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and you, as required under Part 6 of the Privacy Act 2020.

9. Your Rights

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have a number of rights in relation to the personal information we hold about you. These rights, and how to exercise them, are explained below.

Right to access your information

You can ask us for a copy of the personal and health information we hold about you. In most cases we must respond within 20 working days, and we will not normally charge you for this. To make a request, contact us using the details in the Contact Us section below.

Right to correction

If you believe any information we hold about you is incorrect or out of date, you can ask us to correct it. If we do not agree that a correction is needed, you are entitled to have a statement of the requested correction attached to your record.

Right to know how your information is used and shared

You can ask us to explain how we use your information and who we share it with, beyond what is set out in this policy.

Right to raise concerns

If you are unhappy with how we have collected, used, stored, or shared your personal information, you have the right to raise this with us directly, and, if unresolved, to make a complaint to the Office of the Privacy Commissioner, as explained in the How to Make a Complaint section below.

Withdrawing consent

Where we rely on your consent, for example for marketing communications or for taking progress photos or videos, you can withdraw that consent at any time. This will not affect the lawfulness of anything we did with your information before you withdrew consent.

Please note that unlike some other countries' privacy laws, the Privacy Act 2020 does not currently give you a general right to have your information permanently deleted on request or transferred to another provider in a portable format. However, we are always happy to discuss any request you have about your information, and will do what we reasonably can within our legal obligations, including the minimum retention periods described above.

10. Children's Privacy

We provide physiotherapy treatment to patients under the age of 18. Where a patient is a child or young person, we collect personal and health information about them from, and with the consent of, their parent or legal guardian, unless the young person is able to understand and consent to their own treatment and the associated collection and use of their information.

Parents and guardians who complete intake forms or otherwise provide information on behalf of a child confirm that they are authorised to do so and to consent to their child's treatment. We will discuss any assessment findings, treatment plans, and progress with the parent or guardian, and will only share the young person's information in line with the same principles set out in the Who We Share Your Data With section above.

We take extra care with information collected from or about children and young people, and will not use it for any purpose other than providing their physiotherapy care, and, where a parent or guardian has separately opted in, sending appointment reminders and clinic communications relevant to that young person's care.

11. Marketing Communications

If you choose to opt in, for example by ticking a consent box on an intake or enquiry form, we will use GoHighLevel to send you occasional marketing communications, such as clinic updates, health and wellbeing tips, or information about our services.

We will only send you marketing communications if you have actively opted in, and every marketing email or message will include a simple way to unsubscribe. You can also unsubscribe at any time by contacting us directly using the details in the Contact Us section below. Withdrawing your consent to marketing will not affect any clinical treatment you receive from us, and will not affect essential clinical or appointment-related communications, such as booking confirmations and appointment reminders, which are sent separately from marketing and are necessary for the operation of your care.

12. Cookies and Website Tracking

Our website, https://www.ultrahealthphysio.co.nz/, may use cookies and similar tracking technologies. Cookies are small text files stored on your device that help a website function properly and help us understand how the website is used.

We use, or may use, cookies for purposes such as: enabling core website functionality, for example remembering your preferences as you browse; supporting our online booking system, Nookal, if it is embedded in or linked from our website; and understanding, in a general and aggregated way, how visitors use our website, so we can improve it over time.

Most web browsers allow you to control cookies through their settings, including blocking or deleting them, although doing so may affect how well some parts of our website work. We do not use cookies to make automated decisions about you, and we do not knowingly use cookies to serve you targeted advertising based on sensitive health information.

13. Changes to This Policy

We may update this Privacy Policy from time to time, for example if we change the software or service providers we use, if our services change, or if privacy law changes. Where we make a material change, one that meaningfully affects how we collect, use, or share your personal information, we will update the "Last Updated" date below and, where appropriate, take reasonable steps to bring the change to your attention, such as a notice on our website or at the clinic.

We encourage you to check this page from time to time so you are aware of how we protect your information.

14. How to Make a Complaint

If you have any concerns about how we have handled your personal information, we would like the opportunity to address this directly. Please contact us in the first instance using the details below, and we will do our best to resolve your concern promptly and fairly.

If you are not satisfied with our response, or you would prefer to raise the matter independently, you have the right to make a complaint to New Zealand's independent privacy regulator:

• Office of the Privacy Commissioner (OPC)

• Website: www.privacy.org.nz

• Phone: 0800 803 909

15. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise any of the rights described above, please contact us using the details below:

• Ultra Health Physiotherapy Limited

• Suite 2, 7 Windsor Street, Parnell, Auckland, 1052, New Zealand