White Rose Osteopathy complies with the New Zealand Privacy Act 2020 when dealing with personal information. Personal information is information about an identifiable individual.
This policy sets out how we collect, use, disclose and protect your personal information.
This policy does not limit or exclude any of your rights under the Act. If you wish to seek further information on the Act, see www.privacy.org.nz
CHANGES TO THIS POLICY
We may change this policy by uploading a revised policy onto our website. The change will apply from the date we upload the revised policy.
White Rose Osteopathy will collect personal information about you from:
White Rose Osteopathy may disclose your personal information to:
Via remote control access, password controlled.
White Rose Osteopathy will take reasonable steps to keep your personal information safe from loss, unauthorised activity, or other misuse.
Subject to certain grounds for refusal set out in the Act, you have the right to access your readily retrievable personal information that we hold and to request a correction to your personal information. Before you exercise this right, we will need evidence to confirm that you are the individual to whom the personal data relates.
If you choose to exercise your rights, emails us any time on clinic@whiterose.nz
While we take reasonable steps to maintain secure internet connections, if you provide us with personal information over the internet, the provision of that information is of your own risk. If you post your personal information on the website or facebook page please be aware that your post is publicly available.
If you have any questions about this privacy policy, our privacy practices or if you would like to request access to, or correction of, your personal information, you can contact us at clinic@whiterose.nz
The Privacy Act 2020 has 13 privacy principles that govern how you should collect, handle and use personal information.
You can only collect personal information if it is for a lawful purpose and the information is necessary for that purpose.
You should generally collect personal information directly from the person it is about. Because that will not always be possible, you can collect it from other people in certain situations for instance, if:
When you collect personal information, you must take reasonable steps to make sure that the person knows:
Sometimes there may be good reason for not letting a person know you are collecting their information – for example, if it would undermine the purpose of the collection, or if it is just not possible to tell them.
You may only collect personal information in ways that are lawful, fair and not unreasonably intrusive. Take particular care when collecting personal information from children and young people.
You must make sure that there are reasonable security safeguards in place to prevent loss, misuse or disclosure of personal information. This includes limits on employee browsing of other people’s information.
People have the right to ask you for access to their personal information . In most cases you have to promptly give them their information. Sometimes you may have good reason to refuse access. For example if releasing their information could:
A person has the right to ask an organisation or business to correct their information if they think it is wrong. Even if you do not agree that it needs correcting, you must take reasonable steps to attach a statement of correction to the information to show the person’s view.
Before using or disclosing personal information, you must take reasonable steps to make sure it is accurate, complete, relevant up to date and not misleading.
You must not keep personal information for longer than it is necessary.
You can generally only use personal information for the purpose you collected it. You may use it in another ways that are directly related to the original purpose, or you may use it another way if the person gives you permission, or in other limited circumstances.
You may only disclose personal information in limited circumstances. For example, if:
You can only send personal information to someone overseas if the information will be adequately protected. For example:
If there are not adequate protections in place, you can only send personal information overseas if the individual concerned gives you express permission, unless the purpose is to uphold or enforce the law or to avoid endangering someone’s health or safety.
A unique identifier is a number or code that identifies a person in your dealings with them, such as an IRD or drivers licence number. You can only assign your own unique identifier to individuals where necessary for operational functions. Generally you may not assign the same identifier as used by another organisation. If you assign a unique identifier to people, you must make sure that the risk of misuse (such as identity theft) is minimised.
