Privacy policy

Allevia Radiology is a private health company and is subject to the Privacy Act 2020 and Health Information Privacy Code 2020.  

Allevia Radiology (we, us, our) takes its responsibility for your personal information very seriously and is committed to managing personal information in accordance with the Privacy Act 2020 (the Act).  

Personal information is any information about an identifiable individual (a natural person).

This policy does not limit or exclude any of your rights under the Act. If you wish to seek further information about the Act, or about privacy in general, visit www.privacy.org.nz.

This Website Privacy Policy applies to any personal information we collect or obtain about you when you interact with NZ Radiology Group (trading as Allevia Radiology) or any of our other businesses. It covers our websites and patient portals (together, the Website), our clinical services, and our other dealings with patients, referrers, suppliers, employees and applicants. 

The purpose of this policy is to set out the basis on which we collect, store, manage and share personal information, and the rights you have over it.

We may update this policy from time to time, with or without notice to you. When we do, we will publish an updated version on the Website.

Allevia Radiology recognises Te Tiriti o Waitangi and the principles of tino rangatiratanga, equity, active protection, options and partnership. We treat your information as a taonga and work to ensure that our privacy practices are accessible and culturally safe for Māori, Pacific peoples and all the communities we serve.

The personal information we collect varies with the kind of interaction you have with us, but may include:

• Identification and contact — full name (and preferred name), date of birth, address, phone, email, gender and pronouns where you choose to share them, and ethnicity (with your permission) so that we can monitor equity of care.
• Health and clinical — in order to receive radiology services from Allevia Radiology, you will need to provide certain personal and medical information, including the referral, your relevant medical history, your imaging and the resulting reports, and clinical correspondence with your other healthcare providers. This may include your National Health Index (NHI) number.
• Administrative and financial — appointment information, ACC and insurance information, billing details, payment history, and our communications with you.
• Employment-related — if you apply for a job with us, qualifications, work history, references and equity-related demographic information you choose to share. If we employ you, payroll, IRD, KiwiSaver and similar information.
• Website and digital — see section 11 (Website analytics) and section 13 (Cookies) below.
• Other personal information you provide to us, or authorise us to collect, as part of your interaction with us.

We collect personal information directly from you when you:

• contact us through one of our contact forms, our patient communications channel, our patient portal, social media, phone or email;
• subscribe to a newsletter or update list;
• book an appointment online or attend an appointment with us;
• complete patient registration, intake or screening forms;
• apply for a job with us; or
• interact with us as a referrer, supplier or partner.

From 1 May 2026, the Privacy Amendment Act 2025 introduces a new Information Privacy Principle 3A (IPP 3A) and an equivalent new Rule 3A in the Health Information Privacy Code 2020. These rules require us to take reasonable steps to make sure you are aware whenever we collect personal information about you from someone other than you (called “indirect collection”). This section is how we meet that obligation.
By accepting healthcare services from us, you agree that we may collect information about you from the agencies and sources listed below for the purpose of maintaining an up-to-date health record and providing safe, quality radiology care.

From other health agencies and shared health records

We may receive your information from:

• your referring clinician (e.g. GP, specialist, hospital doctor) including the original referral, clinical letters and laboratory or radiology results;
• hospitals, after-hours providers, emergency departments, specialist services, allied-health providers and other secondary or community-care providers — including discharge summaries, outpatient and specialist letters;
• authorised national or regional health-information systems and shared health records that allow us to check your medical history, prior imaging, laboratory results and current prescribing where these support your care;
• other radiology providers — for example, prior imaging accessed to provide a comparison;
• national screening programmes (such as BreastScreen Aotearoa) where applicable;
• contact we initiate with a hospital or specialist service to follow up on a referral or seek advice or an update on your care, where that contact results in information about you being shared with us; and
• approved health-information exchanges that operate in New Zealand.

From non-health agencies and organisations

We may receive your information from:

• the New Zealand Police, legal representatives, Oranga Tamariki, the Ministry of Social Development (Work and Income New Zealand), the Accident Compensation Corporation (ACC), and insurance companies;
• employers — for example, in relation to fitness-for-work imaging where you have consented; and
• other agencies where the law requires or authorises the disclosure to us.

If we receive information from a source not listed here

If we receive information about you from a source not described in this policy, we will take reasonable steps to notify you within a reasonable time, unless an exception applies (for example, where you are already aware, where the information is publicly available, where notification would prejudice your interests, where contacting you is not reasonably practicable, or where notification would create a serious threat to public health or safety).
 

We collect and use your personal information for purposes reasonably necessary to provide our services, including to:

• provide diagnostic imaging and other healthcare services you have requested;
• identify you accurately within the New Zealand health system (including using your NHI under HIPC Rule 12);
• produce, store and deliver your clinical reports and imaging;
• communicate with referring clinicians and others involved in your care;
• manage your appointments and our relationship with you;
• respond to enquiries you send us;
• send you information you have subscribed to, or that may be of interest to you;
• investigate complaints or requests you lodge with us;
• process your application if you apply for a job with us;
• let you know about new services, events, surveys or marketing communications from time to time, where you have consented or where the law allows;
• involve you in service-improvement activities;
• manage billing, ACC and debt-recovery functions;
• monitor and improve the quality and equity of our services;
• meet our regulatory and legal obligations; and
• for the purposes set out in any applicable terms and conditions between you and us.

We share personal information only as authorised by law, or with your consent. We may share information:

• with your referring clinician and other healthcare providers involved in your care;
• with hospitals and specialist services to whom you are referred or who refer you;
• with authorised health-sector agencies and national health-information systems where this supports your care;
• with ACC, insurers and other funders authorised to receive information for the purpose of paying for your care;
• with IT and clinical-system service providers under contract and with strict confidentiality controls;
• with our professional advisers (legal, accounting, audit), where reasonably necessary;
• where you have given us your prior authorisation, or as you instruct;
• to improve our cyber security measures or systems, or to help prevent or resolve fraud, money laundering, unauthorised access or attacks on our information technology systems, or other crimes;
• to comply with the law in New Zealand or in any relevant overseas jurisdiction; and
• to enforce or apply our rights, or to protect our organisation, our staff or our patients.

Complaints and legal matters

If you make a complaint about the care or services we provide, we may disclose relevant health information to our regulators, our insurers, our indemnity providers, or our legal advisers, for the purpose of managing and responding to the complaint. Where information is shared with our indemnifier in this context, we will use anonymised information wherever possible, removing patient-identifying details that are not required.

What we do not do

We do not sell your personal information. We do not share your imaging or reports for marketing or other purposes not outlined above.

The National Health Index (NHI) is a unique identifier used in the New Zealand health system to ensure accurate identification.

Where used, NHI information is handled in accordance with HIPC Rule 12 and Ministry of Health / Te Whatu Ora guidance.

We take all reasonable steps, and maintain the necessary processes and systems, to prevent unauthorised access to, or use of, the personal information we collect. Your personal information is held by, or on behalf of, Allevia Radiology at our offices in New Zealand and at the cloud providers and data centres we use.

Where Allevia Radiology transfers personal information outside New Zealand (for example, to offshore data centres), we take steps to ensure that those transfers are to third parties and/or countries with comparable safeguards, in accordance with Information Privacy Principle 12 of the Privacy Act 2020 and any other applicable privacy laws.

We will keep your personal information for as long as it may lawfully be used, and we keep your health information for at least the period required by the Health (Retention of Health Information) Regulations 1996 (a minimum of ten years from your date of last contact, longer where required).

Some of our imaging systems use artificial intelligence (AI) or automated analysis to assist our clinicians. Where AI is used, it supports — but does not replace — the clinical judgement of our radiologists, your imaging is reviewed by a qualified radiologist, and your information is processed securely. Our use of AI is governed under our internal AI Governance arrangements and follows the Royal Australian and New Zealand College of Radiologists (RANZCR) Ethical Principles for Artificial Intelligence in Medicine (2023) and Medical Council of New Zealand guidance.

Allevia Radiology collects non-identifiable information through your interactions with our information-technology systems, including through use of our websites. We use analytics to understand web traffic based on aggregated behaviour, demographic and interest data. The analytics collect statistical information about visits to the Website, including: 

• IP addresses (which are masked). 
• Search terms used. 
• Pages accessed from the Website, clicks on links, or engagement with content. 
• Dates and times at which the Website is accessed. 
• The referring site (if any) through which the Website is accessed. 
• Operating systems (e.g. Windows, Mac OS X) used to access the Website. 
• Web browsers used (e.g. Microsoft Internet Explorer or Edge, Google Chrome or Apple Safari). 

The data collected is aggregated and IP addresses are masked so that they cannot be used to identify specific individuals or their particular analytics. Analytics will also respect any “do not track” settings on user’s web browsers.

Our website may contain links to third-party websites operated by providers that are not associated with us. After you click the link, we no longer have any influence over the collection, storage, or processing of any personal data transmitted by clicking the link (such as the IP address or URL of the page that contains the link), as the behaviour of third parties is, by nature, beyond our control. Allevia Radiology is not responsible for the processing of personal data by third parties.

A cookie is a small piece of data stored on your computer or other device tied to non-personal information about you. We use cookies to refine and improve the way we provide information and services (for example, the layout of our Website or the types of information we provide). You can disable cookies in your web browser settings and/or delete them from your device. You do not need cookies turned on to use our Website, but some features may not function properly if cookies are disabled.

We use social media websites, like Facebook, Instagram, LinkedIn and YouTube, to communicate with the public about our work. If you interact with us on social media (for example, by posting on our Facebook page or liking our posts), you share your social media profile with us.  We only use this information to interact with you on social media. This information is collected from you by the relevant social media service and is governed by that service’s terms and privacy policy.

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the right to:

• Access the personal information we hold about you (Rule 6).
• Correct information you believe is wrong, or attach a statement of disagreement if we do not agree to make a change (Rule 7).
• Be informed about how your information is collected (directly and indirectly), used, stored and shared.
• Make a complaint about our privacy practices.

We will normally respond to a request for access or correction within 20 working days. There is no charge for the first request in any 12-month period; reasonable charges may apply to repeat or unusually large requests, in line with the Privacy Act 2020. We also take reasonable steps to ensure that the information we collect, use or share is accurate, complete and up to date — please let us know if you notice errors or if your details change.

To make a request, contact our Privacy Officer using the details below.

We take privacy breaches seriously. If a privacy breach occurs that has caused, or is likely to cause, you serious harm, we will:

• investigate and contain the incident;
• notify you and any other affected individuals as soon as practicable;
• notify the Office of the Privacy Commissioner; and
• take action to prevent recurrence.

This is required by the notifiable privacy breach provisions of the Privacy Act 2020.

You may contact us at any time if you have questions or concerns about this policy or about how your information has been handled. To make a privacy complaint, contact our Privacy Officer using the details below.

Our Privacy Officer will first consider whether there are simple or immediate steps that can resolve the complaint. We will generally respond within a week. If your complaint requires more detailed consideration or investigation, we will acknowledge receipt within a week and aim to complete our investigation promptly. We may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review documents, and speak with the people involved. In most cases we will investigate and respond within 30 days; if the matter is more complex, we will let you know.

If you are not satisfied with our response, or you consider we may have breached the Act, you can contact the Office of the Privacy Commissioner on 0800 803 909, via NotifyUs, or using the contact details on privacy.org.nz.

You can contact our Privacy Officer by email at [email protected].