Pacific Health Group (PHG)’s Privacy Statement

Pacific Health Group (PHG) supports people in their communities to optimise health and live their best lives.

As a health care provider, we collect, use, and disclose personal and health information about our customers and clients in order to deliver health care services, and information about our contractors, suppliers, and employees in the performance of our business activities.

This privacy statement applies to PHG, its subsidiaries, and related companies that do not maintain their own privacy statement, and to anyone acting on our behalf.

Some entities within the Pacific Health Group (PHG) group (such as Habit Health) maintain their own Privacy Statement, which will apply when you engage directly with those entities.

It explains how we collect, use, store, disclose, update, and securely destroy individuals' personal information in accordance with New Zealand privacy laws, including the Privacy Act 2020, and, where applicable, the Health Information Privacy Code 2020.

You may be reading this Privacy Statement because you have visited one of our websites, mobile apps, social media profiles, or any other online service operated by PHG (together “PHG”, “us” or “we”), or because you have contacted us directly or used one of our services.

We respect the confidentiality of our clients' personal information and take privacy seriously. This statement sets out:

• Types of personal information we collect
• How we collect information
• How we use personal information
• Who we share personal information with 
• How to request access to your personal information 
• How to request the correction of your personal information 
• How to make a complaint
• How we treat other information we collect that is not personal information

PHG is committed to handling personal information fairly, lawfully and transparently in accordance with applicable New Zealand legislation and privacy guidelines. This Privacy Statement will be made available to anyone who asks for it. 

What is personal information?

Personal Information is any information about an identifiable individual. 

Types of Personal Information We Collect

The type of personal information we collect will depend on the business purpose activity, funding type, and/or services for which you have engaged with PHG. We will not collect personal information about you unless that information is necessary for one or more of our functions or activities.

Personal information collected by us may include: 

• Contact information – name, date of birth, address, email address, phone numbers, next of kin/emergency information, membership details.   
• Unique identifiers – an identifier assigned to an individual by another agency such as ACC claim numbers, NHI numbers, employee numbers etc.  
• Employment information – employment history, work performance.
• Financial information – bank account details. 
• Health information – medical history necessary for safe, effective healthcare delivery. 
• Client and business relationship data – including feedback and opinions  

Why We Collect and Use Your Personal and Health Information

We may collect your personal information and health information to:

· Confirm the identity of our clients and people we communicate with for business.

· Deliver safe and complete clinical and support services.

· Obtain payment for our services

· Enable secure access to our online services and communication.

· Improve service quality through feedback and evaluation.

· Inform you about relevant services and updates.

· Comply with legal, contractual, and professional obligations.

· Provide services and business activities associated with:

• • Injury Rehabilitation and Assessment
  • Psychology and Counselling
  • Employee Assistance Programmes (EAP)
  • Disruptive Event Management
  • Health and Wellbeing services
  • Workplace Assessments and Education
  • Occupational Health and Safety Services
  • Employment and Career Services
  • HR Consulting and Organisational Development
  • Health, Fitness, Diet, and Nutrition

We may also collect your personal information to provide confidential, de-identified reporting on organisational trends relating to the health and wellbeing services we provide. All reasonable steps will be taken to ensure individuals are not identifiable from such reporting.

How We Collect Your Information

We generally collect personal information directly from you, unless you authorise the collection from another party. Collection of information will be conducted fairly, through lawful means, and will not intrude unreasonably into your personal affairs.

Collection methods include:

• In-person or over-the-phone communication.
• Online forms or via our app.
• Email or website inquiries.
• Employer referrals.

You’ll be informed of the purpose for collection, how we’ll handle and protect your information, and your options. If you choose not to provide personal information, we may not be able to provide the appropriate services you seek or require.

We also collect contact and professional information from contractors, suppliers, employees, and other parties we interact with for purposes under the same privacy standards.

Collecting Information from Other Sources

We may collect your information from other sources if: 

• You have authorised us to do so.
• You have authorised a third party to share information with us (e.g., as part of your rehabilitation or pre-employment assessment (ACC, third party insurers, other rehabilitation providers).
• The information will not be used in a form that identifies you.
• The Privacy Commissioner has authorised the collection of information in this manner.

Providing Personal Information About Others

If you give us someone else’s personal information, you must ensure you have the right to do so and that the person is aware of:

• Our identity and contact details
• Our purposes for collecting their personal information and our disclosure practices
• Their rights to access and correct their information

Phone Call Recordings

We may record calls to:

• Support staff training and service improvements
• Record enquiry types and volumes
• Maintain accurate records of calls
• Protect our people from abusive behaviour

Callers will be informed by an automated message when recording occurs.

CCTV Use

CCTV is in use in areas such as entrances, reception, and public spaces to help keep our clients, visitors, and staff safe. Where safety concerns arise, footage may be shared with appropriate authorities (such as NZ Police).

Mailing lists

When you register for one of our services, you may be added to our mailing list for relevant service updates and information. You may unsubscribe anytime using the links at the bottom of our newsletter.

Automatically Collected Website Information

When you visit our websites, we may automatically collect:

• IP address, browser type, OS, date/time of visit
• Usage data through cookies, pixels, and tracking tools (e.g., Google Analytics)

These technologies help us customise content and improve your experience.

More information about how cookies work, how Google uses your data and how you can opt out is available on the Google website here.

You can manage your preference via browser settings.

Continued website use is considered consent for this tracking unless you opt out.

Sharing and Disclosing Personal Information

We only share your information for the purpose it was collected, with your authorisation, or as legally required. This may include: 

• Disclosures related to your care or service use
• With your authorised health practitioners
• PHG related companies and staff
• Personal advisors (e.g., lawyers, accountants)
• Government or third-party service partners (such as ACC, MSD, Apex NZ) in relation to carrying out the service you've requested

We may share de-identify data with external and internal parties for analysis, reporting or service improvement.

We will not disclose your personal information to parties outside of New Zealand unless we ensure they provide comparable safeguards under IPP 12.

Keeping Your Information Secure

PHG stores data securely in specialised software in the cloud or secure server environments. Only authorised personal can access your information, and only for approved purposes. Identity verification is required before information is shared.

We take reasonable steps to destroy or permanently de-identify information when it is no longer needed.

How long We Keep Your Information

We follow all relevant legislation regarding retention. For example, health information must be retained for at least 10 years from the last date of service per the Health (Retention of Health Information) Regulations 1996.

How To Request Access to or Correction of Your Personal Information.

You have the right to:

• Request access to personal information we hold about you; and
• Request correction of any information you believe is incorrect or incomplete.

Please use the contact details for the organisation you interact with:

If you’re unsure which organisation to contact, you can email our Privacy Officer at qualityteam@phg.co.nz, and we will direct your request to the right place.

We will acknowledge your requests within 5 working days and respond to the request within 20 working days. If your request is urgent, please include the reasons and required timeframe in your request, and all efforts will be made to meet this timeframe.

In limited situations, an access request may be denied, or restricted access given. We will provide reasons in writing for any refusal or limitation of access (e.g., due to serious harm risk, legal proceedings) along with information on how to complain.

If we confirm information, we hold about you is factually incorrect, we will;

• Update the information on your file.
• Send the corrected information to any third party who may have received the incorrect information.
• Let you know we’ve made the change.

If we cannot make the change you requested (for example, where information is opinion based such as clinical or medical assessment) we’ll provide a written explanation on why and offer to attach a correction statement to your file.

Complaints or Privacy Concerns

We take privacy seriously and encourage you to raise any concerns with us first.

You can view our complaints management process here.

You can raise concerns or complaints by contacting your service provider directly or contacting the relevant entity below:

We will acknowledge your complaint within 5 working days and aim to resolve it within 10 working days after the complaint is received. If we cannot conclude the complaint within this timeframe, we will provide you with information on how long we think it will take to investigate and respond to it and keep you updated regularly.

If you are not satisfied with the response or the outcome of the complaint, you can lodge a complaint with the Office of the Privacy Commissioner here.

Updates to This Privacy Statement

We may amend or update this Privacy Statement occasionally with or without notice to you.

This privacy statement was last updated on 12/09/2025.