Privacy policy

Last updated: 23 January 2026

Menodoctor is a trading name of Dear Medical Ltd (NZBN 9429050627806), 6/33 Hairini Street, Hairini, Tauranga 3112, New Zealand ("we", "us", "our"). We are a health agency under the Privacy Act 2020 and the Health Information Privacy Code 2020 (HIPC). This policy explains how we collect, use, store, disclose and protect your personal and health information. We take your privacy seriously, particularly the sensitive health information you share with us.

The information we collect

Personal information: your name, date of birth, contact details, billing details, and account and payment information.

Health information: the information you provide in your pre-consultation questionnaire and during your care — your symptoms, medical and family history, medications, test and scan results, prescriptions, and the clinical notes and management plans our doctors create. This is sensitive information and is protected under the Health Information Privacy Code 2020.

Website information: when you use our website we (and Shopify) may collect device, browser and usage information through cookies and similar technologies. See "Cookies" below.

How we collect it

We collect information directly from you wherever possible — when you book, complete forms, or talk with us. With your authority, we may also receive information from your GP or other health providers (for example referral information), and we collect website information automatically.

How we use your information

• To provide your care — assessing your health, consulting with you, prescribing, ordering and interpreting tests, and creating your management plan and records.
• To communicate with you and your GP about your care.
• To take payment, issue invoices and manage your account.
• To meet our legal and professional obligations, including Medical Council requirements and health-record retention rules.
• To improve our services and, where you have agreed, to send you newsletters or updates (you can opt out at any time).

We will only use your health information for purposes connected with your care, or as otherwise permitted under the Health Information Privacy Code 2020.

How we use AI tools

We use artificial intelligence (AI) tools in the day-to-day running of our clinic — for example to help with scheduling and administration, to organise and summarise documents, and to help process forms and routine administrative tasks. These tools assist our team and improve efficiency; they do not make clinical decisions. All clinical decisions, prescriptions and advice are made and reviewed by our doctors, and our team reviews AI-generated output before it is relied on.

Where AI tools handle personal or health information, we limit the information used to what is necessary for the task, and we take reasonable steps to ensure the tools are subject to appropriate security and confidentiality protections and are used consistently with the Privacy Act 2020 and the Health Information Privacy Code 2020. We do not allow your identifiable health information to be used to train publicly available AI models. Your rights to access and correct your information (set out below) apply regardless of the tools we use.

How we store and protect it

Your clinical records are held in our secure patient management system. We hold financial and booking information in our practice and accounting systems. We take reasonable steps to keep your information safe from loss, misuse and unauthorised access, and we limit staff access to those who need it to do their job.

Some of our service providers (for example our website host Shopify, our payment processor Stripe, and our email, document and AI tools) store information on servers that may be located outside New Zealand. Where information is held overseas, we take reasonable steps to ensure it is protected by comparable privacy safeguards, as required by the Privacy Act 2020.

How long we keep it

We are required by law to keep your health information for at least 10 years from the date we last provided you with services (Health (Retention of Health Information) Regulations 1996). We may keep some information longer where there is a lawful reason to do so.

When we share it

We do not sell your information. We may share it:

• with your GP or other health providers involved in your care, with your authority;
• with pharmacies, to dispense your prescriptions;
• with laboratories, to process tests we order for you;
• with our service providers (such as Shopify, Stripe and our clinical, accounting and AI software) who handle information on our behalf under confidentiality obligations;
• where we are required or permitted to by law.
  

Health Information and Secure Processing

Because we handle sensitive health information, we hold ourselves to the strict standards of New Zealand’s Health Information Privacy Code 2020.

• Purpose-Bound Automation: To reduce clinical administration workload and ensure accuracy, we utilize secure automation and AI-assisted tools for tasks such as processing intake forms, appointment scheduling, and creating administrative summaries.

• Data Minimisation & Sovereignty: We restrict the data provided to these tools to the absolute minimum required to complete the task. Where cloud-based processing is required, it is configured exclusively within secure, onshore New Zealand cloud regions (AWS Auckland) and Australian cloud regions (AWS) with strict data processing agreements that contractually prohibit the vendor from using our data to train AI models.

• Local Processing: Where possible, we transition these administrative tasks to dedicated, encrypted in-house hardware, ensuring your patient data does not leave our local environment for the automated step.

• Human Oversight: These tools never replace a clinician's judgment. Every output generated or automated entry made is reviewed and verified by a team member.

• Your Choices: Consumer-facing, open AI models are strictly blocked from accessing patient information. If you prefer that AI-assisted documentation or administrative tools not be used in relation to your care, you have the right to opt out at any time by notifying our team or your clinician.

Your rights

Under the Privacy Act 2020 and the Health Information Privacy Code 2020 you have the right to ask for a copy of the information we hold about you, and to ask us to correct it if it is wrong. To make a request, contact our Privacy Officer (below). We will respond as soon as reasonably practicable, and within 20 working days. There is generally no charge for accessing your own health information.

Cookies and website analytics

Our website uses cookies and similar technologies to make the site work, remember your preferences, and understand how the site is used. You can control cookies through your browser settings and through the cookie banner on our site. Some marketing cookies are only used with your consent.

Marketing

If you have opted in, we may send you newsletters or updates by email. Every marketing email includes an unsubscribe link, and you can opt out at any time. Opting out of marketing does not affect communications about your care.

Complaints and contact

If you have a question or concern about your privacy, please contact our Privacy Officer through our contact form, or call 07 242 4600.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner on 0800 803 909 or at privacy.org.nz. Concerns about access to your health records can also be raised with the Privacy Commissioner.

Changes to this policy

We may update this policy from time to time. The current version is always available on this page.