Legal

Privacy Policy

How we collect, use, and protect your personal and health information.

Last updated: May 2026  |  Applies to: House of Rehab Physiotherapy, 8A Ryedale Road, Flagstaff, Hamilton 3210, New Zealand

House of Rehab Physiotherapy is committed to protecting your privacy. We collect and handle personal information in accordance with the Privacy Act 2020 (NZ) and the Health Information Privacy Code 2020. This policy explains what information we collect, why we collect it, how we use it, and your rights.

1. Who We Are

House of Rehab Physiotherapy is a registered physiotherapy practice operating at 8A Ryedale Road, Flagstaff, Hamilton 3210, New Zealand. We are an ACC Registered Provider. For privacy enquiries, contact us at hello@houseofrehab.co.nz.

2. What Information We Collect

Personal information

  • Full name, date of birth, gender
  • Contact details — address, phone number, email
  • Emergency contact name and number
  • Occupation (relevant to injury and ACC claims)

Health information

  • Current and past medical history
  • Medications and allergies
  • Details of your injury and symptoms
  • Clinical notes from consultations (SOAP notes, assessment findings, treatment plans)
  • Strength and performance testing data (e.g. VALD ForceDecks and Dynamo results)
  • Exercise programmes and rehabilitation progress records
  • Referral letters and correspondence with other health providers
  • Imaging reports or other diagnostic information you provide

ACC information

  • ACC claim number and claim status
  • Information required by ACC for claim lodgement, treatment reports, and invoicing

Website and booking information

  • Appointment booking details
  • Patient registration form submissions
  • General enquiries submitted via email or contact form

Payment information

  • Card details are collected and held by our payment provider, not by House of Rehab. We never see or store your full card number.
  • We retain only a secure token supplied by the provider, along with the card type and last four digits, so that we can charge the balance of your treatment costs after your appointment and issue refunds where they are due.
  • Records of amounts charged, refunded and outstanding.

Our payment provider is [PROVIDER — Patrick to confirm], which stores payment data [LOCATION — Patrick to confirm]. Because this may involve your information being held outside New Zealand, we rely on the provider's contractual protections as required by information privacy principle 12 of the Privacy Act 2020.

Your stored card token is deleted [RETENTION PERIOD — Patrick to confirm] after your last appointment, or sooner if you ask us to remove it. Removing it does not affect your access to care — we will simply take payment in clinic instead.

3. Why We Collect Your Information

We collect this information to:

  • Provide safe, appropriate physiotherapy treatment
  • Communicate your treatment plan and progress to you
  • Lodge and manage ACC claims on your behalf
  • Coordinate care with other health providers (e.g. GPs, specialists, surgeons) where relevant
  • Invoice for services and process payments
  • Meet our legal and professional obligations as registered physiotherapists
  • Contact you about appointments, follow-ups, or changes to your care

We only collect information that is necessary for these purposes. You are not required to provide personal information to visit our website, but we cannot provide clinical services without it.

4. How We Store and Protect Your Information

Your clinical records are stored securely in our practice management system, which uses encrypted storage and access controls. Paper documents (where used) are stored in locked files. We take reasonable steps to protect your information from unauthorised access, loss, or disclosure.

We retain clinical records for a minimum of 10 years from your last consultation, as required by the Health (Retention of Health Information) Regulations 1996. ACC-related records may be retained longer in accordance with ACC requirements.

5. Who We Share Your Information With

We do not sell or rent your information. We may share your information only in the following circumstances:

  • ACC: We are required to provide treatment records, progress reports, and invoices to ACC as part of the claims process.
  • Other treating health providers: With your consent, we may share clinical information with your GP, specialist, or other health providers to coordinate your care.
  • Practice management software providers: Our booking and records systems are operated by third-party providers who are bound by confidentiality obligations.
  • Legal or regulatory requirements: We may disclose information if required by law, a court order, or a regulatory body (e.g. the Physiotherapy Board of New Zealand).

We will always tell you if we need to share your information in a way not described above, unless we are legally prevented from doing so.

6. Your Rights Under the Privacy Act 2020

You have the right to:

  • Access the personal information we hold about you
  • Request correction of any information that is inaccurate or incomplete
  • Withdraw consent for any use of your information that is not required for treatment or ACC purposes
  • Make a complaint about how we have handled your information

To exercise any of these rights, contact us at hello@houseofrehab.co.nz. We will respond within 20 working days, as required by the Privacy Act 2020.

7. Complaints

If you believe we have not handled your information appropriately, please contact us in the first instance. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner:

8. Website Cookies and Analytics

Our website may use basic analytics tools (such as Google Analytics) to understand how visitors use the site. This data is aggregated and does not identify you personally. You can disable cookies in your browser settings if you prefer.

9. Changes to This Policy

We may update this privacy policy from time to time. The current version will always be available on this page, with the date of the most recent update shown at the top.

10. Contact Us

For any privacy-related questions or requests: