Terms of Use of Services for General Practitioners Privacy Notice Terms of Use Privacy Policy
Back to all policies

Privacy Notice

Konnect NET Privacy Notice
Our team is committed to privacy standards that protect, support and empower the privacy rights of New Zealanders. Below we have provided a summary of how we integrate this philosophy into our service design and delivery.

Our privacy protocols
Our suite of services is built on a desire to ensure that health information / service requests are done so in a way that protects the privacy of the individuals involved. We’re consumers of health services too, and we would want our information to be treated respectfully – so we apply that same standard to our processes.
Here we have provided you with some additional specifics regarding how we ensure your personal information is treated in accordance with NZ privacy legislation.

Privacy principle Our approach
Principle 1 – Purpose for collection Our business purpose is to enable the secure exchange of health information between the health sector and authorised organisations involved in healthcare, such as ACC, Veteran’s Affairs NZ, and insurance companies.
Our focus is on making these processes fast, easy, and secure. We do this by integrating into health provider systems and processes. We only let organisations use our service where they have informed consent from their clients.
Examples of some secure transactions we enable are: an insurer requesting medical notes from a GP assessing an insurance application; or a case manager requesting an assessment and report from a physiotherapist. Medical notes can include information covering: consultations, tests, therapies and treatments, health metrics, medications, diagnoses and referrals.
Information collected by authorised companies through our solution can only be used for the original purpose it was consented for.
We also capture product improvement data when authorised organisations and health providers use our solution. This data does not contain personal information and is used for purposes of issue resolution, service delivery, and product improvement.
Principle 2 – Source of information Our service exists for situations where the personal information required for the authorised organisation’s business purpose cannot be collected directly from the individual (e.g. getting detailed medical history or performing a medical exam).
Principle 3 – what to tell an individual Through our contracts and business processes we ensure that when organisations use our service, they have obtained sufficient informed consent from their clients. This includes being clear about what information will be collected, who will access it, whether it is voluntary, what will happen if the info isn’t collected, and what purpose this collection is enabling.
Principle 4 – Manner of collection We ensure that information exchanges through our solution are done so in a way that is respectful towards clients.
Principle 5 – Storage and security We have strong technology and processes in place that ensure only those individuals necessary to perform our authorised business purpose can access personal information.
One critical measure we take to protect health information is to encrypt it in our secure vault. This means that we cannot view it, and it can only be accessed by organisations that have received informed consent for seeing that information.Our system keeps a record of when the authorised organisation accesses the information through our solution, the individual’s name, and their reason for access.
Principle 6 – Access;

Principle 7 – Correction; and

Principle 8 – Accuracy

 We fully support an individual’s right to request a copy of their personal information that we hold, and we will do what we can under the Privacy Act to enable this in a respectful and speedy way.

We will first do a system check to identify what personal information we have on file.
Following that, the Privacy Act requires us to take reasonable efforts to ensure that releasing this information will not cause harm to anyone at all. For this part of this process, we might do a quick check with the doctor who provided the information, and we will also potentially speak with the agency that has requested the copy of the information in the first place.
Please note that in most cases we will have already deleted personal information collected by us; and in cases where we haven’t deleted the information, any medical information will be encrypted and thus inaccessible by us. That said, any information securely delivered through our platform should be available from the organization that shared it via our solution.

Where possible we are happy to correct any information that is inaccurate. We also take reasonable steps to ensure that the info we receive is accurate. This relates only to personal details (e.g. surname, or date of birth) that are used by the health providers to identify you. If we see a potential error in these (e.g. we might spot a possible typo in a common surname) we will confirm first with the requesting organisation.
Principle 9 – Retention We aim to delete personal and health information from our system as quickly as we can. We have invested in our technology to apply rules that automatically delete health information within days of it being accessed by the authorised organisation; or automatically delete the information if it hasn’t been accessed at all within about 60 days. We also delete personal information from the transactions (such as name, DOB, contact details). Some personal information (name, DOB) is kept in our finance system for auditing purposes, however no other details (especially health information) is retained.
Note that after deletion the information exchanged through our system can still be accessed from the person that sent it (e.g. your GP will have a copy in their practice mgmt. system).
Principle 10 – Use Our purpose is to allow health information to be exchanged securely and quickly. We don’t actually use or access the health info ourselves – our job is to enable the smooth and secure transfer, and the delete it once delivered successfully to the authorised organisation.
Additional personal information is used to help health providers confirm that the request relates to you, and by requesting agencies to ensure info is matched to the right person. We delete this information once the transaction is complete.
Additionally, we have built a full audit capability into our solution, such that every time your health information gets accessed in our solution by the requesting organisation, we record who it was, the time, and the reason for their access.
Principle 11 – Disclosure Information we gather through our service delivery is only accessible from our service by those authorised to access it.
For example, if an individual has provided consent for an insurer to request medical notes to assess a policy application, only the people in that insurance company who are involved in that policy assessment process can see that medical information; whereas the insurance advisor who sold the policy might be able to see there is a request for that individual’s information via our service, but not access or view the actual medical information.
Principle 12 – Disclosure of personal information outside of NZ We do not make any disclosures of personal information to offshore entities.
Principle 13 – Unique identifiers We do not assign a unique identifier to individuals.
V2.0 April 2023

Please contact us at privacy@konnectnet.com if you have any questions.