Privacy Information

Privacy notification — collection of your personal and health information

Canopy Cancer Care (we, us, our, trading as Canopy Cancer Care) is part of the Canopy Healthcare Group Limited. We collect personal information and health information about you in connection with oncology or haematology we provide. This notice explains what we collect, where we collect it from, how we use it and who we may share it with, and the rights you have. We handle your information in accordance with the Privacy Act 2020 (the Act), the Health Information Privacy Code 2020 (the Code) and the Health (Retention of Health Information) Regulations 1996.

Who we are and how to contact us 
Canopy Cancer Care is the agency responsible for the information we collect, hold and use about you. If you have any questions about this notice or how we handle your information, please contact our Privacy Officer:

• Privacy Officer: Chris Caradus
• Email: [email protected]
• Phone: 021 627 008
• Post: PO BOX 90022, Victoria St West, Auckland 1142

Where we collect your information from
We collect your information directly from you wherever reasonably practicable — for example, when you book an appointment, complete a registration form, attend a consultation, or contact us by phone, email or through our website. We also receive information about you indirectly from other sources, including:

• Your referring doctor or other treating clinicians (e.g. general practitioners, specialists)
• Other healthcare providers involved in your care, including public hospitals and Health NZ | Te Whatu Ora
• Shared health information systems and clinical portals (for example Testsafe, the National Health Index, and other connected radiology, laboratory and electronic health record platforms)
• Your family, whānau or authorised representative, where you have consented or it is necessary in the circumstances
• Your health insurer, ACC or other funder
• Pathology, imaging and other diagnostic service providers
• Sponsors or administrators of patient access, cost-share or compassionate-use programmes for medicines or therapies, where you participate in such a programme
• Accreditation bodies and auditors, in the limited circumstances described below

What we collect and why we collect it
We collect only the personal information and health information that is reasonably necessary to:

• Plan, coordinate, deliver and follow up your oncology or haematology treatment
• Communicate with you, your family or whānau where appropriate, and the clinicians involved in your care
• Bill for services and process any funding, insurance or ACC claim
• Meet our quality, accreditation, audit, training, regulatory and statutory obligations
• Improve our services through anonymised quality improvement and clinical audit activities

The information we collect includes your contact and demographic details, National Health Index number, next of kin and emergency contact, presenting complaint, clinical history, examination findings, diagnostic and imaging results, medical images, treatments and outcomes, and any relevant social or insurance information.

Indirect collection — what we tell you when we receive your information from someone else
Where we collect your information from a source other than you (for example, from your referring doctor, from a shared health record, or from your insurer), we take reasonable steps to make sure you are aware of:

   (a) The fact that we have collected the information
   (b) The purpose for which we have collected it
   (c) The source from which it has been collected
   (d) The intended recipients of the information (see "Who we share information with" below)
   (e) Our name and contact details as the agency holding the information
   (f) Whether the supply of the information is authorised or required by law
   (g) Your rights of access to, and correction of, the information we hold about you

We will rely on the exceptions in IPP3A of the Act and Rule 3A of the Code where one of those exceptions applies — for example, where you are already aware of these matters, where notifying you would prejudice the purposes of collection or the interests of the individual, where it is not reasonably practicable to notify you in the circumstances, or where notification would prejudice the maintenance of the law or the safety of any person.

How we use your information
We will only use or disclose your personal and health information:

• For the purpose for which it was collected, or a directly related purpose
• For any other purpose for which you have authorised us
• Otherwise, where we are permitted or required to do so by law

Who we share information with
We share your information, on a need-to-know basis and only for purposes connected with your care, with:

• The medical practitioners involved in your care, including your referrer and any specialists, allied health professionals or hospitals to whom you are referred
  Shared health information systems, including Testsafe, Health NZ | Te Whatu Ora, and other secure clinical portals
• Health Insurance Providers and ACC, where treatment is funded in whole or part by them
• Sponsors or administrators of patient access programmes for medicines or therapies, with your consent
• Other non-government agencies such as hospice or support services, where relevant to your care
• If you make a complaint about the care or services we provide, we may disclose relevant health information to our insurers, indemnity providers, or legal advisers for the purpose of managing and responding to the complaint.
• External auditors and accreditation bodies, as permitted under Rule 11 of the Code

Your information may be transferred overseas for purposes outlined in this notice, including for quality audit, image storage or second opinions. Where this occurs, we take reasonable steps to ensure the receiving organisation is subject to privacy laws or contractual obligations that provide comparable safeguards to those under the Act. Where we cannot reasonably establish that a recipient organisation is subject to comparable safeguards through their privacy laws or contractual arrangements, we will seek your authorisation before disclosing your information to them. You should be aware that these recipients may not be required to protect your personal information to the same standard as New Zealand law requires, and you may not have the same rights or remedies available to you as you would under New Zealand law. You should also be aware that information held overseas may, in some circumstances, be subject to lawful access requests by the courts, governments, law-enforcement or national-security authorities of the countries in which it is held, under the laws of those countries.

Research, audit and quality improvement
From time to time we may take part in minimal-risk research studies or conduct clinical audits. Where we do, the use and disclosure of your information is subject to a separate ethics approval process and, wherever possible, we use only anonymous or de-identified information.

Artificial intelligence (AI)
Artificial intelligence tools are used in our practice to assist with scheduling and prioritisation, image reconstruction, transcription of clinical documentation, and to support clinical decision-making. When AI is used in connection with diagnosis or treatment, a healthcare professional will always be involved in the final clinical decision. Some of these AI tools are provided by third-party suppliers, and the processing they perform may take place outside New Zealand. Where this occurs, we apply the same overseas-transfer safeguards described above, and a healthcare professional remains responsible for any clinical decision.

How we store and protect your information
Your information is stored on secure, password-protected systems with audited access. We use a combination of New Zealand-based and approved overseas cloud services for the storage and processing of images and data, and we hold all suppliers to security standards consistent with the Act and the Code. Some of the systems we use to store and process your information — including our patient management system and certain image-analysis services — are hosted outside New Zealand, including in Australia and the United Kingdom or European Union. Where your information is held or processed overseas, we take reasonable steps to ensure the provider is bound by privacy obligations comparable to those under the Act and the Code, through their local privacy laws or our contracts with them. Our suppliers may in turn rely on their own service providers (for example, cloud-hosting providers) to deliver their services. Where they do, we require comparable privacy and security safeguards to apply throughout that supply chain. We retain your health records for a minimum of 10 years and one day from the date of your last consultation or service, as required by the Health (Retention of Health Information) Regulations 1996. Other records are retained only for as long as necessary for the lawful purposes for which we collected them and in line with our retention policy.

Your rights
Under Rule 6 of the Code and IPP6 of the Act, you have the right to ask us:

• Whether we hold information about you
• To access the information we hold about you
• To correct the information we hold if you believe it is wrong or incomplete. Our medical record systems are designed to preserve the integrity of the medical record, so it may be impossible for us to modify some records (e.g. clinical notes, radiology reports). In those situations, we can add a “statement of correction” to the medical record.

You can also ask us to restrict the way we collect or share your information. Please note that doing so may affect our ability to provide some services and, in an emergency, may have unintended clinical consequences.

Voluntary provision and consequences of not providing information
You are not required to provide your personal or health information to us. However, if you choose not to provide information that we reasonably need, we may not be able to provide some or all of our services to you.

How to contact us, and how to complain
If you have any questions about how we collect or handle your information, or if you wish to exercise any of the rights above, please contact our Privacy Officer at [email protected] or 021 627 008. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner on 0800 803 909, or at www.privacy.org.nz.

Updates to this notice
We may update this notice from time to time to reflect changes in our services or in the law. The date of the last update appears at the top of the published version of this notice on our website.

Last updated: 09 September 2026 – Version 3