How will we use your information?
In providing you with a product or service, we may sometimes need to disclose your personal information to others. It is generally our policy not to disclose information to external organisations. However, examples of the types of organisations we may need to disclose information to in the course of providing a product, service, or offer are: mailing houses for bulk mailing of letters and notices; and other service providers.
Those contracted and commercial parties are not authorised by us to use personal information for anything other than the purpose for which we supplied that information to them or when our commercial arrangements with these parties end.
Sometimes, the law requires us to disclose personal information. We may also disclose personal information
where the individual consents to us doing so. That consent may be written, verbal or implied by your conduct. By providing your email address and/or mobile phone number, you consent to us sending you information connected with the above collection and use purposes via email or text message. The messages you receive from us will have instructions about how you can remove yourself from our mailing list if you wish. From time to time, we (or our commercial partners) may use personal information to inform our clients about our, and our commercial partners’, products and services, or about special offers and promotions that we think may be of interest to you. You can let us know at any time if you no longer wish to receive marketing materials (by contacting us by any of the means set out below) and we will remove your details from our direct marketing database. We may also use your information to improve the services and products offered to clients and to target our marketing of these products and services.
OVERSEAS DISCLOSURE OF INFORMATION
Some of our commercial partners, hearing aid manufacturers, cloud service providers, and third-party remote care platforms may be located overseas or may store or process personal information outside New Zealand. Countries where your information may be disclosed, stored, or processed include [list key countries e.g., Australia, USA, EU member states, etc.].
When we disclose personal information to foreign entities, we comply with Information Privacy Principle 12 and Rule 12 of the Health Information Privacy Code 2020 by ensuring that:
- The recipient is subject to privacy laws that overall provides comparable safeguards to New Zealand’s Privacy Act 2020, or
- We have contractual protections in place requiring the recipient to handle your information in accordance with New Zealand privacy principles, or
- You have expressly consented to the overseas disclosure after being informed of the potential privacy implications.
- Before disclosing your information overseas, we conduct due diligence to assess whether the foreign recipient’s privacy framework provides adequate protection.
If you opt in to third-party remote care services, you will be required to agree to the third party’s privacy policy, which governs how they handle your information. We ensure our commercial partners who receive your information are contractually required to protect it appropriately.
If you provide us with an indication of your consent to disclose, share or use your personal information in connection with a third party, we may disclose, share or use your personal information in that manner. For example, if you opt in to e-Health Remote Care with a particular third-party, then we may disclose your relevant personal information to the Third-Party Remote Care Platform for the purposes of adding you to this service. Generally, in such a situation, the third party (usually a hearing aid manufacturer) is not allowed to use your personal information for their purposes, unless they have your express permission. Third-party remote care providers generally require you to agree to their own privacy policies before you are able to use the associated applications, in which case your personal information will be used in accordance with the Third-Party Providers Privacy policy.
Information will only be used or disclosed for the purpose for which it was collected, or directly related purposes. Generally, health information cannot be shared without your express authorisation. Below are some limitations and exceptions to disclosure:
- Purpose Limitation: Serious Threat Exception: Information can be disclosed to avoid a serious and imminent threat to public health, safety, or the life/health of the individual or others.
-
Legal Obligation: Disclosure is permitted if required by law, such as for court proceedings or to police in specific circumstances.
-
Representative Access (Section 22F): A representative (e.g., family) can request information, but it may be refused if it violates the patient’s wishes, is not in their best interest, or breaches another person’s privacy.
-
Minor’s Privacy: For children, requests by parents/guardians may be denied if it conflicts with the child’s best interests or if the child has expressed wishes to keep information private.
-
Publicly Available: Information already in the public domain may be disclosed if it is not unfair or unreasonable.
-
De-identified Data: Information may be used if the individual cannot be identified.
Except as stated in this Privacy Policy, SoundWave Audiology does not disclose personal information to organisations outside SoundWave Audiology. We may join with other business associates of SoundWave Audiology in joint marketing of our respective products and services to clients. We may also need to use and disclose your information to improve our services, if we are selling our business, to assist law enforcement agencies or if we are compelled to under law.
Data Retention:
New Zealand’s Health (Retention of Health Information) Regulations 1996 require health providers to retain health information for a minimum of 10 years from the day after the last service was provided. In complex paediatric cases, we may retain these records for more than 10 years. In most cases, the records we keep are electronic and will be destroyed as set out below:
Electronic data will be destroyed by clearing (using software to overwrite), purging (degassing), or physically breaking down hardware (pulverising, melting, or incinerating). Destruction will cover all electronic media, including hard drives, servers, cloud storage, back-up tapes, and portable devices like USB’s.
Any paper records being destroyed will be cross-cut shredded.
