Privacy Policies For Allied Health Booking Apps

Do you need a privacy policy before your allied health booking app starts taking patient details? Yes, and for a health app, it's one of the first legal documents you should have in place.

If you're collecting names, contact details, appointment notes, intake forms, telehealth information or practitioner notes, you're dealing with personal information and often health information. In New Zealand, that means the Privacy Act 2020 and the Health Information Privacy Code 2020 need to be front of mind.

The good news is that your privacy policy doesn't need to be scary or full of legal jargon. It needs to clearly explain what you collect, why you collect it, who you share it with and how people can access or correct their information.

Do You Need A Privacy Policy For An Allied Health App?

Yes, you should have a privacy policy before you collect patient or client information through your allied health app.

Under the Privacy Act 2020, New Zealand businesses and organisations that collect personal information need to be open about their privacy practices. If your app is used for health services, you'll also need to think about the Health Information Privacy Code 2020, which sets privacy rules for health information.

Your app might collect health information if it handles details such as:

• a person's injury, condition, symptoms or treatment history
• appointment bookings with a physiotherapist, psychologist, dietitian, speech therapist, occupational therapist or other practitioner
• intake forms, screening questionnaires or progress notes
• telehealth recordings, messages or consultation summaries
• prescriptions, referrals, reports or uploaded documents
• payment information linked to health services

A privacy policy helps you meet the transparency side of your privacy obligations. Just as importantly, it helps users feel safe using your app. When people are booking a health appointment, they want to know their information is being handled carefully.

Say Maia is building a booking platform for physiotherapists and dietitians. At first, she only plans to collect names, phone numbers and appointment times. Then she adds pre-appointment forms asking about pain levels, medications and treatment goals. At that point, her app is no longer just a scheduling tool. It's handling health information, so her privacy policy needs to match what the product actually does.

What Health Information Does Your App Collect?

Your app may collect health information even if you don't think of yourself as a healthcare provider.

For privacy purposes, health information is broader than formal medical records. In an allied health booking app, it can include information that reveals something about a person's health, disability, treatment, care or support needs.

Start by mapping every point where your app collects, stores or sends information. This usually includes:

• Account details: name, date of birth, contact details, emergency contact and login details
• Booking details: practitioner selected, clinic location, appointment time, cancellation history and attendance records
• Health intake information: symptoms, conditions, medications, allergies, goals, lifestyle information and uploaded files
• Clinical or practitioner notes: session notes, treatment plans, assessment outcomes and progress updates
• Telehealth data: video consultation details, chat messages, call metadata and any recordings if your app allows them
• Reminder and communication data: SMS reminders, email confirmations, push notifications and message logs
• Technical data: device information, IP address, cookies, analytics events and crash reports
• Payment data: transaction records, invoices, rebates or plan information, depending on your model

Once you know what you collect, your privacy policy should explain it in plain English. Avoid vague phrases like "we may collect information from time to time" if your app is actually collecting detailed health intake forms and practitioner notes.

What If You Only Provide The Software?

If your business provides software to allied health clinics, and the clinic controls how patient information is used, your role may be different from the clinic's role. You might be acting as a software provider, processor or service provider rather than the practitioner collecting information for treatment.

Even then, you still need clear privacy terms. Your app users need to know how your platform handles information, and your clinic customers will often expect strong privacy and data protection commitments in your service agreement and health data sharing terms.

What Should Your Privacy Policy Say About Bookings And Reminders?

Your privacy policy should explain how booking details and reminders are collected, used and shared.

Booking apps often feel low risk because they look like admin tools. But appointment information can still reveal sensitive details. For example, a booking with a psychologist, fertility counsellor or pain clinic can say a lot about a person's health or circumstances.

Your privacy policy should cover:

• what information a person needs to provide to make a booking
• whether a clinic, practitioner or admin team can view the booking
• whether reminders are sent by SMS, email or push notification
• what reminder messages say, especially if they reveal the type of appointment
• how cancellation, no-show and rescheduling information is stored
• whether family members, carers or support workers can book on someone's behalf

Be careful with reminders. A simple message like "Your appointment is tomorrow at 10am" may be safer than a message that names the treatment type or condition. If the reminder goes to the wrong phone number or appears on a shared lock screen, too much detail can create a privacy problem.

Your privacy policy can also explain that users are responsible for keeping their contact details up to date. That won't remove all risk, but it helps set expectations.

How Should You Explain Telehealth And Practitioner Notes?

You should explain telehealth and practitioner notes clearly because they can involve some of the most sensitive information in your app.

If your app supports telehealth, your privacy policy should say what kinds of data are created through the consultation. That might include video, audio, chat messages, uploaded documents, appointment metadata and notes written after the session.

You should also be clear about whether telehealth sessions are recorded. If they are, say:

• when recording happens
• who can access the recording
• why the recording is needed
• how long it's kept
• whether the patient or client can refuse recording

If you don't record sessions, say that too. It can reassure users and reduce confusion.

Practitioner Notes Need Special Care

Practitioner notes can be highly sensitive. They may include clinical observations, treatment goals, risk comments, mental health information or family context.

Your privacy policy should explain whether your platform stores practitioner notes and who can access them. For example, access might be limited to the treating practitioner and authorised clinic staff, while your technical support team may only access data where needed to provide support and subject to internal controls.

If your app lets practitioners export notes, share reports or send referrals, say so. Your product design and your privacy policy should work together here. If the policy says access is limited, your permissions settings need to support that promise.

What About Third-Party Integrations And Overseas Providers?

You can use third-party tools, but your privacy policy should be honest about who receives information and whether data may be stored overseas.

Most healthtech products rely on other providers. You might use separate tools for cloud hosting, SMS reminders, email, payment processing, analytics, customer support, video calls, identity verification or electronic forms.

Under the Privacy Act 2020, New Zealand businesses need to take care when disclosing personal information overseas. Information Privacy Principle 12 deals with overseas disclosures. In simple terms, you may need to check that the overseas recipient is subject to comparable privacy safeguards, or make sure another permitted basis applies.

Your privacy policy should name categories of third parties, and sometimes specific providers if that gives users useful clarity. For example:

• cloud hosting providers that store app data
• SMS and email providers that send appointment reminders
• video conferencing providers used for telehealth
• payment processors that handle card or transaction details
• analytics tools that help improve app performance
• customer support tools used to respond to help requests

You should also back this up with contracts. Your provider agreements should deal with security, confidentiality, data location, breach notification, subcontractors and what happens to data when the relationship ends.

This is where generic templates often fall short. A basic privacy policy may say "we share information with service providers", but it may not properly deal with telehealth tools, offshore hosting, clinic access levels or health information expectations.

How Do You Handle Access, Corrections And Privacy Breaches?

You need a clear process for access requests, correction requests and notifiable privacy breaches.

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, people generally have rights to access and request correction of their personal and health information. Your privacy policy should tell users how to contact you if they want to do this.

In practice, your app should have a workflow for:

• confirming the requester's identity
• working out whether you or the clinic customer should respond
• finding the relevant records across your app and integrations
• recording correction requests and any changes made
• handling situations where another person's information appears in the same record

The Privacy Act also requires notification of privacy breaches that are likely to cause serious harm. If a breach meets that threshold, you must notify the Privacy Commissioner and affected people as soon as practicable.

A breach might include:

• appointment reminders going to the wrong person
• a clinic user being able to see another clinic's patient records
• a practitioner account being accessed after their role changes
• telehealth recordings being exposed through a misconfigured storage folder
• a third-party provider suffering a security incident involving your app data

Your privacy policy doesn't need to describe every internal incident response step. But it should explain that you take privacy breaches seriously and will notify affected people and the Privacy Commissioner where required.

Build The Process Before You Need It

Privacy breach response is much harder when everyone is already under pressure. Before launch, set up a simple internal information security policy and plan covering who investigates incidents, who contacts your providers, who decides whether the serious harm threshold is met and who communicates with affected users.

If your app is used by clinics, your customer contract should also explain who takes the lead when a privacy breach involves clinic data. Without that, you may lose valuable time working out who is meant to do what.

What Should Your Health App Privacy Policy Include?

Your privacy policy should be specific to the way your app collects and handles health information.

A strong allied health app privacy policy will usually cover:

• Who You Are: your legal name, trading name, NZBN if relevant and contact details
• What You Collect: account details, booking information, health intake details, telehealth data, practitioner notes and technical data
• Why You Collect It: bookings, treatment support, reminders, customer support, security, product improvement and legal compliance
• How You Collect It: directly from users, from clinics or practitioners, through forms, integrations, cookies or device data
• Who You Share It With: clinics, practitioners, authorised support people, service providers, payment providers and regulators where required
• Overseas Storage Or Disclosure: whether information may be hosted or accessed outside New Zealand
• Security: practical measures such as access controls, encryption, audit logs, staff training and account permissions
• Retention: how long you keep different types of records and what happens when an account or clinic relationship ends
• Access And Correction: how users can ask to access or correct their information
• Complaints: how users can raise a privacy concern and how you'll respond

Pay particular attention to indirect collection. From 1 May 2026, HIPC rule 3A also needs to be considered where a health agency collects health information indirectly, such as from a clinic, practitioner, caregiver, referral source or integration. Unless an exception applies, reasonable steps may be needed to make sure the individual or their representative is aware of key matters such as the collection, the purpose, intended recipients, access and correction rights, and the agency's contact details.

Your privacy policy should also line up with your onboarding screens, consent forms, clinic contracts and terms of use. If your sign-up flow says one thing and your privacy policy says another, users may be confused and regulators may take a closer look.

Common Mistakes To Avoid

A few privacy issues come up often in allied health apps, especially when the product grows quickly.

Watch out for these common mistakes:

• Using A Generic Policy: health information needs more care than a standard website privacy policy usually provides.
• Forgetting Admin Data: booking details, reminder logs and cancellation records can still reveal health information.
• Being Vague About Integrations: users and clinic customers should know when third-party tools help deliver the service.
• Over-Collecting Information: only collect what you genuinely need for your app's purpose.
• Ignoring Role-Based Access: clinic reception staff, practitioners and platform support staff don't all need the same access.
• Not Planning For Breaches: a privacy breach plan can help you respond calmly and meet notification obligations.
• Letting The Product Outgrow The Policy: update your privacy policy when you add telehealth, notes, AI features, analytics or new integrations.

If you're adding AI features, decision support or automated summaries, review your AI governance approach and get tailored advice before launch. Health information, AI outputs and practitioner oversight can raise privacy, consumer law and contract issues that depend heavily on how the feature works.

Key Takeaways

• An allied health booking app should have a privacy policy before it collects patient or client information.
• New Zealand health apps need to consider the Privacy Act 2020 and the Health Information Privacy Code 2020.
• Your policy should cover bookings, reminders, telehealth, practitioner notes, third-party integrations and overseas data handling.
• From 1 May 2026, HIPC rule 3A may require extra steps when health information is collected indirectly.
• Be clear about access, corrections and what happens if a privacy breach is likely to cause serious harm.
• Your privacy policy should match your actual product and be reviewed as your app grows.

If you'd like help with your health app privacy policy, telehealth privacy wording, third party data arrangements or app terms of use, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.