Do Allied Health Booking Forms Need A Privacy Notice?

Yes, if your allied health clinic collects patient details through an online booking form or intake form, you need to tell patients what you're collecting, why you're collecting it, and who you may share it with.

That answer sounds simple, but health intake forms are more sensitive than a standard contact form. You're often collecting symptoms, medical history, ACC details, GP referrals, medications, disability information, mental health notes, emergency contacts and payment details before you've even seen the patient.

The good news is that an allied health privacy notice doesn't need to be full of legal jargon. It just needs to be clear, accurate and easy for patients to find at the point you collect their information.

Here's how New Zealand privacy law applies to allied health booking forms, referrals and practice management software, and what you should include in your notice.

Do You Need An Allied Health Privacy Notice In New Zealand?

Yes, you generally need a privacy notice when you collect personal information from patients, especially health information.

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, health agencies need to tell people certain things when collecting their health information. The Health Information Privacy Code is especially relevant for clinics that provide health or disability services, including many allied health businesses.

Your clinic may be a health agency if you provide services such as:

• physiotherapy
• occupational therapy
• psychology or counselling
• speech language therapy
• dietetics and nutrition services
• podiatry
• chiropractic or osteopathy
• massage therapy or other health services

A privacy notice, sometimes called a privacy collection notice, is the practical way you tell patients what is happening with their information. It might sit:

• above or beside your online intake form
• as a short notice with a link to your full privacy policy
• inside your booking platform before the patient submits the form
• on a paper patient intake form at reception

Your notice should be given before, or at the time, the patient provides the information. If a patient only sees your privacy policy after submitting their health history, it's unlikely to do the job properly.

What Is The Difference Between A Privacy Notice And A Privacy Policy?

A privacy notice tells the patient key information at the moment you collect their details, while a privacy policy gives a fuller explanation of how your clinic handles personal information overall.

In practice, your clinic will often need both.

A short privacy notice near your booking form can say, in plain English:

• what information you're collecting
• why you need it
• who you may share it with
• where to find more detail in your privacy policy

Your privacy policy can then cover the bigger picture, including storage, access requests, overseas service providers, complaints, retention and security.

For example, your booking form might say:

We collect the information in this form so we can book your appointment, assess your needs, provide treatment, manage payments and meet our legal obligations. We may share relevant information with your treating practitioners, your referrer, ACC or insurer where applicable, and the software providers we use to operate our clinic. You can ask to access or correct your information by contacting us.

That short notice won't cover everything, but it gives patients a clear signal before they submit sensitive information. Your full health clinic privacy policy can then give more detail.

What Should A Patient Intake Form Privacy Notice Include?

Your patient intake form privacy notice should explain the main facts a patient needs to know before handing over their information.

Rule 3 of the Health Information Privacy Code says health agencies should take reasonable steps to make sure the patient is aware of certain matters when collecting health information. For most allied health clinics, your notice should cover the following.

Who Is Collecting And Holding The Information

Your notice should identify the clinic or business collecting the information, including its name and address or privacy contact details. If another agency will hold the information, such as a separate records service or another provider in your group, explain that too.

If a particular law requires you to collect certain information, your notice should identify that law. If the information is optional, say so clearly.

What Information You Collect

Be specific enough that patients aren't surprised. Depending on your clinic, this might include:

• name, date of birth, contact details and emergency contact details
• health history, current symptoms and treatment goals
• medications, allergies, injuries and disabilities
• GP, specialist or referrer details
• ACC claim numbers, insurer details or funding information
• appointment notes, assessment results and treatment plans
• billing and payment information

If your form asks for very sensitive information, such as mental health history, family violence concerns or disability support needs, take extra care to explain why you need it.

Why You Collect It

Your purposes should match how your clinic actually works. Common purposes include:

• booking and confirming appointments
• assessing whether your services are suitable
• providing treatment and continuity of care
• communicating with the patient about appointments and care
• processing payments, ACC claims or insurer claims
• meeting professional, legal and record keeping obligations
• improving your services and clinic operations

Avoid vague wording like for business purposes. Patients should be able to understand why each category of information is needed.

Who You May Share It With

Your notice should name the types of people and organisations that may receive patient information. This could include:

• practitioners and admin staff within your clinic who need access
• the patient's GP, specialist or referrer, where relevant
• ACC, insurers or funders involved in the patient's care or claim
• labs, imaging providers or other healthcare providers, if you coordinate care
• practice management, booking, billing, telehealth and email software providers
• professional advisers and regulators, where required by law or professional obligations

Try not to promise that information will never be shared. There may be times when sharing is necessary for care, safety, billing or legal reasons. It's better to explain the real situations clearly.

Whether Providing Information Is Required

You should explain whether the information is required or optional, and what happens if a patient doesn't provide it.

For example, you might say that certain information is needed to assess and treat the patient safely. If they don't provide it, you may not be able to offer the service, process an ACC claim, or tailor treatment properly.

Access And Correction Rights

Patients have rights to ask for access to and correction of their personal information. Under the Privacy Act 2020, you generally need to respond to an access request as soon as reasonably practicable and no later than 20 working days, unless an extension applies.

Your privacy notice or policy should tell patients how to make those requests, such as by emailing your clinic manager or privacy contact.

What About Referrals And Indirect Collection From 1 May 2026?

Allied health clinics often receive health information indirectly, not just from the patient. For example, a GP might send a referral letter, ACC might provide claim information, an insurer might send funding details, or a school, specialist or other provider might share background information.

From 1 May 2026, new indirect collection notification rules apply under IPP3A in the Privacy Act and Rule 3A of the Health Information Privacy Code. In broad terms, if a health agency collects health information about a patient from someone else, it must take reasonable steps as soon as reasonably practicable after collection to make the patient, or their representative, aware of the Rule 3A matters, unless an exception applies.

For your clinic, this means your referral workflow shouldn't assume that the referrer has handled privacy notification for you. You may need to tell patients that you collect relevant health information from referrers, ACC, insurers, funders, schools, employers or other treating providers, why you collect it, who may hold it, and who you may share it with.

Practical ways to manage this include:

• adding indirect collection wording to your booking form and privacy policy
• sending a short privacy notice when you accept a referral
• including a privacy link in appointment confirmation emails or texts
• checking that referral forms ask referrers to provide patient contact details where appropriate
• training admin staff to spot referrals that contain sensitive information before the patient has been contacted

This is especially important for psychology, occupational therapy, physiotherapy, rehabilitation, disability and child related services, where referral material can be detailed and sensitive.

Practice Management Software And Sharing Patient Information

You can use practice management software, booking platforms, telehealth tools and online form builders, but you still remain responsible for how patient information is handled.

Using software doesn't outsource your privacy obligations. If your clinic chooses the system, decides what information is collected and uses that information to provide services, you need to make sure the setup is appropriate for health information.

Before using a platform, check:

• where patient information is stored, including whether it's stored overseas
• whether the provider has reasonable security measures
• who can access the information within the provider's team
• whether the provider can use your patients' information for its own purposes
• how you can export records if you leave the platform
• what happens if there's a data breach
• whether the contract, or any health data sharing agreement, gives you enough control over patient information

The Privacy Act 2020 has rules for disclosing personal information overseas. In broad terms, if you disclose information to an overseas organisation, you may need to take reasonable steps to make sure comparable privacy safeguards apply, unless another exception applies. If your software provider stores or accesses patient information outside New Zealand, your privacy policy should deal with this carefully.

Sharing information with referrers, ACC or insurers may also be part of normal care or claims management, but you need a proper reason and you should be transparent with the patient. Your privacy notice should explain likely disclosures in plain language. It should also be clear about when you need patient consent, a consent form or authorisation.

Be especially careful with broad, bundled consent wording. A better approach is to describe normal sharing for care, claims and administration, and get clearer consent for more sensitive or unusual disclosures, such as sending a detailed report to an employer, sharing information with a school or sports club, using a patient story in marketing, or disclosing information to a family member where there isn't a clear legal or safety basis.

You should also keep information secure. Limit staff access, use secure systems and have a clear information security policy with sensible password, device and access controls.

Health Records, Retention And Breaches

In many cases, health providers in New Zealand need to keep health records for at least 10 years from the day after the last date services were provided.

This comes from the Health (Retention of Health Information) Regulations 1996. The rule is particularly relevant for clinics providing health services and keeping patient records.

That doesn't mean every piece of information should sit in every system forever. Your clinic should have a sensible retention process that deals with:

• what counts as the clinical record
• what booking or admin data can be deleted earlier
• how long online intake forms stay in your form tool
• how you archive inactive patient records
• how you securely delete or destroy information when it's no longer needed

Some professional standards, funding requirements or insurer arrangements may affect retention periods for your particular profession. If you're unsure, check the rules that apply to your registration body or professional association as well as the legal minimum.

You should also have a simple breach response plan. Under the Privacy Act 2020, a privacy breach is notifiable if it's reasonable to believe the breach has caused, or is likely to cause, serious harm. If a breach is notifiable, you need to notify the Office of the Privacy Commissioner and affected individuals as soon as practicable.

For an allied health clinic, a breach might include sending a referral letter to the wrong person, losing a laptop with patient information on it, staff accessing records without a work reason, a booking platform being compromised, or paper intake forms being left where other patients can see them.

At a minimum, know who will contain the breach, work out what information was involved, assess the risk of serious harm, notify the right people if required, and record what changes are needed.

Common Mistakes To Avoid

Most privacy issues in small clinics come from everyday processes, not dramatic cyber attacks.

Watch out for these common mistakes:

• Copying a generic privacy policy: Templates often miss health specific issues like referrals, ACC, clinical records and practice management software.
• Collecting too much information too early: If you don't need a detailed medical history before the first appointment is confirmed, consider collecting it later.
• Using personal email accounts: Patient information should sit in clinic controlled systems, not personal inboxes.
• Giving all staff full access: Admin staff may need booking and billing details, but not always full clinical notes.
• Forgetting about indirect collection: From 1 May 2026, referral workflows should account for Rule 3A notification where you collect health information from someone other than the patient.
• Using health information for marketing: Email and SMS marketing may also raise issues under the Unsolicited Electronic Messages Act 2007, including consent, sender identification and unsubscribe requirements.
• Not updating your notice when your systems change: If you change booking platforms, add telehealth or start taking online payments, your privacy documents may need an update.

The goal isn't to make your booking process clunky. It's to collect what you need, tell patients what you're doing, and keep their information handled in a way that matches the trust they place in your clinic.

Key Takeaways

• Allied health clinics in New Zealand usually need a clear privacy notice when collecting health information through booking and intake forms.
• Your notice should identify who is collecting and holding the information, what you collect, why you collect it, who you may share it with, whether it's required, and how patients can access or correct it.
• From 1 May 2026, referral workflows and privacy notices should cover indirect collection from referrers, ACC, insurers, funders and other providers under IPP3A and HIPC Rule 3A.
• Practice management software is useful, but you should check security, overseas storage, access controls and data breach processes.
• Health records often need to be kept for at least 10 years from the day after the last service, but your exact obligations may depend on your profession and systems.
• Privacy documents work best when they're tailored to how your clinic actually collects referrals, handles claims and uses software.

If you'd like help with privacy notices, referral workflows, patient intake wording or software privacy checks, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.