Dental Practice Privacy Policies in New Zealand

A dental practice collects some of the most sensitive information a business can hold: health histories, treatment notes, X-rays, payment details, referral letters, ACC information, online enquiry forms and sometimes photos of a patient's mouth or face. A generic website privacy policy is unlikely to cover the way a dental clinic actually handles patient information.

Common mistakes include copying a retail privacy policy, failing to explain which practice management software stores dental patient data in NZ or overseas, and using patient photos or reminder systems without clear consent. Another risk is treating privacy as a website issue only, when the Privacy Act 2020 and the Health Information Privacy Code 2020 also apply to reception, clinical notes, staff access, marketing and third-party contractors.

A well-drafted dentist privacy policy in NZ helps patients understand what happens to their information and helps your team make consistent decisions. It should also support your booking workflows, marketing plans, software choices and complaints process without overpromising what the practice can deliver.

What a Dental Practice Privacy Policy Must Cover

A dental practice privacy policy should clearly explain how the practice collects, uses, stores, shares and protects patient information, with extra care for health information. For New Zealand dental businesses, the key legal framework is the Privacy Act 2020, supported by the Health Information Privacy Code 2020.

Health information privacy in NZ is more specific than ordinary customer data. A patient's dental history, medical conditions, medications, allergies, X-rays, treatment plans and clinical notes are all sensitive because they relate to the patient's health and care. Even a basic online booking form can collect health information if it asks about pain, symptoms, medications or previous treatment.

Your privacy policy should be written for real practice scenarios. A patient should be able to read it and understand what happens when they complete a new patient form, send a website enquiry, book through an online portal, receive a text reminder, request their records or ask for a referral to an orthodontist, oral surgeon or another health provider.

A practical dental practice privacy policy usually covers:

• Who operates the practice: the legal entity, trading name and contact details for privacy questions.
• What information is collected: contact details, date of birth, health history, dental records, X-rays, images, payment information, insurance or ACC details, emergency contacts and online enquiry information.
• How information is collected: in person, by phone, online forms, booking platforms, referrals, emails, SMS, patient portals and from authorised representatives.
• Why the practice collects and uses information: to provide dental care, manage appointments, keep clinical records, process payments, communicate with patients, meet legal obligations and improve services.
• Who information may be shared with: dental specialists, laboratories, hygienists, therapists, insurers, ACC, software providers, payment processors, debt recovery providers and regulators where required.
• How information is stored and protected: practice management software, cloud storage, access controls, backups, physical file security and staff confidentiality.
• Patient rights: how patients can request access to, or correction of, their personal information.
• Privacy complaints: who to contact at the practice and how concerns will be handled.

The policy should match what the practice actually does. If you use cloud-based dental software, store X-rays in an imaging platform, run Facebook lead forms, or send recalls by SMS, the policy should say so in plain English. If you do not use information for marketing, do not include broad marketing wording just because it appeared in a template.

The Health Information Privacy Code 2020 also places strong emphasis on collecting health information directly from the individual where practicable, collecting only what is needed, being open about the purpose of collection and allowing access and correction. For a busy dental clinic, this means your new patient form, website forms and reception scripts should line up with your privacy policy.

Patient Records, Bookings and Online Enquiries

Patient records and online booking pathways are usually the highest-risk areas for a dental practice because they combine sensitive health details with everyday admin processes. Your privacy policy should explain these touchpoints before a problem arises.

Start with your new patient workflow. Many practices ask patients to complete medical history forms that include medications, allergies, pregnancy, smoking status, medical conditions, past dental treatment and emergency contact details. That information is legitimate for safe dental care, but patients should understand why it is requested and who will see it.

For example, a policy might explain that medical history information is used by dentists, oral health therapists, hygienists and authorised practice staff to assess treatment options, manage clinical risk and provide continuity of care. It may also explain that reception staff can access limited information needed to manage appointments and patient communications.

Online enquiries need special attention. A patient might use your website contact form to say, "I have severe gum pain and swelling" or upload a photo. Even if the form was designed for simple enquiries, the content can become health information. If your website provider or customer relationship management system receives those enquiries, your policy should identify that third-party tools may process personal information on behalf of the practice.

A dental practice privacy policy should also address appointment systems and reminders. Patients are often comfortable with reminder texts, but the message should avoid unnecessary clinical detail. A reminder that says, "You have an appointment at ABC Dental at 9.00am" is usually safer than a message that names a procedure, especially if the patient's phone may be seen by family members, colleagues or caregivers.

Consider how your practice handles children's privacy and young patients' information. A parent or guardian may provide information and manage bookings, but older children and teenagers may have privacy interests of their own. Your policy can explain that the practice will manage access requests and communications in line with privacy and health information obligations, the patient's circumstances and any applicable consent arrangements.

Patient access and correction rights should be easy to follow. Under the Privacy Act 2020 and Health Information Privacy Code 2020, individuals can generally request access to their personal and health information and ask for corrections. Your policy should tell patients how to make a request, what information you may need to verify identity, and that the practice will respond in accordance with applicable privacy rules.

Dental records are not just a customer service file. Clinical notes, radiographs, treatment plans and consent records can be critical for continuity of care, professional obligations and managing later questions about treatment. Your privacy policy does not need to set out every recordkeeping rule, but it should avoid promising to delete all records on request if the practice has lawful reasons or obligations to retain clinical information.

A useful internal step is to map the patient information journey. List each point where information enters, moves through or leaves the practice:

1. A patient books online or calls reception.
2. The patient completes a medical history and dental treatment consent form.
3. The dentist takes notes, X-rays, scans or photographs.
4. The practice sends information to a dental laboratory or specialist.
5. The practice issues invoices, receipts or insurance paperwork.
6. The patient receives recall reminders or marketing communications.
7. The patient later requests records or transfers to another provider.

Once you can see the full journey, it is easier to draft a dentist privacy policy NZ patients can understand and your team can follow.

Third-Party Software and Cross-Border Data Handling

A dental practice remains responsible for privacy compliance even when third-party software handles patient information on its behalf. Cloud practice management systems, imaging tools, online booking platforms and payment services should be covered in your policy and checked through your supplier contracts.

Many dental practices rely on software for appointment scheduling, recalls, clinical notes, X-rays, treatment plans, payment processing and email communications. Some systems are hosted in New Zealand, while others store or process information overseas. The Privacy Act 2020 includes rules for disclosing personal information outside New Zealand, so your practice should know where patient data goes and what protections apply.

This does not mean every overseas software provider is off-limits. It does mean the practice should make informed choices and avoid vague promises such as "your information never leaves New Zealand" unless that is accurate. If your patient management platform, email marketing system or website hosting provider stores information offshore, your privacy policy should be transparent about this.

When reviewing software for dental patient data in NZ, ask practical questions before signing or renewing:

• Where is patient information hosted and backed up?
• Does the provider use subcontractors or overseas data centres?
• What security measures are used, such as encryption, user permissions and audit logs?
• Can the practice control staff access levels?
• How does the provider support access, correction and deletion requests?
• What happens if there is a data breach or outage?
• Can the practice export records if it changes providers?
• Does the provider use patient data for its own analytics, AI training or marketing?

Supplier agreements matter because a privacy policy alone does not control your software provider. Your contract should support confidentiality, security, breach notification, data return or deletion, service levels and restrictions on how the provider can use patient information. If the software provider's terms allow broad use of de-identified or aggregated data, your practice should understand what that means before describing data use to patients.

Artificial intelligence features also deserve a careful AI governance review. Some tools assist with dictation, clinical note summaries, call transcription, image analysis or patient communications. If an AI tool receives identifiable patient information, the practice should check where that information is processed, whether it is used to train models, and whether patients need clearer notice or consent. Avoid copying patient details into public AI tools unless you have assessed the privacy and confidentiality risks.

Data breaches are another point a dental privacy policy should handle carefully. The Privacy Act 2020 has a notifiable privacy breach scheme for privacy breaches that have caused, or are likely to cause, serious harm. The Office of the Privacy Commissioner is the key regulator. Your policy can state that the practice will assess and respond to privacy incidents in accordance with legal requirements, including notification where required.

From a business-owner perspective, the best time to address third-party software privacy is before a software rollout. For example, if you move from paper recalls to automated SMS and email recalls, update your policy, patient communications and supplier terms at the same time. If you add online bookings, make sure the booking form links to the current privacy wording in your patient-facing materials, even if the policy itself sits separately.

Marketing, Photos and Team Access to Patient Information

Dental marketing can create privacy risk when a practice uses patient information for recalls, newsletters, reviews, before-and-after images or targeted campaigns without clear permission. Your privacy policy should separate treatment-related communications from promotional marketing.

Appointment confirmations, treatment follow-ups and recall reminders are usually connected to providing dental care and managing the patient relationship. Marketing emails about whitening promotions, Invisalign offers, family check-up specials or new services are different. The Unsolicited Electronic Messages Act 2007 may apply to commercial electronic messages, and your practice should manage consent and unsubscribe functions carefully.

Your privacy policy should explain whether the practice uses patient contact details to send marketing and how patients can opt out. Do not rely on hidden consent or broad statements that patients may miss. If your practice uses an email marketing platform, social media advertising tools or a customer list upload feature, consider whether the patient would reasonably expect that use and whether additional consent is needed.

Before-and-after images are particularly sensitive for dental practices. Even if a photo focuses on teeth, it may identify a patient through facial features, unusual dental work or other context. A separate, written photo and testimonial consent is usually better than burying consent in a privacy policy. The consent should say where the image may be used, such as the practice website, social media, printed materials or advertising, and whether the patient's name or story will appear.

Reviews and testimonials need similar care. A patient may voluntarily post a public review, but the practice should be careful when responding. A reply that confirms treatment details, appointment history or a dispute can disclose health information. A neutral response that invites the reviewer to contact the practice privately is usually safer.

Staff access is another practical privacy issue. Dentists, hygienists, oral health therapists, dental assistants, receptionists, contractors and bookkeepers may need different levels of information. Your privacy policy can describe authorised access at a high level, while your internal privacy and information security policies and employment agreements should set out confidentiality duties in more detail.

For example, a receptionist may need to see patient contact details, appointment notes and billing status, but not every clinical note. A dental assistant may need clinical information for chairside care, while an external bookkeeper may only need invoice and payment information. Your practice management system should support role-based access where possible.

Employment documents and contractor agreements should reinforce privacy obligations. Under the Employment Relations Act 2000, employment arrangements should be clear and fair, and privacy expectations should be practical for the workplace. Confidentiality clauses, staff onboarding, password rules and a social media policy can help prevent accidental disclosures, such as discussing a patient's treatment in a public area or posting workplace content that includes patient files in the background.

Reception layout and daily habits also matter. A privacy policy will not protect patient information if sign-in sheets show other patients' details, computer screens face the waiting room, printed treatment plans are left on the front desk, or staff discuss patients where others can hear. Health information privacy in NZ is both a document issue and an operational issue.

A healthcare-specific privacy approach for a dental practice should include:

• separate consent for clinical photos, testimonials and case studies;
• clear opt-out options for promotional marketing;
• limited access to patient records based on role;
• staff confidentiality training for reception and clinical teams;
• secure processes for sending records to specialists or laboratories;
• regular checks that website forms, booking tools and software settings match the privacy policy.

The Fair Trading Act 1986 can also become relevant if marketing statements are misleading. For example, if your website says patient information is stored securely in New Zealand but your software stores backups overseas, that mismatch can create both privacy and consumer law risk. Keep privacy promises accurate and specific.

FAQs

Does Every Dental Practice in New Zealand Need a Privacy Policy?

Yes, a dental practice should have a clear privacy policy because it collects personal and health information from patients. The policy should reflect the Privacy Act 2020, the Health Information Privacy Code 2020 and the practice's actual systems, not just a generic website template.

Can a Dentist Use One Privacy Policy for the Website and the Clinic?

One policy can cover both the website and clinic if it is drafted broadly enough to address patient records, bookings, treatment communications, online forms, third-party software, marketing and access requests. Many website-only policies are too narrow for dental practices because they focus on cookies and contact forms rather than clinical information.

Can We Send Dental Records to Another Provider?

A dental practice can usually share relevant information with another health provider where it is necessary for the patient's care or where the patient has authorised the transfer. The practice should confirm the request, check identity or authority where needed, and use a secure transfer method.

Do We Need Consent to Send Recall Reminders?

Recall reminders connected to ongoing dental care are different from promotional marketing. Even so, your practice should tell patients how reminders work, avoid unnecessary clinical detail in messages, and allow patients to update their communication preferences.

What Should We Do if Patient Information Is Sent to the Wrong Person?

Treat it as a privacy incident immediately. The practice should contain the issue, assess whether serious harm is likely, document what happened, notify affected people or the Office of the Privacy Commissioner if required, and fix the process that caused the error.

Key Takeaways

• A dental practice privacy policy in NZ should address clinical records, online enquiries, bookings, reminders, marketing, photos, software providers and patient access rights.
• The Privacy Act 2020 and Health Information Privacy Code 2020 are central for dental practices because patient information is health information.
• Third-party software contracts should support your privacy promises, especially for cloud hosting, overseas storage, AI tools, breach notification and data export.
• Marketing activities, testimonials and before-and-after photos need clearer consent and more careful wording than routine appointment communications.
• Staff access, confidentiality training and front-desk habits are just as important as the written privacy policy.

If your dental practice needs help preparing a healthcare-specific privacy policy, reviewing patient consent wording, checking software privacy terms or tightening staff confidentiality documents, Sprintlaw New Zealand can help. Contact us on 0800 002 184 or at team@sprintlaw.co.nz for a free, no-obligations chat.