Privacy Policies For Telehealth Startups In NZ

Launching a telehealth platform is exciting, but it also means you're handling some of the most sensitive information your users will ever share with you.

Patients may be booking appointments, uploading medical history, talking to practitioners over video, receiving prescriptions, and paying through your platform. That creates trust, and it also creates privacy obligations from day one.

The good news is that your privacy documents don't need to be scary or overly legalistic. They just need to clearly explain what you collect, why you collect it, who you share it with, and how your information security policy helps keep it safe.

Do You Need A Privacy Policy For A Telehealth Startup In NZ?

Yes, if your telehealth business collects personal information, you should have a privacy policy that reflects New Zealand privacy law and the way your platform actually works.

Under the Privacy Act 2020, personal information means information about an identifiable individual. In a telehealth setting, that could include:

• names, dates of birth and contact details
• health history, symptoms, prescriptions and clinical notes
• appointment bookings and practitioner communications
• payment details and billing history
• identity checks or eligibility information
• technical data such as account login details, device data and IP addresses

Health information isn't just another customer data set. The Health Information Privacy Code 2020 also applies to health agencies and sets out specific rules for collecting, using, storing and disclosing health information.

Your startup may be a health agency if you provide health services, hold health information for that purpose, or operate a platform that's closely involved in delivering care. The exact position depends on how your model works, so it's worth getting tailored advice before you scale.

A good telehealth privacy policy shouldn't be copied from a standard ecommerce website. Templates often miss the practical details that matter for health platforms, such as practitioner access, cloud storage, video consultations, prescriptions, patient consents and overseas service providers.

What Should An Online Health Platform Privacy Policy Include?

Your online health platform privacy policy should explain your data practices in plain English, not hide them in dense legal wording.

At a minimum, it should cover the key points required under the Privacy Act 2020 and the Health Information Privacy Code 2020. When you collect health information, you generally need to make patients aware of things like who is collecting it, why it's being collected, who may receive it, whether providing it's required or optional, and their rights to access and correct it.

Information You Collect

Be specific about the types of information your platform collects. For example, you might collect:

• patient account details
• medical history and consultation notes
• photos, documents or test results uploaded by patients
• practitioner notes and treatment recommendations
• prescription and pharmacy information
• payment and subscription details
• communications through chat, email, SMS or video
• analytics and usage information

If you use optional features, say so. For example, if patients can upload photos of a skin condition or connect wearable device data, your privacy policy should explain that clearly.

Why You Use The Information

Your policy should connect each main use to a clear business or clinical purpose. Common purposes include:

• creating and managing patient accounts
• matching patients with practitioners
• providing telehealth consultations
• sharing information with treating practitioners
• issuing invoices and processing payments
• sending appointment reminders
• meeting legal and record-keeping obligations
• improving platform safety and functionality

If you use health information for product analytics, research, training, AI tools or marketing, you need to be much more careful and may need an AI governance policy. You may need clear consent, de-identification, contractual controls and a separate assessment of whether the use is allowed.

Who You Share It With

Patients shouldn't have to guess who can see their information. Your policy should explain when information may be shared with:

• doctors, nurses, psychologists, allied health practitioners or other clinicians using the platform
• pharmacies, labs or imaging providers, if relevant
• payment processors and booking tools
• cloud hosting providers and software vendors
• customer support and IT providers
• regulators or authorities where legally required

Use practical language. For example, if a patient books a video consultation, their relevant health information may need to be shown to the practitioner so the practitioner can provide care.

How Does Consent Work For Health Information Privacy In NZ?

Consent matters, but it isn't a magic fix for every privacy risk.

In telehealth, you may need consent for both the healthcare interaction and the way information is collected, used and shared. That consent should be informed, clear and connected to what the patient is actually agreeing to.

For example, say Hana runs a telehealth platform connecting patients with dietitians and GPs. When a patient books a GP appointment, the platform asks them to complete a health questionnaire. Hana's platform should explain that the questionnaire will be shared with the GP for the consultation. If the same information will also be used later to train an AI triage tool, that's a different use and needs separate thought.

Under the Health Information Privacy Code 2020, health information should usually be collected directly from the individual unless an exception applies. You also need to collect only what is necessary for your lawful purpose.

That means you should avoid broad statements such as collecting any information we need for any purpose. Instead, build consent and privacy notices around the actual patient journey.

Consent Points To Build Into Your Platform

Your telehealth flow may need consent or clear notice at several points, including:

• account registration
• booking a consultation
• uploading health records, photos or documents
• sharing information with a particular practitioner
• sending information to a pharmacy, lab or specialist
• using video, chat, recording or transcription features
• receiving marketing communications
• using de-identified data for analytics or product improvement under clear data governance rules

Make these moments easy to understand. A privacy policy is helpful, but for sensitive actions, a short in-platform notice next to the button can be much clearer for patients.

What Should You Check With Third-Party Platforms And Booking Tools?

You should check exactly what each third-party tool does with patient information before you connect it to your telehealth platform.

Many telehealth startups rely on other software to operate. That might include:

• video consultation tools
• online booking systems
• payment processors
• cloud hosting providers
• electronic medical record systems
• SMS and email reminder tools
• analytics platforms
• AI transcription or summarisation tools
• customer support software

These tools can make your business easier to run, but they also create privacy risk. If a vendor stores patient data offshore, uses it for its own analytics, has weak security controls or subcontracts processing to others, that can affect your obligations to patients.

Under Information Privacy Principle 12 in the Privacy Act 2020, there are specific rules for disclosing personal information outside New Zealand. Some offshore storage or processing arrangements may be treated differently from a disclosure, but you still need to understand where the data goes and what safeguards apply.

Before you sign up to a tool, ask:

• What personal and health information will the tool collect or access?
• Where will the information be stored?
• Can the provider use the information for its own purposes?
• Does the provider use subprocessors?
• What security standards does the provider follow?
• How quickly will the provider notify you of a data breach?
• Can you delete or export data if you leave?
• Does the contract help you meet New Zealand privacy obligations?

For health data, don't rely only on a vendor's marketing page. Read the contract, data processing terms and security materials before patient information starts flowing through the system.

Do You Need A Health Data Sharing Agreement In NZ?

Yes, you'll usually need a written agreement when your telehealth business shares health data with practitioners, clinics, service providers or other organisations.

A health data sharing agreement sets the rules for who can access health information, what they can do with it, and what happens if something goes wrong. It's especially useful when your platform works with independent practitioners or partner clinics.

This is different from your patient-facing privacy policy. Your privacy policy tells patients what happens to their information. Your data sharing agreement manages the legal and operational relationship between your business and the organisations or professionals handling that information.

What To Include In A Health Data Sharing Agreement

Your agreement should usually deal with:

• the purpose of the data sharing
• the types of health information being shared
• whether each party is acting independently or on behalf of another party
• who can access the information and on what conditions
• minimum security standards
• confidentiality obligations
• patient consent and privacy notice responsibilities
• rules for overseas access or storage
• data breach notification steps
• retention, deletion and return of information
• how patient access or correction requests will be handled
• limits on using data for marketing, research, AI or product development

If practitioners are independent contractors, your contractor agreement should also align with your privacy documents. From 2026, the contractor gateway test introduced through changes to the Employment Relations Act 2000 may affect how you structure practitioner relationships. If your practitioners look more like employees in practice, that can create employment law issues as well as data governance issues.

Patient privacy, clinical responsibility and worker status are separate questions, but they often overlap in a telehealth model. Getting the contracts aligned early can save a lot of confusion later.

How Do Telehealth Terms And Conditions Fit With Your Privacy Policy?

Your telehealth terms and conditions work alongside your privacy policy, but they do a different job.

Your privacy policy explains how personal and health information is handled. Your terms and conditions set the commercial and platform rules for patients and users.

For a telehealth startup, your terms may need to cover:

• who can use the platform
• how accounts are created and secured
• booking, cancellation and refund rules
• fees, subscriptions, payment processes and any payments privacy wording
• the role of the platform versus the role of practitioners
• patient responsibilities, such as providing accurate information
• what to do in an emergency
• limits on misuse of the platform, including acceptable use rules
• intellectual property in your software and content
• when you can suspend or close an account

Your terms shouldn't promise more than you can deliver. For example, if your platform only connects patients with independent practitioners, avoid wording that suggests your business is providing all clinical care itself unless that's actually true.

You should also make sure your terms and your privacy policy say consistent things. If your privacy policy says consultation notes are only visible to the treating practitioner, your terms shouldn't suggest your whole support team can review them freely.

The Fair Trading Act 1986 also matters here. Your website and onboarding screens shouldn't mislead patients about your service, practitioner qualifications, availability, pricing, data use or the level of care provided through the platform.

What Are Your Privacy Breach And Patient Request Obligations?

You need a practical process for privacy breaches, access requests and correction requests before your platform becomes busy.

Under the Privacy Act 2020, if a privacy breach has caused serious harm or is likely to cause serious harm, you must notify the Office of the Privacy Commissioner and affected individuals as soon as practicable.

A privacy breach could include:

• sending consultation notes to the wrong patient
• a practitioner account being accessed by someone unauthorised
• patient records being exposed through a software error
• a lost laptop containing unencrypted health information
• a vendor security incident affecting your platform data

Health data can raise the seriousness of a breach because of the sensitivity of the information involved. Your response plan should set out who investigates, who contacts vendors, who decides whether notification is required, and how you communicate with affected patients.

Patients also have rights to access and correct their personal information. In New Zealand, access requests generally need to be answered as soon as reasonably practicable and no later than 20 working days, unless an extension is available under the Privacy Act 2020.

Your team should know where patient information is stored so you can respond properly. If information is spread across your platform, video tool, booking system, practitioner notes and customer support inbox, requests can become messy without a clear process.

Retention also matters. If your business is a health agency providing care, the Health (Retention of Health Information) Regulations 1996 may require health information to be kept for at least 10 years from the last date services were provided. Your retention settings should be checked against your exact role and obligations.

Key Takeaways

• A telehealth privacy policy in NZ should be tailored to health information, not copied from a general website policy.
• The Privacy Act 2020 and Health Information Privacy Code 2020 shape how you collect, use, disclose, store and protect patient information.
• Consent should match the patient journey, especially where information is shared with practitioners, pharmacies, labs, AI tools or other third parties.
• Third-party booking, video, payment, hosting and analytics tools need careful contract and data flow checks.
• Health data sharing agreements help set clear rules between your platform, practitioners, clinics and service providers.
• Your privacy policy, telehealth terms and conditions, practitioner agreements and breach response process should all work together.

If you'd like help with your telehealth privacy policy, platform terms and conditions, health data sharing agreements or practitioner contracts, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.