Privacy Policy For Veterinary Clinics In NZ

Running a veterinary clinic means you collect a lot more than names and phone numbers. You may hold pet histories, treatment notes, billing details, booking forms, insurance information, photos, reminder preferences and sometimes sensitive notes about a client's circumstances.

Most of that data is there for good reasons. It helps you treat animals well, keep clients informed and run your clinic smoothly. Still, your clients need to understand what you're collecting, why you're using it and who else might see it.

A clear privacy policy, backed up by practical client terms, can make your clinic look more professional and help your team handle client data consistently.

Do Veterinary Clinics Need A Privacy Policy In New Zealand?

Yes, if your veterinary clinic collects personal information, you need a clear way to tell clients how you handle it. In New Zealand, the Privacy Act 2020 doesn't say every business must have a document called a privacy policy, but it does require you to be transparent when collecting personal information.

Two collection notice rules matter most: Information Privacy Principle 3 and Information Privacy Principle 3A.

IPP 3 applies when you collect personal information from the client directly. You usually need to tell them things like:

• why you're collecting the information
• who will receive it
• whether giving it to you is required or optional
• what happens if they don't provide it
• their rights to access and correct it

Since 1 May 2026, IPP 3A can also apply where you collect personal information about an individual from someone other than that individual. For a vet clinic, that might happen through referrals, authorised pick up people, insurers, other clinics, emergency contacts or third party platforms. In those cases, you may need to take reasonable steps to make sure the individual is told about the collection and the same kinds of matters listed above, unless an exception applies.

A veterinary privacy policy is the neatest way to do this, especially if you take online bookings, use client management software or send reminders by SMS or email.

For example, if a new client books online, uploads pet insurance details and agrees to vaccine reminders through your booking system, your policy should explain how that information flows through your booking platform, practice management system, payment provider and reminder tool.

Your privacy policy should also match what your clinic actually does. A generic template may say you don't share data overseas, but your booking or email platform might host data offshore. That mismatch can cause problems if a client asks how their information is handled.

What Client And Pet Information Counts As Personal Information?

Personal information is information about an identifiable person, so your client's name, contact details, payment information and account history clearly count. Pet information can also become personal information when it's linked to a client.

A dog's vaccination record on its own might not identify a person. But once it's attached to Olivia Smith, her address, her invoice history and her phone number, it forms part of the client record your clinic holds.

Common animal clinic client data can include:

• client names, addresses, email addresses and phone numbers
• emergency contact details or authorised pick up people
• pet names, microchip numbers, breed, age and treatment history
• appointment notes, reminders and follow up instructions
• billing records, payment status and refund notes
• pet insurance claim forms and policy numbers
• photos or videos of pets, especially where the owner is named or pictured
• client communications, complaints and consent notes

New Zealand privacy law doesn't treat animal health records the same way it treats human health information. Still, veterinary records can reveal personal details about the client. For example, a note that a client can only attend appointments after a support worker arrives, or that they need payment arrangements, should be handled carefully.

The practical test is simple: if the information can point back to a person, treat it as personal information and manage it under the Privacy Act 2020.

What Should A Veterinary Privacy Policy Include?

A good veterinary privacy policy should explain your real data handling practices in plain English. It should be specific enough that a client can understand what happens when they book, visit, pay, make an insurance claim or receive reminders.

Here is a practical fill in outline you can use as a starting point. A lawyer or legal adviser should tailor it before you publish it, because templates often miss the tools and workflows that make your clinic different.

1. Who You Are: Write your clinic's legal name, trading name, NZBN if you have one, contact details and privacy contact person.
2. What You Collect: List client details, pet records, booking data, payment records, communications, photos and insurance information.
3. How You Collect It: Cover clinic forms, online bookings, phone calls, emails, referrals, insurance forms and third party platforms.
4. Why You Collect It: Explain treatment, appointment management, billing, reminders, insurance support, customer service and legal compliance.
5. Who You Share It With: Name the types of recipients, such as laboratories, referral hospitals, payment processors, insurers, software providers and couriers.
6. Overseas Storage Or Access: Say if your systems, booking tools or email platforms may store or access data outside New Zealand.
7. Marketing And Reminders: Explain service reminders, newsletters, promotions, unsubscribe options and how clients can update preferences.
8. Photos And Social Media: Set out when you take photos, when you need consent and how clients can ask for removal.
9. Access, Correction And Retention: Explain how clients can ask for their information, correct it and how long you keep records.
10. Privacy Breaches: Say how clients can contact you if something goes wrong and that notifiable privacy breaches must be reported to the Office of the Privacy Commissioner and affected people as soon as practicable, unless an exception or permitted delay applies.

Keep the wording simple. Your reception team should be able to understand it too, because they're often the first people asked about privacy.

How Should You Handle Reminders, Photos And Client Communications?

You can usually send genuine service communications, but marketing messages need extra care. The line between a helpful reminder and a promotional message can matter.

Appointment And Health Reminders

Vaccination reminders, post surgery check ins and appointment confirmations are usually part of providing veterinary services. Your privacy policy should say that you use client contact details for these purposes, and your intake form should make it easy for clients to choose their preferred contact method.

Say Mia runs a Wellington vet clinic with 4,200 active client records. Her team sends annual vaccination reminders by SMS and email. If Mia's privacy policy says client contact details are used for treatment, appointment management and health reminders, clients are less likely to be surprised when those messages arrive.

Marketing Emails And Texts

If you're sending promotions, newsletters or offers, the Unsolicited Electronic Messages Act 2007 may apply. In practice, you should have consent, identify your clinic and include a working unsubscribe option.

For example, a reminder that Luna the cat is due for a vaccination is different from a promotional email offering 20% off dental checks. Your systems should let clients opt out of marketing without losing essential care reminders.

Pet Photos And Social Media

Pet photos can feel harmless, but privacy issues can arise if you name the owner, show a person's face, reveal an address tag or share a sensitive story. Get clear consent before using photos or stories for social media, website testimonials or advertising.

A simple photo consent process can sit in your client terms or intake form, but it should never force clients to agree to marketing photos as a condition of treatment.

What If You Use Online Booking, Payment Platforms Or Pet Insurance?

You can use third party tools, but you're still responsible for choosing sensible providers and telling clients how their information may be shared. Your privacy policy shouldn't stop at what happens inside your clinic.

Online Booking Tools

If your booking tool collects names, emails, pet details, appointment reasons or notes, it's handling client data for your business. Check where the provider stores data, who can access it, what information security policy applies and whether it uses information for its own purposes.

Offshore storage or processing isn't always the same as an overseas disclosure. If a provider only stores or processes personal information overseas as your clinic's agent, that arrangement is generally not treated as a cross border disclosure under Information Privacy Principle 12. However, you're still responsible for making sure the provider handles the information consistently with the Privacy Act 2020.

IPP 12 is more directly engaged where you disclose personal information to an overseas person or entity, especially if they aren't merely acting as your agent or they will use the information for their own purposes. Either way, you should check the provider's terms, security practices, access controls and data location before you rely on the platform.

Payment Platforms

Your clinic should collect the minimum payment information it needs. If a payment provider handles card details directly, your privacy policy can explain that payments are processed through a third party and that your clinic may not store full card numbers.

This is also a good place to check your internal access settings. Not every staff member needs to see payment notes, failed payment messages or refund reasons.

Pet Insurance

Insurance claims often involve sharing treatment records, invoices and clinical notes with an insurer. Your policy should explain when you share information with pet insurers and whether you need the client's consent first.

For example, if a client asks your clinic to lodge a $1,850 surgery claim for their dog, you may need to send the insurer itemised invoices and treatment notes. Your process should record that the client requested or authorised that sharing of sensitive information.

How Do Privacy Policies And Veterinary Terms And Conditions Work Together?

Your privacy policy and veterinary terms and conditions do different jobs, and your clinic will usually need both. The privacy policy explains how you handle personal information. Your client terms explain how your services, fees and clinic rules work.

Your terms and conditions might cover:

• how bookings, cancellations and late arrivals are handled
• consultation fees, estimates, deposits and payment due dates
• after hours fees or emergency care arrangements
• medicine, food and product returns
• client responsibilities, such as providing accurate information
• consent for treatment, sedation, surgery and referrals
• limits around non payment, abandoned animals and follow up care
• how privacy consents connect with insurance, reminders and photos

Your terms must also be fair and accurate. The Fair Trading Act 1986 prohibits misleading or deceptive conduct, so your pricing, refund and service statements need to match what you actually do. The Consumer Guarantees Act 1993 can also apply when you provide services or products to consumer clients, so your terms shouldn't suggest clients have fewer rights than the law gives them.

Be careful with broad disclaimers. For example, saying your clinic is never responsible for any outcome may be too blunt and may not reflect your actual legal position. Better terms explain the limits of veterinary care, the client's role in following instructions and what happens if complications or extra costs arise.

The documents should speak to each other. If your terms say clients consent to SMS reminders, your privacy policy should explain how reminder data is used and how clients can change preferences.

What Should You Do If Something Goes Wrong With Client Data?

If client data is lost, accessed by the wrong person or sent to the wrong recipient, act quickly and keep a clear record. A calm process is better than trying to work it out through scattered emails.

Start with these steps:

1. Contain The Issue: Disable accounts, recall emails, reset passwords or contact the platform provider.
2. Work Out What Happened: Record the date, systems involved, information affected and who may have accessed it.
3. Assess The Risk: Consider whether the breach could cause serious harm, such as financial loss, embarrassment, threats or misuse of identity information.
4. Notify If Required: If the breach has caused serious harm or is likely to do so, you must notify the Office of the Privacy Commissioner and affected people as soon as practicable, unless an exception or permitted delay applies.
5. Fix The Cause: Update permissions, train staff, change workflows or review the provider that caused the issue.

For access and correction requests, the Privacy Act 2020 gives you 20 working days to make and communicate a decision. You may need to provide the information, refuse for a lawful reason or explain how the client can ask for a correction.

For example, if a client asks for all information your clinic holds about them and their two cats, don't ignore it because the file is mainly veterinary notes. Treat it as a privacy request, diarise the 20 working day deadline and check whether any third party information needs to be managed carefully.

Key Takeaways

• A veterinary privacy policy in New Zealand should explain how you collect, use, store and share client information linked to pet care.
• IPP 3 applies when you collect information from a client directly, while IPP 3A can require reasonable notification steps when you collect it indirectly.
• Pet records can become personal information when they're connected to an identifiable client.
• Your policy should cover reminders, online booking tools, payment platforms, pet insurance claims, overseas handling and photo consent.
• Your client terms and conditions should work alongside your privacy policy, especially for fees, treatment consent, cancellations and communications.
• Notifiable privacy breaches must be reported to the Office of the Privacy Commissioner and affected people as soon as practicable, unless an exception or permitted delay applies.

If you'd like help with your veterinary privacy policy, client terms and conditions, booking platform privacy checks or photo consent wording, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.