Privacy Policy

1. Our commitment to you

Caring for people means being trusted with their information, and we take that as seriously as the care itself. Promisia Healthcare is committed to being open about how we collect, store, use and share personal information, including, where an enduring power of attorney acts on behalf of a resident, the personal information of that resident.

Three principles sit behind everything in this policy:

We handle personal information in accordance with New Zealand privacy law at all times.
We only use your information where it is needed to provide our services or run our business.
We never use or share your information for unrelated purposes without first getting your consent.

2. Who we are and what this policy covers

In this policy, “Promisia”, “we”, “us” and “our” mean Promisia Healthcare Limited (NZX: PHL) and its related companies. Promisia operates residential aged care and retirement living communities in New Zealand: Ranfurly Manor and Nelson Street in Feilding, Aldwins House and Chatswood (60 Hawford Road, Opawa) in Christchurch, and Golden View (17 Iles Street) and Ripponburn in Cromwell. Our services include resthome, hospital, dementia, respite, palliative and young persons with disability care, independent living options, and online services such as this website (together, the “Services”).

This policy explains how we meet our obligations under the Privacy Act 2020 and, for health information, the Health Information Privacy Code 2020. It applies to residents and their families, prospective residents, employees and job applicants, suppliers, shareholders and anyone else who provides us with personal information.

“Personal information” means information that identifies you, such as your name, contact details, date of birth or financial details. Some of what we hold is sensitive information, in particular health information, and we treat it with extra care.

3. Changes to this policy

We may update this policy from time to time. The current version will always be published on this page, and where changes are significant we will draw attention to them on the website or by email. Continuing to use our Services after a change takes effect means you accept the updated policy.

4. What we collect

Information you give us directly, for example when you enquire, book a visit, join a waitlist, complete an admission agreement, apply for a role, or use our website forms. Depending on the situation this can include:

Your name, and photographs, for example on a resident directory, a room door, or event photos from village life.
Demographic details such as date of birth, gender, title and spoken languages.
Contact details: address, email and phone, and the names and contact details of your nominated representatives and family members.
Health information: your medical history, disabilities, current medications, and information created before or during the provision of care to you, handled under the Health Information Privacy Code 2020.
Copies of enduring powers of attorney for care and welfare or property, and the contact details of appointed attorneys.
Records of consents you have given.
Financial information such as bank account and IRD details where needed for billing, subsidies or employment.
For job applicants: work history, qualifications and referee details.

Information from others, with your authority: from your GP, hospital or other health providers, needs assessment services, Work and Income in relation to subsidies, referees, Police vetting for staff, and family members or representatives acting for you.

Information collected automatically: basic website usage information such as pages visited, device type and IP address, collected using cookies and similar technologies to help us improve the site. Our communities also operate CCTV in shared and exterior areas for the safety of residents, staff and visitors.

Information you make public, for example on social media where you interact with our pages.

If you give us personal information about someone else, such as a family member or your lawyer, please make sure they know you have done so, why, and that they can contact us to access or correct it.

You can always choose not to provide information, though in some cases that may mean we cannot provide the Services.

5. Links to other websites

Our website links to sites we do not control, such as NZX, our share registry, Work and Income and QJumpers. Their privacy practices are their own; please review their policies. We are not responsible for the content or privacy practices of linked sites.

6. How we use your information

We use personal information only to provide the Services, to meet our legal obligations, or with your consent. In practice that includes:

Providing care and accommodation, including maintaining clinical records and assessments (for example in interRAI and our clinical management systems).
Responding to enquiries, arranging visits and viewings, and managing waitlists.
Administration: billing, record keeping, training, audits and quality improvement.
Communicating with you, your family and your nominated representatives.
Working with Health New Zealand Te Whatu Ora under our contracts, including audits of our facilities, and supporting applications for government subsidies.
Assessing employment applications and managing employment.
Sending you updates or marketing you have opted into, which you can unsubscribe from at any time.
Reviewing CCTV footage to keep people safe, investigate incidents, and deter inappropriate behaviour.
Meeting our legal and regulatory obligations, including as an NZX-listed company.

We do not sell, trade or rent your personal information. We share it outside Promisia only where needed for the purposes above, for example with:

Health New Zealand Te Whatu Ora, needs assessment services, auditors of our care, and your own health providers.
Work and Income, in connection with the Residential Care Subsidy where you ask us to assist.
Service providers who help us run the business, such as IT, payroll and, for shareholders, our share registry MUFG Pension and Market Services, all bound to protect your information.
Referees, vetting and credit-check agencies where relevant and authorised.
Debt collection agencies, only where necessary to recover amounts owing.

We may also disclose information where the law requires it, for example a court order or statutory investigation, or where disclosure is necessary to prevent a serious threat to someone's life, health or safety. Where possible and appropriate, we will tell you first.

8. Information stored overseas

Some of our systems, including this website's database, are hosted with reputable cloud providers whose servers may be located outside New Zealand, including Australia. We only use providers we reasonably believe protect personal information to standards comparable to New Zealand privacy law.

9. Storage and security

We take reasonable technical and organisational precautions to protect personal information from loss, misuse and unauthorised access, modification or disclosure. If a privacy breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Privacy Commissioner as the Privacy Act requires.

10. Emails, texts and marketing

We comply with the Unsolicited Electronic Messages Act 2007. If you subscribe to updates, you can unsubscribe at any time using the link in any message or by contacting us, and we will remove you from the relevant list promptly.

11. Access and correction

You may ask for a copy of the personal information we hold about you, and ask us to correct it, at any time. Put your request in writing to our Privacy Officer at info@promisia.co.nz. We will respond as soon as reasonably practicable, and within 20 working days. If we cannot provide something, we will explain why. Current employees should contact their manager or the office for employment records.

12. How long we keep information

We keep personal information only as long as we need it for the purposes above or as the law requires. Health records must be kept for at least 10 years from the last time we provided services to that person, under the Health (Retention of Health Information) Regulations 1996. After the applicable period, information is securely deleted or anonymised.

13. Questions and complaints

We take concerns seriously. Contact our Privacy Officer at info@promisia.co.nz and we will respond within 20 working days and handle every complaint fairly. If you remain unsatisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909.

14. Publication and review

This policy is published at promisia.co.nz and is reviewed at least every two years, or sooner if the law or our practices change.