Privacy Policy

1. About this Policy

This Privacy Policy describes how Carepon and its affiliated entities ("Carepon", "we", "us") collect, hold, use and disclose personal information about individuals in New Zealand. It applies to all Carepon platforms, mobile applications, and digital services.

We are committed to handling your personal information in accordance with the New Zealand Privacy Act 2020 and the thirteen Information Privacy Principles (IPPs).

2. Products and Services Covered

• Digital health services
• Marketplace services and referrals
• Appointment, delivery, and pharmacy-related services
• Carepon mobile and web applications
• Partner-integrated services
• Customer support services

Use of any Carepon product or service implies agreement with this Privacy Policy.

3. What Personal Information We Collect

"Personal information" means information about an identifiable individual. We may collect:

3.1 Identifiers and contact details

• Name, date of birth, gender
• Postal and physical addresses
• Email address, mobile and telephone numbers

3.2 Online identifiers

• IP address, device and browser data
• Cookies and usage analytics

3.3 Engagement and transactions

• Bookings, appointments, referrals
• Communications, queries and complaints
• Payment and billing data

3.4 Health information

Where you use Carepon's digital health services, we may collect health information. In New Zealand, health information is also subject to the Health Information Privacy Code 2020, and we handle it accordingly.

4. How We Apply the 13 Information Privacy Principles

Our handling of personal information is governed by the IPPs set out in the Privacy Act 2020:

• IPP 1–4 (Collection): We only collect personal information that is necessary for a lawful purpose connected to a Carepon function or activity, collect it directly from you where reasonably practicable, and tell you why we are collecting it and who will receive it. Collection is fair and not unreasonably intrusive.
• IPP 5 (Storage and security): We protect personal information with reasonable safeguards against loss, unauthorised access, use, modification or disclosure.
• IPP 6 (Access): You have the right to request confirmation of, and access to, personal information we hold about you.
• IPP 7 (Correction): You may request correction of personal information you believe is inaccurate.
• IPP 8 (Accuracy): Before using or disclosing personal information, we take reasonable steps to ensure it is accurate, up to date and complete.
• IPP 9 (Retention): We do not keep personal information for longer than is required for the purposes for which it may lawfully be used.
• IPP 10 (Use): We use personal information only for the purpose for which it was collected, or for a directly related purpose, unless an exception under the Act applies.
• IPP 11 (Disclosure): We disclose personal information only where authorised by you, where it is one of the purposes of collection, or where otherwise permitted under the Act.
• IPP 12 (Cross-border disclosure): If we disclose personal information to a recipient outside New Zealand, we take reasonable steps to ensure the recipient is subject to comparable privacy safeguards, or rely on another lawful basis under IPP 12.
• IPP 13 (Unique identifiers): We assign unique identifiers (such as account IDs) only where necessary for our operations, and do not require you to disclose unique identifiers assigned by other agencies except as permitted by the Act.

5. How We Collect Your Personal Information

• Directly from you during registration, bookings, support and other interactions
• Automatically through analytics and device technologies when you use our services
• From partners such as pharmacies, healthcare professionals, payment providers, and delivery partners
• From publicly available sources, where lawful

6. Why We Use Your Personal Information

• To provide, administer and improve Carepon products and services
• To verify identity and maintain accounts
• To process transactions, bookings, referrals and payments
• To communicate about your services and respond to enquiries
• To meet legal, regulatory and risk-management obligations
• To detect and prevent fraud, misuse and security incidents
• For analytics, research and product development (using de-identified data where practicable)

Where the law requires consent (for example, for certain uses of health information or marketing), we will ask for it and you may withdraw consent at any time.

7. Sharing and Cross-Border Disclosure

We may share personal information with:

• Healthcare providers and pharmacies you transact with via Carepon
• Payment, delivery and identity-verification providers
• Cloud hosting and analytics providers
• Regulators and law enforcement, where required or authorised

Some of these recipients may be located outside New Zealand. Where this occurs, we comply with IPP 12 by ensuring the recipient is subject to comparable privacy safeguards (including via contractual data-protection terms) or by relying on another lawful basis under the Act.

8. Retention

We retain personal information only as long as necessary for the purposes for which it was collected and to meet our legal and regulatory obligations. After that, we securely delete or de-identify it.

9. Security

• Encryption in transit and at rest
• Role-based access controls and authentication
• Monitoring, logging and incident response
• Regular vulnerability testing and assessments
• Confidentiality obligations for staff and partners

10. Privacy Breach Notification

In line with Part 6 of the Privacy Act 2020, if we experience a privacy breach that has caused, or is likely to cause, serious harm to affected individuals, we will notify the Office of the Privacy Commissioner and the affected individuals as soon as practicable.

11. Your Rights

• Request access to personal information we hold about you (IPP 6)
• Request correction of inaccurate information (IPP 7)
• Withdraw consent where processing is based on consent
• Make a complaint about how we have handled your personal information

We may need to verify your identity before responding to a request.

12. Cookies and Tracking

We use cookies and similar technologies to authenticate users, remember preferences, measure performance and improve the service. You can control cookies through your browser settings.

13. Children

Carepon's services are not directed to children under 16. Where parental or guardian consent is required for a child to use a service, we will obtain it before collecting personal information.

14. Contact Us and Complaints

To exercise a right, ask a question, or make a complaint:

Carepon Privacy Office
Email: privacy@carepon.global
Website: https://carepon.global

If you are not satisfied with our response, you may complain to the New Zealand Office of the Privacy Commissioner:

Website: privacy.org.nz
Email: enquiries@privacy.org.nz
Phone: 0800 803 909