Our Commitment to Privacy

Mercy Hospice respects your privacy and is committed to protecting your personal and health information. We collect, use, store, retain, and share information only where it is reasonably necessary for lawful care, support, operational, employment, education, fundraising, volunteer, safety, and related purposes. We take reasonable steps to ensure information is protected from loss, unauthorised access, use, modification, or disclosure.

We handle information in accordance with New Zealand’s:

• Privacy Act 2020 (Act); and
• Health Information Privacy Code 2020 (Code)

This Privacy Statement explains how we collect, use, store, and share personal information – it is separated in sections relating to each audience:

• Patients receiving hospice services, and their whānau, carers, and support people
• Donors and supporters
• Volunteers
• Education and training participants
• Employees, prospective employees, contractors and those on clinical placement
• Visitors to Mercy Hospice sites

Patients, Whānau and Carers

Information We May Collect

We may collect:

• Name, address, date of birth, gender, ethnicity, contact details, and National Health Index (NHI) number
• Information required to determine eligibility for publicly funded services
• Medical history, diagnosis, symptoms, medications, allergies, laboratory results, imaging results, and treatment information
• Clinical assessments, notes, care plans, treatment records, and service information
• Communication needs and preferences
• Cultural, spiritual, emotional, social, practical, and wellbeing information relevant to care
• End-of-life preferences and goals of care
• Information regarding family, whānau, carers, support people, attorneys, welfare guardians, and authorised representatives
• Consent records and information-sharing preferences
• Feedback, compliments, complaints, incidents, investigations, and quality improvement information
• Information required to meet legal, audit, funding, reporting, and safety obligations

Where Information Comes From

Information may be collected from:

• You directly
• Your legal representative or authorised representative
• General practitioners, specialists, and other healthcare providers
• Health New Zealand services
• Community nursing services
• Laboratories, pharmacies, imaging providers, and ambulance services
• Shared-care records and authorised health information systems
• Community, social service, disability, and support agencies involved in your care
• Family, whānau, carers, and support people involved in your care and support

Indirect Collection of Information

Sometimes we collect personal or health information from sources other than you directly. This is known as indirect collection. When this occurs, we will take reasonable steps to inform you, in accordance with Information Privacy Principle 3A of the Act and Rule 3A of the Code, about the following matters:

• That information has been collected
• Why the information was collected
• The intended recipients of the information
• Where the information was collected from
• Who collected and holds the information
• Whether collection is authorised or required by law, and, where applicable, the relevant legal authority
• Your rights of access and correction

For routine hospice referrals and care activities, we will generally provide this information as soon as reasonably practicable after collecting the information and, in most cases, during our first successful contact with you and no later than your initial assessment, unless an earlier notification is impracticable or a lawful exception applies.

This statement serves as a standing explanation of routine referral, assessment, treatment, and care information flows. We may not repeat the same notification each time routine updates, results, or care information are received where you are already aware of the fact of collection, the purpose of collection, the recipients of the information, and your privacy rights.

Additional notification may be provided where information is collected from a materially new source, for a new purpose, or where particularly sensitive information is involved.

Providing Information

Most information is provided voluntarily or with your authority. Some information is necessary for us to assess referrals, determine eligibility, provide safe care, coordinate services, and comply with legal obligations.

If you choose not to provide information, or do not authorise access to relevant information, we will explain any genuine consequences and consider reasonable alternatives where possible.

Where collection is specifically authorised or required by law, we will identify the relevant legal authority unless a lawful exception applies.

How We Use Information

We use personal and health information to:

• Assess referrals, needs, service requirements, and eligibility
• Deliver hospice and palliative care services
• Assess, plan, document, review, and coordinate care
• Manage appointments and service delivery
• Communicate with patients, families, whānau, carers, support people, and healthcare providers
• Support cultural, spiritual, emotional, social, and practical wellbeing
• Ensure patient safety and continuity of care
• Manage concerns, incidents, feedback, and complaints
• Improve quality, safety, effectiveness, and equity of services
• Undertake service planning and improvement activities
• Undertake reporting using de-identified or aggregated information where appropriate
• Meet legal, professional, funding, audit, regulatory, and reporting obligations

Who We Share Information With

We may share personal and health information, where this is reasonably necessary and permitted, authorised or required by law, including under the Act and the Code, with:

• Mercy Hospice clinical and support staff who require the information for their role
• Health New Zealand services
• General practitioners, specialists, community nursing providers, pharmacies, laboratories, and other healthcare providers involved in care
• Family, whānau, carers, support people, and authorised representatives where authorised by you or otherwise lawful
• Students/trainees and visiting clinicians involved in care under appropriate supervision and confidentiality obligations
• Information technology and operational service providers supporting Mercy Hospice systems
• Government agencies, funders, auditors, and regulators
• Emergency services or persons able to help where disclosure is necessary to prevent or lessen a serious threat to health or safety
• Legal, indemnity, insurance, governance, and professional advisors where reasonably necessary for Mercy Hospice’s operations or legal requirements.

We will only share the minimum information reasonably necessary for the relevant purpose. Where personal or health information is disclosed outside New Zealand, appropriate legal and security safeguards will be applied.

Family, Whānau and Support People

You may choose:

• Who receives information about you
• What level of information each person may receive
• Whether detailed clinical information, general updates, or practical information only may be shared
• Individuals who must not receive information about you

You may change your preferences at any time.

Mercy Hospice will take reasonable steps to verify identity before sharing information. Being listed as an authorised contact does not automatically grant authority to make healthcare decisions or access a complete clinical record.

Students, Training and Digital Tools

Mercy Hospice participates in healthcare education and training and may host students, trainees, and clinical placement participants within its services.

Mercy Hospice may also use digital tools and technologies to support clinical documentation, communication, education, and operational efficiency. Where these tools process personal or health information on Mercy Hospice’s behalf, we will take reasonable steps to ensure appropriate privacy, confidentiality and security safeguards apply.

If you have concerns about student involvement or the use of optional digital tools, please discuss these with us. Choosing not to participate in an optional educational activity or digital tool will not affect the provision of ordinary care.

Information After Death

Information-sharing permissions that applied during a patient’s lifetime generally cease on death.

Mercy Hospice may inform appropriate persons of the fact of death. Detailed health information or clinical records will only be disclosed where the requester demonstrates lawful authority, such as being the executor or administrator of the estate, or where another lawful basis for disclosure exists.

An Enduring Power of Attorney does not automatically continue after death. Requests for access to information following death will be assessed in accordance with the Health Information Privacy Code and other applicable law.

Retention of Health Information

Health information is retained for as long as required to support patient care and meet legal, clinical, regulatory, audit, and reporting obligations.

Health records are generally retained for at least 10 years after the last service provided and may be retained longer where required by law or clinical need. Records are not automatically destroyed when a patient dies.

Patient Rights

Patients have the right to:

• Be informed about how information is collected and used
• Be informed about indirect collection of information
• Ask whether Mercy Hospice holds information about them
• Request access to personal or health information
• Request correction of inaccurate, incomplete, or misleading information
• Request that a statement of correction be attached to a record where a correction is not made
• Withdraw consent for particular uses where appropriate
• Raise concerns, complaints, or privacy enquiries

Donors and Supporters

Information We Collect

We may collect:

• Name and contact details
• Donation history
• Giving preferences
• Communication preferences
• Participation in fundraising events and activities
• Payment information processed through authorised payment providers

Where Information Comes From

Information may be collected directly from donors and supporters through:

• Donations
• Fundraising activities
• Event registrations
• Communications with Mercy Hospice
• Third-party fundraising and payment platforms acting on our behalf

How We Use Information

We use donor information to:

• Process donations
• Issue receipts and acknowledgements
• Communicate fundraising activities and organisational updates
• Understand supporter engagement
• Meet legal, taxation, financial, and reporting obligations

Sharing Information

Information may be shared with:

• Payment processing providers
• Trusted fundraising and communications providers
• Auditors, accountants, and regulators
• Legal and professional advisors where necessary

Retention

Donation and financial information is retained in accordance with legal, financial, taxation, and audit requirements.

Your Rights

Donors and supporters may:

• Request access to their personal information
• Request correction of information
• Opt-out of fundraising and marketing communications at any time

Volunteers

Information We Collect

We may collect:

• Name and contact details
• Emergency contact details
• Skills, qualifications, and experience
• Reference and background check information
• Health and safety information
• Volunteer activity, availability, and scheduling records

Where Information Comes From

Information is generally collected directly from volunteers and, where authorised:

• Referees
• Vetting providers
• Training organisations

How We Use Information

We use volunteer information for:

• Recruitment and onboarding
• Placement and scheduling
• Health and safety management
• Volunteer support and coordination
• Recognition and engagement activities

Sharing Information

Information may be shared with:

• Staff members responsible for volunteer management
• Training providers
• Health and safety personnel
• Relevant authorities where required by law

Retention

Volunteer information is retained only for as long as reasonably necessary to manage volunteer relationships and meet legal obligations.

Your Rights

Volunteers may request access to and correction of personal information held by Mercy Hospice.

Education and Training Participants

Information We Collect

We may collect:

• Name and contact details
• Organisation or employer
• Registration and attendance information
• Payment information where applicable
• Feedback and evaluation data

How We Use Information

We use information for:

• Programme administration
• Course delivery
• Communication of materials and updates
• Evaluation and programme improvement

Sharing Information

Information may be shared with:

• Course facilitators
• Administration providers
• Accreditation bodies where necessary
• Payment service providers where applicable

Retention

Information is retained for programme administration, reporting, and compliance purposes for appropriate periods.

Your Rights

Participants may request access to and correction of their personal information.

Employees, Prospective Employees, Contractors and Clinical Placement Personnel

Information We Collect

We may collect:

• Name and contact information
• Employment history, qualifications, and registrations
• Curriculum vitae, applications, interviews, and recruitment records
• Identity verification documents
• Police vetting and background check information where required
• Occupational health and workplace safety information
• Payroll, banking, taxation, and employment administration information
• Training, performance, development, and employment records

Where Information Comes From

Information may be obtained from:

• The individual
• Referees
• Professional registration bodies
• Education providers
• Vetting agencies
• Laboratories & immunisation registers
• Recruitment agencies where applicable

How We Use Information

We use information for:

• Recruitment and selection
• Employment administration
• Payroll and benefits administration
• Health and safety management
• Professional development
• Workforce planning
• Performance and employment management
• Compliance with legal obligations

Sharing Information

Information may be shared with:

• Payroll providers
• Government agencies
• Professional registration bodies
• Insurers
• Occupational health providers
• Legal and professional advisors
• Auditors and regulators where required

Retention

Employment records are retained in accordance with employment legislation and organisational requirements. Information relating to unsuccessful applicants is retained only for a reasonable period unless consent for longer retention is obtained.

Your Rights

Employees, applicants, contractors, and placement personnel may request access to and correction of their personal information.

Visitors to Mercy Hospice Sites

Information We Collect

We may collect:

• Name and contact details
• Organisation or company
• Vehicle information
• Entry and departure information
• Purpose of visit
• CCTV video (no audio) captured in public areas

How We Use Information

We use visitor information to:

• Manage access to facilities
• Maintain site security
• Support emergency procedures
• Meet health and safety obligations
• Protect patients, visitors, staff, and property

Sharing Information

Information may be shared with:

• Security providers
• Emergency services
• Health and safety personnel
• Law enforcement agencies where authorised or required by law

Retention

Visitor records and CCTV footage are retained only for as long as necessary for safety, security, investigation, or legal purposes.

Your Rights

Visitors may request access to their personal information and request correction where appropriate.

Information Security

Mercy Hospice takes reasonable safeguards to protect information from loss, unauthorised access, disclosure, misuse, modification, or destruction. These safeguards include:

• Secure electronic systems
• Access controls and user permissions
• Physical security measures
• Staff confidentiality obligations
• Information security policies and procedures
• Security controls applied to third-party service providers

Cross-Border Disclosures

Where personal or health information is disclosed or stored outside New Zealand, Mercy Hospice will take reasonable steps to ensure appropriate legal and security safeguards apply in accordance with New Zealand privacy law.

Cookies and Online Information

Mercy Hospice may collect information about website usage, including cookies, IP addresses, and similar technologies, to:

• Improve website functionality
• Understand website usage and performance
• Improve online services

Contact Us

Privacy Officer
Mercy Hospice
PO Box 47693
Ponsonby
Auckland 1144

Phone: +64 9 361 5966 and ask for the Privacy Officer
Email: use the Contact Us form linked below

Making a Complaint

If you have concerns about how your information has been handled, please contact Mercy Hospice in the first instance.

You may also contact:

• Office of the Privacy Commissioner
• Health and Disability Commissioner

Updates to This Statement

We may update this Privacy Statement from time to time. The latest version will be available on our website.