Privacy Policy

Hibiscus Neuro Rehab Limited

Effective date: 1 September 2026 | Last updated : August 2026

Privacy at a Glance

We collect personal and health information to provide assessment, treatment and rehabilitation services.

We comply with the Privacy Act 2020 and the Health Information Privacy Code 2020.
We only collect information reasonably necessary for your care, communication, administration, ACC requirements and our legal and professional obligations.
We use secure systems including Cliniko, Microsoft 365, Heidi Health, Everbility and approved local or cloud-based storage solutions.
We use Heidi Health and Everbility to assist with clinical note-taking and documentation. AI does not make clinical decisions, and clinicians review AI-assisted documentation.
We may provide consultations by Zoom and may use clinical photographs or videos for assessment, treatment planning and progress monitoring.
We may share relevant information with ACC and healthcare providers involved in your care where authorised, necessary, permitted or required by law.
We do not sell your personal or health information.
You may request access to your information and ask us to correct it.
If a notifiable privacy breach occurs, we will notify affected individuals and the Office of the Privacy Commissioner where required.

Our Commitment to Privacy

Hibiscus Neuro Rehab Limited ("Hibiscus Neuro Rehab", "we", "our" or "us") is committed to protecting your privacy and managing your personal and health information responsibly.

As a New Zealand healthcare provider, we comply with the Privacy Act 2020 and the Health Information Privacy Code 2020. We take reasonable steps to ensure that personal and health information is collected for lawful purposes, kept secure and accurate, and used or disclosed only as permitted.

This policy explains what information we collect, why we collect it, how we use and protect it, when we may disclose it, and your rights regarding your information.

Who We Are

Hibiscus Neuro Rehab Limited is a New Zealand healthcare provider specialising in neurological rehabilitation, vestibular rehabilitation, concussion rehabilitation, balance and mobility services.

Privacy Officer

Hibiscus Neuro Rehab Limited

Email: sarah@hibiscusneurorehab.co.nz

Information We Collect

We may collect personal information including:

name, date of birth and contact details
address and emergency contact details
appointment information
payment and billing information
website enquiry and communication information

As part of providing healthcare services, we may also collect health information including:

medical history, health conditions and diagnoses
medications and relevant risk information
assessment findings and clinical notes
treatment plans, rehabilitation goals and progress information
referral information and reports from GPs, specialists, hospitals or other healthcare providers

ACC claim information and reports

relevant information provided by family members, carers, support workers or other people involved in your care
clinical photographs, videos and telehealth information where relevant to your care

How We Collect Information

We may collect information directly from you through:

website enquiry forms and online forms
telephone calls and emails
initial assessments and ongoing treatment sessions
telehealth and video consultations
information, photographs or videos you provide to us

With your authorisation, or where collection is otherwise permitted by law, we may also collect information from ACC, your GP, medical specialists, hospitals, other healthcare providers, family members, carers, support people or agencies involved in your care.

Why We Collect and Use Your Information

We collect and use information to:

assess your health and rehabilitation needs
provide treatment and rehabilitation services
develop and review individual rehabilitation plans and goals
communicate with you about appointments and care
coordinate care with other healthcare professionals and support people
complete ACC documentation, claims, reports and related administration
manage billing, payments and general administration
maintain safe, accurate and legally compliant clinical records
improve our services and meet legal, regulatory and professional obligations

We aim to collect only the information reasonably necessary for these purposes. If you choose not to provide information we reasonably need, we may be unable to provide some services safely or effectively.

Telehealth and Video Consultations

Hibiscus Neuro Rehab may provide telehealth services through video conferencing platforms, including Zoom. Information discussed during a telehealth consultation is treated with the same privacy and confidentiality as information discussed during an in-person consultation.

Relevant clinical information from a telehealth appointment may be added to your clinical record. We take reasonable steps to use secure technology and appropriate privacy settings. We ask clients to join telehealth appointments from a private location where possible.

A telehealth consultation will not be recorded unless this has been discussed with you and appropriate consent has been obtained.

Clinical Photographs and Videos

As part of assessment and treatment, we may take photographs or videos to assist with movement, balance, gait, vestibular or functional assessment, rehabilitation planning and monitoring progress over time.

Clinical photographs and videos form part of your health information. They are stored securely on authorised systems or secured clinical devices and, where required, downloaded to secure New Zealand-based storage used by Hibiscus Neuro Rehab.

We will seek separate, explicit consent before using identifiable photographs or videos for any purpose outside your clinical care, including education, marketing, testimonials or promotional activities. Declining promotional use will not affect your care.

Artificial Intelligence and AI-Assisted Documentation

Hibiscus Neuro Rehab uses approved artificial intelligence tools, including Heidi Health and Everbility, to assist with clinical note-taking, documentation, administrative tasks and communication drafting.

These tools support our clinicians and team but do not replace professional judgement or clinical decision-making. In particular:

clinical decisions are made by qualified healthcare professionals
AI is not used to make autonomous decisions about your care
AI-assisted notes and other clinical content are reviewed by a clinician before being finalised in the clinical record
information processed through AI-assisted documentation tools is used to support healthcare delivery, documentation and service administration
we take reasonable steps to assess the privacy and security safeguards of the AI providers we use some AI or cloud service providers may process or store information outside New Zealand. We do not state a specific overseas location unless it has been verified. Where overseas processing or disclosure occurs, we take reasonable steps to ensure appropriate privacy safeguards are in place.

How We Store and Protect Information

We take reasonable steps to protect personal and health information from loss, unauthorised access, misuse, disclosure, alteration or destruction.

Information may be stored or processed using:

Cliniko practice management software
Heidi Health and Everbility clinical documentation tools
Microsoft 365 business systems
secure New Zealand-based document and media storage
secure local clinical devices and systems
Rocketspark website services for website enquiries and related website functions

Access is restricted to authorised team members and service providers who require the information to perform their duties or provide services to us. We use reasonable administrative, technical and physical safeguards appropriate to the information involved.

Sharing Your Information

We do not sell your personal or health information.

We may disclose relevant information where this is necessary to provide or coordinate your care, where you have authorised the disclosure, or where disclosure is otherwise permitted or required by law. Recipients may include:

ACC and ACC case managers
GPs, medical specialists and hospitals
physiotherapists, occupational therapists, psychologists, speech-language therapists and other healthcare providers
support workers, carers and other authorised people involved in your rehabilitation
insurers or funders where authorised
legal representatives where authorised
government, regulatory or law enforcement agencies where legally required

We aim to disclose only the information reasonably necessary for the intended purpose.

Overseas Storage and Processing

Some technology and cloud service providers used by Hibiscus Neuro Rehab may process or store information outside New Zealand. Where overseas disclosure or processing occurs, we take reasonable steps to confirm that appropriate contractual, privacy and security safeguards apply and to meet our obligations under New Zealand privacy law.

Website, Rocketspark, Cookies and Analytics

Our website is hosted through Rocketspark. When you visit our website, information may be collected automatically, such as browser and device type, pages visited, time spent on the website, referral sources and general website usage information.

Our website may use cookies and analytics tools to support website functionality, understand how the website is used and improve the user experience. You may control or disable cookies through your browser settings, although some website functions may be affected.

Information submitted through website forms will be used to respond to your enquiry and provide requested services. Please avoid including unnecessary detailed health information in a general website enquiry form.

Marketing Communications

We may send service-related communications that are necessary for your appointments, care or administration. We will only send promotional electronic messages where permitted. You may unsubscribe from marketing messages using the unsubscribe option provided or by contacting us. Unsubscribing from marketing will not prevent necessary clinical or administrative communications.

Accessing and Correcting Your Information

You may ask to access the personal or health information we hold about you and request correction of information you believe is inaccurate, incomplete, outdated or misleading. Please contact our Privacy Officer. We may ask for proof of identity and may withhold information only where permitted by law.

If we do not make a requested correction, you may ask us to attach a statement of correction to the information where applicable.

Retention and Secure Disposal

We retain health information for as long as required by applicable legal, professional and healthcare record-keeping obligations, and for as long as it is lawfully needed for the purpose for which it was collected. When information is no longer required, we securely destroy it or permanently de-identify it.

Privacy Breaches

If a privacy breach occurs, we will take reasonable steps to contain and assess it. Where a breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of external websites. We encourage you to review their privacy policies before providing personal information.

Changes to This Policy

We may update this Privacy Policy when our services, systems or legal obligations change. The current version,including its effective date and last updated date, will be available on our website.

Privacy Questions and Complaints

If you have a question or concern about how we have collected, used, stored or disclosed your personal or health information, please contact our Privacy Officer so we can investigate and respond.