1. Introduction

PONSONBY A & E DENTAL LIMITED (“we”, “us”, “our”) is committed to protecting the privacy and confidentiality of personal information we collect about our patients and other individuals in the course of providing dental care and related services. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information in accordance with the Privacy Act 2020 (New Zealand) and the Health Information Privacy Code 2020.

By accessing our services, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are

PONSONBY A & E DENTAL LIMITED is a dental clinic located in Auckland, New Zealand. We provide a range of dental services including general dentistry, emergency dental care, and specialist dental treatments. As a healthcare provider, we are subject to the Health Information Privacy Code 2020, which governs the collection and use of health information in New Zealand.

Contact details for privacy-related enquiries:

• Name: Privacy Officer, PONSONBY A & E DENTAL LIMITED
• Email: reception@ponsonbyaedental.co.nz
• Phone: 09-376 9222
• Address: 1/1 Prosford Street, Ponsonby, Auckland 1011
• Website: ponsonbyaedental.co.nz

3. What Personal Information We Collect

We collect personal information that is necessary to provide you with dental and healthcare services. This may include:

3.1 Personal Identification Information

• Full name, date of birth, gender
• Contact details (address, phone number, email address)
• Emergency contact information
• Identity verification documents when required

3.2 Health Information

• Medical and dental history
• Current medications, allergies, and health conditions
• Dental treatment records, X-rays, photographs, and clinical notes
• Information about referrals to specialists or other healthcare providers
• Any other health information relevant to your dental care

3.3 Financial Information

• Health insurance and ACC details
• Payment records and billing information
• Southern Cross or other health fund membership details

3.4 Website, Communication and Marketing Data

• Contact form submissions and appointment requests
• Email correspondence
• Website usage data (via cookies and analytics tools)
• Name, email address, and phone number submitted via Google Ads lead forms
• Data collected through third-party advertising platforms (such as Google Ads) when you interact with our online advertisements

4. How We Collect Your Information

We collect personal information directly from you in the following ways:

• Patient registration and intake forms (paper or electronic)
• In-person consultations and clinical assessments
• Telephone, email, or online communications
• From your GP, specialists, or other healthcare providers (with your consent where required)
• From ACC or insurance providers in relation to a claim
• Through our website (including contact forms and appointment booking)
• Through Google Ads lead forms, when you submit an enquiry via one of our online advertisements

Where possible, we collect personal information directly from you. In some circumstances, we may collect information from third parties (e.g., a referral from another healthcare provider, or via Google Ads when you respond to one of our advertisements). We will only do so where it is lawful and appropriate to do so.

5. Indirect Collection of Information (IPP3A)

The Privacy Act 2020 introduced Information Privacy Principle 3A (IPP3A), which requires us to notify you when we collect personal information about you indirectly — that is, from a source other than you personally.

5.1 When Indirect Collection Occurs

In the course of providing dental and healthcare services, it is common for us to receive information about you from other health providers. This happens so that we can provide you with fully informed, clinically appropriate care. Common examples of indirect collection at our clinic include:

• Referral letters and clinical summaries from your general practitioner (GP) or family doctor
• Records or discharge summaries from hospital emergency departments
• Reports and clinical notes from specialist clinics (e.g., oral surgeons, orthodontists, periodontists, or other dental specialists)
• Radiology and dental imaging reports from external imaging providers
• Pathology or laboratory results from external lab services
• Treatment records or notes transferred from your previous dental practice
• Information received from ACC in relation to an accident claim or dental trauma
• Information from your health insurer relevant to a claim or pre-authorisation
• Contact information or enquiry details received via third-party advertising platforms, such as Google Ads lead forms

5.2 How We Will Notify You

When we collect information about you indirectly, we will take reasonable steps to make you aware of this. In most cases, this notification will occur at or before your first or next appointment with us. We will inform you of:

• The fact that information about you has been collected from a third party
• The source from which the information was obtained
• The purpose for which it was collected
• Your right to access and request correction of that information
• Any persons or organisations to whom we routinely disclose such information

Where it is not practical to notify you in advance (for example, in an emergency situation), we will notify you as soon as reasonably practicable thereafter.

5.3 Exceptions to Notification

There are circumstances where notification may not be required or may not be reasonably practicable. These include situations where:

• Notification would endanger your health or safety, or the safety of another person
• The information was collected and used in an emergency to protect your life or health
• Providing notification is not reasonably practicable given the circumstances
• An exception applies under the Privacy Act 2020 or the Health Information Privacy Code 2020

All information collected indirectly is held and treated with the same level of care, confidentiality, and security as information you provide directly to us. You retain the same rights to access and correct indirectly collected information as you do for directly collected information (see Section 11).

6. Why We Collect and Use Your Information

We collect and use your personal information for the following purposes:

• To provide dental care, treatment, and related healthcare services
• To maintain accurate and up-to-date clinical records
• To communicate with you about appointments, treatment plans, and follow-up care
• To process payments and manage billing and insurance claims
• To comply with legal and regulatory obligations, including the Health and Disability Commissioner Act 1994
• To refer you to specialists or other healthcare providers as required
• To respond to ACC claims and other insurance-related matters
• To improve the quality and safety of our services
• To send appointment reminders or relevant health information (where you have consented)
• To follow up on enquiries submitted via Google Ads lead forms or other online advertising channels
• To measure the effectiveness of our advertising campaigns using tools such as Google Ads conversion tracking

We will only use your personal information for the purposes for which it was collected, unless you consent to another use, or we are required or authorised by law to use it for another purpose.

7. Disclosure of Your Information

We treat your personal information with strict confidentiality. We may share your information in the following circumstances:

7.1 With Your Consent

We may share your information with other healthcare providers (such as specialists, GPs, or hospitals) when you have given us permission to do so, or where it is clearly in your best interests.

7.2 Legal Requirements

We may disclose your information if required by law, a court order, or a regulatory authority. This includes the Health and Disability Commissioner, the Dental Council of New Zealand, or the Privacy Commissioner.

7.3 ACC and Insurance

We will share relevant information with ACC or your health insurer in relation to the processing of claims and entitlements.

7.4 Service Providers

We may share information with trusted third-party service providers (such as laboratory services, X-ray facilities, or software providers) who assist us in delivering our services. These providers are required to maintain the confidentiality and security of your information.

7.5 Emergency Situations

In an emergency, we may disclose relevant information to other healthcare providers to protect your health or safety, or that of another person.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

8. Storage and Security of Your Information

We take reasonable steps to protect your personal information from unauthorised access, use, disclosure, loss, or destruction. Our security measures include:

• Secure physical storage of paper records in locked cabinets
• Electronic records stored in secure, password-protected practice management software
• Staff training on privacy obligations and confidentiality
• Restricting access to personal information to authorised personnel only
• Regular review and updating of our security practices

While we take all reasonable precautions, no security system is completely impenetrable. In the event of a privacy breach that is likely to cause serious harm, we will notify affected individuals and the Privacy Commissioner as required under the Privacy Act 2020.

9. How Long We Retain Your Information

We retain patient health records for a minimum of 10 years from the date of the last treatment, or until the patient turns 26 years of age (whichever is later), in accordance with the Health Information Privacy Code 2020 and professional obligations. Financial and administrative records are retained in accordance with the requirements of the Companies Act 1993 and the Tax Administration Act 1994.

When your information is no longer required, we will securely dispose of or anonymise it.

10. Children’s Privacy

When treating patients under 16 years of age, we collect information from and communicate with parents or legal guardians who have provided consent for the child’s treatment. We handle children’s health information with the same standards of care and confidentiality as adult patient information.

11. Your Rights Under the Privacy Act 2020

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the right to:

11.1 Access Your Information

You may request access to the personal information we hold about you. We will respond to access requests within 20 working days. In some circumstances, we may be permitted to withhold certain information (for example, if disclosure could endanger your health or safety, or the safety of others).

11.2 Correct Your Information

If you believe that personal information we hold about you is inaccurate, incomplete, or out of date, you may ask us to correct it. We will either make the correction or, if we disagree, note your request on the record.

11.3 Complain About a Privacy Breach

If you believe we have breached your privacy rights, we encourage you to contact us directly so we can address your concern. You also have the right to make a complaint to the Privacy Commissioner at:

• Office of the Privacy Commissioner: www.privacy.org.nz
• Phone: 0800 803 909
• Email: enquiries@privacy.org.nz

12. Website, Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve your browsing experience and to support our advertising activities. Cookies are small text files placed on your device when you visit our website.

12.1 Types of Cookies We Use

• Essential cookies: Required for the website to function correctly (e.g., session management, form submissions).
• Analytics cookies: We use Google Analytics to understand how visitors use our website. This data is aggregated and does not personally identify you.
• Advertising cookies: We use Google Ads cookies to measure the effectiveness of our advertising campaigns, track conversions (e.g., when you call us or submit an enquiry after clicking an ad), and to show relevant ads to people who have previously visited our website (remarketing).

12.2 Managing Cookies

You may disable or delete cookies through your browser settings at any time. Please note that disabling certain cookies may limit the functionality of our website. You may also opt out of Google’s use of advertising cookies by visiting Google’s Ads Settings, or by visiting the Network Advertising Initiative opt-out page.

12.3 Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies before providing any personal information.

13. Google Ads and Online Advertising

13.1 Google Ads Conversion Tracking

We use Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. When you click on one of our Google Ads and then complete an action on our website (such as submitting a contact form or calling us), a cookie is placed on your device. This allows Google and us to track that a conversion has occurred. The information collected is used only to measure campaign performance and is not used to personally identify you without your consent.

13.2 Google Ads Lead Forms

We may use Google Ads lead forms to allow prospective patients to submit enquiries directly through our Google advertisements. When you submit a lead form, the information you provide (such as your name, email address, and phone number) is collected by Google and forwarded to us. We use this information solely to respond to your enquiry and, where you have consented, to communicate with you about our services.

Lead form submissions are handled in accordance with both this Privacy Policy and Google’s Privacy Policy. We do not use lead form data for any purpose other than responding to your enquiry and following up as requested.

13.3 Remarketing

We may use Google Ads remarketing features to display advertisements to previous visitors of our website on other websites across the internet. This is done using cookies and does not involve the use of any personally identifiable information. You may opt out of remarketing as described in Section 12.2 above.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or other factors. The updated policy will be posted on our website and the effective date will be revised accordingly. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the personal information we hold about you, please contact our Privacy Officer: