Privacy policy

This Privacy Notice explains how ADHD Simple collects, uses, stores, protects and shares your personal information when you use our services. We are committed to protecting your privacy and handling your information in accordance with the Privacy Act 2020, the Health Information Privacy Code 2020, and other applicable laws and professional obligations.

In New Zealand, ADHD Simple is operated by ADHD Test NZ Limited (company number 9367751). We are part of the group owned by Simple Health Technology Limited (New Zealand company number 9316973). The group also operates ADHD Simple through ADHD Simple Pty Limited in Australia and ADHD Test Limited in the United Kingdom. ADHD Test NZ Limited is responsible for the personal information it collects and holds when providing New Zealand services.

The group consists of our parent, Simple Health Technology Limited, and the three operating companies: ADHD Test NZ Limited, ADHD Simple Pty Limited and ADHD Test Limited. All employees, clinicians and contractors working for these companies who handle your information must follow the privacy, confidentiality and security requirements that apply to it. This includes this notice when they handle information on behalf of our New Zealand service. Each operating company remains responsible for its own services and applicable local privacy obligations.

If this notice and our terms differ about how we handle your information, this notice applies.

If you have any questions about this Privacy Notice or how we handle your personal information, please contact us:

Email: contact@adhdsimple.co.nz

• Name, preferred name and previous names where relevant
• Date of birth
• Gender, pronouns and sex assigned at birth where clinically relevant
• Residential and postal address
• Email address
• Telephone numbers
• Emergency contact and next-of-kin details
• Family members, carers, whānau and support people that you nominate
• National Health Index (NHI) number and other healthcare identifiers
• Medical history
• Mental health history
• ADHD assessments
• Screening questionnaires
• Diagnoses
• Medications
• Allergies
• Blood pressure, pulse and other clinical observations
• Blood test, ECG, laboratory and imaging results, where relevant or provided to us
• Referral letters
• Hospital discharge summaries
• Specialist reports
• Clinical notes
• Treatment plans
• Prescriptions
• Appointment history
• Insurance information
• Billing and payment information
• Communications with us, including telephone calls, SMS, iMessage, WhatsApp, email and in-app messages
• Message and email metadata, including delivery, read, bounce and status information
• Audio recordings of telephone calls
• Audio and video recordings of consultations where applicable
• Recordings and transcripts of online meetings and video consultations where applicable
• Website and application usage information
• Device information, IP addresses and push notification device tokens
• Support and messaging metadata, including device and messaging identifiers used to route and deliver your messages
• Cookie identifiers, advertising and click identifiers, and campaign, referral and UTM data
• Security and audit logs
• Consent records
• Complaint records
• Information required for legal, regulatory, safeguarding or fraud prevention purposes

We use your information to:

• Provide healthcare services

• Assess, diagnose and treat medical conditions

• Prescribe medications safely

• Coordinate your care

• Communicate with healthcare providers involved in your care

• Arrange appointments

• Operate our patient portal and digital services

• Process payments

• Respond to enquiries and complaints

• Meet legal, regulatory and professional obligations

• Protect health and safety

• Prevent fraud or misuse of our services

• Carry out quality assurance and clinical audit activities

• Improve our healthcare services

• Measure, analyse and improve our websites, digital services and marketing

• Conduct research where permitted by law

Where required by law we will obtain your consent before collecting, using or disclosing your information. In many situations, however, health information may be collected, used or shared where authorised or permitted under the Privacy Act 2020 and the Health Information Privacy Code 2020 without separate consent.

We contact you about your care by email, text and through the app. You can opt out of marketing messages at any time.

We may collect information directly from you, including when you:

• Register with ADHD Simple

• Book appointments

• Complete questionnaires or forms

• Attend consultations

• Use our patient portal

• Contact us by telephone, email, SMS or other communications

We may also receive information from:

• Your GP

• Nurse practitioners

• Psychiatrists

• Psychologists

• Specialists

• Hospitals

• Pharmacies

• Laboratories

• Radiology providers

• Previous healthcare providers

• Referring clinicians

• Health insurers where applicable

• ACC or other funding agencies where applicable

• Government agencies where authorised or required by law

• Family members, carers, whānau or support people that you have nominated or authorised

• Parents, guardians or attorneys acting on your behalf

• Other individuals authorised by you to provide information relevant to your healthcare

As part of providing healthcare we may receive referral letters, previous assessments, medication history, specialist reports, hospital discharge summaries, laboratory results, imaging reports and other information relevant to your treatment.

We take reasonable steps to ensure patients are aware when health information has been collected from sources other than themselves, in accordance with the Health Information Privacy Code 2020.

We mainly use transcripts of calls and appointments to prepare notes. We may also make audio or video recordings for care, quality checks, training or handling complaints.

We tell you when recording or transcription is used and ask for consent where required. Tell us if you have concerns so we can discuss alternatives.

Only authorised people and providers can access these records. We keep recordings only as long as needed for care or legal duties. Transcripts and approved notes may become part of your health record.

We may use AI to transcribe calls and appointments, draft notes and summarise information. This may include Microsoft Azure OpenAI, Anthropic and Vexa.

AI does not diagnose you or decide your treatment. A clinician checks and approves each note before it goes into your health record.

Providers process your information on our behalf under contracts that protect it and limit how it is used.

We use secure electronic health record systems, patient management systems, cloud infrastructure and specialist technology providers to deliver our healthcare services.

The categories of technology providers we may use include:

• Cloud hosting and infrastructure providers, including Microsoft Azure and Supabase

• Communication and collaboration platforms, including Microsoft Teams and the underlying Microsoft Graph services that support them

• Telephony and messaging providers, including Twilio, and services used to send and receive SMS and iMessage, including BlueBubbles

• Email delivery and email verification providers, including Postmark and ZeroBounce

• Payment processing providers, including Stripe

• Mapping and address lookup providers, including Google Maps and Google Places

• Error monitoring and performance providers, including Sentry

These providers may securely store or process information on our behalf and are required to maintain appropriate privacy, confidentiality and security safeguards.

Depending on the services being provided, your information may be securely stored or processed within New Zealand or in other countries where appropriate safeguards exist or where otherwise permitted under New Zealand law.

We do not store your full payment card number. Our payment provider holds it securely.

We use cookies and similar technologies on our websites and digital services, including booking and checkout pages. Cookies are small files stored on your device. We also use measurement tags, advertising pixels and other tools that record how people use our services.

We use these tools to understand where visitors come from, which adverts or links brought them to us, and whether they go on to start or complete a booking or purchase. This is called attribution. It helps us measure advertising performance and improve our websites and checkout.

We also use session recording tools on our websites and checkout. These create a replay of website activity, such as pages visited, scrolling, clicks and movement through checkout steps. This is separate from recording a telephone or video consultation. We use replays to identify problems and understand how to make our services easier to use.

When you use our websites and digital services, we and our service providers may use cookies, tags, pixels, software development kits and similar technologies to operate our services, understand how they are used, measure and improve performance, and deliver and measure marketing.

These technologies may collect information such as your device and browser details, IP address, pages viewed, links and buttons clicked, referring website, session activity, and campaign, referral and UTM parameters, as well as advertising and click identifiers.

The tools and providers we may use include:

• Product analytics and session recording tools, including PostHog and Microsoft Clarity, which help us understand how our digital services are used and may record session activity such as pages viewed and interactions. Input masking and other restrictions are used to reduce the capture of sensitive information. What a tool records depends on the page and its configuration.

• Tag management and web analytics tools, including Google Tag Manager and Google Analytics, which we use to manage measurement tags and to record website and conversion events.

• Advertising and marketing platforms, including Meta and TikTok, which use cookies, pixels and advertising or click identifiers to help us deliver and measure advertising and understand campaign performance.

• Email and customer messaging platforms, including Klaviyo, which we use to send communications and to understand engagement, such as whether messages are opened or links are clicked.

• A/B testing and optimisation tools, which we use to test and improve the content, layout and performance of our digital services.

We use cookies and similar technologies that are strictly necessary to operate our services, as well as others that we use only where permitted or where you have provided consent in accordance with applicable law. You can manage non-essential cookies and similar technologies through the controls we provide and through your browser or device settings. Disabling some cookies may affect how our services function.

Where these technologies involve health information or could identify you as a patient, we apply additional care and only use them where lawful and subject to appropriate safeguards.

We only share personal information where necessary to provide healthcare, comply with legal obligations or where otherwise authorised by law.

We may share your information with:

• Your GP

• Specialists involved in your care

• Hospitals

• Laboratories

• Radiology providers

• Pharmacies

• Other healthcare providers involved in your treatment

• Family members, carers or support people where authorised by you or otherwise permitted by law

• Health insurers

• ACC and other funding agencies

• Government agencies where required by law

• Professional advisers

• Payment providers

• Electronic health record providers

• Patient portal providers

• Secure cloud hosting providers

• Communication, telephony and messaging providers

• Email delivery and verification providers

• AI service providers acting on our instructions

• Analytics, marketing and advertising providers

• Error monitoring and performance providers

• IT support providers

• Cybersecurity providers

All service providers acting on our behalf are required to maintain appropriate privacy, confidentiality and security safeguards.

Our group has teams working in more than one country. Authorised team members may access your information from overseas when needed to provide your care or support our services, including administration and technical support. Access must be limited to what they need for their work and is subject to confidentiality and privacy requirements.

We manage patient records for each country separately. This does not prevent authorised team members from accessing information from another country. Shared ownership does not give every group company or employee unrestricted access to your information. Overseas access and sharing must comply with New Zealand privacy law and the safeguards described in this notice.

Authorised group teams in Australia and the United Kingdom may access New Zealand records for the work described above. ADHD Test NZ Limited remains responsible for the information it holds. Being part of the same group does not remove our privacy obligations.

Overseas safeguards. Before disclosing health information to an overseas recipient, we must meet rule 12 of the Health Information Privacy Code 2020. This may involve checking that the recipient is subject to New Zealand law, comparable overseas law, or an agreement requiring comparable safeguards, or that another lawful ground applies. When an overseas provider only stores or processes information on our behalf as our agent, we remain responsible for how it is handled. Accepting these terms or this policy is not blanket authorisation to send information overseas without the required safeguards. Contact us for information about the countries, recipients and protections relevant to your information.

Who can access information? Access must be authorised and limited to what is needed for the work:

• Clinicians and clinical support staff: information needed to assess, treat and support you.

• Administration and patient-support teams: information needed for bookings, billing, communications and helping you use the service.

• Authorised technology and security staff: information needed to maintain systems, investigate faults or protect the service.

• Approved service providers: information needed to perform their contracted work, subject to appropriate instructions and safeguards.

We take reasonable technical, organisational and administrative measures to protect your information from unauthorised access, loss, misuse, alteration or disclosure.

These measures include:

• Encryption

• Multi-factor authentication

• Role-based access controls

• Audit logging

• Secure cloud infrastructure

• Regular backups

• Security monitoring

• Staff privacy training

• Confidentiality obligations

• Regular security reviews

Although no system can be guaranteed to be completely secure, we continually review and improve our security practices.

We retain personal information only for as long as necessary to provide healthcare services, comply with legal obligations and meet professional record-keeping requirements.

Temporary telephone recordings and consultation recordings are retained only for a limited period unless required for ongoing clinical care, legal, regulatory or other authorised purposes.

When information is no longer required it is securely destroyed or permanently de-identified where appropriate.

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the right to:

• Request access to the personal information we hold about you, subject to any lawful exceptions.

• Request correction of personal information that you believe is inaccurate, incomplete or misleading.

• Be informed about how your personal information is collected, used and shared.

• Withdraw your consent where we rely on your consent.

• Make a complaint if you believe your privacy rights have been breached.

If you believe information we hold about you is factually inaccurate, incomplete or misleading, you may request that it be corrected.

Where appropriate, we will take reasonable steps to correct factual errors, such as incorrect contact details, medication information, dates, or other factual information.

Clinical records also contain the professional observations, assessments, diagnoses and opinions of healthcare professionals. These records form part of your medical history and are maintained to support safe and effective healthcare.

Where information accurately records a clinician's professional opinion, diagnosis, assessment or contemporaneous clinical observations, we may decide that the record should remain unchanged if it accurately reflects the clinician's assessment at the time it was made.

If you disagree with a clinical opinion or diagnosis, you may request that it be reviewed by the treating clinician. Where appropriate, updated clinical information or subsequent assessments may be added to your record.

If we decide not to make a requested correction, we will explain our decision and, where required by law, take reasonable steps to associate your request for correction or a statement of disagreement with your record.

We generally do not remove clinically relevant information from an accurate medical record where doing so would make the record incomplete, inaccurate or compromise the provision of safe healthcare. This includes information that was accurately recorded during the course of your assessment or treatment.

Submitted questionnaires form part of your clinical record. We retain a history of what you reported and when. If you made a mistake or your situation changes, contact us so that a correction or update can be recorded. Keeping the original submission does not remove your right to request a correction.

You may request access to the personal information we hold about you, including your health information, subject to any lawful exceptions under the Privacy Act 2020 or other applicable legislation.

In limited circumstances, some information may be withheld where permitted by law, including where disclosure could pose a serious risk to the health or safety of any person, unreasonably disclose another person's personal information, or where another statutory exception applies.

You can request a copy of your health information whether or not you owe us money. We provide it free of charge. The response timeframe is explained under Making a Privacy Request.

If you would like to access your information, request a correction, or have questions about how we handle your personal information, please contact us using the details provided in this Privacy Notice.

We aim to respond as soon as reasonably practicable and no later than 20 working days, unless an extension is permitted by law.

If you are not satisfied with our response, you may make a complaint to the Office of the Privacy Commissioner.