Privacy Policy

Effective date: 23/09/2026

Version 2.0

Bay Paediatrics ("we", "us", "our") is committed to protecting the privacy of the children and families we care for, and of visitors to our website.

This policy explains how we collect, use, disclose and protect personal and health information. It applies to our clinical services, our website, and our communication with families. We handle health information in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020.

If anything here is unclear, or you would like to discuss how your family's information is handled, please contact our Privacy Officer (section 8).

1. Information we collect

We collect only what we need to care for your child, and wherever possible we collect it directly from you.

About your child and family. Names, contact details, date of birth, NHI number, GP and school details, and information about your family and home situation that is relevant to your child's care.

Health information. Developmental and medical history, assessment results, questionnaires completed by you, your child's school and our clinicians, observations from consultations, diagnoses, treatment plans, prescribing records, and correspondence with other health professionals.

Information from others. With your consent, information from your GP, other health and education providers, and your child's school or early learning service.

Website information. IP address, browser type, pages visited and time spent on the site. See section 9.

2. How we use it

We use the information we hold to:

  • assess, diagnose, treat and support your child

  • communicate with you about appointments, results and your child's care

  • prepare reports and correspondence for you and, with your consent, for others involved in your child's care

  • manage payments, accounts, and insurance or funding claims

  • meet our legal and professional obligations, including record-keeping and mandatory reporting

  • improve our services, using aggregated or de-identified information wherever possible

We do not use your child's health information for marketing. If you have opted in to hear about our courses, events and resources, we use only your contact details, and you can opt out at any time.

3. Use of artificial intelligence

We use AI tools to help our clinicians with clinical documentation. These tools do not make decisions about your child's care. Your clinician reviews and remains fully responsible for everything recorded in your child's notes and in any report we issue.

Heidi (AI medical scribe). Heidi produces a draft written summary of the consultation, which your clinician checks and edits. Your clinician will ask for your agreement before using it at each consultation, and will record your answer in your child's notes. Audio is not retained. Information is processed and stored on encrypted servers in Australia. Under our agreement with Heidi, your information is not used to train AI models.

ChatGPT (Business Workspace). Our admin team may use this to help summarise information you have provided in our forms, and to assist with drafting. Before anything is entered, we remove names, contact details, addresses, dates of birth and NHI numbers; those details stay only in our patient management system. The remaining information is processed on OpenAI's servers (which may be located overseas) within our private business workspace, is not accessible to other organisations, and is not used to train AI models. Even with identifiers removed, a detailed history could still identify a child to someone who knows the family, so we include only what is needed.

You may decline the use of either tool at any time. This will not affect your child's care or the standard of care they receive.

Our clinicians work under our Artificial Intelligence Use Policy, which sets out which tools are approved, what information may be entered, how consent is obtained and documented, and how clinicians verify AI-generated content. That policy reflects the Medical Council of New Zealand's Guidance on using artificial intelligence (AI) in patient care (March 2026), the New Zealand Psychologists Board's Guidelines for the use of Artificial Intelligence in Psychology, and the Office of the Privacy Commissioner's guidance on AI and the Information Privacy Principles. A copy is available on request.

4. Where information is stored, and information sent overseas

Your child's clinical record is held in our patient management system, Elixir, hosted on secure servers within the AWS infrastructure.

Some of our service providers store or process information outside New Zealand. Before using an overseas provider, we take reasonable steps to satisfy ourselves that your information will be protected by safeguards comparable to those required in New Zealand, as required by information privacy.

5. How we protect information

  • Access is limited to staff who need it for your child's care, and is controlled by individual logins.

  • Our data collection websites use SSL encryption for information you submit through it.

  • Clinical reports and correspondence are sent by our secure Elixir patient management system. If you would prefer a different method, please tell us.

  • Our staff are bound by confidentiality obligations and are trained in privacy and in the safe use of AI tools.

  • We review our systems and our service providers periodically.

If we experience a privacy breach that is likely to cause serious harm, we will notify you and the Office of the Privacy Commissioner, as required by the Privacy Act 2020.

6. Who we share information with

With your consent. Your GP and other treating health professionals. Unless in exceptional circumstances, we do not share reports or letters with your child’s school or early learning service. This is your choice

Service providers. Our patient management, AI, email, file storage, payment and accounting providers. They are contractually required to protect your information and to use it only for the services they provide to us.

Where the law requires or allows it. Including court orders, statutory reporting obligations, and where disclosure is necessary to prevent a serious threat to someone's safety, particularly the safety of a child.

We do not sell your information, and we do not share it for advertising.

7. How long we keep it

We keep health records for at least 10 years from the date of the last service we provided, as required by the Health (Retention of Health Information) Regulations 1996. Some records are kept longer where there is a clinical or legal reason to do so.

8. Your rights

Access. You can ask for a copy of the information we hold about you or your child. We will respond within 20 working days.

Correction. You can ask us to correct anything you believe is wrong. If we decide not to make the change, you can ask us to attach a statement of the correction you sought, and we will do so.

Withdraw consent. You can withdraw or change any consent at any time, including consent to the use of AI tools.

Children and young people. As your child grows, they gain their own rights over their health information. We will discuss this with you and with them when it becomes relevant.

To make a request, contact our Privacy Officer:

Privacy Officer, Bay Paediatrics, hello@baypaediatrics.conm· 12 Elizabeth Street, Tauranga 3110

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909). For concerns about your child's care, you can contact the Health and Disability Commissioner (hdc.org.nz, 0800 11 22 33), or a free Health and Disability Advocate on 0800 555 050.

9. Cookies

Our website uses cookies to support its basic function and to understand how visitors use the site. You can control cookies through your browser settings, although some features may not work if you disable them.

Google Analytics. Collects your device and browser type, operating system, an approximate location based on your IP address, which pages you visit and how long you spend on them, how you arrived at our site, and a randomly generated identifier stored in a cookie that recognises a returning device. We use this to understand how our website is used.

Meta Pixel. Collects the pages you visit, your IP address, browser and device details, and any Facebook cookies already on your device, and sends this to Meta. If you are logged in to Facebook or Instagram, Meta may link this activity to your account. We may use this for advertising.

You can opt out of Google Analytics using Google's browser add-on, and you can manage advertising preferences in your Facebook or Instagram settings. Using a browser's private browsing mode, or a tracker-blocking extension, will also limit what these tools collect.

10. Changes to this policy

We may update this policy from time to time. The current version and its effective date are shown at the top of this page.

11. Contact us

Bay Paediatrics. 12 Elizabeth Street, Tauranga, 3110. hello@baypaediatrics.com | 021 212 5660