Privacy Statement

1. Introduction

CAMRI is a department within the University of Auckland (the University).

This Privacy Statement sets out generally how we collect, use, store and disclose personal information. We may include more details of how we handle personal information for each of our specific services in additional privacy notices and/or information provided to you in connection with that service. Any such additional privacy notices should be read in conjunction with this Privacy Statement.

From time to time, we may review and update this statement. Updates are uploaded to the website and take effect from that date. Please ensure that you are aware of the most recent version of this statement. This Privacy Statement was last updated on 16 July 2026.

2.Who we collect and hold information about

Generally, we collect personal or health information about the following types of people:

·        Patients, usually referred to us from DHBs or clinicians in private practice, including via online referral platforms;

·        Participants in research studies, which may be carried out by the University or third party researchers; and

·        Clinicians and other health professionals who engage with us, either when referring patients, or in connection with providing reports on images generated by our services.

3. Patients

3.1 Collection and use of information

If you are a patient who has been referred to us, we will collect some or all of the following health information for the stated purposes:

·        Name, address(es), date of birth, gender, NHI number, phone and email contacts, contact person’s name (if different, e.g. a parent or guardian of a child), for administrative and billing purposes (e.g. to contact you to carry out our necessary pre-screening checks, or to discuss any queries with you) and so that we can ensure we match information from different sources with the right patient;

·        Detailed health information including gender, weight, age and medical history, to protect your health and safety (e.g. by ensuring that health risks for imaging are identified and managed appropriately) and to enable us to provide the requested imaging services to the best quality that we can; and

·        Where applicable, ACC claim number, and/or details of your insurance provider, for billing and payment purposes, assisting with insurance pre-approvals (where you have asked us to do so), and responding to queries from your insurer or from ACC.

We may collect some of the information about you from third parties rather than from you directly. We do so where we reasonably believe that you have authorised that collection (e.g. because it is reasonable to assume that you have authorised that third party to disclose that information to us, such as when your clinician has referred you to us for imaging services) or it is not practicable to collect the information directly from you (e.g. where we need detailed medical information to provide our services to you safely, and your referring clinician holds that information).

We will take reasonable steps to verify the information with you when we engage with you by phone or when you come to our clinic for your imaging services.

We also collect newly generated health information about you from our consultant radiologists who review your images and provide reports to us, as part of our services that we provide to you.

If you choose not to provide us with the information that we have requested, it is likely that we will be unable to provide you with the requested services.

3.2 Disclosure ofinformation

We may share your health information with the following persons/organisations for the following purposes:

·        Our consultant radiologists who review your images and provide reports to us, to enable us to provide the requested imaging services;

·        Your referring clinician, so that they may provide you with health and disability services in connection with your imaging (as set out in more detailin paragraph 3.3, below)

·        Where you have been referred to us by a DHB, to the DHB for healthcare and reporting requirements;

·        Where requested by you or your referring clinician, a copy of your report to other healthcare providers;

·        Your insurer, in connection with any insurance placed or claim made by you;

·        ACC, in connection with a claim you have lodged, for ACC’s purposes of determining your entitlement to that claim and where it is reasonable to believe that you have authorised ACC to obtain medical and other records which are relevant to that claim under s 55(1)(c) of the Accident Compensation Act2001;

·        Where you are a participant in a research study, to the researcher and organisation carrying out the study;

·        On a de-identified basis, with our trusted equipment and software suppliers to aid the monitoring, improvement and operability of the equipment, as well as part of our regular quality assurance process; and

·        Other persons and organisations, where we are required or permitted to do so under the Privacy Act or other laws.

 3.3. Providing health information to your referring clinician

To ensure that you receive appropriate advice and support in connection with your results (including other relevant health information), we will provide your report to your referring clinician. Please arrange a time with your clinician to discuss your results. This is subject to your rights to access your information, as set out below in paragraph 8.

4. Participants in research

Where you engage with us as a participant in a research study, we collect much of the same information as for any other patient (other than ACC, insurer and billing information) including health information relevant to the purposes of the study in which you have agreed to participate.

Further information on the purpose of the study, and the way your personal or health information will be collected, used and shared, will be set out in the participant information sheet and other information provided to you by the researchers and organisation carrying out the research.

Wherever practicable, we take steps to de-identify your information, including:

·        Using a study participant identifier instead of name and/or NHI numbers; and

·        Using a standardised date of birth and/or any other anonymization steps required under the terms of the research protocol.

5.Clinicians and other health professionals

Where you engage with us as a health professional, we collect information from you including:

·        name and contact details, and place of practice, for administrative and billing purposes, and so that we can provide our services to you and our patients; and

·        medical practising number, so that we can verify your entitlement to practise.

Where you are a referring clinician, we also collect the information that you provide about the patients you are referring. You must ensure that you have any necessary authorisation from the patient to disclose that information to us, and that you have taken all reasonable steps to verify that the information is accurate and up-to-date before providing it to us. Where you have requested that we provide a copy of the patient report to the patient’s GP, you must ensure that you have the necessary authorisation from the patient for us to do so.

6. Marketing and cookies

6.1 Marketing

We do not sell your personal information to third parties for their marketing or other purposes.

Where you have signed up to be on our mailing list or have otherwise provided us with your consent, we may send you information about our Services, and/or events and services of our third party partners, including via email and other electronic messaging. You have the right to unsubscribe from those communications.

6.2 Cookies

Cookies are small text files that are stored on your browser or device by a website or app. We use cookies and similar technologies to help remember users and monitor how they interact with our websites and apps. You can disable the acceptance of cookies by adjusting the settings in your web browser, although this may restrict your ability to access some web pages.

7. Storage and security of information

We take reasonable security safeguards to ensure that your personal and health information is protected against loss and unauthorised access, use, modification and disclosure.

We store information on trusted servers in strict adherence to the requirements of the Privacy Act 2020, and other applicable laws governing the storage of patient health information. Physical records are stored securely onsite or archived with our trusted storage provider Iron Mountain New Zealand Limited.

We use trusted third party providers of software applications specifically designed to enable efficient and confidential management of patient information. We use these providers and their applications under terms that do not permit the provider to use your information for any purpose other than storage and processing for the services for which we use them and/or in an aggregated (anonymised) form for the purposes of monitoring traffic and to improve the services.

We keep information only for as long as we need it or are required by law to keep it. For example, we keep health information for ten years following the last date of services that we provided to you, in accordance with the Health (Retention of Health Information) Regulations 1996.

 8. Your rights to access and correct your information

You can:

·        ask us to confirm what information we hold about you;

·        request access to, and correction of, your information; and

·        provide us with a statement of correction to attach to your information if we choose not to correct it.

We may choose not to provide you with access to your information for certain reasons set out in the Privacy Act, for example, where:

·        to do so could prejudice your health;

·        you are under the age of 16 and we believe the disclosure of the information would be contrary to your interests;

·        the information cannot readily be retrieved; or

·        to do so would give unwarranted disclosure of information about another individual.

If we provide access to your information, we will provide you with a copy, extract or summary of that information. As we are legally required to retain health records, we are not generally able to hand over original records.

If you wish to exercise any of your rights under the Privacy Act, please contact us at mri@auckland.ac.nz. You will need to:

·        clearly state your request;

·        tell us who you are and provide reasonable evidence of your identity if we ask; and

·        tell us if (and why) your request is urgent.

9. Keeping your information up-to-date

It is important that any contact details that we hold about you are kept up-to-date. For example, we may need to contact you urgently if we suffer a security event such as unauthorised access or disclosure of your information. Please let us know if your contact details change by contacting us at mri@auckland.ac.nz.

It is important that any health information that we hold about you is accurate and complete, so that we can be sure we are managing your health and safety in an appropriate manner whenever we provide healthcare services to you. Please let us know if you become aware of any errors in your health records by contacting us at mri@auckland.ac.nz.

10. Enquiring or complaining about your privacy

If you have any concerns about the way we’ve collected or processed your personal information, let us know, so we can try to put the matter right. To raise your concerns:

·        Email us directly at mri@auckland.ac.nz;or

·        Email the University Privacy Officer at privacy@auckland.ac.nz.

If we can’t resolve your concerns, you can also make a complaint to the Office of the New Zealand Privacy Commissioner by:

• Completing an online     complaint form at www.privacy.org.nz
• Writing to the Office of     the Privacy Commissioner, PO Box 10-094, The Terrace, Wellington 6143, New     Zealand.

·