Habit Health's Privacy Statement

This privacy statement applies to all of Habit Health (or a person acting on behalf of Habit Health). It aims to clarify how we collect, use, store, disclose, update, and destroy individual's personal information in New Zealand. Habit Health represents Habit Holdings Ltd and its related companies, including PMARS, Hand Rehab, PRG and EAP Services. 

We respect the confidentiality of our clients' personal information and take privacy seriously. We set out in this privacy statement:

As a health care provider Habit Health may collect, use, and disclose personal information relating to its customers and clients to provide health care services and information relating to contractors, suppliers, and employees in the performance of its business activities.

Habit Health manages personal information we collect in a fair and transparent manner. We appreciate the sensitive nature of personal information and place a high importance in managing information in accordance with relevant legislation, particularly the Health Information Privacy Code 2020, the Privacy Act 2020, other relevant legislation, and the Information Privacy Principles in relation to the collection, storage, use and disclosure of records containing individuals' personal Information.


Personal Information means information about an identifiable individual. 

Collection of personal information

Types of personal information we collect

The type of personal information collected will likely vary depending on the business purpose, activity, funding type and/or services for which you are engaged with Habit Health. We only collect information required for us to perform one or more of our functions or activities, as outlined in Collection of Personal Information above.

Personal information collected by us may include: 

How we collect information

Personal information will be collected from the individual it relates to and in compliance with the Privacy Act and HIPC 2020. An exception would be where you (the individual) have provided authority/consent to collect the information from someone else.

How we collect personal information will vary depending on the business purpose, activity, funding type and/or services for which you are engaged with Habit Health.

Personal information may be collected through the following means: 

We may also collect information about you from another source if: 

In addition to collecting and storing necessary information to communicate with our clients about their health concerns, Habit Health also stores names, addresses and contact details of contractors, suppliers, employees, and other parties we interact with related to business activities. The same privacy statement applies to this information. 

Personal Information can also be collected automatically

When you visit our websites or use our services, some information about you is automatically collected. For example, to improve our websites usefulness, our servers may collect your browser type, operating system, Internet Protocol (IP) address, domain name, and/ a date/time stamp for your visit. Some of this information is also collected using cookies and similar technologies including Google Analytics. The Google website provides more information about how cookies operate and how Google uses your data and how you can opt out. We recommend you accept the use of cookies, if you reject or erase the cookies, some of our services may not function properly or be fully available. See further information here.

How we use personal information

Personal information allows us to confirm the identity of our clients and people we communicate with for business. This information allows our clients to securely access our online services, book services with ease and communicate. This information is used to confirm your identity, assist in the safe provision of services, and is intended to satisfy our contractual, professional and legal obligations.

Personal information may be used under the following conditions: 

We also collect, use and store personal information to enable us to; 

We also collect your personal information to enable the provision of confidential and de-identified reporting in relation to organisational trends relating to the health and wellbeing services we provide. All reasonable steps will be taken by us to ensure that this information does not allow for the identification of any persons.

The function or activity of Habit Health and the delivery of our services, as well as those of our contracted providers, may vary from time to time.  

Who we will share or disclose personal information with

Habit Health will only share personal information if we are using it for the reason we collected it, if you’ve given your authorisation, or where there is other legal or compliance reasons. 

We will only disclose your personal information where we reasonably believe one of the following applies: 

Examples of disclosures of personal information (depending on the services under which you are engaged or enrolled) may include disclosures to: 

We may de-identify personal information we have collected for use and disclosure to organisations outside of Habit Health for the purposes of analysing our service quality and timeliness, marketing and compilation or analysis of statistics comprised of, or related to the information you provide us. De-identified information may also be used internally for business analysis and educational purposes. We will not disclose personal information we have collected to a party outside of New Zealand unless we have taken steps to confirm they will comply with a standard equal of protection regarding personal information that is equal to that offered under New Zealand legislation. 

Other People’s Information which you Provide to Us

If you provide personal information to us about someone else, you must ensure that you are entitled to disclose that information to us and that, without us taking any further steps required by privacy laws, we may collect, use, and disclose such information for the purposes described above. For example, you should take reasonable steps to ensure the individual concerned is aware of the various matters detailed in this policy as those matters relate to that individual, including our identity, how to contact us, our purposes of collection, our information disclosures practices, the individual’s right to obtain access to the information and the consequences for the individual if the information is not provided.

How we keep your personal information safe and secure

Habit Health will take all reasonable steps to ensure that data is secure and will maintain generally accepted standards of technology and operational security to protect Personal Information from loss, misuse, alteration, or destruction. Any person acting on behalf of Habit Health will not transfer Personal Information to an individual without first establishing the identity of the recipient using a personal identifier and/or cross check. 

All personal information is stored securely in specialised software in the cloud or in a secure server environment. Information is only accessed by authorised persons for the purposes related to the services provided or anonymised reporting. 

Habit Health will take reasonable steps to destroy or permanently de-identify personal information (such as a job applicant's resume) if it is no longer needed. Habit Health comply with all legislations that mandate certain time periods that we must hold your information for. 

How to request access to your personal information

If Habit Health holds Personal Information about you, we will comply with legislative obligations to let you know what information we have on record. You can request access to your personal information or someone else’s personal information (as long as you have the correct authority). Requests will be acknowledged promptly (within 5 working days).

You can contact us to request access by:

We must be able to verify your identity to be able to provide you access to your information. 

If you have any concerns regarding the above, you can email our Privacy Officer at qualityteam@habit.co.nz.

How to request correction of your personal information

Habit Health takes reasonable steps to ensure the Personal Information we collect, use or disclose is accurate, complete and up to date. If the information we have on record for you is not accurate, complete, and up to date, we will take reasonable steps to correct the information. We may require evidence that the information we have is inaccurate, incomplete, or out-of-date. 

You can request us to correct your information by:  

We will respond and check our records. If the information we hold is confirmed to be factually incorrect, we will:

Sometimes we may not be able to make the change you’ve requested. This is usually because it relates to opinion-based information e.g., clinical, or medical assessment. In this instance we will: 

If you have any concerns regarding the above, you can email our Privacy Officer at QualityTeam@habit.health.

Privacy concerns or complaints

We are happy to discuss with you any concerns regarding the management of personal information or any information about our privacy statement.

If you think we have breached the Privacy Act, Information Privacy Principles or Health Information Privacy Code 2020 you are entitled to complain.

You can view our External complaints management process here.

Let us know of your concerns or complaint by:

We will acknowledge your complaint within 5 working days.  

We will investigate the complaint and attempt to resolve it within 10 working days after the complaint was received. If we cannot conclude the complaint within this timeframe, we will provide you with information on how long we think it will take to investigate and respond to and keep you updated regularly.

If you are not satisfied with the response or the outcome of the complaint, you can appeal to the Privacy Commissioner.

Alternatively, you can lodge a complaint with the Office of the Privacy Commissioner here.

Personal Identifiers

EAP Services will use a Client Identification Numbering System which allows for privacy and security of your information, and which is not related to any other identifier system.


Habit Health is open about its management of personal information. This Privacy Statement will be made available to anyone who asks for it. 

Call Recording Privacy Statement

As part of our commitment to providing the best possible service to our clients and customers, we record telephone calls made to and from our EAP service National Support Centre.

We record calls:

We understand your personal information is important, and we are committed to protecting your privacy. Recordings will be securely stored.

Updates to Habit Health’s Privacy Statement

We may amend or update this Privacy Statement from time to time with or without notice to you.

Altogether better health

Habit Health deliver physical, mental health and workplace support, enabling people to optimise their health and live their best lives.

Click here to visit Habit Health