Privacy & Health Information Policy

Personal Information, Health Records and Confidentiality

Last Updated: 29 October 2026

Introduction and Responsible Businesses

Northwest Pharmacy operates through:

Baraka Health Limited
Northwest 7 Day Pharmacy
98 Hobsonville Road, Auckland 0618

New Zealand Pharmacy Services Limited
Northwest Pharmacy Kumeu
Units 5 & 6, 1 Putaki Drive, Kumeu, Auckland 0810

In this policy, “Northwest Pharmacy”, “we”, “our”, and “us” refer to the company responsible for the relevant product, service, or patient record. 

We respect the confidentiality of personal and health information and handle it in accordance with the Privacy Act 2020, Health Information Privacy Code 2020, and other applicable New Zealand laws. Abdul Eraki is the designated Privacy Officer for both operating companies. 

This policy explains:

• What information we collect
• How and why we collect it
• How we use and share it
• How we protect it
• Your rights to access and correct information

1. Information We Collect

Depending on the services used, we may collect and hold:

Personal and Contact Information

• Full name
• Date of birth
• Residential address
• Phone number
• Email address
• National Health Index (NHI) number (where relevant)
• Eligibility information
• Authorised representatives
• Emergency contact details

Health and Clinical Information

• Prescriptions
• Dispensing and medication history
• Allergies
• Relevant medical conditions
• Vaccination records
• Consultation and assessment information
• Medication packaging requirements
• Delivery requirements
• Relevant clinical correspondence

Transaction and Website Information

• Orders and purchase history
• Appointment bookings
• Repeat prescription requests
• Invoices
• Communications with our team
• Information required to operate our website and process transactions

We collect only information reasonably necessary to provide healthcare services, fulfil professional obligations, and operate our pharmacy services. 

2. How We Collect Information

Information Provided Directly

We may collect information when you:

• Visit our pharmacies
• Submit prescriptions or repeat requests
• Complete website forms
• Make purchases
• Book appointments
• Attend consultations
• Contact us by phone, email, or other channels

Information Collected Indirectly

We may receive information from:

• General practitioners (GPs)
• Authorised prescribers
• Hospitals
• Aged-care facilities
• Disability support providers
• Authorised carers or representatives
• Other healthcare organisations involved in your care

Where information is collected indirectly, we will take reasonable steps to inform you or your representative when required by law. 

3. Why We Use Your Information

We collect and use personal and health information for legitimate healthcare and business purposes, including:

• Dispensing and supplying medicines safely
• Reviewing prescriptions and medication histories
• Managing repeat prescriptions and medication requests
• Providing pharmacist consultations and vaccinations
• Preparing medication blister packs and sachet rolls
• Coordinating medication supply for care facilities
• Arranging deliveries and communicating with recipients
• Maintaining clinical and dispensing records
• Meeting regulatory and legal obligations
• Reviewing service quality and improving operations

We do not use identifiable patient health information for unrelated promotional marketing without an appropriate lawful basis or required consent. 

4. When Information Is Required

Certain personal and health information is required to safely provide pharmacy services and meet legal obligations.

For example, dispensing prescription medicines may require:

• Patient identification
• Prescription verification
• Relevant clinical information

Some information, such as marketing preferences, is optional.

If required information is not provided, we may be unable to deliver certain services safely or lawfully. 

5. Information Sharing and Disclosure

We respect patient confidentiality and do not sell personal or health information. 

Information may be shared where authorised, required for healthcare purposes, or otherwise permitted by law.

Information may be shared with:

• Prescribers and healthcare professionals involved in patient care
• Hospitals and healthcare organisations
• Aged-care and disability support providers
• Authorised carers, guardians, and representatives
• Health New Zealand and regulatory authorities
• Delivery providers and couriers where necessary
• Authorised service providers acting on our behalf

We take reasonable steps to ensure disclosures are limited to information necessary for the intended purpose. 

6. Information Shared Between Pharmacy Locations

Northwest Pharmacy operates through two separate legal entities.

Where information is transferred between the Hobsonville and Kumeu pharmacies, we will ensure there is an appropriate lawful basis for doing so, such as:

• Patient-requested transfers
• Coordinated healthcare requirements
• Circumstances otherwise permitted by law

Any information sharing remains subject to privacy and confidentiality obligations. 

7. Residential and Disability-Care Information

We handle information relating to aged-care residents, disability support services, and residential care providers with particular care.

Information may be used for:

• Dispensing medications
• Medication reconciliation
• Medication packing services
• Clinical communication
• Delivery and continuity of care

Access is limited to appropriately authorised individuals and organisations. 

8. Website Forms and Communications

Information submitted through our website may include personal and health information.

We use this information to:

• Respond to enquiries
• Arrange services
• Process prescriptions
• Support pharmacy operations

Patients should avoid submitting unnecessary sensitive information through general enquiry forms or public communication channels.

For urgent medication issues, please telephone the pharmacy directly. 

9. Promotional Messages

We may send:

• Pharmacy news
• Health service updates
• Promotional offers

Where required, marketing communications will include:

• Sender identification
• An unsubscribe option

Opting out of marketing messages will not prevent us from sending essential communications relating to:

• Prescriptions
• Appointments
• Medicine safety notices
• Deliveries

10. Confidentiality and Information Security

We take reasonable technical, physical, and organisational measures to protect personal and health information from:

• Loss
• Misuse
• Unauthorised access
• Alteration
• Disclosure

Security measures may include:

• Staff confidentiality obligations
• Restricted access to records
• Secure physical storage
• Access management controls

Access is limited to individuals with an authorised operational or clinical need. 

11. Privacy Incidents and Data Breaches

If a privacy or information-security incident occurs, we will:

1. Investigate the issue.
2. Take steps to contain it.
3. Minimise potential harm.
4. Notify affected individuals where required by law.

Where required under the Privacy Act 2020, we will notify the Office of the Privacy Commissioner as soon as practicable. 

12. Record Retention and Secure Disposal

Personal and health information may be stored in both electronic and physical formats.

Health information is generally retained for a minimum of 10 years from the last patient service, subject to applicable legal requirements and exceptions. 

When information is no longer required, and there is no lawful basis to retain it, we will securely destroy or de-identify it. 

13. Accessing Your Information

You may request access to personal and health information we hold about you, subject to applicable legal exceptions. 

We may ask for:

• Proof of identity
• Evidence of authority to act on behalf of another person

We will generally respond within 20 working days, unless a lawful extension applies. 

14. Correcting Your Information

You may request correction of information that is:

• Inaccurate
• Incomplete
• Outdated
• Misleading

Where we do not agree with a requested correction, you may request that a statement of correction be attached to the relevant record in accordance with applicable law. 

15. Children, Vulnerable Patients and Representatives

We recognise the importance of protecting the privacy and rights of:

• Children and young people
• Older adults
• People with disabilities
• Individuals requiring additional support

Information may be provided to appropriately authorised representatives where permitted by law. We consider the individual’s age, capacity, wishes, legal rights, and clinical circumstances when making privacy decisions. 

16. Privacy Enquiries and Complaints

If you have concerns about the collection, use, disclosure, or handling of your information, please contact our Privacy Officer. We will review concerns fairly and take appropriate steps to address them. 

If you are dissatisfied with our response, you may contact the Office of the Privacy Commissioner:

• Website: privacy.org.nz
• Phone: 0800 803 909

17. Privacy Officer Contact Details

Abdul Eraki
Privacy Officer for Baraka Health Limited and New Zealand Pharmacy Services Limited

Northwest Pharmacy
98 Hobsonville Road
Auckland 0618

Email: info@northwestpharmacy.co.nz

Phone: 09 416 0405

Please mark privacy requests or complaints for the attention of Abdul Eraki, Privacy Officer. 

18. Updates to This Policy

We may update this Privacy & Health Information Policy from time to time to reflect changes in legislation, business practices, or services.

The latest version and effective date will always be published on our website. Where required by law, additional notice or consent will be provided