Privacy and Health Information Policy

Last updated: 6 September 2026

Neff Functional Medicine is a New Zealand medical practice led by Dr Stephan Neff.

This policy explains what personal and health information I collect, why I collect it, how it may be used or shared, and your rights in relation to that information.

It applies when you:

  • visit this website
  • submit an enquiry
  • communicate with Neff Functional Medicine
  • become a patient
  • receive clinical services
  • arrange testing, prescriptions or other healthcare services through the practice

Personal and health information is handled in accordance with the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020.

Information I may collect

The information collected will depend on your reason for contacting the practice. It may include:

Identification and contact information

  • your name and preferred name
  • date of birth
  • address and location
  • telephone number
  • email address
  • NHI number, where appropriate
  • emergency or nominated contact details

Health information

  • your current symptoms and health concerns
  • medical and surgical history
  • diagnoses
  • medications and supplements
  • allergies and adverse reactions
  • family history
  • nutrition, sleep, exercise and lifestyle information
  • alcohol and substance-use history
  • environmental or occupational exposures
  • mental health and relevant social history
  • laboratory results
  • imaging reports
  • specialist letters
  • clinical notes
  • prescriptions and treatment plans

Administrative information

  • appointments
  • invoices and payment information
  • correspondence
  • consent forms
  • referrals
  • records of services provided

Website information

When you use this website, limited technical information may be collected automatically. This may include your device type, browser, approximate location, referring website and the pages you visit.

Why I collect your information

Your information may be used to:

  • respond to your enquiry
  • decide whether my services are likely to be suitable for you
  • confirm your identity
  • create and maintain your clinical record
  • understand your health history and current concerns
  • provide medical assessment and care
  • arrange laboratory testing, prescriptions, referrals or other services
  • communicate with your GP, specialist, pharmacist, laboratory or another healthcare provider
  • arrange and manage appointments
  • issue invoices and manage payments
  • meet clinical, professional, legal and regulatory obligations
  • maintain the safety and security of the practice
  • improve the operation of the website and patient pathway

Submitting an initial enquiry does not automatically establish an ongoing doctor–patient relationship. I will review your enquiry before confirming whether I am able to assist you.

If you choose not to provide information that is reasonably required, I may not be able to assess your enquiry or provide appropriate medical care.

How information is collected

Most information is collected directly from you through:

  • website enquiry forms
  • clinical intake forms and questionnaires
  • consultations
  • emails, telephone calls and messages
  • information or documents you provide

With your authorisation, information may also be obtained from your GP, specialist, laboratory, pharmacy, hospital, other healthcare provider or a person supporting you.

Information may be collected without your direct authorisation where this is permitted or required by law.

If someone provides information on your behalf, I may need to confirm their identity, relationship to you and authority to act for you.

Website enquiry forms

The website enquiry form asks for personal and health information so that I can understand why you are seeking help and decide what type of consultation may be appropriate.

Please provide only the information requested and avoid including unnecessary information about other people.

Website forms and ordinary email should not be used for urgent medical problems. If you require urgent medical attention, contact your usual healthcare provider, an urgent care service or emergency services.

How your information is stored

Information may be held in systems used to operate the practice, including:

  • the Neff Functional Medicine website and Ninja Forms
  • secure clinical record systems, including Cliniko
  • practice email and communication systems
  • accounting and invoicing systems
  • laboratory, prescribing and referral systems
  • secure electronic devices and document storage
  • website hosting, security and backup services

I take reasonable steps to protect information from loss, unauthorised access, misuse, alteration or disclosure.

No internet or electronic storage system can be guaranteed to be completely secure. If a privacy breach occurs, it will be assessed and managed in accordance with New Zealand privacy law, including notification where required.

Who may receive your information

Your information may be shared when reasonably necessary with:

  • your GP, specialist or another healthcare provider involved in your care
  • laboratories, pharmacies and diagnostic services
  • clinics from which I provide services
  • administrative or clinical staff supporting the practice
  • information technology, website hosting, security and clinical-software providers
  • accountants, payment providers and professional advisers
  • debt-recovery services where an account remains unpaid
  • insurers or other organisations where you have authorised disclosure
  • regulatory, legal or government authorities where disclosure is required or permitted by law

Only information reasonably required for the relevant purpose will be shared.

I do not sell personal or health information.

Service providers outside New Zealand

Some technology, website, communications, payment or data-storage providers may process or store information outside New Zealand.

Where overseas services are used, I will take reasonable steps to use reputable providers and ensure that information is handled with appropriate privacy and security safeguards.

Some disclosures outside New Zealand may require your authorisation or other protections under New Zealand privacy law.

Website analytics and cookies

This website uses cookies and services such as Google Analytics to help me understand how people find and use the website.

Analytics may collect technical information such as:

  • the pages visited
  • the approximate location of the visitor
  • browser and device information
  • how the visitor arrived at the website
  • links or buttons used

I do not intentionally send names, contact details, free-text medical information or the contents of patient forms to Google Analytics.

You can restrict or remove cookies through your browser settings. Some website functions may not work as intended if cookies are disabled.

Email and newsletters

If you subscribe to a newsletter or request educational material, your contact details may be used to send that material.

You will not be added to a marketing list simply because you made a clinical enquiry. Marketing and newsletter communications will only be sent where you have requested them or otherwise provided appropriate consent.

You can unsubscribe from marketing emails at any time.

Clinical and administrative messages relating to your care are not marketing communications.

How long information is retained

Clinical records are retained for at least the period required by New Zealand law and professional standards.

For doctors in private practice, patient health records will generally be retained for a minimum of 10 years and one day from the date of the last consultation. Records may be retained for longer where there is a clinical, legal or professional reason to do so.

Information from people who make an enquiry but do not become patients will be retained only for as long as it is reasonably required for the purpose for which it was collected, subject to any legal obligations.

Information that is no longer required will be securely deleted, destroyed or anonymised where reasonably practicable.

Accessing or correcting your information

You have the right to ask for access to personal and health information held about you.

You may also ask for information to be corrected if you believe it is inaccurate, incomplete or misleading.

Before releasing information, I may need to confirm your identity. In some circumstances, access may be limited or refused where permitted by law. If this happens, the reason will be explained to you.

To request access or correction, contact Neff Functional Medicine through the website Contact page.

Privacy concerns or complaints

If you have a concern about how your information has been handled, please contact me first so that I can investigate and respond.

Privacy Officer: Dr Stephan Neff
Practice: Neff Functional Medicine
Contact: Contact Dr Stephan Neff

If you are not satisfied with the response, you may contact the New Zealand Office of the Privacy Commissioner:

Office of the Privacy Commissioner

Changes to this policy

This policy may be updated when the practice, technology, legal requirements or information-handling processes change.

The current version will be published on this website with the date of the latest update.