Privacy & Security Policy

Epilepsy New Zealand Privacy Statement 

This statement applies to clients, supporters, website visitors, and anyone who contacts Epilepsy NZ. 

Last updated: April 2026 

 

Our commitment to you 

Epilepsy NZ is committed to protecting the privacy and dignity of everyone we work with. We collect only the information we need to provide safe and effective epilepsy support. We are honest about what we collect, why we collect it, who can see it, and how we keep it safe.  

This statement explains your privacy rights and how we manage your personal information, in line with the Privacy Act 2020 and the Health Information Privacy Code 2020. 

 

Your Privacy Rights 

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the following rights in relation to the personal information Epilepsy NZ holds about you: 

  • Access your information: you can ask us for a copy of the personal or health information we hold about you. We will respond within 20 working days. 
  • Correct your information: if you think something we hold about you is wrong or out of date, you can ask us to correct it. 
  • Know when your information is collected: we will tell you what we are collecting and why, at the time we collect it or as soon as practicable after. 
  • Know when information is received from others: if we receive information about you from someone else, such as a family member, GP, or referrer, we will let you know as soon as practicable. 
  • Ask questions about how your information is used: you can contact us at any time with questions about your privacy. 
  • Complain if you’re not satisfied: if you are unhappy with how we have handled your information, you can contact us or complain to the Privacy Commissioner at www.privacy.org.nz. 

To exercise any of these rights, contact us at national@epilepsy.org.nz or call 0800 37 45 37. 

ENZ Privacy Brochure – Updated April 2026

ENZ Youth Brochure – Updated April 2026

PART 1 – Privacy when accessing our services

1. What Information We Collect and Why 

When you access Epilepsy NZ services, including education sessions, advocacy, referrals, or phone and email support, we may collect personal and health information. This may include: 

  • Name, contact details, and date of birth – to identify you, contact you about your support, and maintain accurate records 
  • Epilepsy diagnosis, seizure type, frequency, and triggers – to provide safe, appropriate, and personalised epilepsy support 
  • Medication and treatment information – to support safe care planning and coordination with health professionals, with your consent 
  • Emergency contact and support network details – to contact someone on your behalf in an emergency 
  • Cultural and communication preferences – to ensure support is delivered in a way that works for you 

Information about your epilepsy, including your diagnosis, seizures, medication, and treatment, is health information. The Health Information Privacy Code 2020 gives health information the highest level of legal protection. This means we apply additional care and restrictions to how it is stored, accessed, and shared.

 

2. When We Receive Information About You from Others 

Sometimes we receive information about you from someone other than you, for example: 

  • A family member or whānau who contacts us on your behalf 
  • A GP, specialist, or other health professional who makes a referral 
  • A school, employer, or community agency that contacts us about your needs 
  • A carer who provides information to help us support you 

Under IPP 3A of the Privacy Act 2020, when we receive information about you from someone else, we are required to let you know, as soon as practicable, that this has happened. When we first make contact with you, we will tell you that we received information about you and from whom, what that information is being used for, who else may have access to it, and that you have the right to see and correct it. 

There may be rare situations where telling you immediately is not practicable, for example, where we have not yet been able to reach you. In those cases, we will notify you as soon as we are able to make contact. If notifying you would create a safety risk, we will seek advice before proceeding. 

If you submit a referral form on behalf of someone else, you must have their consent or legal authority to do so. We will still take reasonable steps to notify that person directly when we make contact.

 

3. How We Use Your Information 

We use your personal and health information only for the purposes we have told you about. This includes: 

  • Delivering safe and appropriate epilepsy support and education 
  • Planning and personalising your support over time 
  • Maintaining accurate records for continuity of care 
  • Coordinating care with health professionals, only with your consent 
  • Meeting our legal and professional obligations 

We will not use your information for any other purpose without your consent, unless the law requires it. 

 

4. Who We Share Your Information With 

We do not share your personal or health information with third parties except in the following circumstances: 

  • You have given us clear consent to share, for example, to coordinate with your GP or specialist 
  • Sharing is necessary to prevent a serious and imminent risk to your safety or someone else’s 
  • We are required to do so by law or a court order 
  • It is shared with a service provider working on our behalf, under a confidentiality agreement, for the purpose of delivering our services 

When we do share your personal or health information, we will share only what is necessary. 

 

5. How Long We Keep Your Information 

We keep personal and health information only for as long as we need it for the purpose it was collected, or as required by law. Your information will be kept for 7 years after the date of your last interaction with us, in line with the Privacy Act 2020.  

When information is no longer needed, it is securely destroyed. Paper records are shredded or securely placed in confidential disposal bins, and digital records are permanently deleted from all systems. 

 

6. How We Keep Your Information Safe 

Your information is stored securely in our approved case management system (Noted) and is accessible only by authorised Epilepsy NZ staff. We use appropriate technical and organisational security measures to protect your information from loss, unauthorised access, misuse, or disclosure. 

Staff who handle personal information receive privacy training and are bound by confidentiality obligations. Handwritten notes taken during sessions are transferred into our system and securely destroyed within 24 hours.

 

7. Accessing and Correcting Your Information 

You have the right to request access to the personal or health information Epilepsy NZ holds about you, and to request correction of anything that is inaccurate, incomplete, or misleading. 

To make a request, email us at national@epilepsy.org.nz or call us on 0800 37 45 37.  

We will acknowledge your request promptly and respond within 20 working days. If we need more time, we will let you know before the deadline.   

Our Privacy Brochure and Youth Privacy Brochure explain your access and correction rights in plain language and are available on request or on our website.

 

PART 2 – Privacy when visiting our website 

8. Information We Collect on Our Website 

8.1 Aggregated website traffic data 

We collect statistical information about how our website is used. This includes the number of visitors, pages most viewed, time spent on the site, and general traffic sources. This information is aggregated; it does not identify individual users and is used only to improve the website and our services. 

We may use cookies or similar technologies to collect this information. Cookies are small files stored on your device that help us understand how you use our site. You can manage or disable cookies through your browser settings, though this may affect some website functionality. 

 

8.2 Personal information you choose to provide 

We collect personal information from our website only when you choose to provide it. This may happen when you: 

Sign up as a member 

We collect your contact details and store them securely. You can unsubscribe at any time. 

Register for an event 

We collect your name, email address, and phone number. If an event is delivered regionally, your registration details may be shared with the relevant regional Epilepsy NZ organisation (the one you selected when registering).  

Make an online donation 

We collect your name, address, email address, and phone number to issue a receipt and to communicate with you about our work. We do not store credit card or banking details. 

Complete a referral form 

Information submitted through a referral form is shared only with the Epilepsy NZ organisation you selected. If you are submitting information about another person, you must have their consent or legal authority to do so. Epilepsy NZ will take steps to notify that person directly when we make contact with them. 

Contact us through the website 

Any personal information you provide when contacting us will be used only to respond to your enquiry. We will not add you to a mailing list without your consent.

 

9. Social Media 

Epilepsy NZ maintains social media accounts to share information, raise awareness, promote events, and engage with our community.  

If you interact with us on social media: 

  • Any information you provide is also subject to the privacy policy of the relevant social media platform 
  • Information you post publicly may be visible to others and is outside our control 
  • We may respond to public comments but will never discuss personal or health information in a public forum 
  • If you contact us via direct message and share personal information, we will move the conversation to a secure channel such as email or phone 

We will not collect personal information from your social media profile beyond what you choose to share with us directly. 

 

10. Security of Information 

Epilepsy NZ and our website service providers use appropriate technical and organisational measures to protect personal information from loss, unauthorised access, misuse, alteration, or disclosure. 

While we take reasonable steps to protect your information, there is always a residual risk when transmitting data electronically. If you have concerns about sending sensitive information online, please contact us by phone on 0800 37 45 37. 

 

11. Communications and Mailing List 

If you are on our mailing list and no longer wish to receive communications from us, you can use the unsubscribe link included in any email we send, or contact us at national@epilepsy.org.nz. 

If your contact details change, please let us know at national@epilepsy.org.nz or call 0800 37 45 37. 

 

12. Changes to This Statement 

We review this Privacy Statement regularly and update it when our practices change or legislation is updated. The date at the top of this statement shows when it was last revised. 

 

13. Questions and Complaints 

If you have any questions about this Privacy Statement or how we handle your personal information, please contact us: 

  • Email: national@epilepsy.org.nz 
  • Phone: 0800 37 45 37 
  • Website: www.epilepsy.org.nz

If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner: 

  • Website: www.privacy.org.nz 
  • Phone: 0800 803 909 
Back to top