In this Privacy Policy, ‘we’, ‘us’, ‘our’, ‘Bupa’, refers to Bupa Care Services NZ Limited (company number 1662622) and its related entities. Bupa is part of the Bupa Asia Pacific Group of companies, and part of the global Bupa Group of companies.
References to ‘products’ or ‘services’ in this Privacy Policy refer to and include the provision by Bupa of residential care and accommodation, retirement villages, and any ancillary services, products, or other healthcare related product or service offered by Bupa from time to time.
‘You’ or ‘your’ refers to any individual whose personal information we collect or process, including current, former or prospective residents or customers of Bupa and their family/whānau and representatives, visitors, and prospective, current and former employees, suppliers and contractors.
We may collect, hold, use and disclose your personal information in accordance with this Privacy Policy.
- About this Privacy Policy and how it applies to you
- Definitions
- Information we collect
- How Bupa uses your information
- How Bupa collects your information
- Accuracy of personal information
- How Bupa discloses your personal information
- Marketing
- Storage and security of your information
- Accessing, updating and correcting your information
- Website Security
- Cookies
- How you can provide us with feedback or make a complaint
-
1. About this Privacy Policy and how it applies to you
Your privacy and maintaining the confidentiality of your personal information is important to us. We are committed to safeguarding your personal information.
This privacy policy explains:
- how we collect, store, use, handle and protect your personal information;
- when your personal information may be disclosed to third parties;
- your rights for requesting access to or amending your personal information; and
- how you can provide us with feedback or make a complaint.
We collect and hold personal information about:
- current, potential and former customers or residents, and their family/whānau and other representatives;
- service providers, suppliers and their employees and contractors;
- funders, Te Whatu Ora (Health New Zealand), Government Agencies and their employees or contractors;
- current, former and prospective employees and contractors of Bupa, and their next of kin or emergency contacts;
- visitors to our residential care and accommodation facilities, retirement villages, and other premises;
- individuals we deal with in the course of carrying on our business; and
- other people who come in to contact with Bupa.
By making an enquiry about our products or services, accessing or using our products or services as a resident, patient or customer, supplying products or services to us, applying for and/or accepting employment with us, visiting our premises, or otherwise interacting with us, you acknowledge and accept that we will handle your personal information(including any use or disclosure) as outlined in this Privacy Policy. We may change this Privacy Policy from time to time by making the updated version available at bupa.co.nz/privacy. Where we make any significant or material change, we will endeavour to provide you reasonable notice of such changes(e.g. via email or through the website).
This Privacy Policy applies in addition to any contractual terms or policies applicable to the Bupa products and services that you obtain from us, products or services you supply to us, or any other contractual arrangement or understanding between us.
-
2. Definitions
Applicable Privacy Laws mean the Privacy Act 2020 and the Health Information Privacy Code 2020, and any other law that governs the processing of personal information and health information.
Government Agencies include any ministry, government department, or other crown entity, such as Te Whatu Ora (Health NZ), the Accident Compensation Corporation (ACC), the Ministry of Health, Inland Revenue, and Ministry of Social Development.
Personal information means information about an identifiable individual, which includes health information as defined under the Health Information Privacy Code 2020.
-
3. Information we collect
We collect your personal information in order to manage and conduct our business, to provide and market our products and services, and to meet our legal obligations. This will be by lawful and fair means and not in a way that may be unreasonably intrusive.
The amount and type of personal information we collect and hold about you will vary depending on the nature of our relationship with you.
The personal information that we collect and hold about you may include:
- your name, address, email address, phone number, contact details and documents that verify your identity and other personal details;
- personal details and diversity information such as date of birth, gender, ethnicity, languages spoken, relationship status, religious beliefs, affiliations, profile photo, tax status and citizenship or residency details;
- medical history, health information and records, including health assessments and treatment plans, quarterly personal services assessments, conditions or impairments, hospital admissions, emergency health events, medications, dependencies, and hearing or vision impairments;
- for suppliers, records of service contacts you’ve had with us or which we create in the course of our relationship with you, including purchases made and services used;
- census and statistical information for purposes including product development and risk assessment;
- financial information (for example, payment and billing details) and tax information (for example, IRD and GST numbers and tax payments);
- information about your access to our sites and premises;
- copies of your communications with us, including messages sent via the Blua App;
- Blua App usage information;
- images and videos of you attending Bupa-related events and activities; and
- any other information which is necessary for assisting us in conducting our business, providing and marketing our products and services, receiving products or services from you, and meeting our legal obligations.
For prospective, current and former residents, this will also include information collected as part of the application process and to enable us to provide our products and services on an ongoing basis, such as:
- details of your family medical history;
- your NHI number;
- name and contact details of your family/whānau, visitors, next of kin, representative(s), emergency contacts and others acting on your behalf. We may also collect copies of any relevant enduring powers of attorney or court orders;
- information collected through any applications you submit to us for our products or services and the contracts that you enter into with us relating to the provision of our products or services, including information contained in Admission Agreements and Occupation Right Agreements;
- evacuation, fitness centre, swimming pool, and workshop permission alerts;
- information about your hobbies and interests for administrative purposes;
- whether you use or require an interpreter (for those with hearing impairments or those who do not speak English);
- details of any ancillary products or services that you access during your time as a resident (whether provided by Bupa or through a third party provider facilitated by Bupa); and
- any other relevant details relating to your residence at our facilities.
For current, prospective and former employees, contractors, and suppliers, this may include information for the purpose of conducting our business or employment relationship with you. This may include:
- information about your occupation, employment history, qualifications, education and suitability for the role or relationship, including Police vetting and criminal history checks and publicly available information from social media profiles;
- the name and details of your emergency contacts;
- information related to your employment, such as salary and benefit information, hours of work and attendance records, leave entitlements, training records, disciplinary records;
- biometric information collected from employees and contractors for attendance, access and security purposes (where required by law, further information about this collection will be provided to you prior to the collection of your biometric information);
- video and audio recordings and written transcripts of online meetings you attend in the performance of your role or relationship with us (e.g. via Microsoft Teams) for the purposes of preparing meeting minutes and other administrative and business related purposes;
- geolocation information collected from your mobile device, where such functionality is enabled for attendance and access verification and audit purposes, device management, and security purposes; and
- information about your performance in the role or relationship.
-
4. How Bupa uses your information
We will only collect information that is necessary for the purposes of:
- communicating with you;
- conducting our business, including entering into and complying with supplier, funding, and other contracts;
- helping us manage and improve our products and services;
- providing you with our products or services, including facilitating the provision of third party services to you where that forms part of our service offering;
- verifying your identity;
- subject to your consent (in accordance with the Unsolicited Electronic Messages Act 2007), marketing and promoting our products and services to you, including contacting you electronically (e.g. by text or email);
- ensuring the integrity, safety and security of our operations (including complying with our health and safety obligations under the Health and Safety at Work Act 2015);
- processing, administering, collecting payments from or making payments to you and, if applicable, making appropriate tax deductions, including the collection of outstanding debt through the use of third party debt collection agencies;
- carrying out internal functions including administration, employment requirements and processes, accounting, audits, quality assurance, compliance and risk management, information technology and internal reporting;
- resolving and responding to complaints and reporting on complaints internally for management reporting purposes;
- facilitating transport and travel arrangements for residents and employees as required;
- providing the Blua App;
- conducting data analysis, surveys and market research; and
- complying with our legal obligations, including protecting and/or enforcing our legal rights and interests.
For prospective and current residents, this also includes:
- to assist you to apply and to live in our villages and care homes;
- assessing your requirements and needs and how we can best provide you with our products or services; and
- offering and providing you with or facilitating the provision of healthcare services, treatments or care, including maintaining complete and accurate records about your care and use of our products and services, and assessing your ongoing requirements and needs and continued suitability to occupy your home.
For current or prospective employees, contractors, and suppliers this also includes:
- to assess your suitability, performance or management in the role or function you perform for us;
- to manage and meet any contractual and statutory obligations that apply to our relationship with you; and
- to facilitate any required employment related travel, in which case we may need to collect your passport number and airline membership number.
In addition, CCTV footage specifically may be collected and used for the following purposes:
- detecting and deterring criminal or inappropriate behaviour on our premises;
- monitoring the safety and security of our employees, residents, contractors and visitors, and completing incident investigations; and
- reviewing the actions of any person at any of our sites, including our employees, contractors or visitors.
For more information about how we handle CCTV footage, please contact us at info@bupa.co.nz or the Privacy Officer at the relevant Bupa Retirement Village or Care Home.
-
5. How Bupa collects your information
We will always try to collect information from you directly. This includes where we collect your information from your legal representative (e.g. someone acting on your behalf under an enduring power of attorney).
In some circumstances, we may also collect your information via indirect means for the following purposes:
- we may collect certain personal information about you from any person you have authorised to act on your behalf (such as a family member or representative) and/or receive information about you and your care. Where you have authorised the collection of your personal information from a designated person, we will collect any personal information that such designated person provides to us for the purposes of facilitating your care(this information may be collected via email, text, phone, in person, or through the Blua App or other electronic platform). Any personal information we collect from an authorised representative or designated person, may be shared with your other authorised representatives and designated persons in accordance with your authorisation;
- we may collect health information about the treatment you receive from external healthcare practitioners (including your physiotherapist, medical specialist, general practitioner, podiatrist, pharmacist, speech language therapist, social worker, dietician, occupational therapist, and other allied health professionals) who are involved in providing you with care and treatment. We collect this information for the purpose of enabling us to effectively manage and deliver ongoing care to you from these health practitioners as needed, and ensuring we can continue to meet your needs and requirements by understanding your treatment plans and diagnoses;
- we may collect baseline health assessment information from Te Whatu Ora (Health NZ), including via their InterRAI system and the Needs Assessment and Service Co-ordination (NASC), for the purpose of assessing your suitability and eligibility for funded care services;
- we may collect information about your hospital stay and discharge notes from Te Whatu Ora (Health NZ) if you have been admitted to hospital, to ensure we can provide appropriate ongoing care and management or follow up treatment when you return to our care homes and villages;
- we may collect financial information about you from Government Agencies, such as MSD for the purposes of facilitating the funding or payment of your care services;
- we may collect resident identity and contact information, underlying health information and information related to your access to and use of services delivered to you by the medical alarm provider that we engage to provide such service to our retirement village residents (currently Umps Health New Zealand Limited), including information regarding when a medical alarm is activated. Umps’ collection and use of your information in connection with the provision of their medical alarm services is governed by their own privacy policy and practices, which operates independently of our own. For more information about how Umps processes and manages your information please refer to their privacy policy at https://www.umps.com/privacy-policy;
- we may collect information from the Health and Disability Commissioner about any complaint that you make involving Bupa and our products or services for the purposes of enabling Bupa to respond to any requests for information about your care that relates to your complaint and facilitating the resolution of your complaint;
- ACC may provide us with certain claim related information where you have submitted a claim to ACC for an injury that occurred on our premises or involves our residents, and ACC requires such information from us to process and assess the claim in accordance with their statutory functions.
For employees and contractors:
- we may collect an employment reference from any former employer that you have authorised us to contact for the purpose of assessing your suitability for employment with us, and we may collect employment related information about you from any recruitment or labour hire company you have authorised to provide the information to us for the purpose of enabling us to process any application of employment and assessing your suitability for employment with us;
- we may collect information about your criminal history and traffic offences from the Police Vetting Service and Ministry of Justice for the purposes of assessing your suitability for employment;
- with your consent, we may collect your contact information and employment location from any union or trade organisation you are a member of for the purposes of facilitating your union membership and providing you with union related benefits and services during the course of your employment;
- we may collect your car registration number and contact details from Parkable when you use the Parkable App to enable you to book a parking space at any of our sites;
- we may collect your contact details, injury details, NHI number, identification number, and any other relevant medical information relevant to your injury from Howden, our ACC claims management provider, for the purpose of facilitating and managing your injury recovery and assessing your suitability to return to work (whether a work related injury or otherwise). We may disclose this information to ACC in order to process your claim and any authorised medical practitioner involved in your care that requires access to such information in order to provide you with treatment.
If you have provided us with information about another person, then you are responsible for informing that other person that you have done so, that they have a right to access their information and that we will handle their personal information in accordance with this Privacy Policy.
If you do not provide us with the personal information we reasonably request, we may be unable to provide you with the products or services that you are requesting or we may not be able to employ you or engage you to provide products or services to us.
-
6. Accuracy of personal information
Before we use or disclose your personal information in accordance with the purposes set out in this Privacy Policy, we will take reasonable steps (if any) to ensure that the information is accurate, up to date, relevant and not misleading.
-
7. How Bupa discloses your personal information
As part of operating our business, Bupa may disclose your personal information on a confidential basis to our related companies within the Bupa Australia and New Zealand Group of companies and the global Bupa Group of companies (including our ultimate parent company, the British United Provident Association Limited, located in the United Kingdom), where necessary for Group level administrative and reporting purposes, or to enable a related company to provide certain services to us or on our behalf.
In the course of our operations, we may also disclose your personal information to third parties, in a manner consistent with the purposes for which it was collected, including to:
- your authorised nominated representative(s) or any person acting on your behalf, where necessary in order for them to manage their responsibilities to you and facilitate your care, or any other person(s) you have expressly designated to receive certain types of personal information about you;
- Our medical alarm provider (currently Umps Health New Zealand) to facilitate the provision of those services to our residents and manage the ongoing provision of such services;
- emergency responders to enable them to render aid to residents or others on our premises that require emergency care services;
- Government Agencies, statutory supervisors and regulatory bodies where we are required and/or permitted by law to do so or you have consented to such disclosure;
- auditors and other service providers we may appoint to ensure the integrity and clinical safety of our operations or any other person or entity engaged by us or acting on our behalf. In this case any such person or entity will be contractually bound to use any personal information shared with them only to perform the services they have been hired to provide for our benefit;
- healthcare providers involved in your treatment or care who have a need to know certain information in order for them to provide you with care;
- third party health benefit providers and insurance companies to assist in the processing of a claim for reimbursement or payment of all or part of the cost of treatment submitted by you or on your behalf;
- any business that supports our products and services, including any person that hosts or maintains any underlying IT system or data centre that we use to provide our website, the Blua App or other services or products;
- third party health insurance providers we engage to provide eligible employees discounted health insurance (currently Southern Cross Medical Care Society);
- any transportation, ride share, or taxi company (such as Uber B.V.), that we use to book transportation on your behalf;
- any debt collection agency that we engage to collect any outstanding debts owed to us;
- Inland Revenue and KiwiSaver providers for the purposes of calculating and paying employee superannuation contributions;
- any person or agency involved in any complaint or dispute, including any retirement village, health and disability, contractual or employment disputes process; and
- any court, Government Agency, tribunal or other person or entity where disclosure is required or permitted by law, including in legal proceedings.
If we send your personal information outside of New Zealand, we require that the recipient of the information complies with privacy laws and/or contractual obligations that provide comparable safeguards to those under New Zealand privacy law to maintain the privacy and security of your information.
-
8. Marketing
From time to time, we may contact you to provide you with information about products and services offered by us, our related companies and our business partners that may be of benefit to you and your family.
When you become our customer, we rely on inferred consent to use your personal information for marketing purposes (as described in this Privacy Policy), including for data analytics and related activities that may help us improve our products and services and how we deliver these to you.
If you do not wish to be contacted by Bupa for marketing purposes, you can contact us at any time to let us know. Our contact details are listed at the end of this Privacy Policy. If you request not to receive marketing material, please note that we will still contact you in relation to the provision of our products and services and our on-going relationship with you. For example, we will still send you any bills, statements and notices that are relevant to the products and services you have purchased from us.
If you contact us to make an enquiry, we may store your personal information to contact you in the future in relation to the product or service you enquired about.
-
9. Storage and security of your information
We will protect your personal information using such security safeguards as are reasonable in the circumstances to take, to prevent unauthorised access, use or disclosure of your information. We maintain data security standards, policies and procedures.
We keep your personal information for as long as it is required for the purposes for which it was collected as set out in this Privacy Policy, and to comply with legal requirements.
If we no longer require your personal information for any lawful purpose, including legal compliance purposes, we will take reasonable steps to securely destroy or de-identify your personal information. In the case of health information, we will retain your information for a minimum of 10 years from the most recent time we provided health services to you in accordance with our obligations under the Health (Retention of Health Information) Regulations 1996 or as otherwise required by law.
-
10. Accessing, updating and correcting your information
-
10.1. Access to personal information
You have the right to ask what personal information Bupa holds about you and to request access to that information. You can ask us for access to the information that we hold about you at any time. Simply contact us (our contact details are listed below) to make your request.
We will always endeavour to meet your request for access within a reasonable time and in the manner requested by you if it is reasonable to do so. However, in some circumstances, access to certain information may be declined, as permitted by Applicable Privacy Laws.
We may charge you a reasonable fee for access to some types of information in accordance with our rights and obligations under the Privacy Act.
-
10.2. Correcting or updating your personal information
It is important that the information we hold about you is accurate. If your details change, it is your responsibility to contact Bupa to notify us of any changes.
We will take reasonable steps to ensure that your personal information is accurate, complete, up-to-date and not misleading at the time of using it.
If you believe any information we hold about you is inaccurate, incomplete, out-of-date or misleading, you should contact us to let us know. We will respond to your request within a reasonable time and will take reasonable steps to amend your records if appropriate. If we decline to make any requested correction, we will notify you of our reasons for declining to do so and at your request take reasonable steps to attach a statement to your personal information setting out that you have requested that the information be corrected.
-
-
11. Website Security
Our website does not provide facilities that guarantee secure transmission of information over the internet. You should be aware that there are risks in transmitting information across the internet, including online forms and email. If you are concerned about conveying sensitive or personal information to us over the internet, please contact us by telephone to discuss the matter.
Our website contains links to other websites. You should take care in providing personal information to external websites linked to our website. We are not responsible for the privacy practices of other websites or external websites linked to this website.
We collect standard web server/visitor traffic information, commonly referred to as aggregate information, regarding overall website traffic patterns. Normally, web servers collect this type of basic information as part of their web log processes. We only use this information for statistical, reporting and website administration and maintenance purposes. It is not used in a way that individually identifies you, and we do not report on individual users.
-
12. Cookies
A "cookie" is a small text file placed on your computer by a web server when you access a website. Cookies are frequently used on websites. Cookies in themselves do not identify the individual user, just the computer used. We use cookies to make a record of your visit to our website and may log the following depersonalised information:
- your server address;
- your top-level domain name;
- the date and time of access to the website;
- pages accessed and documents downloaded;
- the previous website visited;
- the type of browser software in use.
Bupa uses this information for various purposes including:
- statistical purposes;
- to enable you to access online services and improve your website experience;
- determine whether you have previously used parts of the website or to identify the pages you have accessed, but in each case, information collected cannot be used to personally identify you.
You can choose if and how a cookie will be accepted by configuring your preferences and options in your browser. For example, you can set your browser to notify you when you receive a cookie or to reject cookies. However, if you decide not to display cookies, then you may not be able to gain access to all the content and facilities of our website.
-
13. How to contact us
You can contact us at any time if you have any questions or concerns about this Privacy Policy, about how your personal information has been handled, or if you would like to request access to any personal information we hold about you.
You can contact us by calling us on 0800 608 099 or via email info@bupa.co.nz. For requests regarding access to or correction of your personal information please contact BupaCSIRequests@bupa.co.nz. If your query relates to the handling of your personal information by a Bupa Retirement Village or Care Home, you should contact the Privacy Oicer at that Village or Care Home. The contact details for our Villages and Care Homes are available on our website.
If we are unable to resolve your query, or you would like to make a complaint regarding the handling of your personal information, you can contact the Oice of the Privacy Commissioner on 0800 803 909 or by visiting privacy.org.nz.
Effective 28 April 2026