Privacy notice

This section summarises St John’s approach to privacy of Personal Information and Health Information. From time to time we may update this Privacy Notice and/or our Privacy Policy and amend them to reflect changes in legislation, industry codes or in our operations.

This notice doesn’t change any other rights and obligations you or St John have relating to information and privacy.

For a copy of St John’s Privacy Policy, or if you have any question or concerns about your privacy then please contact our Privacy Officer.

The Privacy Officer
St John
Private Bag 14-902
Auckland

Phone: 0800 ST JOHN (0800 785 646)
email: privacyofficer@stjohn.org.nz

Personal Information

Personal Information is described by the Privacy Commissioner as:

…any piece of information that relates to a living, identifiable human being. People's names, contact details, financial health, purchase records: anything that you can look at and say, ‘this is about an identifiable person’.

We deal with your Personal Information in accordance with the Privacy Act 2020, the Health Information Privacy Code 2020 and the Telecommunications Information Privacy Code 2020

Health Information

Health Information is Personal Information in a health context. It is defined in clause 4(1) of the Health Information Privacy Code as:

(a) information about the health of that individual, including his or her medical history;

(b) information about any disabilities that individual has, or has had;

(c) information about any health services or disability services that are being provided, or have been provided, to that individual;

(d) information provided by that individual in connection with the donation, by that individual, of any body part or any bodily substance of that individual or derived from the testing or examination of any body part, or any bodily substance of that individual;

(e) information about that individual, which is collected before or in the course of, and incidental to, the provision of any health service or disability service to that individual.

How we use your Personal and Health Information

Collection

We may collect Personal and Health Information when you:

or somebody else on your behalf, makes a request to us for help, often through a 111 call
are given advice, treated or cared for by us,
are transported by us at the request of another healthcare provider
correspond with us
engage with us for any of the services or products we provide
fill in an online form
give us a donation or somebody else on your behalf give us a donation
join our Supporter Scheme, Youth Programme, Community Programme
attend a First Aid Training course
purchase or rent a first aid product or Medical Alarm

The information collected may include:

information about why we had contact with you and how we responded
information used to identify you such as your name, address, email or phone number
information about your condition, and the care and treatment we provided
information about how we resolved your case, including details of where we took you (if applicable) and referrals to other healthcare providers
information from a hospital or another health provider or their database such as Health One or Careconnect when that information is relevant to the advice, care or treatment we provide to you or administration and billing of ambulance services

We use your NHI Number to help positively identify you.

Storage

Any information you choose to give us is stored on paper or in a secure computer system. Health Information is kept for at least ten years and then securely destroyed.

Usage

We may use your Personal and Health Information for one or more of the purposes of:

helping to identify you
your treatment, management, and care
recording your health status
recording any advice and treatment we give you
providing continuity of care and support with other healthcare, support and emergency service providers
monitoring the quality of our products, services, treatment and care
clinical research
administration and billing of ambulance services
education/training of our clinical personnel and clinical audits
service planning
providing you with information, products, and services
contacting you about our products and services including our Supporter’s Scheme, Youth Programme, Community Programmes, Medical Alarms and First Aid Training courses and products
responding to your requests, inquiries, complaints, or applications
administration of your account
invoicing
training and education
inviting you to participate in surveys, fundraising, Supporter Scheme, events and similar promotions
prevention and detection of fraud
compliance with our legal obligations, resolution of disputes, and enforcement of our agreements
improving and updating this website

Sharing

We follow the rules and guidance of the Privacy Act, the Health Information Privacy Code and the Telecommunications Information Privacy Code about when and why we may share or disclose Personal and Health Information with others including your close family, and other healthcare, support and emergency service providers.

We have a Vulnerable Children, Young Persons and Adults Protection Policy which guides our decision making about sharing information in situations of suspected and actual abuse, neglect and vulnerability.

We may transfer your personal information to other countries for processing, support, storage and other necessary activities and by using our services and products you consent to the transfer of information to countries outside New Zealand which may have different personal data protection rules than in New Zealand. If we do this in this way, we will take steps to ensure that your privacy continues to be protected according to New Zealand privacy law.

Your personal information may be accessible to our contracted service providers and suppliers, which assist us with producing and delivering our products and services, operating our business, and marketing, promotion and communications.

Additional information about patient care records

Storage

When you or someone on your behalf calls 111, the information we receive is stored in a secure computer system.

When St John clinical personnel treat you a record of that care is made, either on a paper form or by recording the details on a tablet.

When a paper form is used the form is stored in a secure facility after we have finished with it.

When a tablet is used, your information is stored initially on the tablet in the Ambulance Officer’s hand, then transferred to St John’s data centre and removed from the tablet. It is encrypted while it is on the tablet and when it is being transferred.

This information is kept for at least ten years and then securely destroyed.

Sharing

When we transport you

If you are transported by ambulance to a healthcare facility (such as a hospital or medical centre) some of the information we collect is made available to the healthcare facility and their staff.

The reasons for this are to ensure appropriate transfer of care at the time you arrive at the healthcare facility, and to assist with ongoing provision of healthcare services to you.

We won’t automatically send our record of your care to your GP when we transport you. The place we take you to might though; if this is of concern then you should discuss it with them.

The process is different depending on whether we handover a paper record or an electronic record:

Paper Records

This is the way we have created and handed over healthcare records for many years.

We still sometimes create the record of your care directly on paper. In these cases, a copy of the paper record is handed to staff at the healthcare facility we take you to. We may key the information into our electronic system later.

In other cases, we use our electronic tablet to create our records and then print a copy to give to the healthcare facility.

When we handover a paper record, that document is kept by the healthcare facility and is then subject to the facility’s own privacy policies and procedures.

In all cases a copy is also retained by St John.

Electronic Records

There is a secure electronic system that allows staff at some hospitals to access our electronic record of your care.

The system means that hospital staff can refer to your ambulance care records as they need them and don’t have to rely on the paper copy being available. This may include access to records of previous ambulance encounters, including those when you were not transported.

Access is permitted only for the purposes of providing healthcare services to you and directly related purposes (including, where applicable, the conduct of quality audits and serious event reviews, and the provision of information to the Coroner, Ministry of Health, ACC, or other regulatory or professional bodies).

All access is logged and is auditable.

Some healthcare facilities may make a copy of the record. If they do, they will then follow their policies and procedures relating to access and care of that record.

When we don’t transport you

There is a secure process to send a copy of your electronic care record to your GP practice if you are enrolled with a Primary Health Organisation (PHO).

We will only use this process if an ambulance officer sees you, but you are not transported by ambulance.

Our staff will ask you about this first. You may choose to ask us not to send the record to your GP.

If you are happy for the record to be sent, we will access a database held by the Ministry of Health to find out which GP practice you are enrolled with, and send a summary of your ambulance encounter to that practice.

You may request that we don’t automatically send care information to your GP by contacting us at privacyofficer@stjohn.org.nz

We will then keep a record in our system to stop electronic care records being automatically sent. That record will override consent given at the time an ambulance officer sees you and will also stop messages being automatically sent if “yes” is accidentally ticked on our electronic tablets in the field.

You can however change your mind at any time; just inform us using the same email address privacyofficer@stjohn.org.nz.

If you’ve already told us not to send information to your GP, the ambulance staff may still ask you, as they can’t access that information from their mobile tablets.

We may give you a code to access the electronic record of your ambulance encounter. You will receive a piece of paper with the code and instructions on how to access the electronic record. You may then access the record yourself or share it as you see fit. The access is available for a limited period.

Data security

We use a variety of data security measures intended to ensure the confidentiality and integrity of your Personal Information and Health Information.

Access to information we hold about you

You can ask for access to and corrections of your Personal Information and/or Health Information by writing to or emailing us.

We may ask you to verify your identity. We may not agree to change your Health Information (for example if clinicians relied on that information whilst treating you); in this case we will record your request alongside the Health Information.

Any requests for access should be made directly to the St John Privacy Officer; contact details are above.

Resolving problems related to your privacy

If you want to report a suspected breach of your privacy or you do not agree with a decision regarding access to your Personal Information or Health Information, please contact us. We have an internal dispute resolution process to address such issues and will promptly acknowledge and investigate complaints.

Any enquires or complaints can be made through the Privacy Officer whose contact details are above.

If you are not satisfied with our final decision you can direct your complaint to the Office of the Privacy Commissioner; phone 0800 80 39 09 or by mail to PO Box 466, Auckland.

Monitoring phone calls

We monitor and record calls we receive through the 111 emergency call centre, and through our customer service 0800 numbers.

Caller location information

If you or somebody else, on your behalf, makes an emergency 111 call from a mobile device, we collect, store, use and disclose information on the probable location of the caller to help us respond in accordance with the Telecommunications Information Privacy Code 2003.

You can read about the caller location system here and here.

Monitoring the use of this website

When you visit this website, we may use automated tools and methods (such as cookies and sessions) to collect information about your visit, including:

the internet protocol address and domain name used by your computer to connect to the internet
the operating system and which browser your computer uses, and any search engine or inbound hyperlink used to reach this website
the date, time, and duration of your visit and the pages you viewed.

This information may be used to analyse how this website is being used.

We may gather more extensive information if we are concerned about abnormal website usage patterns or website security breaches.