Skip to content

Privacy Policy

Last updated: 21/07/2026

1. About this Policy

This Policy explains what personal and health information we collect, how we use it, who we share it with, how long we keep it, and what rights you have over it. It applies to all the information we collect in connection with our services.

We comply with the Privacy Act 2020, the Health Information Privacy Code 2020, and any other applicable privacy and health information law.

This Policy forms part of our Terms of Service. Where this Policy and our Terms of Service differ, the Terms of Service apply, except that nothing in either document reduces your rights under New Zealand law.

Some words in this Policy have the meaning given to them in our Terms of Service. In particular:

  • Brightly Team means everyone who works with you. The team includes several different roles, doctors such as geriatricians and GPs, nurses, pharmacists, dietitians, health coaches and care coordinators.

  • Brightly Clinician means a member of the Brightly Team who is a registered health practitioner holding a current annual practising certificate.

  • Partner Services means services provided by professionals or organisations that are not part of Brightly, such as external specialists, laboratories, audiology and sleep services, pharmacists, telehealth providers, and financial or legal advisers.

  • Service Description means the page on our website that describes the service you bought, as it read when you bought it, together with anything we confirmed to you in writing before you bought.

2. Information we collect

We collect:

  • Brightly Team means everyone who works with you. The team includes several different roles, doctors such as geriatricians and GPs, nurses, pharmacists, dietitians, health coaches and care coordinators.

  • Brightly Clinician means a member of the Brightly Team who is a registered health practitioner holding a current annual practising certificate.

  • Partner Services means services provided by professionals or organisations that are not part of Brightly, such as external specialists, laboratories, audiology and sleep services, pharmacists, telehealth providers, and financial or legal advisers.

  • Service Description means the page on our website that describes the service you bought, as it read when you bought it, together with anything we confirmed to you in writing before you bought.

We will collect information directly from you unless that is not practical. If it is not, we may collect it from another source, such as a family or whānau member, or another health professional, where you have authorised that, where the law requires or permits it, or where you are unable to give authority and your representative authorises it. Clause 2.4 of our Terms of Service explains who can act for you.

Where we collect information about you from another source, we will take reasonable steps to make sure you know: that we have collected it; why; who we intend to give it to; our name and contact details; the specific law involved, if the collection is authorised or required by law; and your rights to see and correct it.

We may not give you that notice where an exception in the Privacy Act applies, for example where telling you is not reasonably practicable, where the information is publicly available, where telling you would prejudice purposes such as the prevention, detection, investigation or prosecution of offences, or where you already know these things. If we rely on an exception, we will keep a brief record of why.

3. Why we collect it

We collect your information so that we can provide the services you have bought from us, and because we need it to do so. What that involves depends on the service. The Service Description for each service sets out what it includes.

Across our services, we generally use your information to:

  • deliver the assessments, programmes and other services you buy, including arranging tests, running your appointments, analysing your information, and preparing your reports, plans and recommendations;

  • communicate with you about your appointments, results, findings and recommended next steps;

  • arrange referrals, or share relevant information with your GP, another healthcare provider, or a Partner Service, with your authority;

  • support your discussions with your GP and other providers involved in your care;
    coordinate your care across the people and organisations involved in it;

  • administer your account, bookings, payments and any promotion you take part in;
    meet our legal and professional obligations;

  • handle complaints and improve the quality and safety of our services; and
    carry out service improvement, quality assurance, and de-identified research or statistical analysis.

Giving us your information is voluntary, but without it we may not be able to provide a service. Where the law requires you to give us particular information, we will tell you which law that is and what happens if you do not.

4. How we use it

We use your information for the purposes described in clause 3. In practice, that includes generating draft reports and plans for review and approval by a Brightly Clinician, providing platform features such as progress tracking, bookings and the sharing settings you control, supporting your interactions with your GP and care team, helping you access non-clinical support services such as legal and financial advice, and, where you ask us to, seeking approval for and managing claims with your insurer.

We also monitor, maintain and improve the platform and our services, using de-identified and aggregated information wherever that is reasonably practicable.

We take reasonable steps to make sure the information we use is accurate, up to date, complete, relevant and not misleading.

We will not use your personal or health information for purposes unrelated to those described in this Policy unless you consent or the law permits it. Before any materially different new use, we will tell you and, if we need to, ask for your consent.

4.1 Artificial intelligence

We may use approved AI-enabled tools in connection with your care, to help with tasks such as transcribing discussions and preparing draft transcripts and documents.

These tools support documentation and care delivery. They do not replace clinical judgement. A Brightly Clinician remains responsible for reviewing, interpreting and approving any clinically relevant output before it goes into a final report, into your medical record, or is used to support a decision about your care.

We will tell you when we use AI in connection with your care. Where professional or legal standards require it, we will ask for your consent first, including where AI plays a significant role in delivery of care. If you would rather we did not, tell us, and we will explain what that means for the way we provide the service, including any effect on timing, workflow or particular features.

We do not use fully automated decision-making without human clinical oversight.

4.2 Marketing and personalised content

We may use your contact details, and information about how you use our platform, newsletter and educational content, to send you updates, health insights and community news that you have chosen to receive, and to tailor educational content and ageing support to the interests or health markers in your profile.

You can opt out at any time using the unsubscribe link in our emails, or by updating your account settings. Opting out of marketing does not stop messages about your care, such as booking confirmations, reminders and updates to your plan.

4.3 Research and de-identified information

We may contribute de-identified and aggregated information to research and analysis projects that aim to understand health trends, design better support for older people, improve the health system, or develop new health products and services. These projects may be run by government agencies, research institutions or private organisations, and de-identified information may be shared with them for those purposes.

De-identified means the information has had identifying details removed. We will not publish or share information in a form that could reasonably be expected to identify you.

If we ever wanted to use information that could identify you for research, we would ask for your consent first, and you would be free to say no.

5. Who we share it with

We may share your information:

  • with members of the Brightly Team involved in your care, on a need-to-know basis, and subject to professional and contractual confidentiality obligations;

  • with your GP or other care providers, or with family, whānau or other supporters you have nominated, with your authority;

  • with laboratory and diagnostic providers, for tests we arrange for you or results we receive;

  • with a Partner Service, where a referral is made on your behalf;

  • with service and technology providers, under confidentiality, privacy and security arrangements;

  • with payment providers, to process payments;

  • with ACC, insurers or funders, where you ask us to help and you consent, so that they can consider whether a service is eligible for cover, authorise, process and settle claims, and evaluate the provision and quality of our services;

  • where the law requires it, or to prevent a serious threat to health or safety; and

  • where the Health Information Privacy Code otherwise permits it, such as for quality assurance, accreditation or risk management.

5.1 Partner Services

We will ask for your authority before making a referral to a Partner Service. Once we do, that organisation receives only the information it needs to provide the service, and handles it under its own privacy obligations and applicable law.

5.2 Brightly Clinicians working from overseas

Some Brightly Clinicians may be physically located overseas, including in the United Kingdom. They are registered in New Zealand and hold current annual practising certificates, and New Zealand law and professional standards apply to them.

They access your information to review and approve plans and reports, and to do things reasonably connected with that. They do so as part of our own team and under our control, using our secure systems, and they are contractually and professionally bound to protect your information to the same standard as if they were in New Zealand. The same New Zealand privacy obligations apply.

If you would prefer your care was handled only by practitioners physically in New Zealand, tell us and we will arrange that where we can.

5.3 AI providers

Where an approved AI scribe is used during a discussion, information from that discussion and related health information may be processed by the provider of that tool, for the purpose of generating a transcript and draft documentation for a Brightly Clinician to review.

6. Keeping your information safe

We take the protection of your personal and health information seriously. In line with the Privacy Act 2020, the Health Information Privacy Code 2020 and recognised industry standards, we use a range of administrative, technical and physical safeguards.

Your information is encrypted both in transit and at rest. Access is restricted by role-based controls and the principle of least privilege, and multi-factor authentication is required for administrative and staff access. Access and changes are logged in audit trails and reviewed periodically. Our systems are monitored for unusual or unauthorised activity, supported by intrusion detection and incident response procedures. Everyone who works with us receives regular privacy, security and data handling training. Any third-party provider we engage must meet equivalent security and privacy standards, including contractual obligations under the Privacy Act 2020.

Data is backed up regularly, stored securely and encrypted. We maintain redundant systems and disaster recovery processes, and test them periodically.

No system can be guaranteed to be completely secure. If a privacy breach happens that has caused, or is likely to cause, serious harm, we will notify you and the Office of the Privacy Commissioner as soon as practicable, and tell you what happened, what we have done to contain it, and what you can do to protect yourself.

7. How long we keep it

We keep health information for at least 10 years from the date of your last interaction with us, as New Zealand law requires. We keep other personal information only for as long as we need it for the purpose we collected it, or for as long as the law requires.

As a guide, support requests and communications are normally kept for up to 2 years; technical logs and analytics are normally anonymised or deleted after 12 months; and complaints correspondence may be kept for up to 7 years.

At the end of these periods we securely destroy or permanently anonymise the information, unless we are required to keep it for longer by law or for a legitimate business purpose such as an ongoing dispute.

Ending a service or closing your account does not by itself delete your health information, because we are required to retain it for the periods above.

8. Your rights

You can ask to see the information we hold about you, and ask us to correct it, by emailing privacy@agebrightly.co.nz. We will respond within 20 working days, or tell you if we need more time. If we do not agree to make a correction, we will attach your statement to the record.

You can withdraw or limit your consent to our collecting, using or sharing your information at any time, subject to any legal or contractual restrictions. That will not affect information we have already used with your consent, and it may affect our ability to keep providing a service. You can also refuse or withdraw consent to a proposed use of AI in your care where your consent is required, and we will explain what that means at the time.

If you are not able to make decisions for yourself, someone with legal authority can exercise these rights for you, including access, correction and withdrawing consent.

If a privacy breach involving your information has caused, or is likely to cause, serious harm, we will notify you and the Office of the Privacy Commissioner as New Zealand law requires.

9. Complaints

If you have a concern about how we have handled your information, please tell us at privacy@agebrightly.co.nz. We will acknowledge your complaint within 5 working days. Within 10 working days of that, we will either tell you our decision or tell you that we need more time and why. If we do need longer, we will keep you updated at least once a month until we reach a decision.

You do not have to complain to us first, and you do not have to wait for us to finish.

The Health and Disability Advocacy Service gives free, independent and confidential support to anyone with a concern about a health or disability service, phone 0800 555 050, or visit www.advocacy.org.nz.

You can complain to the Privacy Commissioner (www.privacy.org.nz), phone 0800 803 909, or to the Health and Disability Commissioner (www.hdc.org.nz), phone 0800 11 22 33.

10. Changes to this Policy

We may update this Policy from time to time. If we make material changes to how we collect, use or share your health information, we will tell you directly, for example by email or through the platform, and, where the law requires it, ask for your consent. The current version is always available on our website.

11. Contact us

For anything about privacy, including access and correction requests: privacy@agebrightly.co.nz.

For anything else: hello@agebrightly.co.nz, or phone 0800 159 753.