Health Data Schedule

Working with healthcare comes with some extra rules around how patient and customer information needs to be handled — and rightly so.

This Health Data Schedule forms an extension of our Terms of Service and Privacy Policy, and sets out the healthcare-specific standards and safeguards betterbunch follows, so you can feel confident your customer data is being handled securely and in line with relevant industry requirements and recommendations.

Last updated: 29th August 2026

1.  Application

1.1  This Health Data Schedule (Schedule) applies where you are a Health Customer, and forms part of, and is incorporated into, the Agreement between you and betterbunch Limited (we, us, our). It also applies to our collection, holding, use, retention and disposal of Customer information where you are a Health Customer.

1.2.  Capitalised terms used but not defined in this Schedule have the meaning given in our Terms and Conditions (Agreement) or Privacy Policy. In addition, in this Schedule:

(a) HIPC means the Health Information Privacy Code 2020;

(b) Purge Period means the period described in clause 4 ;

(c) Purge means the automatic deletion of identifiable Customer contact information and feedback in accordance with clause 4.

1.3. To the extent of any inconsistency between this Schedule and clause 9 of the Agreement or our Privacy Policy, this Schedule applies in respect of our collection, use, retention and disposal of Customer information relating to your Customers.

2.  Roles and Responsibilities 

2.1  As between you and us, you remain responsible, as the collecting agency for the purposes of the HIPC, for compliance with the HIPC in respect of Customer information, including the indirect collection notice requirements described in clause 3.

2.2  We act as your agent for the purposes of section 24 of the Privacy Act 2020 in respect of our collection, holding, use and disclosure of Customer information under the Agreement, and will only collect, hold, use and disclose Customer information for the purpose of
providing the Services to you and in accordance with your instructions and this Schedule.

2.3  We undertake that all times during the term we will comply with the HISO 10029:2022  Health Information Security Framework and any other relevant Health Information Security Frameworks and standards, as notified and updated by the NZ Government.

3. Indirect collection of customer information

3.1. Where Customer information is collected about a Customer otherwise than directly from that Customer (for example, because you have provided it to us), you are responsible for ensuring the Customer is made aware of the matters required by Rule 3A of the HIPC
(including that we will process their information on your behalf, and how it will be used, stored and disposed of), unless an exception under Rule 3A applies.

3.2 On request, we will provide you with factual information about how we handle Customer information (including this Schedule) to assist you to prepare any notice required by clause 3.1.

4.  Retention and disposal

4.1  Contact-data purge and feedback purge are always enabled for Customer information relating to a Health Customer.

4.2  Subject to clause 4.3 , identifiable Customer contact information (name, email address and phone number) and any feedback submitted by a Customer will be automatically purged 120 days after the Customer's last interaction with the Services.

4.3  If you have Better Rewards enabled, the Purge Period is locked at 120 days. If you do not have Better Rewards enabled, you may select a shorter Purge Period, but not a longer one.

4.4  On expiry of the Purge Period, we will remove the relevant Customer’s identifiable information and retain their contact details only in cryptographically hashed, non-identifiable form. However, where a Customer has unsubscribed, generated a spam report, or been added to a blocklist to prevent further communication, we may retain the relevant email address and/or phone number in identifiable form solely to ensure that Customer is not contacted again if their details are later uploaded to us by you.

4.5  If you, or a Customer, request deletion of Customer information earlier than the Purge Period, we will action that request through our privacy request process, unless we are otherwise required by law to retain the information.

5.  Cancellation 

5.1  If your account is cancelled, the retention and disposal terms in clause 4 continue to apply to Customer information.

5.2 We will fully delete your remaining account and configuration information 5 years after cancellation of your account.

6.  Access and security 

6.1  You must nominate one user of the Services per practice or location, and that user must have multi-factor authentication enabled on their account.

6.2  We will maintain a list of subprocessors that may receive or store Customer information, and will provide this to you on request.

7.  Better Rewards

7.1  Where you have enabled Better Rewards, we will administer the prize draw on your behalf from eligible Customers, drawing a winner approximately every 90 days. We will not use a Customer's participation in Better Rewards for our own marketing or unrelated purposes.

8.  Breach notification 

8.1 We will notify you without undue delay if we become aware of a privacy breach involving Customer information, to allow you to meet your notification obligations under the Privacy Act 2020 and any obligations you owe to a health agency you provide services to.

9.  Ordering services, term and renewal

9.1  This Schedule may be updated by us from time to time in accordance with clause 12.1 (Amendments) of the Agreement.