This Privacy Policy outlines the commitment of Heron Health Limited (we, us, or our) to safeguarding Personal Information provided to us by our customers (you or your) and ensuring that all data processing activities are conducted in strict compliance with the Privacy Act 2020 (the Privacy Act) and the Health Information Privacy Code 2020.
This Privacy Policy applies to all Personal Information collected, used and disclosed through Heron, our cloud-based patient booking and inquiry software system, and any related services, products, or other engagements that we have with you.
Where we process Personal Information on behalf of healthcare providers using Heron, those providers act as the 'agency' (data controller) and are responsible for ensuring appropriate notices and consents are obtained from their patients in accordance with applicable privacy laws.
Where we collect Customer Data indirectly (that is, from your clinic rather than from the patient), we rely on the exception under IPP 3A of the Privacy Act 2020 on the basis that healthcare providers have already informed the patient of the collection. You are responsible for ensuring that your patients are made aware that their Personal Information may be processed through Heron, including the purposes of collection, the categories of recipients, and their rights of access and correction under IPP 6 and IPP 7.
Heron is a communication and booking interface, not a clinical System of Record (SoR). While Heron may capture and temporarily store health information (such as call transcripts or summaries), you are solely responsible for ensuring that any relevant health information is transferred to and maintained in your own System of Record (such as your Patient Management System) in accordance with your legal obligations. Heron does not accept responsibility for your regulatory compliance obligations, including but not limited to health record retention requirements.
We collect Personal Information about you and your customers when you sign up as a user of Heron and use Heron and our related services. The types of information we may collect include:
Cookies collect information such as IP addresses, browser types, device information, and browsing activity. You can manage cookie preferences in your account settings and opt-out of third-party cookies if applicable.
Security of Personal Information: We will take reasonable steps to secure Personal Information against unauthorised access or breaches. Our security measures are in accordance with our legal obligations, our Internal Privacy Policies and industry standards, taking into account the nature of the Personal Information.
We process, use, collect, and retain your data in a manner that complies with applicable laws and regulatory requirements. In particular:
We take data security seriously and have implemented appropriate technical and organisational measures to protect data from misuse, interference, loss, unauthorised access, modification, or disclosure. This includes:
The collection of Personal Information through Heron and our related services is conducted in accordance with specific legal bases under New Zealand law:
Account Data: collected for the performance of our contractual obligations under the Terms of Service and our legitimate interests in account security, billing, and regulatory compliance.
Customer Data (health information): collected on the basis of healthcare provider obligations under the Health Information Privacy Code 2020, patient consent obtained by healthcare providers, and our legitimate interests in service delivery where permitted by IPP 10.
Usage Data: collected for the performance of essential service features (such as transcriptions and summaries) and our legitimate interests in service improvement and operational continuity.
Technical Data: collected for our legitimate interests in system security, technical support, service compatibility, and fraud prevention.
Voice Recordings: collected only where your clinic has enabled call recording and confirmed that appropriate procedures are in place in accordance with the Privacy Act 2020 and the Health Information Privacy Code 2020.
Where applicable, we will inform you whether the provision of Personal Information is voluntary or mandatory, as well as the possible consequences of failing to provide such data. Healthcare providers using Heron are responsible for obtaining appropriate patient consents and notices as agencies under applicable privacy laws.
Account Data: We retain invoices, payment records and other corporate financial records only for as long as reasonably necessary for business and operational purposes, which may include account management, financial reporting, and customer support. We will not retain such records beyond seven (7) years from the end of the financial year in which the transaction occurred, as required by the Tax Administration Act 1994.
Personal Information: We keep personal information only while it is reasonably necessary for the specific purpose for which it was collected or to meet a legal obligation. When that purpose ends, we securely delete or de-identify the data as required by IPP 9 of the Privacy Act 2020.
Customer Data: We retain health-related data - such as bookings, transcripts, voice recordings and call summaries containing health information - on a strictly temporary basis for up to 90 days to enable you to review and transfer relevant information to your own systems. This temporary storage is provided as a convenience only and does not constitute permanent record-keeping. For the avoidance of doubt, Heron processes Customer Data on your behalf as a data processor and does not independently hold health information as a health agency under the Health Information Privacy Code 2020. The retention obligations applicable to health agencies, including the 10-year minimum retention period under the Health (Retention of Health Information) Regulations 1996, apply to you as the agency holding the primary health record and not to Heron.
You acknowledge that:
You are solely responsible for exporting all relevant health information to your own System of Record (such as your Patient Management System) within this 90-day period and for meeting all applicable regulatory requirements for health record retention;
After 90 days, this data is automatically deleted from our systems; and
We do not retain health information for the statutory 10-year period required of health providers; this obligation rests entirely with you as the agency holding the primary health record.
We do not share Personal Information with third parties except as reasonably necessary to provide our services (such as cloud hosting providers, payment processors, telephony infrastructure, and AI processing tools).
When engaging market-leading technology vendors, we take reasonable steps to ensure your data remains protected. Rather than bespoke contracts, these providers are typically engaged under standard industry Data Processing Agreements (DPAs) or Terms of Service. We conduct due diligence to ensure these standard agreements offer privacy, security, and confidentiality protections that are consistent with the Privacy Act 2020 and the Health Information Privacy Code 2020.
Our vendor agreements generally include:
Personal Information may be stored and processed in New Zealand, Australia, and the United States through our third-party service providers. For data transfers to Australia, we rely on the recognised similarity of Australian privacy laws to New Zealand's Privacy Act 2020. For data transfers to the United States, we ensure protection through binding contractual arrangements that provide equivalent safeguards to the Privacy Act 2020. Where Customer Data includes health information, cross-border disclosures are also made in accordance with Rule 12 of the Health Information Privacy Code 2020. For the avoidance of doubt, our primary database and core data storage reside securely within Australia. However, current likely overseas recipients include vendors located in the United States, which we utilise for specific critical infrastructure components. This includes providers for API hosting, telephony services, AI processing (such as real-time speech-to-text and text-to-speech), and payment processing. A complete, current list of our overseas recipients and their locations is available upon request.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. We will notify you of any significant changes by email or through the Heron app, or we will post an updated version on our website www.heyheron.ai. Significant changes include alterations to how we collect, use, or share Personal Information. We encourage you to review this Privacy Policy periodically to stay informed of any updates.
The agency collecting and holding your information is:
Heron Health Limited 9 Huron Street, Takapuna, Auckland, 0622, New Zealand
If you have any questions or concerns about this Privacy Policy or your data, please contact our Privacy Officer:
Email: hello@heyheron.ai Attention: Heron Privacy If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner (OPC) by calling 0800 803 909 or visiting www.privacy.org.nz.
This Privacy Notice was last updated on 2 April 2026.
For the purposes of this Privacy Policy:
“Customer Data” means any data provided by you or your customers, that is entered into, stored in, or processed Heron, and any data that is based on or derived from this data and provided to you via Heron.
“Internal Privacy Policies” means our internal data policies including in relation to information security, information retention, incident response and recovery.
"Personal Information" means any information about an identifiable individual, as defined under the New Zealand Privacy Act 2020.