Privacy Policy

Your information. Your rights. Our duties.

This notice sets out how Enhanced Men handles the personal and health information you trust us with — what we collect, how we use and disclose it, and how you can review or correct what we hold. Please read it before booking your first consult.

At a glance

We collect and use health information so we can deliver clinical care safely and lawfully.
The Privacy Act 2020 and the Health Information Privacy Code 2020 give you rights over that information, including the right to access and correct it.
We disclose your information only in defined circumstances — for your care, where you've consented, or where the law requires it.
If you think we've handled your information badly, you can raise it with us and escalate to the Office of the Privacy Commissioner.

Enhanced Men is committed to protecting your privacy in line with New Zealand law. We are an NZ telehealth clinic for men's health, with a registered office in Mount Eden, Auckland, and we see patients New Zealand–wide via secure video and online consult. Prescribing is overseen by Enhanced Men's lead clinician — an NZ-registered doctor. The conditions we treat are testosterone replacement therapy (TRT), hair loss, erectile dysfunction, and athlete and enhanced-care programmes. As a "health agency" under the Health Information Privacy Code 2020, the Code's rules apply to us in addition to the Privacy Act 2020.

You can reach us at info@enhancedmen.co.nz for anything in this policy.

Your rights under the Privacy Act 2020

When you receive care from Enhanced Men, the law gives you specific entitlements over the personal and health information we hold about you. The following sections set out what you can ask of us, and how we respond.

Accessing your health information

You may ask for a copy of any personal or health information we hold about you.
We will normally respond within 20 working days, in line with the Privacy Act 2020.
We can usually provide your record at no cost; in unusual cases (large or complex requests) we may charge a reasonable fee to recover the cost of copying.
We may withhold particular items where releasing them would put someone's safety at risk or compromise your treatment.

Correcting your information

You can ask us to amend any detail you believe is wrong, out of date, incomplete, irrelevant, or misleading.
Where we agree the change is required, we will update the record and inform any third party we have already shared the information with.
If we decline a correction, we will explain our reasoning in writing and attach a statement of your requested correction to your file.

Receiving a list of disclosures

You can ask us for a record of who we've shared your information with, and on what basis.
The list will cover disclosures made over the previous 12 months.
One list per calendar year is provided free of charge.

Asking for a copy of this notice

A printable or electronic copy of this notice is available on request, at any time.
We will send you the current version promptly.

Appointing a representative

If you have an enduring power of attorney for personal care and welfare, or a court-appointed welfare guardian, that person can exercise your privacy rights on your behalf.
We will check the supporting paperwork before acting on a request from a representative.

Raising a privacy complaint

Email us first at info@enhancedmen.co.nz so we can try to resolve the issue directly.
You can also contact the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.
For complaints about clinical care (rather than information handling), contact the Health and Disability Commissioner at hdc.org.nz — 0800 11 22 33.
We will not penalise you for raising a privacy concern.

Information sharing: your choices

For some categories of health information, you can tell us how you would like sharing handled. If you have a particular preference about any of the situations below, please raise it with your clinician.

Emergency situations

If you are unable to give us your preference at the time — for example, in a clinical emergency or while incapacitated — we may share information where we judge it necessary to protect your life or health, or someone else's.

Family, whānau, and support people

Where you've given consent, we can pass relevant clinical information to family members, whānau, or support people involved in your care. You can change or revoke that consent at any time by emailing info@enhancedmen.co.nz.

Research and quality improvement

From time to time we may invite you to take part in a clinical research project or service-improvement initiative. Participation is always voluntary, and declining will not affect the care you receive from us.

How we collect, use and share your health information

What we collect and where it comes from

Most of what we hold is given to us directly by you — through the intake form, your consult, and any messages you send us. Specifically, we collect:

Personal information — name, date of birth, gender, NHI number (if you give it to us), email, phone, postal address, and identity verification where required for prescribing.
Health information — your medical history, current medications, allergies, lifestyle factors, the symptoms and reasons for your consult, blood test and pathology results, GP records or specialist letters where you've asked us to request them, the notes the clinician makes during your consult, and your prescription history and treatment plan.
Payment information — transaction reference, amount, and date. Card details are handled by Stripe (see Billing and administration).
Technical information — device, browser, IP address, and pages visited on enhancedmen.co.nz, plus a small number of cookies (see Cookies and the website).

We also receive information from:

NZ pathology labs (such as Labtests and Awanui), when we order blood work on your behalf and the results come back to us.
Your GP or other treating clinicians, with your explicit consent, where we need a copy of relevant history.
NZ pharmacies, to confirm a prescription has been dispensed.
Pharmac, when we apply for funded medicines on your behalf.

Providing treatment and care

Your clinician reviews your history, symptoms, and lab results to make safe prescribing decisions.
Where it's relevant to your care, information may be shared with other treating clinicians — for example your GP, an endocrinologist, or a urologist — with your consent, or where it's clinically necessary for your safety.
We may use a clinical AI scribe (an ambient transcription tool such as Heidi) to draft consult notes from your video consult. Any AI scribe we use is one approved for clinical use in New Zealand, processes audio under contract, and the final note is reviewed and signed by the clinician before it enters your record. If you would prefer the AI scribe was not used in your consult, just tell us and we will switch it off.
We send you appointment reminders and clinically relevant follow-ups by email or text. Marketing or educational content is sent only if you've opted in — and you can opt out at any time.

Managing our services

We use your contact details to book and remind you of appointments and to coordinate your care.
We use de-identified, aggregated data — with no names, NHI, or contact details — to look at clinic-wide trends, such as how a cohort responds to a particular treatment over six months.

Billing and administration

Card payments are processed by Stripe. Full card numbers are not stored on our systems; Stripe handles that under PCI DSS Level 1 standards.
We retain the transaction reference, amount, and date for accounting and tax purposes.
Where your treatment relates to an ACC-covered injury, information may be shared with ACC for cover and payment purposes.
Our accountants and auditors see only what they need to meet our tax, GST, and statutory financial reporting obligations.

Cookies and the website

Our website uses essential cookies to keep the booking and login flow working, and analytics cookies to understand which pages people use and where they get stuck. Analytics data is aggregated and does not identify you personally. You can block or remove cookies through your browser settings; doing so will not affect your clinical care, but parts of the site may not work as well. See our Cookie Policy for the detail.

We do not sell your information. We do not share it with advertisers, data brokers, or marketing partners.

Other permitted uses and disclosures

There are situations where we may use or share your information beyond what's described above — generally because the law requires it, or because the public interest does.

Public health and safety

We may report certain notifiable diseases to public health authorities where the law requires it.
We may disclose information to prevent or reduce a serious threat to anyone's life, health, or safety, in line with HIPC Rule 11.

Legal and regulatory requirements

We will release information when we are compelled by NZ law, a court order, or a properly issued statutory request.
Information may be supplied to government agencies — including the Medical Council of New Zealand and the Ministry of Health — where we are required to do so.
Information may be released for coronial inquiries.

Research

De-identified data — stripped of any detail that could identify you — may be used for approved health research.
Where research would require identifiable records, we will only share them with your specific written consent or under approval from a recognised ethics committee.

Law enforcement and legal proceedings

A court order, subpoena, or other lawful process may compel us to release records, and in those circumstances we will comply.
Police may receive limited information where statute permits it, or where it is needed to avert a serious threat to someone's safety.

Retention of health information

We hold your clinical record for at least 10 years from the date we last provided you with health services, in line with the Health (Retention of Health Information) Regulations 1996.
In practice we usually keep records longer than the minimum, because TRT and other long-term treatments rely on the historical labs and prescribing trail for many years.
Non-clinical records — such as marketing consents and accounting paperwork — are kept only for as long as we have a lawful reason to hold them, then securely destroyed or de-identified.

Our responsibilities and security measures

Our legal obligations

We are legally required to safeguard the privacy and security of the information you give us.
We comply with the Privacy Act 2020, the Health Information Privacy Code 2020, the Medicines Act, the Misuse of Drugs Act, and the Health Practitioners Competence Assurance Act.
We follow the privacy practices set out in this notice, and review them at least annually.

Information security

Records are encrypted in transit (TLS 1.2 or above) and at rest.
Clinical data is hosted in New Zealand or Australia where practical.
Access inside the clinic is role-based — administrative staff see only what they need to book and bill; clinicians see your full record. Every access is logged.
Every staff member completes privacy and confidentiality training before they handle patient records.

International transfers

The clinical record itself is held in New Zealand or Australia. Some service providers operate overseas — most notably Stripe (which processes payments in the United States and other regions), and any cloud-based AI scribe we use (which may process audio in Australia, the EU, or the US depending on the provider). Where we use an overseas provider, we satisfy ourselves that they offer privacy protections comparable to New Zealand law, as required by Information Privacy Principle 12 of the Privacy Act 2020.

Privacy breach notification

If a privacy incident occurs, we will:

Work out whether the breach is likely to cause anyone serious harm.
Where it is, let affected patients know as soon as practicable.
Notify the Office of the Privacy Commissioner where required by Part 6 of the Privacy Act 2020.
Take steps to remedy the breach and prevent a repeat.

Children

Enhanced Men's services are for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has given information to us, contact info@enhancedmen.co.nz and we will delete it.

Changes to this privacy notice

We may update this notice from time to time to reflect changes in our services, our providers, or the law. When we make changes:

The updated notice is published on this page at enhancedmen.co.nz/privacy, with a fresh "last updated" date at the top.
For changes that materially affect existing patients, we will email you.
The current version applies to all information we hold, including information collected before the update.

For your reference: New Zealand privacy legislation and regulations

Primary legislation

Privacy Act 2020 — New Zealand's overarching privacy law and the source of the information privacy principles. legislation.govt.nz
Health Information Privacy Code 2020 — sector-specific rules that apply to health agencies like Enhanced Men. privacy.org.nz
Health (Retention of Health Information) Regulations 1996 — the minimum retention period for health records held in New Zealand.

Relevant authorities and resources

Office of the Privacy Commissioner — privacy.org.nz — 0800 803 909
Ministry of Health — health.govt.nz
Health and Disability Commissioner — hdc.org.nz — 0800 11 22 33

Contact information

Enhanced Men

Website: enhancedmen.co.nz
Email: info@enhancedmen.co.nz
Address: Mount Eden, Auckland, New Zealand

For any privacy question, request, or complaint, email info@enhancedmen.co.nz in the first instance.