Privacy Policy

Your information. Your rights. Our duties.

This notice sets out how Enhanced Men handles the personal and health information you trust us with — what we collect, how we use and disclose it, and how you can review or correct what we hold. Please read it before booking your first consult.

At a glance

We collect and use health information so we can deliver clinical care safely and lawfully.
The Privacy Act 2020 and the Health Information Privacy Code 2020 give you rights over that information, including the right to access and correct it.
We disclose your information only in defined circumstances — for your care, where you've consented, or where the law requires it.
If you think we've handled your information badly, you can raise it with us and escalate to the Office of the Privacy Commissioner.
There is one optional marketing tick box on the booking form. You don't need it to book or to receive care, and the section The optional marketing box when you book explains what it covers and how to withdraw.

Enhanced Men is committed to protecting your privacy in line with New Zealand law. We are an NZ telehealth clinic for men's health, with a registered office in Mount Eden, Auckland, and we see patients New Zealand–wide via secure video and online consult. Prescribing is overseen by Enhanced Men's lead clinician — an NZ-registered doctor. The conditions we treat are testosterone replacement therapy (TRT), erectile dysfunction, and athlete and enhanced-care programmes. As a "health agency" under the Health Information Privacy Code 2020, the Code's rules apply to us in addition to the Privacy Act 2020.

You can reach us at info@enhancedmen.co.nz for anything in this policy.

Your rights under the Privacy Act 2020

When you receive care from Enhanced Men, the law gives you specific entitlements over the personal and health information we hold about you. The following sections set out what you can ask of us, and how we respond.

Accessing your health information

You may ask for a copy of any personal or health information we hold about you.
We will normally respond within 20 working days, in line with the Privacy Act 2020.
We can usually provide your record at no cost; in unusual cases (large or complex requests) we may charge a reasonable fee to recover the cost of copying.
We may withhold particular items where releasing them would put someone's safety at risk or compromise your treatment.

Correcting your information

You can ask us to amend any detail you believe is wrong, out of date, incomplete, irrelevant, or misleading.
Where we agree the change is required, we will update the record and inform any third party we have already shared the information with.
If we decline a correction, we will explain our reasoning in writing and attach a statement of your requested correction to your file.

Receiving a list of disclosures

You can ask us for a record of who we've shared your information with, and on what basis.
The list will cover disclosures made over the previous 12 months.
One list per calendar year is provided free of charge.

Asking for a copy of this notice

A printable or electronic copy of this notice is available on request, at any time.
We will send you the current version promptly.

Appointing a representative

If you have an enduring power of attorney for personal care and welfare, or a court-appointed welfare guardian, that person can exercise your privacy rights on your behalf.
We will check the supporting paperwork before acting on a request from a representative.

Raising a privacy complaint

Email us first at info@enhancedmen.co.nz so we can try to resolve the issue directly.
You can also contact the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.
For complaints about clinical care (rather than information handling), contact the Health and Disability Commissioner at hdc.org.nz — 0800 11 22 33.
We will not penalise you for raising a privacy concern.

Information sharing: your choices

For some categories of health information, you can tell us how you would like sharing handled. If you have a particular preference about any of the situations below, please raise it with your clinician.

Emergency situations

If you are unable to give us your preference at the time — for example, in a clinical emergency or while incapacitated — we may share information where we judge it necessary to protect your life or health, or someone else's.

Family, whānau, and support people

Where you've given consent, we can pass relevant clinical information to family members, whānau, or support people involved in your care. You can change or revoke that consent at any time by emailing info@enhancedmen.co.nz.

Research and quality improvement

From time to time we may invite you to take part in a clinical research project or service-improvement initiative. Participation is always voluntary, and declining will not affect the care you receive from us.

How we collect, use and share your health information

What we collect and where it comes from

Most of what we hold is given to us directly by you — through the intake form, your consult, and any messages you send us. Specifically, we collect:

Personal information — name, date of birth, gender, NHI number (if you give it to us), email, phone, postal address, and identity verification where required for prescribing.
Health information — your medical history, current medications, allergies, lifestyle factors, the symptoms and reasons for your consult, blood test and pathology results, GP records or specialist letters where you've asked us to request them, the notes the clinician makes during your consult, and your prescription history and treatment plan.
Payment information — transaction reference, amount, and date. Card details are handled by Stripe (see Billing and administration).
Technical information — device, browser, IP address, and pages visited on enhancedmen.co.nz, plus a small number of cookies (see Cookies and the website).

We also receive information from:

NZ pathology labs (such as Labtests and Awanui), when we order blood work on your behalf and the results come back to us.
Your GP or other treating clinicians, with your explicit consent, where we need a copy of relevant history.
NZ pharmacies, to confirm a prescription has been dispensed.
Pharmac, when we apply for funded medicines on your behalf.

Providing treatment and care

Your clinician reviews your history, symptoms, and lab results to make safe prescribing decisions.
Where it's relevant to your care, information may be shared with other treating clinicians — for example your GP, an endocrinologist, or a urologist — with your consent, or where it's clinically necessary for your safety.
We may use a clinical AI scribe (an ambient transcription tool such as Heidi) to draft consult notes from your video consult. Any AI scribe we use is one approved for clinical use in New Zealand, processes audio under contract, and the final note is reviewed and signed by the clinician before it enters your record. If you would prefer the AI scribe was not used in your consult, just tell us and we will switch it off.
We send you appointment reminders and clinically relevant follow-ups by email or text. Marketing or educational content is sent only if you've opted in — by ticking the optional marketing box when you book (explained below) or the follow-up box on the symptom self-check — and you can opt out at any time.

Managing our services

We use your contact details to book and remind you of appointments and to coordinate your care.
We use de-identified, aggregated data — with no names, NHI, or contact details — to look at clinic-wide trends, such as how a cohort responds to a particular treatment over six months.

Billing and administration

Card payments are processed by Stripe. Full card numbers are not stored on our systems; Stripe handles that under PCI DSS Level 1 standards.
We retain the transaction reference, amount, and date for accounting and tax purposes.
Where your treatment relates to an ACC-covered injury, information may be shared with ACC for cover and payment purposes.
Our accountants and auditors see only what they need to meet our tax, GST, and statutory financial reporting obligations.

Cookies and the website

Some tools run for every visitor: our website host, Cloudflare Web Analytics (which uses no cookies), our own daily visit counters, and the Acuity booking calendar with the services it relies on, including Google reCAPTCHA and Stripe. Two optional tools, Meta Pixel and Google Ads, load only if you choose Accept in our cookie banner, and never if your browser sends a Global Privacy Control or Do Not Track signal. Blocking cookies in your browser won't affect your clinical care, but the booking calendar may not work. Our Cookie Policy lists each tool, what it sends and to whom, and how to change your choice.

We do not sell your information, and we do not share it with data brokers. We never give advertisers your clinical details: your symptoms, self-check answers or result, test results, diagnosis or medicines. We don't use your visits to this website to target ads at you, to re-target you, or to find people like you. And unless you tick the optional marketing box on the booking form, which is explained under The optional marketing box when you book below, we don't upload patient or customer lists to Google, Meta or any other advertiser — no names, email addresses or phone numbers, whether scrambled (hashed) or not. If you do tick it, your details can go only to Google and Meta, only for the purposes described there, and never to re-target you or to find people like you.

If you choose Accept in our cookie banner, Meta and Google receive the pages you view on this website and whether a booking was made and its price, and Meta also learns when you click to book or reach the booking section. Neither tool runs on our self-check pages (the symptom self-check, the hair transplant readiness check, the Norwood stage check and the athlete bloods check), so the fact that you used one is never sent to either. Both receive your IP address, browser details and their own cookie IDs, along with standard browser information such as the site that referred you, and any Meta or Google cookies already in your browser — which can let them connect the visit to your account with them if you're signed in. We use this to see whether our advertising works. None of this includes your name, contact details, anything you type into our forms, or your self-check answers or result, and a booking reference is replaced with a scrambled code before it leaves your browser. Because we're a men's health clinic, the pages you visit or the fact that you booked can still say something about your health, which is why these tools stay off unless you choose Accept. If you choose Decline, or your browser sends a Global Privacy Control or Do Not Track signal, none of this happens. The optional marketing box on the booking form is separate from this choice and doesn't depend on it; it is explained below.

Separately from cookies, our own server keeps simple daily totals of certain events, and of the pages they happened on — for example, how many times the booking calendar was viewed, a self-check was finished, or someone arrived from a link in an AI assistant such as ChatGPT. We use these totals to see where visitors drop out before booking and which pages lead to bookings. They contain no names, contact details, IP addresses or cookies, and we don't link them to your name, your booking or any health record. We never pass the totals themselves to Google, Meta or any other advertiser; what the two optional advertising tools receive if you choose Accept is described above. Links from this site to Gro Clinics carry a short tag naming the Enhanced Men page you clicked from (for example, the hair transplant readiness check), so Gro can see the referral came from this site; the tag identifies the page, not you — it carries no name, contact detail or cookie, and nothing you entered on that page — and the click is counted in the same aggregate totals. If you use the "email me my results" option on the symptom self-check, we email your result to the address you give and keep a copy in our clinic mailbox like any other clinic correspondence; your address is not added to any marketing list unless you separately tick the follow-up box on the symptom self-check, described below. To stop that form being abused, the server also keeps a one-way scrambled version (a hash) of each address it has emailed for up to 24 hours — enough to cap repeat sends — and then deletes it.

If your self-check score falls in the moderate or severe range, that form also offers a tick box — never pre-ticked — asking whether we may send you one follow-up email a few weeks later about getting tested. If you tick it, we store your email address, the date and time you ticked it, and the exact wording you agreed to. We do not store your score or your answers against your address — but because only moderate and severe scorers are offered the box, we still treat this list, and the records described below, as health information and protect them accordingly. We use them only to send that one email, to show, if ever asked, that you requested it, and to make sure you aren't sent it again or emailed after you unsubscribe. We never sell this information, never give it to Google, Meta or any other advertiser, and never use it for ad targeting or audience matching. The email is sent from our clinic mailbox, which keeps a copy like any other clinic correspondence.

Once the email has been sent — or 8 weeks after you ticked the box, if it hasn't been — we delete your address from the list. If we sent the email, or you unsubscribe, we keep a scrambled (hashed) version of your address instead, which can be checked against your address but not read back. With it we keep the date and time you ticked the box, which version of the wording you agreed to, when we emailed you (if we did) and, if you unsubscribe, when and how you did and when we logged it for our do-not-email list. We keep that record for 2 years from the last of those dates (or until any complaint about the email is resolved, if that is later), as proof of your consent and so your address isn't added to the list again while we hold it. If you ask us to unsubscribe an address that isn't on the list, we keep the same kind of record for the same reason. The email has an unsubscribe link, and replying "unsubscribe" works too (we action replies within 5 working days). Unsubscribing removes you from this list and adds your address to our do-not-email list, which we check before sending any marketing email. You can ask us at any time what we hold for your address, or ask us to delete it, by emailing info@enhancedmen.co.nz. If you ask us to delete it, we delete your address from the list and treat your request as an unsubscribe too: your address goes on our do-not-email list and we keep the hashed record described above, so we can show you asked for the email and make sure we don't email you again. Copies of emails already in our clinic mailbox are kept like other clinic correspondence.

The optional marketing box when you book

The Terms and Conditions step of our booking form has two tick boxes. The first, "I have read and agree to the terms above", is required. The second is optional. It reads: "I'd like to receive occasional marketing and educational content from Enhanced Men by email/text, and understand my contact details may be used to manage this advertising via Google and Meta (optional)". You don't need to tick it to book, to pay or to receive care, and it makes no difference to your care if you don't.

If you don't tick it, we send you only the messages that go with your booking and your care, such as reminders and clinical follow-up, and we don't use your contact details with Google or Meta for advertising.

If you tick it, you are telling us two things. First, that we may send you occasional marketing and educational content from Enhanced Men by email or text. Second, that we may use your name, email address and phone number, in scrambled (hashed) form, with Google and Meta to manage our advertising: to keep our ads for a first consultation from being shown to people who have already booked, and to check whether our advertising led to bookings. We will not use them to target you with ads, to re-target you or to find people like you, and we won't give them to any other advertiser.

What happens today. Ticking the box doesn't send anything anywhere on its own, and no automatic process of ours sends your name, email address or phone number to Google or Meta. We keep your answer with your booking record, and we count how many bookings ticked the box each day, without names or any other detail. If we start to use ticked details with Google or Meta, we will change this page, with a new date at the top, before we do.

What would be sent, and what never would. Only your name, email address and phone number, scrambled (hashed) before they are sent. Never the type of appointment you booked, your symptoms, self-check answers or result, test results, diagnosis, medicines, or anything you typed into the booking form. Scrambling lets Google and Meta match your details to an account they already hold; it doesn't make you anonymous. And because the details would come from people who booked with a men's health clinic, being on a list can itself say something about your health.

Google and Meta are overseas. Both are overseas companies with their own privacy policies, and they may use what they receive for their own purposes as well as ours (our Cookie Policy links to each). They may not be required to protect your information in a way that, overall, provides comparable safeguards to New Zealand's Privacy Act 2020 and the Health Information Privacy Code 2020. If you're not comfortable with that, don't tick the box, or withdraw it as described below.

Changing your mind. You can withdraw at any time, for any reason. Reply "unsubscribe" to any marketing message from us, or email info@enhancedmen.co.nz. That withdraws the whole tick: no more marketing email or text, and no more use of your details with Google or Meta. We'll act within 5 working days at the latest, and we'll record that you asked so we don't contact you for marketing again. If your details have already been sent to Google or Meta we'll ask them to remove you, but we can't recall what they've already received or used. Withdrawing doesn't affect your booking, your care or your clinical record.

Messages. Every marketing email or text will say that it is from Enhanced Men and will have a way to unsubscribe that works by replying. Appointment reminders and clinical follow-up aren't marketing and don't depend on the box.

How long we keep your answer. We keep it with your booking record, for as long as we hold that record, so we can show what you agreed to and honour a withdrawal.

How this fits with cookies and our counters. The box is separate from the cookie banner. It doesn't depend on your cookie choice, and your cookie choice, or a Global Privacy Control or Do Not Track signal from your browser, doesn't switch it on or off. The two optional tools described under Cookies and the website receive no names, email addresses or phone numbers whatever you tick, and our own daily totals contain no names or contact details and are never passed to Google, Meta or any other advertiser. The follow-up box on the symptom self-check is a different list for a different purpose, and it is never used for advertising or audience matching.

Other permitted uses and disclosures

There are situations where we may use or share your information beyond what's described above — generally because the law requires it, or because the public interest does.

Public health and safety

We may report certain notifiable diseases to public health authorities where the law requires it.
We may disclose information to prevent or reduce a serious threat to anyone's life, health, or safety, in line with HIPC Rule 11.

Legal and regulatory requirements

We will release information when we are compelled by NZ law, a court order, or a properly issued statutory request.
Information may be supplied to government agencies — including the Medical Council of New Zealand and the Ministry of Health — where we are required to do so.
Information may be released for coronial inquiries.

Research

De-identified data — stripped of any detail that could identify you — may be used for approved health research.
Where research would require identifiable records, we will only share them with your specific written consent or under approval from a recognised ethics committee.

Law enforcement and legal proceedings

A court order, subpoena, or other lawful process may compel us to release records, and in those circumstances we will comply.
Police may receive limited information where statute permits it, or where it is needed to avert a serious threat to someone's safety.

Retention of health information

We hold your clinical record for at least 10 years from the date we last provided you with health services, in line with the Health (Retention of Health Information) Regulations 1996.
In practice we usually keep records longer than the minimum, because TRT and other long-term treatments rely on the historical labs and prescribing trail for many years.
Non-clinical records — such as accounting paperwork — are kept only for as long as we have a lawful reason to hold them, then securely destroyed or de-identified. Your answer to the optional marketing box is kept with your booking record, as described under The optional marketing box when you book.

Our responsibilities and security measures

Our legal obligations

We are legally required to safeguard the privacy and security of the information you give us.
We comply with the Privacy Act 2020, the Health Information Privacy Code 2020, the Medicines Act, the Misuse of Drugs Act, and the Health Practitioners Competence Assurance Act.
We follow the privacy practices set out in this notice, and review them at least annually.

Information security

Records are encrypted in transit (TLS 1.2 or above) and at rest.
Clinical data is hosted in New Zealand or Australia where practical.
Access inside the clinic is role-based — administrative staff see only what they need to book and bill; clinicians see your full record. Every access is logged.
Every staff member completes privacy and confidentiality training before they handle patient records.

International transfers

The clinical record itself is held in New Zealand or Australia. Some service providers operate overseas — most notably Stripe (which processes payments in the United States and other regions), and any cloud-based AI scribe we use (which may process audio in Australia, the EU, or the US depending on the provider). Where we use an overseas provider, we satisfy ourselves that they offer privacy protections comparable to New Zealand law, as required by Information Privacy Principle 12 of the Privacy Act 2020.

Google and Meta are different. If you tick the optional marketing box when you book, they are the overseas companies your contact details could go to, and they may not be required to protect that information in a way that, overall, provides comparable safeguards to New Zealand law. That is why any such use depends on the box being ticked and can be withdrawn at any time. See The optional marketing box when you book.

Privacy breach notification

If a privacy incident occurs, we will:

Work out whether the breach is likely to cause anyone serious harm.
Where it is, let affected patients know as soon as practicable.
Notify the Office of the Privacy Commissioner where required by Part 6 of the Privacy Act 2020.
Take steps to remedy the breach and prevent a repeat.

Children

Enhanced Men's services are for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has given information to us, contact info@enhancedmen.co.nz and we will delete it.

Changes to this privacy notice

We may update this notice from time to time to reflect changes in our services, our providers, or the law. When we make changes:

The updated notice is published on this page at enhancedmen.co.nz/privacy, with a fresh "last updated" date at the top.
For changes that materially affect existing patients, we will email you.
The current version applies to all information we hold, including information collected before the update.

For your reference: New Zealand privacy legislation and regulations

Primary legislation

Privacy Act 2020 — New Zealand's overarching privacy law and the source of the information privacy principles. legislation.govt.nz
Health Information Privacy Code 2020 — sector-specific rules that apply to health agencies like Enhanced Men. privacy.org.nz
Health (Retention of Health Information) Regulations 1996 — the minimum retention period for health records held in New Zealand.

Relevant authorities and resources

Office of the Privacy Commissioner — privacy.org.nz — 0800 803 909
Ministry of Health — health.govt.nz
Health and Disability Commissioner — hdc.org.nz — 0800 11 22 33

Contact information

Enhanced Men

Website: enhancedmen.co.nz
Email: info@enhancedmen.co.nz
Address: Mount Eden, Auckland, New Zealand

For any privacy question, request, or complaint, email info@enhancedmen.co.nz in the first instance.