Florence Digital Privacy Policy
1. Our Privacy Commitment
1.1 Florence Digital Limited (“Florence”, “we”, “us” or “our”) is committed to protecting the privacy and security of personal information.
1.2 As a provider of digital healthcare technology, including self-service patient check-in kiosks, patient engagement solutions and related software, we recognise the importance of maintaining the confidentiality, integrity and security of personal information entrusted to us.
1.3 This Privacy Policy explains how we collect, use, access, store, process, disclose and protect personal information.
1.4 Our privacy principles are that:
1.4.1 we collect, use, store and disclose personal information in accordance with applicable privacy laws, including the Privacy Act 2020 (New Zealand) and the Health Information Privacy Code 2020, where applicable;
1.4.2 we collect only the personal information that is reasonably necessary to provide, operate, maintain and improve our Services;
1.4.3 we use personal information only for the purposes for which it was collected, for purposes directly related to those purposes, where otherwise authorised by the individual or required or permitted by law; and
1.4.4 we implement appropriate technical and organisational security measures designed to protect personal information.
2. Scope of this Privacy Policy
2.1 This Privacy Policy applies to personal information collected or processed through:
2.1.1 our website;
2.1.2 Florence self-service patient check-in kiosks;
2.1.3 our customer or administration portals;
2.1.4 our software applications;
2.1.5 our support and customer services; and
2.1.6 any other products or services we provide (collectively, the Services).
2.2 This Privacy Policy applies to individuals whose personal information is collected or processed by Florence in connection with our Services.
2.2.1 Information collected through our website relates to the information listed under section 5.1
2.3 Where Florence provides technology services to a healthcare provider, the healthcare provider generally determines the purposes for which patient and health information is collected and used and remains responsible for its own privacy obligations in relation to that information.
3. Our Role
3.1 Florence provides technology solutions and services to healthcare providers.
3.2 In many circumstances, Florence processes personal information, including patient and health information, in order to provide Services that have been engaged by a healthcare provider.
3.3 Depending on the nature of the Services and the applicable arrangements, Florence may collect, access, store or otherwise process information in accordance with its contractual arrangements with the relevant healthcare provider.
3.4 Healthcare providers generally determine:
3.4.1 what patient or health information is collected;
3.4.2 the purposes for which that information is collected and used;
3.4.3 how long the information should be retained; and
3.4.4 how requests from patients relating to access to or correction of their health information should be managed.
4. Changes to this Privacy Policy
4.1 We may amend this Privacy Policy from time to time to reflect changes to our Services, privacy practices, legal requirements or other relevant circumstances.
4.2 Any updated version of this Privacy Policy will be published on our website.
4.3 Where a change is material to the way Florence handles personal information, we will take reasonable steps to notify our affected customer healthcare providers.
4.4 The updated Privacy Policy will take effect from the date it is published, unless otherwise stated.
5. Personal Information We Collect, Its Source and Purpose
5.1 Depending on how you interact with Florence and the Services being provided, we may collect or process the following categories of personal information.
| Information | Typical Source | Purpose |
| Website and technical information, including IP address, browser type, operating system, device identifiers, website usage information, dates and times of access, and diagnostic and performance information | Website, browser or device | Maintaining website and system security, diagnosing faults, analysing usage, improving our products and Services, and investigating incidents |
| Patient identity and contact information, including name, NHI number, ethnicity, date of birth, gender, address, email address, telephone number and language preferences.
Emergency Contact: name, mobile number, email, relationship Walk-in patient: home phone number, and emergency contact home phone number |
Healthcare provider, integrated Practice Management System, patient or other authorised source | Identifying the patient, facilitating patient check-in, verifying appointment details and enabling healthcare providers to maintain accurate information |
| Appointment information | Healthcare provider, integrated Practice Management System or patient | Facilitating patient self-check-in, verifying appointments and supporting the delivery of healthcare services |
| Information entered during patient check-in, including responses to information requests or questionnaires | Patient | Facilitating the relevant check-in process and making information available to the healthcare provider in connection with the Services |
| Health or screening information, where applicable.
Health details: smoking/vaping status, weight, height |
Patient, healthcare provider or integrated Practice Management System | Providing the relevant healthcare workflow or functionality requested by the healthcare provider |
| Medical practice or healthcare provider staff contact information, including name, role, business email address and telephone number | Healthcare provider, staff member or other business contact | Managing the customer relationship, providing support, administering accounts, communicating about the Services and, where permitted by law, providing information about Florence’s products and services |
| Customer account and administration information | Healthcare provider or authorised users | Establishing and administering customer accounts, managing access to Services and providing support |
| Support enquiries and correspondence | Customer, authorised user or other individual contacting Florence | Responding to enquiries, resolving technical issues and maintaining records of our interactions |
| Information received from service providers or integration partners | Trusted service providers, integration partners or other organisations supporting the Services | Operating, maintaining, securing and improving the Services, where necessary and authorised |
5.2 We collect and process personal information only where reasonably necessary for the purposes described in this Privacy Policy, to provide the Services requested by our customers, or where otherwise permitted or required by law.
6. How We Use Personal Information
6.1 Florence may use personal information to:
6.1.1 provide, operate, maintain and support our Services;
6.1.2 facilitate patient self-check-in;
6.1.3 verify appointment information;
6.1.4 make relevant information available to the healthcare provider that has engaged Florence to provide the Services;
6.1.5 support healthcare providers and authorised users;
6.1.6 provide customer and technical support;
6.1.7 maintain, improve and develop our products and Services;
6.1.8 maintain the security, confidentiality, integrity and availability of our systems and Services;
6.1.9 detect, investigate and respond to security, privacy, fraud or other incidents;
6.1.10 administer customer relationships and our business;
6.1.11 communicate with healthcare providers, authorised users and other relevant business contacts;
6.1.12 provide information about Florence’s products, services or events to healthcare providers and relevant business contacts where permitted by law;
6.1.13 comply with legal, regulatory and contractual obligations; and
6.1.14 for any other purpose authorised by the individual or permitted or required by law.
6.2 Florence does not use patient personal information for unrelated marketing or advertising purposes.
7. Health Information
7.1 Some information collected or processed through the Florence Services may constitute health information under the Health Information Privacy Code 2020.
7.2 Florence processes health information only as reasonably necessary to provide the Services that Florence has been engaged to provide to the relevant healthcare provider.
7.3 Florence does not use patient health information for unrelated purposes.
7.4 Healthcare providers generally remain responsible for determining:
7.4.1 what health information is collected;
7.4.2 the purposes for which it is collected and used;
7.4.3 how long it is retained; and
7.4.4 how requests for access to or correction of patient information are managed.
8. How Personal Information Is Made Available and Processed
8.1 Florence does not sell personal information.
8.2 Florence does not disclose patient personal information to unrelated third parties or use patient personal information for purposes unrelated to facilitating the Services that Florence has been engaged by healthcare providers to provide.
8.3 In providing our Services, personal information may be collected from, accessed by, or made available to the healthcare provider that has engaged Florence to provide those Services, where this is necessary to facilitate the Services and in accordance with applicable privacy law.
8.4 Florence engages third-party service providers to support the delivery, operation, maintenance and security of our Services.
8.5 These service providers may include:
8.5.1 cloud hosting and infrastructure providers;
8.5.2 technology and software providers;
8.5.3 security and monitoring providers;
8.5.4 support and maintenance providers; and
8.5.5 other contractors engaged by Florence to support our Services.
8.6 Where a service provider processes personal information on behalf of Florence, Florence requires the provider to comply with applicable contractual, privacy and security requirements.
8.7 We may disclose personal information where disclosure is authorised or required by law, necessary to protect the rights or safety of individuals or others, or where we have obtained the relevant consent or authority.
9. International Data Transfers and Overseas Processing
9.1 Some of Florence’s service providers or technology infrastructure may involve the storage or processing of personal information outside New Zealand.
9.2 Where personal information is stored or processed overseas, Florence will take reasonable steps to ensure that the information receives protections consistent with applicable New Zealand privacy requirements.
9.3 Florence may use contractual, technical and organisational safeguards appropriate to the nature of the information and the relevant overseas processing arrangements.
10. Storage and Security
10.1 Florence maintains administrative, technical and physical safeguards designed to protect personal information against unauthorised access, use, modification, loss, disclosure or destruction.
10.2 As a supplier to the health sector, Florence’s information security programme is aligned with the principles and relevant control objectives of HISO 10029.4 Health Information Security Framework guidance for suppliers, where applicable, and is designed to support the confidentiality, integrity and availability of information.
10.3 While Florence takes reasonable steps to protect personal information, no method of electronic transmission, storage or processing can be guaranteed to be completely secure.
11. Cookies and Website Technologies
11.1 Our website may use cookies and similar technologies to support website functionality, security, performance monitoring and analysis of website usage.
11.2 Information collected through cookies and similar technologies may include device, browser and website usage information.
11.3 You may disable or manage cookies through your browser settings. However, doing so may affect the functionality of our website.
12. Third-Party Websites
12.1 Our website may contain links to third-party websites or services.
12.2 Florence is not responsible for the privacy practices, security or content of third-party websites.
12.3 Individuals should review the privacy policies of third-party websites before providing personal information to them.
13. Communications and Marketing
13.1 Florence may communicate with healthcare providers, authorised users and other relevant business contacts regarding:
13.1.1 the operation, maintenance and support of our Services;
13.1.2 product updates and service announcements;
13.1.3 customer accounts and contractual matters;
13.1.4 relevant industry events; and
13.1.5 where permitted by law, Florence’s other products and services.
13.2 Florence does not use patient contact information collected through the Services to send Florence marketing communications.
13.3 A recipient may unsubscribe from non-essential marketing communications at any time by using the unsubscribe facility provided or by contacting Florence.
13.4 Individuals may continue to receive service-related, security, account or other operational communications where these are necessary for the provision or administration of the Services.
14. Accessing and Correcting Personal Information
14.1 You may request access to or correction of personal information held by Florence in accordance with applicable privacy legislation.
14.2 Where Florence processes patient or health information in connection with Services provided to a healthcare provider, requests relating to that information should generally be directed to the relevant healthcare provider in the first instance.
14.3 Where Florence receives a request relating to information that is primarily held or controlled by a healthcare provider, Florence may work with the relevant healthcare provider to ensure that the request is appropriately managed.
14.4 Florence will respond to requests that it is responsible for handling in accordance with applicable privacy legislation.
15. Retention and Deletion
15.1 Florence retains personal information only for as long as reasonably necessary for the purpose for which it was collected or processed, including to:
15.1.1 provide, operate and support our Services;
15.1.2 comply with legal, regulatory or contractual obligations;
15.1.3 resolve disputes;
15.1.4 enforce our agreements;
15.1.5 maintain appropriate business and security records; or
15.1.6 satisfy other legitimate and lawful business requirements.
15.2 Where Florence processes personal information on behalf of a healthcare provider, retention and deletion may also be governed by Florence’s contractual arrangements with that healthcare provider and applicable legal requirements.
15.3 When personal information is no longer required, Florence will take reasonable steps to securely delete, destroy or de-identify the information, as appropriate.
16. Privacy and Security Incidents
16.1 Florence maintains processes for identifying, assessing, managing and responding to privacy and security incidents involving personal information.
16.2 Where Florence becomes aware of an actual or suspected privacy or security incident involving personal information processed in connection with a healthcare provider, Florence will take reasonable steps to investigate and contain the incident and will work with the relevant healthcare provider in accordance with applicable contractual arrangements and legal obligations.
16.3 Where an incident may constitute a notifiable privacy breach or otherwise require notification under applicable law, Florence and the relevant healthcare provider will manage notification responsibilities in accordance with their respective legal obligations and contractual arrangements.
17. Contact Us
17.1 If you have questions about this Privacy Policy, wish to request access to or correction of personal information, or wish to raise a privacy concern, please contact Florence using the contact details published on our website.
17.2 Where your enquiry relates to patient or health information collected or held by a healthcare provider, you may be directed to contact the relevant healthcare provider.
17.3 We will take reasonable steps to investigate and respond to privacy concerns in accordance with applicable privacy legislation.
17.4 If you are not satisfied with our response, you may make a complaint to the Office of the Privacy Commissioner (New Zealand).
Privacy Officer
Florence Digital Limited
Email: [email protected]
Website: https://www.florence.digital/
Effective Date: July 2026