Privacy Policy

Miva is the trading name under which Miva Health NZ Limited provides online pharmacy and healthcare services to people in New Zealand through joinmiva.co.nz. In this policy, “we”, “us” and “Miva” mean that organisation, which is the agency responsible for the personal information collected through this website.

Miva Health NZ Limited is part of the Miva group. Our parent company is Miva Health Ltd, 77 Dunn Street, Glasgow, G40 3PA, United Kingdom, which provides group technology, administrative and support services to us. You can reach us about any privacy matter at contact@joinmiva.com.

We handle personal information in accordance with the Privacy Act 2020 and its 13 Information Privacy Principles, the Health Information Privacy Code 2020, and applicable medicines and pharmacy legislation including the Medicines Act 1981 and the standards set by the Pharmacy Council of New Zealand and the Medical Council of New Zealand.

Information you give us directly

• When you leave your email address to stay informed or sign up for a treatment.
• When you create an account or complete a medical questionnaire.
• When you place an order and we process and deliver it.
• When you contact us by email or a form on this website.
• When you communicate with our doctors or pharmacists about your treatment.

Information we receive indirectly

• From service providers who deliver technical, payment or courier services on our behalf.
• From other health providers, such as your GP or pharmacy, with your authorisation.
• Through cookies and analytics tools when you visit our website.

Wherever it is reasonably practicable, we collect health information directly from you, as required by the Health Information Privacy Code 2020.

Depending on your relationship with us, we may collect and hold:

• Name, date of birth, gender, address and email address.
• Order, invoice and payment details.
• Health information: questionnaire answers, height and weight, current medicines, allergies, medical history, treatment and dispensing records, and any side effects you report.
• Identity verification details where we are required to confirm who you are.
• Online identifiers such as your IP address and cookie IDs.
• Correspondence with our patient support team and clinical team.

We only ask for your NHI number where it is necessary to provide or coordinate your care, and we never require your IRD number.

• To have your request assessed by a doctor registered with the Medical Council of New Zealand or a pharmacist registered with the Pharmacy Council of New Zealand.
• To prepare, dispense and deliver your medicine.
• To keep a clinical record, as required by New Zealand health law and professional standards.
• To handle your questions, complaints, returns and refunds.
• To report adverse reactions to the Centre for Adverse Reactions Monitoring (CARM), Medsafe or the manufacturer where required.
• To send service messages, and marketing messages you have opted in to.
• To secure, maintain and improve our website and services.

We only use or disclose your information for the purpose it was collected for, or for a directly related purpose, unless an exception in the Privacy Act 2020 applies.

• To provide the service you asked for, such as assessing, supplying and delivering your treatment.
• With your authorisation — for example for marketing emails, non-essential cookies, and sharing information with your GP. You can withdraw this at any time.
• To meet legal obligations, including clinical record-keeping, medicines and tax requirements.
• To prevent or lessen a serious threat to someone's life or health.
• For related purposes such as fraud prevention, protecting our systems and improving our services.

Health information

Health information receives additional protection under the Health Information Privacy Code 2020. It is only accessible to the clinicians and support staff involved in your care, all of whom are bound by confidentiality obligations and professional standards.

We never sell your information. We share it only with parties who need it, including:

• Our doctors, pharmacists and clinical support staff.
• The dispensing pharmacy and the courier that delivers your parcel.
• IT, hosting, email and payment providers acting as our service providers under written agreements, including group services provided by our UK parent company.
• Your GP or another health provider, with your authorisation, or where required for your continuing care.
• Regulators and authorities — such as Medsafe, the Pharmacy Council, the Medical Council or Health New Zealand — where the law requires or permits it.

Your information is stored on secure servers, some of which are located outside New Zealand (including in Australia, the United Kingdom and the United States), because parts of our technology and support are provided by our UK parent company and its suppliers. Before we send personal information overseas we take the steps required by Information Privacy Principle 12, including binding contractual protections, so that your information receives comparable safeguards to those under the Privacy Act 2020.

• Health records: at least 10 years from the last date of service, as required by the Health (Retention of Health Information) Regulations 1996.
• Dispensing and prescription records: as required by medicines legislation and pharmacy standards.
• Accounting records and invoices: 7 years, as required by New Zealand tax law.
• Email sign-ups and marketing preferences: until you unsubscribe, and then for a limited period so we can honour your opt-out.

When information is no longer needed for any lawful purpose, we securely destroy or anonymise it.

We use appropriate technical and organisational safeguards: encryption in transit and at rest, access limited to staff who need it, multi-factor authentication, audit logging and regular reviews. Our staff are bound by confidentiality obligations.

If we experience a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the affected people as soon as practicable, as required by the Privacy Act 2020.

We use functional cookies that are necessary for the website to work. We ask for your consent before setting analytics and marketing cookies, and you can change your choice at any time in your browser settings.

Marketing emails and texts are only sent where you have consented, and every message includes a working unsubscribe link, as required by the Unsolicited Electronic Messages Act 2007.

Under the Privacy Act 2020 you have the right to:

• Access the personal and health information we hold about you.
• Request correction of information that is inaccurate or incomplete, or ask us to attach a statement of correction.
• Ask us to stop sending you marketing at any time.
• Withdraw your authorisation for sharing information with other providers.
• Complain to us, and then to the Office of the Privacy Commissioner, if you are not satisfied.

We will respond to an access or correction request within 20 working days of receiving it. If we need more time, we will tell you within that period. To protect you, we may need to verify your identity first. There is normally no charge for a request.

Please contact our Privacy Officer first at contact@joinmiva.com. You can also write to The Privacy Officer, Miva Health Ltd, 77 Dunn Street, Glasgow, G40 3PA, United Kingdom.

If we cannot resolve your concern, you can complain to the Office of the Privacy Commissioner on 0800 803 909 or online at privacy.org.nz. Complaints about the care itself can be made to the relevant professional regulator or to the Health and Disability Commissioner.

We may update this privacy policy from time to time. The current version is always published on this page, and we will clearly signal any significant change to the way we handle your information.