Privacy Policy

Restore Prehabilitation & Wellness Ltd, trading as Restore Prehabilitation & Recovery (“Restore”, “we”, “us” or “our”), respects the privacy of the people we work with and is committed to protecting personal and health information entrusted to us.

This Privacy Policy explains how Restore collects, uses, stores, protects and discloses personal information across our in-person services, online services, website, assessments, programmes and other business activities.

We handle personal information in accordance with the Privacy Act 2020 and, where applicable, the Health Information Privacy Code 2020.

This policy applies to information collected through our website, booking and client management systems, assessments, consultations, training and movement services, digital platforms, communications and other interactions with Restore.

The information we collect depends on your relationship with Restore and the services you use.

We may collect:

• your name, date of birth and contact details;
• address and emergency contact details;
• booking, attendance and payment information;
• information supplied through enquiries, registration forms, questionnaires and consultations;
• health, injury, surgical, activity and training history relevant to the services we provide;
• information about symptoms, physical limitations, movement history, goals and activities;
• movement, mobility, range-of-motion, strength, balance and physical performance measurements;
• assessment results generated through technologies used by Restore, including VALD HumanTrak;
• exercise programmes, practitioner notes, progress records and other information generated while providing services;
• photographs or video where these form part of an assessment or service and you have been informed of their collection;
• communications between you and Restore;
• information associated with online programmes or digital services you use; and
• technical information generated when you use our website or online services.

We aim to collect only information that is reasonably necessary for the purpose for which it is being collected.

We usually collect information directly from you.

This may occur when you:

• contact Restore;
• complete an enquiry, booking, registration or intake form;
• create an account;
• purchase or participate in a service or programme;
• complete a Movement Profile or another assessment;
• attend an individual or group screening;
• participate in an in-person or online session;
• communicate with us by phone, email, messaging service or in person; or
• use our website or digital services.

We may also generate information during our work with you, such as practitioner notes, assessment measurements, programme information and progress records.

Information received from another person or organisation

In some situations we may receive information about you from somebody else, such as:

• a parent, guardian or representative;
• another health or movement professional;
• a coach or team representative;
• an organisation arranging a group assessment; or
• another person you have authorised to provide information.

Where required, we will take reasonable steps to ensure you are aware that the information has been collected, why we have collected it, who may receive it and your rights in relation to it.

We may collect and use personal and health information to:

• provide Restore’s services;
• understand your movement history, physical capacity, goals and relevant health background;
• conduct Movement Profiles and other physical assessments;
• interpret assessment results;
• identify areas that may benefit from movement or strength training;
• develop and deliver exercise, mobility and strength programmes;
• monitor progress and compare assessments over time;
• communicate with you regarding appointments, assessments and programmes;
• provide access to online services;
• administer bookings and payments;
• maintain client records;
• provide customer support;
• operate and improve Restore’s services;
• maintain the security and functionality of our systems;
• meet legal, accounting, regulatory and business requirements;
• analyse Restore’s services using appropriately de-identified or aggregated information; and
• carry out other activities that are reasonably connected with the purpose for which the information was collected.

We will not ordinarily use identifiable personal or health information for a substantially different purpose unless you have authorised that use or it is otherwise permitted or required by law.

Restore uses movement assessment technologies as part of some of our services, including VALD HumanTrak.

HumanTrak enables Restore to collect and analyse movement and physical-performance information. Depending on the assessment being undertaken, this may include measurements relating to movement, mobility, range of motion, balance and functional performance.

Information generated through HumanTrak may be associated with your Restore client record and may therefore constitute personal and/or health information.

Restore remains responsible for the identifiable information we collect through HumanTrak. Under Restore’s agreement with VALD, Restore acts as the controller of client personal data and VALD acts as a processor/service provider on Restore’s behalf.

VALD may process identifiable client data to provide, support, maintain and secure the service, undertake permitted product-improvement activities and convert information into a de-identified or anonymised form. Analytics, benchmarking and normative reporting undertaken by VALD are performed using de-identified or anonymised information.

Restore uses third-party technology and professional service providers to help operate our business and provide services.

These may include providers of:

• client management and booking systems;
• movement assessment and performance technology;
• exercise-programming and online-training platforms;
• website hosting and content management;
• email and communications;
• payment processing;
• accounting and administration;
• analytics;
• secure data storage; and
• information technology services.

These providers may process information on Restore’s behalf where reasonably necessary to provide their services.

Where a third-party provider processes personal information for Restore, we take reasonable steps to ensure appropriate privacy and security arrangements are in place.

Some technology providers used by Restore may store or process information outside New Zealand, or allow authorised personnel or subprocessors located overseas to access information.

Where an overseas provider processes personal information on Restore’s behalf, Restore remains responsible for taking reasonable steps to ensure appropriate protections are in place.

Where information is disclosed to an overseas person or organisation rather than simply processed by a service provider acting on our behalf, Restore will comply with the overseas-disclosure requirements of applicable New Zealand privacy law.

For VALD, Restore’s contract provides that personal information may be hosted in the region selected by Restore and accessed by authorised VALD personnel and subprocessors on a need-to-access basis. Appropriate safeguards must apply to offshore access and transfers.

Restore will only disclose identifiable personal or health information where there is a lawful reason to do so.

This may include disclosure:

• to somebody you have authorised;
• to another practitioner or provider where you have authorised the disclosure or it is otherwise permitted by law;
• to a service provider processing information on Restore’s behalf;
• where disclosure was one of the purposes for which the information was collected;
• where disclosure is required or authorised by law;
• where reasonably necessary to prevent or lessen a serious threat to someone’s health or safety; or
• in another circumstance permitted under the Privacy Act or Health Information Privacy Code.

Restore does not sell identifiable client personal or health information.

.

Where Restore provides assessments or screening for a team, club, employer or other organisation, information about an individual remains that individual’s personal information.

The organisation arranging the assessment does not automatically receive an individual’s full assessment record or identifiable health information.

Before collecting information, Restore will make it reasonably clear:

• what information is being collected;
• why it is being collected;
• how it will be used; and
• what information, if any, may be provided to the organisation arranging the assessment.

Where individual results are to be shared with a coach, club, employer or another organisation, this will be done where the individual has authorised the disclosure or where another lawful basis applies.

Restore may provide appropriately de-identified or aggregated group information where individuals cannot reasonably be identified.

Restore may de-identify or aggregate information so that it no longer reasonably identifies an individual.

We may use de-identified or aggregated information for purposes including:

• service evaluation;
• quality improvement;
• internal education;
• analysis of assessment or programme outcomes;
• statistics;
• research into trends within Restore’s services; and
• business planning.

VALD may also use de-identified or anonymised information for analytics, benchmarking and normative reporting. Under Restore’s agreement with VALD, identifiable data is not used for benchmarking or normative reporting.

Restore takes reasonable administrative, technical and physical steps to protect personal and health information against:

• loss;
• misuse;
• unauthorised access;
• unauthorised disclosure;
• alteration; and

Access to client information is limited to people who reasonably require access to carry out their role or provide services to Restore.

Third-party service providers are expected to maintain appropriate security measures for information they process on Restore’s behalf.

VALD’s agreement with Restore requires technical and organisational measures designed to protect client personal data from accidental or unlawful loss, alteration, destruction, unauthorised disclosure or access.

If Restore becomes aware of a suspected privacy breach, we will take reasonable steps to contain, investigate and assess the incident.

Where a breach meets the notification requirements under New Zealand privacy law, Restore will notify the Office of the Privacy Commissioner and affected individuals as required.

VALD is required under its agreement with Restore to notify Restore without undue delay and no later than 72 hours after becoming aware of a security incident involving Restore’s client personal data.

Restore retains personal and health information for as long as reasonably required:

• to provide services;
• to maintain appropriate client records;
• for continuity of service;
• to meet legal or regulatory requirements;
• to resolve disputes or complaints; and
• for legitimate business record-keeping purposes.

When information is no longer required, we will take reasonable steps to securely delete, destroy or de-identify it where appropriate.

Restore takes reasonable steps to ensure personal and health information is accurate, up to date, complete, relevant and not misleading before relying on it.

We encourage clients to tell us when relevant information changes.

You may ask Restore to provide access to personal information we hold about you.

You may also ask us to correct information you believe is inaccurate.

We may ask you to verify your identity before providing access to personal or health information.

There are limited circumstances under New Zealand law in which information may be withheld.

If Restore does not make a correction you have requested, you may be entitled to ask for a statement recording the correction you sought to be attached to the relevant information.

Restore may contact you with information that is necessary to provide a service you have requested, including:

• appointment confirmations and reminders;
• programme information;
• changes affecting a service;
• assessment or account information; and
• other operational communications.

These communications are separate from marketing.

Where permitted, we may also send newsletters, educational content, promotions or information about Restore services that may be relevant to you.

You can unsubscribe from marketing emails at any time using the unsubscribe link provided in the message or by contacting Restore.

Unsubscribing from marketing will not prevent us from sending communications that are reasonably necessary to provide a service you are currently using.

When you visit Restore’s website or use our online services, some information may be collected automatically.

This may include:

• IP address;
• browser and device information;
• pages visited;
• date and time of visits;
• referring websites;
• interaction with pages or features; and
• other technical or diagnostic information.

We may use cookies and similar technologies to:

• operate and secure the website;
• remember settings or preferences;
• understand how visitors use the website;
• measure website performance; and
• where applicable, measure the effectiveness of advertising or communications.

Some cookies may be provided by third-party services used by Restore.

You can usually control or disable cookies through your browser settings, although doing so may affect some website functionality.

Where information collected through website technologies identifies, or could reasonably identify, an individual, we treat it as personal information in accordance with this Privacy Policy.

Advertising and analytics technologies

Restore may use third-party analytics and advertising tools from time to time. Where these tools collect personal information or use tracking technologies, their use will be subject to this Privacy Policy and applicable privacy law.

Where payments are processed by an external payment provider, payment details may be collected and processed directly by that provider.

Restore does not necessarily receive or retain complete payment-card details when these are processed by an external payment provider.

Payment providers handle information in accordance with their own privacy and security obligations.

Restore may provide services to children and young people.

We take particular care when collecting, using and disclosing information about younger people and will consider the individual’s age, maturity, circumstances and the nature of the service.

Where appropriate, information may be provided by or discussed with a parent, guardian or authorised representative.

A parent or guardian does not necessarily have an unrestricted right to all information held about a young person. Requests for access or disclosure will be considered in accordance with applicable New Zealand privacy law and the circumstances of the individual concerned.

Restore’s website or digital services may contain links to websites or services operated by other organisations.

Restore is not responsible for the privacy practices or content of independent third-party websites. We recommend reviewing their privacy information when providing personal information directly to them.

Restore may update this Privacy Policy to reflect changes to:

• our services;
• technology;
• service providers;
• business practices; or
• legal obligations.

The latest version will be available on our website and will state when it was last updated.

Where a change materially affects how existing client information is collected, used or disclosed, Restore will take reasonable steps to notify affected people where appropriate or required.

Restore has a Privacy Officer responsible for helping Restore meet its privacy obligations and responding to questions or concerns about personal information.

You can contact our Privacy Officer if you:

• have a question about this Privacy Policy;
• wish to request access to your information;
• want us to correct information;
• are concerned about how your information has been handled; or
• wish to make a privacy complaint.

If you are not satisfied with Restore’s response, you may also contact the Office of the Privacy Commissioner of New Zealand.