Everything you need to know.

Surely is a patient-led health record request service for New Zealand. Patients and applicants use Surely to review and approve requests for their health records and to formally authorise who their information may be shared with. Once the patient has digitally signed a scoped consent, the records are retrieved from the practice's Practice Management System (PMS) via standards-based FHIR integration and delivered to the patient, or, if the patient chooses, to a third party such as an insurer to support an insurance application. What the patient does with their own records is entirely their decision.

Surely connects to the Practice Management Systems used by NZ general practices via standards-based FHIR integration. We're actively expanding our integration coverage and can work with your team on specific practice requirements.

Consent is at the core of how Surely works. Every health record request begins with the patient or applicant being presented with a secure, personalised link to review the request. They can confirm exactly what information is being requested, from which practice, and for what purpose, before they e-sign. This creates a verifiable, time-stamped consent record aligned with the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020. Surely's consent chain is auditable end-to-end.

Once the patient has provided consent, Surely retrieves the records automatically, typically within minutes. The total turnaround time depends largely on how quickly the patient acts on their consent link. For patients who respond promptly, the request can move from initiation to delivery on the same day. This compares to a manual process that typically takes 2–6 weeks.

Surely connects to the practice's existing Practice Management System via FHIR, so there's no new software for the practice to install or learn. Consent requests and record retrieval happen through the existing system. The practice retains full visibility and control over which records are shared, and the platform is designed to fit within the practice's existing arrangements.

Yes. Surely is built to meet the requirements of the NZ Privacy Act 2020, the Health Information Privacy Code 2020, and SOC 2 Type II security standards. All data in transit is encrypted. Records are delivered through secure, time-limited access links, not email attachments. Surely does not retain data: once a request has been fulfilled, all data is automatically and permanently deleted from the system within a defined number of days. Our infrastructure and data handling practices are reviewed regularly by independent auditors.

The easiest way to get started is to book a demo. We'll walk you through how the platform works and answer any integration questions, whether you're an insurer, broker, or general practice. Reach out to us at hello@surely.nz or visit our contact page to get in touch.