Privacy Policy.

Surely Ltd ("Surely", "we", "us", or "our") is committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020. Surely is a patient-led health record request service. Patients and applicants use Surely to request their own health records from their general practice; what they then choose to do with those records, including whether to share them with a third party such as an insurer, is entirely their decision.

1. What information we collect

We collect personal information that is necessary to provide our services, including:

• Contact information (name, email address, phone number, organisation)
• Health information that the patient or applicant has consented to retrieve and share through Surely
• Account and authentication information
• Usage data and logs for security and audit purposes

2. How we use your information

We use personal information to:

• Provide and operate the Surely platform and services
• Process patient-initiated, consented health record requests between general practices and the recipients the patient authorises
• Maintain audit trails as required by law
• Communicate with you about your account or enquiries
• Improve our services and ensure security

3. Health information

Each request is reviewed and authorised by the patient or applicant, who approves what information is shared, who it is shared with, and the purpose for which it is used. We operate in accordance with the Health Information Privacy Code 2020 and the New Zealand Privacy Act 2020.

4. Disclosure of information

We do not sell or share personal information with third parties for marketing purposes. We may share information:

• With general practices and the recipients authorised by the patient as required to complete a consented request
• With our technology partners who support the operation of the platform (under data processing agreements)
• When required by law or regulatory authority

5. Security

Surely is SOC 2 Type II compliant and uses end-to-end encryption for all data in transit. Records are delivered via time-limited presigned access. We are equipped to handle personally identifiable health information in accordance with NZ law. For full details, see our Security page.

6. Your rights

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the right to access and correct personal information we hold about you. To exercise these rights, contact us at hello@surely.nz.

7. Retention

Surely does not retain health record data. Once a request has been fulfilled, the data is automatically and permanently deleted from the system within a defined number of days. Audit logs and account information are retained only for as long as necessary to provide our services and comply with legal obligations, in accordance with the Health Information Privacy Code 2020 and the Privacy Act 2020.

8. Contact

For privacy enquiries, contact our Privacy Officer at hello@surely.nz or write to us at Level 4, 40 Taranaki Street, Wellington 6011, New Zealand.