At The Tooth Spa, we are committed to protecting your privacy and ensuring the security of your personal health information. This policy explains how we collect, use, and store your data when you book a treatment or visit our clinic.

1. Information We Collect

We collect information necessary to provide safe and effective teeth whitening services. This includes:

• Personal Details: Name, date of birth, and contact information (phone, email).
• Health Information: Medical history relevant to teeth whitening (e.g. allergies, pregnancy, medications), clinical notes, or photographs of your teeth.
• Booking & Payment Data: Appointment times, service history, and payment records.

2. How We Use Your Information

Your information is used to:

• Manage your appointments and send reminders via SMS or email.
• Ensure the requested treatment is safe for your specific health profile.
• Process payments securely.
• Communicate follow-up care instructions or occasional promotional updates (where you have opted in).

3. Storage and Security (Timely)

We use Timely as our cloud-based booking and clinic management software.

• Data Processor: Timely acts as a data processor on our behalf, storing your information on secure servers with industry-standard 256-bit SSL encryption.
• Access Control: Only authorised staff at The Tooth Spa have access to your records.
• No Sharing: We do not sell or share your personal data with third parties for their own marketing purposes.

4. Your Rights

Under the Privacy Act 2020 and HIPC, you have the following rights:

• Access: You may request a copy of all personal and health information we hold about you.
• Correction: You can ask us to correct any inaccurate information.
• Retention: We are legally required to retain your health records for 10 years from your last appointment.

5. Contact Us

If you have any questions or wish to exercise your rights, please contact our Privacy Officer:

• Name: Kim Prater
• Email: info@thetoothspa.co.nz
• Address: Unit 14/ 6 Molesworth Drive, Mangawhai

If you are unsatisfied with our response, you can contact the Office of the Privacy Commissioner at 0800 803 909.