Website
This website uses cookies to help us provide you with the best possible user experience. Without some of the cookies, this website simply would not work. Other cookies perform functions like recognising you each time you visit the site or helping our team to understand which parts of the website you find most interesting and useful. Please ensure you review the cookies and manage your settings to suit your requirements.
Policy Statement
At all times the RST employees, contractors, trustees, and volunteers manage personal information in compliance with the Privacy Act 2020 and the Health Information Privacy Code 2020, other relevant laws, and the promises the RST makes regarding the security of personal information.
Accountabilities
Privacy is everyone’s responsibility. This policy applies to all those at the RST who are privy to personal information, that may be required to collect, access, use or disclose personal information, manage projects or systems that impact on personal information management, or are responsible for making policy decisions about the way personal information is managed.
Definitions
Individual Concerned - means anyone about whom the RST collects and holds personal information.
Lawful purpose - is a purpose that is directly connected with any of RST’s lawful functions, and includes, but is not limited to considering referrals, employment with RST; service delivery; managing staff and ensuring health and safety; and meeting RST’s reporting requirements.
Personal information - means any information, whether electronic or hard copy, about an individual concerned, whether or not the information directly identifies the individual, and includes but is not limited to contact, demographic, health and service information, photographs and videos, staff performance information, emails and other correspondence, and opinions about the individual concerned.
Privacy breach - means an event (whether intentional or unintentional) in which personal information is lost or is accessed, altered, disclosed or destroyed without authorisation, or is at increased risk due to poor security safeguards, including but not limited to:
- accidental disclosure of personal information to the wrong recipient;
- employee browsing of personal information without a legitimate business reason;
- an external attack on an RST system; or
- a lost or stolen RST device or document.
Procedures
1. Collection and use
We collect the personal information, such as:
- Names and contact details
- Date of Birth
- Location
- Health or support needs (if relevant to our services)
- Emergency contacts
- Information relevant to engaging with RST services (such as communications and correspondence)
The information collected is only for a lawful purpose, such as to:
- Recruit staff
- Deliver our services
- Meet our legal obligations
- Improve our support and safety practices
We will always communicate why we are collecting this information and how it will be used.
2. Storage and Disposal
The RST team take responsibility to protect personal information against loss, misuse, or unauthorised access, modification or disclosure. We keep personal information safe by:
- Storing it securely in locked files or password-protected systems
- Limiting access to authorised staff only
- Following strict confidentiality procedures
Personal information will not be retained for longer than the RST has a lawful purpose to use it, and is securely disposed of to prevent unauthorised access, use, or disclosure.
Personal Information is securely disposed by:
Paper Records
- Shredded using a cross-cut shredder or a secure shredding service.
- Intact documents containing personal data are not disposed of in general rubbish or recycling bins.
- Documents containing personal information are stored in a locked container until they are destroyed.
Electronic Records
- Files are deleted securely using software that overwrites the data (not just sending to the Recycle Bin).
- Hard drives and USBs are wiped or destroyed before disposal or reuse (e.g. degaussing, physical destruction, or secure data erasure tools).
- Accounts or access credentials that are no longer in use are removed.
Other Media (e.g. audio, video)
- Media physically destroyed (e.g. cutting or breaking).
- Secure e-waste disposal services used that include certified data destruction.
3. Access and disclosure
Every individual concerned, or their authorised representative, has the right to request a copy of the personal information the RST holds about them, or to ask for corrections to their personal information if they think it is wrong.
We do not share personal information unless:
- The individual concerned gives permission
- It is required by law
- It is necessary to protect someone’s safety
4. Privacy Breach
The RST team will report any privacy breach they become aware promptly to the Privacy Officer. The Privacy Officer will notify the office of the Privacy Commissioner of any privacy breach that has caused serious harm to someone (or is likely to do so) as soon as possible.
Key relevant documents
Include the following:
- Health Information Privacy Code 2020
- RST Informed Consent Policy
- Privacy Act 2020
- Public Records Act 2005
If you would like to make a privacy related complaint, please contact the Regional Trust your complaint relates to. If you are not satisfied with RST’s response you can refer your complaint to the Privacy Commissioner, their details are available on their website www.privacy.org.nz
We may update this privacy statement from time to time to reflect changes to privacy law or our operations. This privacy statement was last updated in May 2026.