Updated Consultation Pricing: Now only $49 for all initial and follow-up consultations!
*Excludes Paediatric/Specialist consultations

Southern Cross Affiliated Provider
CannaPlus+ Cannabis Clinic
Book now

Privacy
Policy

Contents

1. Introduction

This policy explains how we collect, use, and protect your personal information, and your rights in relation to that information. It is prepared in accordance with the Privacy Act 2020 (including the Information Privacy Principles), the Health Information Privacy Code 2020 (HIPC), the Health and Disability Commissioner (Code of Health and Disability Services Consumers’ Rights) Regulations 1996, and other applicable New Zealand legislation.

2. This Update
We have updated our privacy practices relating to the collection and use of health information, including where information is collected from third parties, to ensure alignment with the Health Information Privacy Code 2020.

This version is dated 24 June 2026.

3. Who are we?
We are Elysian Holdings Limited and its related companies, including Cannaplus Limited and Mr Healthcare Limited.
We are the agency that collects and holds your personal information for the purposes described in this policy.

We are committed to maintaining the accuracy, confidentiality and security of your personal information. This Privacy Policy describes the personal information that we collect from or about you, how we use, and to whom we disclose that information.

4. Privacy Policy Effective for New Zealand
It is our policy to comply with the privacy legislation within New Zealand. This Privacy Policy covers only those activities that are subject to the provisions of New Zealand’s privacy laws, as applicable. This Privacy Policy has a limited scope and application. Consequently, the rights and obligations contained in this Privacy Policy may not be available to all individuals.

5. What personal information do we collect about you?
Background and identity information

  • Name, date of birth, gender, address, ethnicity, citizenship
  • National Health Index (NHI) number
  • Identity documents (e.g. passport, driver licence)
  • Contact details and emergency contacts

 

Health information

  • Medical history, treatment, healthcare plans, and insurance
  • Consultation records and communications, and forms that you fill in
  • Copies of relevant health records
  • Consent to share information with your primary healthcare provider

 

Use of AI

  • Our clinicians may use artificial intelligence (AI)-supported tools to assist with clinical documentation. These tools may process consultation transcripts and relevant health data. Your doctor will ask for your consent during the consultation prior to using any such tools.
  • AI is used to support, not replace, clinical decision-making
  • A clinician reviews and approves all outputs
  • Appropriate security and confidentiality safeguards are applied
  • You may request that AI tools are not used during your consultation. If this would affect your care, we will discuss any impacts with you.
  • AI tools may also be used in aggregated or de-identified form to analyse outcomes, improve services, and support administration.

 

Payment information

  • Bank account details, if required for issuing refunds
  • Billing and transaction information

 

Information about your device and interactions

  • You can visit our website without telling us who you are or revealing sensitive information about yourself.
  • Our web server may collect information related to your visit, such as IP address, location, cookies, and session data.
  • We use third party analytics tools to help us measure traffic and usage trends for our website. These tools may use cookies and other technologies to collect information about your use of our website. These tools collect information sent by your device or our website and other information that assists us in improving our website. This information may be used to, among other things, analyse and track data, determine the popularity of certain content, and better understand your online activity.
  • For example, we may use Google Analytics and Meta Analytics to better understand who is using our website and how people are using it. Google and Facebook may use cookies, pixel tags and other technologies to collect and store information such as website pages visited, places where users click, time spent on each website page, IP address, type of operating system used, location-based data, device ID, search history, and phone number. We may use this information to improve our website and as otherwise described in this Privacy Policy (including, for example, for the purposes of sending you marketing materials that we believe may be of interest to you).
  • We may use de-identified, hashed, or anonymised data to help us understand audiences and improve services, including use with third-party platforms. This does not involve identifying you as an individual patient.

 

Other Data you provide

  • In addition, we collect any information that you submit to our website, by email, or by calling us. This includes, for example, using the “contact us” portion of this website; or using the “book a consultation” portion of this website; or corresponding with a representative of CannaPlus via e-mail using the hyperlinks created for that purpose.

6. If you do not provide information

Providing some information is necessary to safely deliver healthcare services. If you choose not to provide information, we may not be able to provide services or may be limited in doing so.

7. What are the purposes for collecting your information?

We collect and use your information to:

  • Verify your identity and eligibility for services
  • Provide healthcare services and maintain clinical records
  • Coordinate care and make referrals
  • Support shared health records and national systems
  • Communicate with you about your care
  • Improve services and clinical outcomes
  • Conduct research (subject to ethical approval, in line with the National Ethical Standards for Health and Disability Research and Quality). Where identifiable information is used for research, this will only occur with your consent. Otherwise, research will use de-identified or anonymised information.

 

Marketing

  • To the extent permitted by applicable law, we may use your personal information (e.g. your contact information) to send you information about offers on goods and services that we believe may be of interest to you, or which we believe are relevant to your continued care.
  • You can opt out of receiving marketing communications at any time using the unsubscribe function in our emails or by contacting us at info@cannaplus.co.nz with the subject line “unsubscribe from marketing emails”.

 

These purposes are supported by our obligations under:

  • Health Act 1956
  • Health Information Privacy Code 2020 (Rules 10 and 11)
  • Medicines Act 1981 and Medicines Regulations 1984
  • Misuse of Drugs Act 1975 and Regulations 1977
  • Pae Ora (Healthy Futures) Act 2022

8. Who do we share your information with?

We may disclose your information to:

  • Clinicians, staff, and service providers involved in your care
  • Government agencies (e.g. Health NZ, ACC, Ministry of Social Development)
  • Regulators (e.g. Health and Disability Commissioner, Medical Council, Coroner)
  • Health insurers or employers where applicable
  • Service providers supporting operations (e.g. identity verification, payments)
  • Wholesalers of Unapproved Medications (see Regulatory Disclosures below)
  • With your consent, we will also share relevant information about your care with other professionals involved in your care, such as your GP or other specialists.

 

We only disclose information where permitted or required by law, including under Rule 11 of the HIPC.


Regulatory Disclosures

If you receive services through CannaPlus, we may collect, use, and disclose your information to comply with New Zealand’s Medicinal Cannabis Scheme and related legislation. Many medicinal cannabis products prescribed in New Zealand are “unapproved medicines” supplied under section 29 of the Medicines Act 1981.

Under section 29, suppliers of these medicines are legally required to collect and report information about their supply to the Director-General of Health (delegated to Medsafe).
This may include information relating to;

  • the prescribing clinician
  • the product supplied
  • the quantity and timing of supply.

 

In some cases, patient-level information may be recorded and retained for audit and compliance purposes. We may share relevant information with:

  • The wholesaler who supplies the medication
  • Ministry of Health / Manatū Hauora
  • Medsafe (New Zealand Medicines and Medical Devices Safety Authority)
  • Health New Zealand / Te Whatu Ora

 

These disclosures support:

  • regulatory oversight and compliance
  • monitoring of prescribing and supply
  • pharmacovigilance and patient safety

 

Disclosures are made as permitted or required by law, in accordance with:

  • Medicines Act 1981 (including section 29)
  • Misuse of Drugs Act 1975
  • Health Information Privacy Code 2020 (Rule 11 – permitted disclosures)

9. How do we collect personal information?

Directly from you

  • When you register or communicate with us
  • During consultations

 

Indirectly

We may collect information from:

  • Other healthcare providers (labs, hospitals, specialists)
  • Insurers or employers
  • Payment providers
  • National systems (e.g. TestSafe, reCare)

 

Where we collect information indirectly, we take reasonable steps to ensure you are aware of:

  • the collection
  • the purpose
  • intended recipients
  • your rights

 

National prescription systems access

We may access prescription records through national systems such as TestSafe and reCare to support safe treatment.

Your consent will be obtained where practicable. In some situations, access may occur without consent where permitted by law (e.g. serious threat situations). Reasons for such access will be recorded.

10. Where is your personal information stored?

Your clinical data and health records, such as consultation notes and prescriptions, are stored in our Patient Management System (PMS), MyPractice.

We store non-clinical data using cloud service providers such as Microsoft, Cliniko, and Xero.

Some providers may store or process information outside New Zealand. Where this occurs, we take reasonable steps to ensure appropriate safeguards are in place in accordance with the Privacy Act 2020.

We protect information using technical and organisational safeguards consistent with health sector standards (including NZS 8134), such as access controls, encryption, and monitoring.

11. How do we manage the health information of dependents and young adults?

If you are under the age of 16 and wish to register with us, your account will usually be linked to your parent or guardian’s account.

Parents (and legal guardians) also have some rights to access their children’s/dependent’s health information, up until they turn 16.

Usually your parents and/or guardians will be able to access and view your medical information. However, there may be times where we need to limit the information shared in order to respect confidentiality and the best interests of the child or young person.

As a young adult you may ask us not to share your information with parents or guardians. Requests are assessed on a case-by-case basis in accordance with:

  • Privacy Act 2020
  • Health Information Privacy Code 2020
  • Health Act 1956
  • Code of Health and Disability Services Consumers’ Rights

12. Access to Your Personal Information

You can ask to see your personal information. If you want to review, verify or correct your personal information, please contact our Privacy Officer. Please note that any such communication must be in writing.

When requesting access to your personal information, please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you.

Access is generally free, although a reasonable administrative fee may apply in limited circumstances permitted by law. If a fee were to apply, we will advise you in advance.

13. Updating Your Personal Information

It is important that the information contained in our records is both accurate and current. If your personal information happens to change during the course of our relationship, please keep us informed of such changes.

In some circumstances we may not agree with your request to change your personal information and will instead append an alternative text to the record in question (“notice of correction”).

14. Retention of information

We retain your information in accordance with legal obligations, including the Health (Retention of Health Information) Regulations 1996.

This generally means retaining records for at least 10 years after your last interaction with us.

Where AI tools are used for documentation, transcripts may be temporarily retained (e.g. up to 14 days) for processing and then securely deleted.

15. Notifiable privacy breaches

If a privacy breach occurs that is likely to cause serious harm, we will:

  • notify you as soon as reasonably practicable; and
  • notify the Office of the Privacy Commissioner

 

We will also take steps to contain and investigate the breach and prevent recurrence.

16. Cookies and tracking technologies

We use cookies and similar technologies to support functionality, analytics, and service improvement. These may include third-party tools. You can adjust your browser settings to manage cookies.

17. Changes to this policy

We may update this policy from time to time. The latest version will be available on our website. Where possible, we will notify you of any changes by sending you a notice via email. It is your responsibility to check this Privacy Policy periodically for changes, and to keep your email address current.

This Privacy Policy was last updated on 24 June 2026.

18. Complaints

If you have concerns, contact us first, at privacy@cannaplus.co.nz. We will respond to requests within the timeframes required by the Privacy Act (generally within 20 working days).

If you are unsatisfied with the resolution, you may then contact:

  • Office of the Privacy Commissioner (OPC)
  • Health and Disability Commissioner (HDC)

19. Privacy Officer

We have appointed a Privacy Officer to oversee compliance with this Privacy Policy.

The contact information for our Privacy Officer is as follows:

  • 231 Ponsonby Road, Ponsonby, Auckland 1011. Letters should be marked “attention: Privacy Officer”.
  • Phone: 09 218 3411
  • Email: privacy@cannaplus.co.nz

20. Interpretation of this Privacy Policy

Any interpretation associated with this Privacy Policy will be made by our Privacy Officer.

This Privacy Policy includes examples but is not intended to be restricted in its application to such examples; therefore, where the word “including” is used, it shall mean “including without limitation”.

This Privacy Policy does not create or confer upon any individual any rights or impose upon CannaPlus any rights or obligations outside of, or in addition to, any rights or obligations imposed by New Zealand’s privacy laws, as applicable. Should there be, in a specific case, any inconsistency between this Privacy Policy and New Zealand’s privacy laws, as applicable, this Privacy Policy shall be interpreted, in respect of that case, to give effect to, and comply with, such privacy laws.