How we handle your data

Who’s responsible

Your clinic is the agency responsible for its patients’ health information under the Privacy Act 2020 and the Health Information Privacy Code 2020 (HIPC). Kakapo Health — a Rebellion Digital product — is the tool and service provider the clinic uses to run consults and prepare letters.

Under section 11 of the Privacy Act, information a service provider holds only on a clinic’s behalf is treated as held by the clinic, so the clinic stays in charge of it.

At a glance

• Audio only. We record audio, not video, and only to prepare the clinical letter.
• Stored in Auckland. Recordings, transcripts and draft letters are stored on Amazon Web Services in Auckland, New Zealand, encrypted at rest and only reachable over encrypted connections.
• Transcription happens in the United States. Transcription is done by a specialist provider in the US. We say so plainly because it matters.
• Letters are drafted in the Australia/New Zealand region. The AI model that drafts letters runs on Amazon Web Services in the Australia/New Zealand region.
• Your doctor reviews every letter. The doctor reviews every AI-drafted letter and files it themselves. Nothing is sent automatically.

Where it’s stored and processed

What	Who handles it	Where
Consult recordings (audio only)	Amazon Web Services	Auckland, New Zealand
Transcripts and draft letters	Amazon Web Services	Auckland, New Zealand
Transcription	A specialist medical transcription provider	United States
Drafting the letter	An AI model on Amazon Web Services	Australia/New Zealand region
Approved letters	Filed by the doctor to the patient’s record in the clinic’s practice management system	The clinic’s system

Keeping it secure

• Encrypted at rest. Recordings, transcripts and draft letters are encrypted with AES-256 (AWS KMS).
• Private storage. The storage is private, with public access blocked, and only reachable over encrypted connections.
• Encrypted video calls. Video calls are encrypted in transit.
• Signed-in staff only. Staff sign in through an access-controlled portal, and each doctor can only open their own consult room.
• A record of recording downloads and deletions. When a manager downloads or deletes a recording, it’s logged.

Consent

Your clinic asks for your consent before using the scribe. That’s part of the clinic’s process, and if you’d rather not have the scribe used, tell your clinic or your doctor.

A clinician reviews every letter

The AI produces drafts. Your doctor reviews every AI-drafted letter and files it themselves — nothing is sent automatically. Kakapo Health doesn’t diagnose or give medical advice.

How this relates to NZ rules

Kakapo Health is designed to support clinics with the rules below. It doesn’t hold any certification or accreditation, we don’t claim compliance on a clinic’s behalf, and it isn’t a substitute for the clinic’s own privacy assessment and advice.

Rule	What it covers	How Kakapo Health relates
HIPC rule 5 — security	Reasonable safeguards against loss, misuse and unauthorised access	Storage in Auckland, encrypted at rest and in transit, private storage, signed-in staff, doctors limited to their own rooms.
HIPC rule 9 — retention	Not keeping health information longer than needed	The lasting record is the letter the doctor files in the clinic’s own system. Ask us about retention for recordings, transcripts and drafts.
HIPC rule 11 — disclosure	Limits on disclosing health information	Information is processed by the services listed above, to transcribe the consult and draft the letter.
HIPC rule 12 — overseas	Rules for disclosing health information outside New Zealand	Transcription happens in the United States, and letters are drafted in the Australia/New Zealand region. Clinics should consider this in their own assessment.
Health (Retention of Health Information) Regulations 1996	Health records kept for at least 10 years from the day after the last service	The clinic, as record holder, keeps the patient record — including filed letters — in its own system.
HISO 10029 Health Information Security Framework	Security expectations for the health sector	We don’t claim HISO 10029 compliance. Clinics assessing us against it can ask for details.
Consent to the AI scribe	Patients agreeing to the scribe being used	Your clinic asks for your consent before using the scribe.
Clinician review of AI output	A clinician checks AI-generated notes and letters	The doctor reviews every AI-drafted letter and files it themselves.
Health NZ and AI scribes	Health NZ’s National AI and Algorithm Expert Advisory Group reviews AI tools for the public health system	Kakapo Health isn’t on Health NZ’s endorsed list. Public-sector clinicians should follow their organisation’s process before using any new AI tool.

Questions about any of this? Email [email protected] — we’d rather you asked.