Health Information Privacy Code
Last updated: 1 October 2026
PMIL holds health information, including genetic data, so we follow the Health Information Privacy Code 2020 (HIPC), issued under New Zealand's Privacy Act 2020. The Code sets 13 rules for how health agencies collect, store, use and share health information. Here is how we apply each one. Our Privacy Policy gives more detail.
Rule 1 - Purpose of collection. We collect only what is needed to produce XY Leap analyses and reports, run our education programs, and meet our obligations as a medical device manufacturer.
Rule 2 - Source of information. We collect platform data from your healthcare provider, the accredited laboratory that produces your genetic data, and partners who offer XY Leap, with your authorization.
Rule 3 - Telling you about collection. Your provider explains the analysis and obtains your express consent before it runs. Our Privacy Policy sets out what we hold and why.
Rule 4 - Manner of collection. We never collect health information in a way that is unfair or unreasonably intrusive.
Rule 5 - Storage and security. We use encryption in transit and at rest, limit access to staff who need it, keep audit logs, and require service providers by contract to protect information.
Rule 6 - Access. You can ask for the information we hold about you. Because platform data reaches us under a code, requests about it go through your healthcare provider.
Rule 7 - Correction. You can ask for a correction, or for a statement of the correction you asked for to be attached.
Rule 8 - Accuracy. Reports rely on accredited laboratory data and are updated as new evidence is published.
Rule 9 - Retention. Health information is kept for at least 10 years after the last service, under the Health (Retention of Health Information) Regulations 1996. Other information is deleted or de-identified when no longer needed.
Rule 10 - Use. We use health information for the provider's purposes, and de-identified data for research and model development only where the provider has authorized it or you have given separate consent.
Rule 11 - Disclosure. We share information only with your clinicians, laboratories, service providers and partners as needed, or where the law requires. We never share it with employers or insurers without your express consent.
Rule 12 - Overseas disclosure. Before sending information outside New Zealand, we make sure the recipient has comparable privacy safeguards.
Rule 13 - Unique identifiers. We assign our own codes to platform records and use unique identifiers only as the Code allows.
Questions or complaints. Email info@precisionmedicineinternational.com with "Privacy" in the subject line. We will respond within 20 working days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.