Green Leaf Group Limited

Last updated: April 2026

About this policy

Green Leaf Group Limited has this privacy policy because we understand that it is important for you to know how we collect, store, and use your personal information.

By “Green Leaf Group” we mean the following companies and any of their associated brands: CClinic Limited (Cannabis Clinic), Florx Health Limited, YUDC Limited (Lake Road Pharmacy), Green Leaf Services Limited, and Green Leaf Technologies Limited.

In this policy we refer to Green Leaf Group as “we”, “us”, “our” or “Group”. By using our websites, mobile site, apps, clinics or services, participating in our database, promotions, or membership programmes, or interacting with our team in any way, you acknowledge that your personal information will be treated as described in this policy.

Your rights under the Health Information Privacy Code 2020 and the Privacy Act 2020 will be respected, including your right to access and, if necessary, correct any information held about you.

  1. Information we collect and why

Personal information

We collect personal information to provide you with our services, carry out our business activities, and give you the best possible care and customer service. The personal information we collect may include your name, address, phone number, email address, date of birth, and payment details.

We collect personal information from several sources:

  • Information you give us directly: (for example, when you register, complete a form, or contact us)
  • Information we collect automatically: when you use our websites or apps (see below)

Health information

Because we are a healthcare provider, we also collect health information about you. This is a special category of personal information and includes your medical history, current conditions, medications, and treatment records. We collect and use this information to provide you with clinical care, manage our healthcare services, and meet our legal obligations.

We collect health information from several sources:

  • Your GP or Specialist (with your consent):

What we might collect: Your medical history, medications, allergies, referral letters, and current treatment plans.

Why we collect it: To understand your medical background and ensure continuity of care.

  • The National Health Index (NHI):

What we collect: Your unique NHI number and basic demographic details (such as your name, date of birth, and updated address).

Why we collect it: To accurately identify you across the New Zealand healthcare system and ensure your medical records are correctly linked.

  • The New Zealand electronic Prescription Service (NZePS):

What we collect: Your recent and historical prescription data, alongside your medication dispensing records.

Why we collect it: To check for medication allergies or adverse interactions before prescribing new treatments, and to verify exactly what medications have been dispensed to you to prevent medication errors or wrong dispensing.

How we access it: Our clinical team accesses your NZePS records through Recare and Script Sense. 

  • TestSafe (for Northland and Auckland area patients):

What we might collect: Your shared electronic health record, which includes GP summaries, hospital discharge notes, allergy alerts, and dispensed medications.

Why we collect it: To ensure we have an accurate clinical picture at the point of care.

Eligibility quiz and lead forms

If you complete our online eligibility quiz, download a brochure, or submit your details through our website or social media lead forms, your information will be saved to our database. You will receive communications from us related to our services. You can opt out at any time by clicking “unsubscribe” or “STOP” in any email or text message you receive from us.

  1. Cookies and log data

When you visit our websites, we automatically collect certain technical information. This may include your IP address, browser type, the pages you visit, how long you spend on our site, and how you found us.

We use this information to operate and improve our websites, understand how people use our services, measure the effectiveness of our marketing, and present content that is relevant to you.

We use cookies and similar technologies to do this. Cookies are small files stored on your device. Some last only for the duration of your visit, while others remain so we can recognise you when you return.

We use Google Analytics and may use other third-party analytics services. These tools collect anonymous data about website traffic and usage patterns. You can manage or disable cookies through your browser settings, although this may affect your experience on our site.

  1. Patient information and prescribing records

We request patients submit their medical background notes ahead of their first consultation. These are typically obtained from your GP, specialist, or patient portal. If you choose not to provide your background medical notes, this may affect our ability to provide you with our services.

Your prescription information is recorded on the national prescribing database, as required for all electronically prescribed medications in New Zealand. This information is accessible by your doctor and other health professionals involved in your care. We access this information through Recare and Script Sense.

In accordance with the Medicines Act 1981, information about the supply of medicinal cannabis will be forwarded to the Ministry of Health.

  1. How we use your information

We use your personal information for the following purposes:

  • Providing you with clinical care and healthcare services
  • Managing appointments, prescriptions, and treatment plans
  • Communicating with you about your care, including appointment reminders and follow ups
  • Service improvement, quality assurance, and clinical audit
  • Meeting our legal and regulatory obligations
  • Contacting you about products, services, or information we think may be relevant to your treatment, where you have opted in or where this is directly related to your care
  • Requesting feedback about your experience with our services
  • Responding to complaints or enquiries

You can opt out of non-essential communications at any time by clicking “unsubscribe” or “STOP” in any message, or by contacting us directly.

  1. Who we share your information with

We keep your personal information confidential. We will only share it with others where this is necessary to provide you with our services, or where we are required by law. The types of people and organisations we may share your information with include:

  • Your GP, specialist, or other healthcare professionals involved in your care. We will only do this with your knowledge and consent.
  • Pharmacies dispensing your medication
  • The Ministry of Health, as required under the Medicines Act 1981
  • Other regulatory or government bodies, where required by law
  • Third party service providers who support our operations (see Section 6)
  • Payment processors
  • Anyone you have asked us to communicate with on your behalf
  • Our professional advisers, such as lawyers, auditors, and insurers

Where we share your information, we share only what is necessary for the specific purpose. All third parties are required to protect your information and may only use it in accordance with our instructions and applicable New Zealand privacy law.

  1. Third party service providers, AI tools, and offshore processing

We use trusted third-party service providers to support the delivery and improvement of our services. This may include providers of technology systems, communications tools, appointment management, analytics, and patient feedback services.

Artificial intelligence tools

We use artificial intelligence (AI) tools to support certain administrative and operational tasks, such as drafting correspondence and supporting service delivery. These tools do not make clinical decisions about your care. All clinical decisions are made by our qualified healthcare professionals.

We have internal policies and staff training in place to govern the appropriate use of AI tools and to protect your information. Our AI providers are contractually restricted from using your data to train their models.

Offshore processing

Some of the third-party services and AI tools we use may process information on servers located outside New Zealand, including in the United States and Australia. Where your personal information is processed overseas, we take reasonable steps to ensure that the overseas recipient is subject to comparable privacy safeguards, in accordance with our obligations under the Health Information Privacy Code 2020.

  1. How we keep your information safe

The security of your personal information is important to us. We take reasonable steps to protect the personal information we hold from misuse, loss, unauthorised access, or modification. This includes using commercially acceptable security measures and restricting access to authorised personnel.

No method of transmission over the internet or electronic storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. If you suspect any misuse or loss of, or unauthorised access to your personal information, please contact us immediately.

You are responsible for keeping your password confidential. Please do not share your login details with anyone.

  1. How long we keep your information

We retain your personal and health information for as long as necessary to fulfil the purposes described in this policy and to meet our legal obligations.

Health records are retained for a minimum of 10 years from the date of the last entry, in accordance with the Health (Retention of Health Information) Regulations 1996. In some cases, records may be retained for longer where there is a clinical or legal reason to do so.

We may also retain anonymised or aggregated information for research, audit, and service improvement purposes. This information cannot be used to identify you.

  1. Your rights

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the right to:

  • Access the personal information we hold about you
  • Ask us to correct any information that is inaccurate, incomplete, or out of date
  • Ask us to stop using your information for direct marketing purposes
  • Make a complaint to the Office of the Privacy Commissioner if you believe your privacy has been breached

To make a request or exercise any of these rights, please contact us using the details in Section 12 below. We will respond within 20 working days, as required by law.

  1. Data breaches

If we become aware of a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and any affected individuals as soon as reasonably practicable, in accordance with the Privacy Act 2020.

  1. Changes to this policy

We may update this policy from time to time to reflect changes in our services, legal requirements, or the way we handle personal information. When we make changes, we will update the “last updated” date at the top of this page. If the changes are significant, we may notify you directly.

Your continued use of our services after any changes takes effect means you accept the updated policy. We encourage you to check this page from time to time.

  1. Contact us

If you have any questions about this privacy policy, want to make a request about your personal information, or have a concern about how we have handled your information, please contact us:

Email: [email protected]

Phone: (09) 390 0059

Post: Green Leaf Group Limited, 12-14 Como Street, Takapuna, Auckland 0622

 

You can also contact the Office of the Privacy Commissioner:

Website: www.privacy.org.nz

Phone: 0800 803 909