Privacy and confidentiality in online therapy in New Zealand

The law that protects your information

In New Zealand, health information is governed by the Health Information Privacy Code 2020, issued under the Privacy Act 2020. It applies to health agencies, which includes psychologists in private practice as well as GPs, hospitals, insurers and ACC. The Code has 13 rules covering how information is collected, stored, used, disclosed, kept and accessed, and it applies to a video session exactly as it applies to a face-to-face one.

Three other layers sit alongside it. The Code of Health and Disability Services Consumers' Rights gives you the right to privacy, information and informed consent, and a free complaints route through the Health and Disability Commissioner. The Code of Ethics for Psychologists Working in Aotearoa New Zealand sets professional standards for confidentiality that the Psychologists Board can enforce. And the Privacy Act itself requires agencies to notify serious privacy breaches.

What confidentiality means, and where it stops

Confidentiality means that what you tell your psychologist is not passed on without your agreement. Rule 11 of the Code restricts disclosure to the purpose the information was collected for, or to disclosures you have authorised. In practice: your GP is usually only written to with your consent, your employer learns nothing, and your insurer sees a receipt, not your notes.

The limits are narrow and your psychologist should explain them in the first session:

• Serious threat. The Code allows disclosure where it is necessary to prevent or lessen a serious threat to someone's life, health or safety, including your own. This is about imminent danger, not ordinary distress.
• Legal requirement. A court order or a statutory obligation can compel disclosure. These are rare in therapy.
• Supervision. Psychologists discuss their work with a professional supervisor as a standard of good practice; this is usually done without identifying you.

If a psychologist ever needs to use one of these exceptions, good practice is to tell you, unless doing so would increase the risk. Everything else requires your consent, and you can ask exactly what will be shared, with whom and why before you give it.

How video sessions are protected

Platforms designed for health care, as opposed to general-purpose video apps, typically do several things: encrypt the audio and video in transit so it is protected from interception, generate a unique link for each appointment so nobody can wander into a session, let the clinician control who is admitted, and only record when recording is deliberately switched on. Access to records is limited to authorised users, with logins and audit trails.

What to ask any online practice: Which platform do you use, and is it built for health care? Where are my records stored, and who can access them? Are sessions ever recorded? How long are records kept? A practice that handles privacy well will answer without hesitation. Our guide on whether online therapy is effective covers the clinical side of the same question.

Book a session How booking works →

Your side of the screen: practical privacy

The weakest point in an online session is usually not the platform; it is the room you are in and the device you are using.

• Place. A room with a closing door, a parked car, or a quiet corner of a garden all work. Tell household members you are not to be interrupted. White noise or a fan outside the door helps in thin-walled flats.
• Headphones. They mean nobody can overhear your psychologist's half of the conversation.
• Device. Use a personal device rather than a work laptop or phone; employers can legitimately monitor work equipment and networks. Lock the device with a passcode and log out of the platform afterwards.
• Connection. Home Wi-Fi or mobile data is fine. Avoid public Wi-Fi in cafés or libraries.
• Email and calendar. Your appointment reminders arrive by email and calendar invite; if you share a device or account with someone, consider where those land.
• Notes. If you keep your own notes between sessions, keep them somewhere only you can see.

Your records and your rights

Your psychologist keeps clinical notes: a brief record of each session, your assessment and plan, and correspondence. Under the Health (Retention of Health Information) Regulations 1996, health information must be kept for at least 10 years from the last time you were seen, so records do not vanish when therapy ends, and nor can they be deleted on request before then.

You have the right under rule 6 of the Code to access your own health information. A psychologist must respond as soon as practicable and within 20 working days, and may only refuse on limited grounds, such as where disclosure would seriously prejudice your health or unreasonably expose someone else's private affairs. Private providers can charge for access only in narrow circumstances. Under rule 7 you can ask for information you believe is wrong to be corrected, and if the agency disagrees, to have your request noted on the file.

If you think your privacy has been breached, raise it with the practice first. Beyond that, you can complain to the Office of the Privacy Commissioner, or to the Health and Disability Commissioner under the Code of Rights. Both are free.

Insurance claims, GP letters and other sharing

Claiming on insurance does not require your psychologist to share clinical information. A receipt shows the provider, the date, the service and the amount. If an insurer asks for more, you can ask what it needs and why, and decide whether to consent; your psychologist should not send notes without your written agreement.

A letter to your employer always needs your consent, for a purpose you understand, and letters to your GP or another health professional usually work the same way. It is reasonable to ask to see a letter before it is sent. The one area where consent is not the deciding factor is the serious-threat exception above, and a psychologist should talk with you about it if it ever arises.

How Mindwell handles your information

Mindwell operates under the Health Information Privacy Code 2020. Sessions run through Carepatron, a health-care practice platform that works in your browser with nothing to download, and your intake form and consent sit within it. Your psychologist keeps your clinical notes, either in Carepatron or in their own secure system. Information is shared only with your consent or where the law requires or allows it, as set out above, and your psychologist will go through confidentiality and its limits in your first session.

If you would like a copy of your notes, a letter to your GP or a report for another agency, ask your psychologist or email team@mindwell.co.nz; letters and reports are quoted and agreed in advance. Our full privacy policy sets out what we collect, why, and how to contact us about it. Mindwell works with adults 18+ in New Zealand and is not a crisis service: for immediate danger call 111, and for free 24/7 support call or text 1737.

Related support: Is online therapy effective? · Your first session · Privacy policy · Online therapy in NZ