Privacy Policy

Your privacy is important to us. This Privacy Policy explains how Medfuture Ltd (NZBN 9429046885838), trading as Medfuture (“Medfuture”, “we”, “us” or “our”), collects, uses, stores, shares and protects your personal information.

This policy applies to our recruitment services in New Zealand and to everyone who uses our website at medfuture.co.nz, including candidates, healthcare professionals, referees, clients and website visitors.

We manage personal information in accordance with the Privacy Act 2020 (the “Privacy Act”) and its Information Privacy Principles (“IPPs”), as amended by the Privacy Amendment Act 2025.

Personal information is any information about an identifiable individual. It can include opinions about you, whether or not they are accurate. Some personal information is particularly sensitive, such as information about your health, ethnicity or criminal history. We take extra care with this information and only collect it where it is necessary for a recruitment or placement purpose.

Depending on how you deal with us, we may collect:

• your name, contact details, date of birth and identity documents;
• your CV, work history, qualifications, skills and professional development records;
• your professional registration and practising certificate details, for example with the Medical Council of New Zealand, the Nursing Council of New Zealand or another responsible authority;
• your work rights, visa and immigration status;
• references and opinions about your work performance;
• results of competency assessments, aptitude tests and interviews;
• police vetting, criminal record check and other background check results, including safety checks required under the Children's Act 2014;
• health information relevant to your ability to safely carry out a role, such as immunisation status or reasonable adjustments you request;
• information about workplace incidents, complaints, investigations, or professional disciplinary matters that involve you;
• your job preferences, preferred locations and availability;
• information about how you use our website (see section 6); and
• for clients, the contact details of your staff and information about the roles you are recruiting for.

We will only collect information that is necessary for a lawful purpose connected with our recruitment services.

We collect most personal information directly from you, for example when you register or apply for a role through our website, send us your CV, speak with a consultant, attend an interview or complete a form.

We may also collect personal information about you from other sources (indirect collection), including:

• referees you nominate, and your current or former employers and colleagues;
• professional registration bodies and public registers;
• the New Zealand Police Vetting Service, the Ministry of Justice and other background check providers, with your authorisation;
• our clients, for example feedback about your performance in a placement;
• job boards and professional networking sites where you have made your profile available; and
• other Medfuture group companies, such as our Australian business, where you have dealt with them.

When we collect your personal information from someone other than you, we will take reasonable steps to tell you about it as required by IPP 3A, unless an exception under the Privacy Act applies (for example, where you already know about the collection). This policy forms part of that notice.

If you give us personal information about another person, such as a referee or emergency contact, please make sure they know you are sharing it and that they can read this policy.

We use personal information to:

• assess your suitability for roles and match you with work opportunities;
• present your application to prospective employers and arrange interviews and placements;
• carry out reference, registration, identity, work rights and background checks;
• manage placements, including onboarding, performance feedback and support;
• provide career guidance and identify training needs;
• manage and resolve complaints, enquiries, incidents or investigations;
• tell you about job opportunities, events and services that may interest you (see section 9);
• operate, secure and improve our website, systems and services; and
• meet our legal, regulatory and insurance obligations.

We will only use your information for another purpose if you agree, or if the Privacy Act otherwise allows it.

When you visit our website, we may collect technical information such as your IP address, browser type, pages visited and the time of your visit. We use cookies and similar technologies to keep the website working, remember your preferences and understand how visitors use the site, including through analytics tools such as [Google Analytics].

You can set your browser to refuse cookies, but some parts of the website, such as your candidate account, may not work properly. We do not use information about your individual website visits to identify you, except where you are logged into your account or have submitted a form.

If you create an account, you can review and update your profile details at any time by logging in.

We may share your personal information with:

• prospective and actual employers and clients, for the purpose of placing you in work;
• your referees and former employers, when we conduct reference checks;
• professional registration bodies and background check providers;
• other companies in the Medfuture group;
• our service providers, such as IT, hosting, applicant tracking, email and administrative support providers, who handle information on our behalf;
• our insurers and professional advisers;
• ACC, where relevant to a workplace injury; and
• government agencies, regulators or other parties where we are required or authorised by law.

We will not send your CV or application to an employer for a specific role without discussing it with you first. We do not sell your personal information.

Medfuture is part of a group with operations in Australia, and some of our service providers are located outside New Zealand. As a result, your personal information may be sent to, stored in or accessed from other countries, including Australia, [India, Sri Lanka, Bangladesh, Nepal, the United Kingdom, the United States, Canada, Ireland, Switzerland and Singapore].

Before we disclose personal information to an organisation overseas, we take reasonable steps to make sure it will be protected in a way that is comparable to the Privacy Act, as required by IPP 12. This usually includes contractual privacy and security obligations. Service providers that only store or process information on our behalf are not permitted to use it for their own purposes.

Please be aware that information held overseas may be subject to the laws of that country, which could require it to be disclosed to authorities there. If you have questions about overseas disclosure, please contact our Privacy Officer (see section 15).

We may send you job alerts, newsletters and information about our services by email, text or other electronic means where you have agreed to receive them or where it is otherwise permitted under the Unsolicited Electronic Messages Act 2007. Every marketing message will include a simple way to unsubscribe, and you can also contact us at any time to opt out.

You do not have to provide personal information to us. However, if you do not provide information we reasonably request, we may not be able to assess your suitability for roles, put you forward to employers or place you in work.

We hold personal information in secure electronic systems, including cloud-based systems, and in limited paper records. We take reasonable security safeguards to protect it from loss, unauthorised access, use, modification or disclosure, and other misuse. These include access controls, secure passwords, staff training and confidentiality obligations.

We keep personal information only for as long as we need it for the purposes described in this policy, or as required by law. When it is no longer needed, we securely destroy or de-identify it. If you close your account, we may keep some information where we are legally required to do so.

If a privacy breach occurs that has caused, or is likely to cause, serious harm to you, we will notify you and the Office of the Privacy Commissioner as soon as practicable, as required by the Privacy Act.

You have the right to ask for access to the personal information we hold about you, and to ask us to correct it if you think it is inaccurate, out of date, incomplete or misleading.

To make a request, contact our Privacy Officer using the details in section 15. You can make a request in any form, and we may ask you to verify your identity before we respond. We will respond as soon as reasonably practicable, and no later than 20 working days after we receive your request, unless the Privacy Act allows an extension, in which case we will let you know.

We do not charge for correction requests. We do not normally charge for access requests, but where the Privacy Act permits, we may charge a reasonable fee for providing information. We will tell you about any charge before proceeding.

In some cases, the Privacy Act allows us to refuse access, for example where providing the information would involve an unwarranted disclosure of another person's affairs or would breach confidentiality given to a referee. If we refuse access or decline to make a correction, we will explain why in writing and tell you about your right to complain to the Privacy Commissioner. If we do not correct your information, you can ask us to attach a statement of the correction you requested.

If you have a concern about how we have handled your personal information, please contact our Privacy Officer first so we can try to resolve it. We aim to acknowledge complaints within 10 working days and to respond in full within 30 working days. If a complaint is more complex, we will keep you updated.

If you are not satisfied with our response, you can make a complaint to the Office of the Privacy Commissioner:

• Website: www.privacy.org.nz
• Phone: 0800 803 909
• Post: Office of the Privacy Commissioner, PO Box 10094, Wellington 6143

We may update this policy from time to time, for example to reflect changes in the law or in how we operate. The current version will always be available on our website, with the date it took effect. If we make a significant change, we will take reasonable steps to let you know.