AI records and privacy for NZ private businesses
Good records can help a business investigate an interaction, respond to a customer, and apply its own privacy and operational processes. They do not replace legal advice or make a product automatically compliant.
Start with the business process
Before using AI with personal information, define what information is collected, why it is needed, who can access it, and how a person can ask for access or correction. AliceHQ is designed to create timestamped operational records of configured interactions so a business can review what happened. The business remains responsible for its own privacy, customer-service, and clinical processes.
Private-sector health information
The Health Information Privacy Code 2020 applies to health information handled by health agencies in New Zealand. It covers the information lifecycle, including collection, security, use, access, correction, retention, and disclosure. It does not impose a blanket New Zealand data-residency requirement on private clinics.
A clinic should assess its own arrangement, including its patient notice, security controls, retention practices, incident process, and contracts with service providers. For a health use case, obtain legal advice on the facts of the specific arrangement.
Third-party processors and offshore services
Under section 11 of the Privacy Act 2020, a provider that stores or processes personal information solely on another agency's behalf is generally treated as holding it for that agency. That position depends on the provider not using or disclosing the information for its own purposes. Location alone does not decide the privacy analysis.
Businesses should review provider terms, including data use for training or product improvement, sub-processors, security commitments, deletion, breach notification, and contractual safeguards.
What operational records can do
A timestamped record can help a business reconstruct what was captured, routed, or written during a configured workflow. That may support internal review and customer follow-up. It is not a substitute for appropriate human oversight, a privacy impact assessment, or legal advice, and AliceHQ does not certify a customer's compliance.
Primary sources
- Health Information Privacy Code 2020
- Privacy Act 2020
- Office of the Privacy Commissioner: third-party providers
This is general information, not legal advice. Discuss your own circumstances with qualified counsel.