Meeting your Privacy Act 2020 obligations with ClientWell

If you hold client information in ClientWell, your practice is an agency under the Privacy Act 2020, and health information brings extra rules under the Health Information Privacy Code 2020. This article is practical guidance, not legal advice - for anything significant, talk to your professional body or a privacy advisor.

What ClientWell provides

• Controlled access. Every team member signs in with their own account and a scoped role. You can show who had access to a client's information, and remove someone the moment they leave.
• Storage security. Your workspace is isolated from every other practice at the database layer. Traffic is encrypted in transit and data at rest is encrypted by our infrastructure providers.
• Access and correction requests. When a client asks to see their information or fix something, open their page and you can view, edit and export the record yourself - no need to come to us first.
• Retention you control. Delete a client, session, note or campaign from the app at any time. For a full workspace deletion, email hello@myclientwell.com.
• No selling, no AI training. We never sell your data or your clients' information, and we do not use client records or Sage conversations to train third-party models.
• Breach help. If you think a privacy breach involves ClientWell, email security@myclientwell.com. We will help you establish what happened and what may need to be notified.

What stays with your practice

• Telling clients. You decide what you collect and what you tell clients about it. Most practices cover this in their intake form and privacy notice.
• Collecting only what you need. The Act asks you to limit collection to what the purpose requires - the intake form helps, but the judgement is yours.
• Notification duties. If a breach is likely to cause serious harm, the Privacy Commissioner's NotifyUs tool (privacy.org.nz) is the place to notify. We will help you assess any breach involving the platform.
• Your own devices and premises. Screen locks, disk encryption, anti-virus and a nominated Security Officer are practice-side controls. Our HISF security policy maps these out - email us for the latest copy.

A one-hour privacy check-up

1. Check your intake form collects only what you use.
2. Confirm every past team member has been removed from the workspace.
3. Make sure your clients know how to ask for their records.
4. Save security@myclientwell.com as your platform breach contact.
5. Request our HISF security policy and keep a copy with your practice records.