Last updated: October 2026
SAFERsleep (“SAFERsleep”, “we”, “us”, “our”) develops clinical software used by hospitals and other health providers, including SAFERsleep PREOP, OR, Recovery, ACUTE Pain and Maternity. We take the privacy of patients, clinicians and everyone we deal with seriously. This policy explains how we collect, use, store, disclose and protect personal information, including health information, and how you can contact us about it.
1. The laws we follow
In New Zealand we comply with the Privacy Act 2020 and the Health Information Privacy Code 2020 (HIPC), which sets thirteen rules for how health information about identifiable individuals is collected, held, used and disclosed, including rule 3A on collecting health information from someone other than the individual. Where we work with health providers in other countries we also follow the privacy and health-information laws that apply there. In the United Kingdom this includes the UK General Data Protection Regulation, the Data Protection Act 2018 and the common law duty of confidentiality that applies to patient information.
2. Our two roles
Health information in our software: we act for the health provider
Patient health information recorded in SAFERsleep software (for example anaesthetic records, drug administrations, vital signs, assessments and pain-management records) belongs to and is controlled by the hospital or health provider using the software. We hold or access that information only on the provider’s behalf, to supply, host, maintain and support the software. Under New Zealand law we act as the provider’s agent, and under UK law as a data processor. The health provider remains responsible for that information, and its own privacy policy explains how it uses it.
If you are a patient and want to see, correct or ask about your health record, please contact the hospital or health provider that treated you. If you contact us, we will refer your request to them and help them respond.
Information we collect for our own purposes
We also collect a limited amount of personal information for running our own business, such as the details of people who visit this website, contact us, or work for our clients and suppliers. For that information, SAFERsleep is responsible.
3. How we handle health information
When we host, support or maintain SAFERsleep software for a health provider, we:
- use health information only to provide, support and improve the service the provider has engaged us for, and as the provider instructs;
- access patient information only when needed for a specific support or maintenance task, with the provider’s authorisation, and limit access to authorised staff;
- never sell health information, use it for marketing, or use it for our own purposes;
- use de-identified or synthetic data for development and testing wherever possible;
- require our staff and contractors to keep health information confidential;
- return or securely destroy health information at the end of an engagement, as agreed with the provider and as the law allows.
Depending on the provider’s choice, SAFERsleep systems are installed on the provider’s own servers or hosted for them in a secure data centre in the provider’s own country. Health providers are responsible for how long patient records are kept. In New Zealand the Health (Retention of Health Information) Regulations 1996 generally require health information to be kept for at least ten years.
4. Personal information we collect about you
- When you contact us through our website form, by email or by phone: your name, email address, organisation, and anything you tell us in your message.
- Client and supplier contacts: names, job titles, work contact details and records of our dealings with you.
- Software users: when clinicians and staff use SAFERsleep software, the system records user names and activity (for example who recorded or changed an entry) for clinical safety and audit. This forms part of the provider’s records.
- Website use: technical information such as your IP address, browser type, the pages you visit and how you arrived at our site. See section 9 on cookies.
We collect this information directly from you where we can. We use it to respond to enquiries, provide demonstrations, supply and support our products, manage our client and supplier relationships, keep our systems secure, meet our legal obligations and improve our website and services. We do not sell personal information.
5. Who we share information with
We only disclose personal information where the law allows, for example:
- to the health provider on whose behalf we hold it;
- to trusted service providers who help us run our business (such as hosting, email, IT support, website analytics and spam protection), who must protect the information and use it only for the services they provide to us;
- where you have agreed;
- where required or authorised by law, or where needed to prevent or lessen a serious threat to someone’s health or safety.
6. Information sent overseas
We operate in New Zealand and the United Kingdom. Some of our service providers, such as email, cloud and website analytics providers, may store information in other countries. Where personal information is disclosed overseas, we take reasonable steps to make sure it will be protected to standards comparable to New Zealand and, where applicable, UK law. Patient health information in our software is kept in the provider’s own country unless the provider agrees otherwise.
7. Keeping information secure
We protect personal and health information with physical, technical and organisational safeguards. These include an information security management system aligned to ISO/IEC 27001, role-based access controls, multi-factor authentication, encryption, network separation, logging and monitoring of access, staff training and confidentiality obligations. We keep personal information only for as long as we need it for the purposes above, or as the law requires, and then securely destroy or de-identify it.
8. Privacy breaches
If we become aware of a privacy breach affecting information we hold for a health provider, we will tell that provider promptly and help them assess and respond to it. Where a breach of information we are responsible for is likely to cause serious harm, we will notify the affected people and the Office of the Privacy Commissioner in New Zealand, or the Information Commissioner’s Office in the UK, as the law requires.
9. Cookies and website analytics
Our website uses cookies and similar technologies to make the site work, to understand how it is used (Google Analytics) and to protect our contact form from spam (Google reCAPTCHA and Akismet). These services may collect your IP address and information about your device and browser. You can block or delete cookies in your browser settings; some parts of the site may not work properly if you do. Our website does not collect health information, so please do not send us patient information through the contact form or by email.
10. Your rights
You have the right to ask for access to the personal information we hold about you and to ask us to correct it. Depending on where you live, you may also have other rights, such as asking us to delete or restrict use of your information, or objecting to how we use it. We will respond within the time the law requires (in New Zealand, within 20 working days). We may need to confirm your identity first. Requests about patient health records will be passed to the health provider responsible for them.
11. Contact us and complaints
If you have a question or concern about privacy, or want to make a request or complaint, please contact our Privacy Officer:
Privacy Officer, SAFERsleep
Unit G, 5 Orbit Drive, Rosedale 0632, Auckland, New Zealand
Email: privacy@safersleep.com
We will acknowledge your complaint and try to resolve it promptly. If you are not satisfied with our response, you can complain to:
- New Zealand: the Office of the Privacy Commissioner, www.privacy.org.nz, 0800 803 909
- United Kingdom: the Information Commissioner’s Office, ico.org.uk, 0303 123 1113
12. Changes to this policy
We may update this policy from time to time. The current version is always available on this page, with the date it was last updated.