The Institute of Environmental Science and Research Limited (“ESR” or “we”) has multiple roles in the pandemic response. Two of these roles involve ESR:
- operating a national clinical data repository, called Éclair, on behalf of the Ministry of Health, to collect and maintain all positive and negative COVID-19 test results. Information collected and processed includes personal information relating to individuals. This information is used to support the Ministry of Health, District Health Boards and Public Health Units in monitoring and managing the prevalence of COVID-19; and
- using Éclair to provide an electronic ordering solution of COVID-19 tests, including the automated distribution of test orders and results designed to assist laboratories to quickly process test results.
This privacy statement sets out how your personal and health information is collected, used, disclosed and protected by ESR (acting as agent on behalf of the Ministry of Health) when you undergo a COVID-19 test, as well as how you can access and correct any personal information we hold about you.
ESR works with a number of laboratories around the country who undertake the physical testing for COVID-19. ESR plays a key co-ordination role in how the testing is undertaken and the information is recorded as part of the testing.
You should also consult the laboratory that completed your test for their specific Privacy Statement which will set out how they manage and distribute the data they hold.
Collecting your information
The following personal and health information about you will be provided by you directly to either your GP, a hospital staff member, a managed isolation quarantine facility staff member or a community testing staff member when you request a test. This information will be securely entered by that person into ESR’s Éclair database:
- Your full name, NHI number, recent travel, contact history, surveillance code, symptoms, clinician responsible for order, assessment date, mobile phone number, date mobile number was validated, whether to notify patient of negative result, occupation, employer and workplace address.
- If you have requested a test via a community testing centre, that centre may record the first three letters of your car’s license plate so that we can locate your electronic order quickly.
- If you have a test at a MIQ facility, your date of isolation, room number, whether you are displaying COVID-19 symptoms and whether you are confined to your room will be recorded.
- The laboratory processing your test will collect your NHI number, email address, mobile phone number, test status and test result.
Your patient National Health Index (“NHI”) number and associated data including your full name, current address, email address, phone numbers, date of birth, place of birth, mother’s birth name, residency and citizenship details, ethnicity, language, gender, and usual GP clinic has been securely provided to us by the Ministry of Health and will be linked to the personal information you have provided in our Éclair database. This information is only used for the purposes set out below.
Your test result will be generated as part of the testing process and will be linked to your personal details in our Éclair database.
Your information is collected to enable us and other agencies (please see below) to identify and contact you about your test, and for public health purposes.
How do we use your personal information?
We collect your personal and health information in order to:
- Provide information to the laboratory completing your test
- Identify you so that you can receive your test result
- Provide your information to other government agencies supporting the COVID-19 response – please see the next section below
- Provide information to other health agencies – please see the next section below.
Your personal and health information may be used to:
- Inform New Zealand’s overall response to COVID-19.
- Identity, monitor, and manage COVID-19 clusters.
- Facilitate effective contact tracing.
- Support the Border Workforce Testing Register.
- Provide COVID-19 updates to the public.
Where personal information is not required to be shared for these purposes, it will be either de-identified, anonymised or aggregated.
Who receives my information?
- We provide the test request information to the laboratory or laboratories that process your test. Note that multiple laboratories could receive your information
- We send your information to the Ministry of Health, Public Health Units and data and analytical teams within the district health board (“DHB”) where the test was undertaken
- We may send your results to your enrolled general practice and your GP
- Your information may be accessed by our staff who have a need to know such information and are subject to strict security and confidentiality requirements.
We take our role as a custodian of health information seriously and know that privacy is an important component of consumer and provider trust in our services.
How do we store your personal and health information?
We keep your personal information safe by only allowing authorised staff to access it. Your information is only shared for the reasons set out above.
How can you access and/or correct your personal information?
You have the right to access and correct your personal information. Please send an email to the Ministry of Health at information@health.govt.nz if you wish to access or correct the personal information we hold about you (and the Ministry of Health will notify us accordingly of any required changes).
How long do we keep your personal information?
We only keep your personal information for as long as we require it, as agreed with the Ministry of Health. Sometimes this requirement will be mandated by law.
How can you make a privacy related complaint?
If you have any concerns about the way we’ve collected, used or shared your health information, or you think we have refused a request for information wrongly, then please let the Ministry of Health know and we’ll try our best to resolve your query. Please email the Ministry of Health at security@health.govt.nz.
If we can’t resolve your concerns, you can also make a complaint to the Office of the Privacy Commissioner by:
- completing an online complaint form at www.privacy.org.nz(external link)
- writing to the Office of the Privacy Commissioner, PO Box 10-094, The Terrace, Wellington 6143
Changes to this privacy statement
We may update this privacy statement from time to time, to reflect changes to privacy law or our business operations. Any such changes will be posted here. We recommend that you check back to see any updates or changes. This privacy statement was last updated as of 3 August 2021.