Privacy Policy

Effective date: 21 May 2026
Last reviewed: 21 May 2026

This privacy policy tells you how dentalholiday.nz collects, uses, discloses, stores, and protects your personal information and health information. It has been prepared to comply with the Privacy Act 2020 (New Zealand) and the Health Information Privacy Code 2020 (HIPC).

1. Who we are

This website is operated by Picasso Dental Clinic (“we”, “us”, “our”), a dental group headquartered in Vietnam.

Although Picasso Dental Clinic is based in Vietnam, we carry on business in New Zealand by targeting New Zealand residents, receiving their enquiries, and providing dental treatment services. The Privacy Act 2020 therefore applies to us as an overseas agency carrying on business in New Zealand.

2. Our Privacy Officer

Every agency subject to the Privacy Act 2020 is required to appoint a Privacy Officer. Our Privacy Officer is responsible for ensuring we comply with the Act, handling access and correction requests, and liaising with the Office of the Privacy Commissioner.

Contact our Privacy Officer:
Email: [email protected]
Subject line: “NZ Privacy — [your request]”

3. What personal information we collect

We collect the following categories of personal information from you when you interact with this website:

Contact and identity information

• Full name
• Email address
• Phone number (including country code)
• Country of residence

Clinical and health information (health information under the HIPC)

• Dental X-rays and OPG radiographs you upload
• Clinical photos of your teeth and gums
• Details of your dental condition, symptoms, or treatment history you share with us
• Quote and treatment correspondence that includes health details

Website usage information

• IP address and browser type (collected automatically via analytics)
• Pages visited and time spent on site
• Referral source (how you found us)
• Cookie identifiers (see Section 10 below)

We do not collect New Zealand Health Index (NHI) numbers or any other government-issued unique identifiers.

4. Health information — special obligations

Dental X-rays, clinical photos, and any information about your oral health are health information under the Health Information Privacy Code 2020. Health information attracts stronger protections than general personal information.

We treat all health information you share with us with heightened care, including:

• Storing it on secure, access-controlled systems
• Limiting access to clinical and patient-coordination staff only
• Not using it for any purpose other than preparing your dental quote and coordinating your care
• Not disclosing it to third parties outside your treatment team without your consent

5. Why we collect your information (purpose)

We collect personal information only for the following purposes:

1. Treatment quotation — to assess your dental needs and prepare a personalised NZD treatment quote
2. Appointment coordination — to arrange consultations and treatment visits at our Vietnam clinics
3. Aftercare and warranty support — to assist you following any treatment
4. Clinical care — to provide safe, informed dental treatment
5. Website improvement — to understand how visitors use this site and improve the content (analytics data only)
6. Communications — to respond to your enquiries via email

We will not use your information for marketing or any secondary purpose without your separate, explicit consent.

6. How we collect your information

We collect information:

• Directly from you when you submit the free-quote form, contact form, or any other form on this website
• From our communications with you via email
• Automatically via website analytics tools when you browse this site (see Section 10)

When health information is collected (such as when you upload X-rays or clinical photos), we are required by the Health Information Privacy Code 2020 to tell you:

• What health information is being collected
• Why it is being collected
• Who will receive it (including that it will be sent to Vietnam — see Section 7)
• That providing health information is voluntary
• That without it, we may not be able to prepare an accurate quote
• Your rights to access and correct your information (see Section 9)

This notice is provided on each form at the point of collection.

7. Transfer of your information to Vietnam

Your information — including health information — is transferred to and stored by Picasso Dental Clinic in Vietnam for treatment planning and coordination.

What this means for you under New Zealand law:

Information Privacy Principle 12 of the Privacy Act 2020 requires us to ensure your information receives comparable protections when transferred overseas. Vietnam’s Personal Data Protection Law took effect on 1 January 2026, but the New Zealand Privacy Commissioner has not formally assessed whether it provides protections comparable to those available under the Privacy Act 2020.

We address this in two ways:

Contractual safeguards: We operate internal data-sharing agreements between the website operator and our Vietnamese clinics that require the handling of New Zealand patient data to meet Privacy Act 2020 standards.

Your informed consent: By submitting an enquiry form on this website, you acknowledge that your personal information and health information will be transferred to Vietnam, and that Vietnam’s laws may not provide protections equivalent to those available to you in New Zealand. You consent to this transfer.

If you do not wish your information to be transferred to Vietnam, do not submit your information via this website.

8. How we share your information

We do not sell your personal information. We may disclose your information only in the following circumstances:

We require all third-party service providers to handle your information in accordance with the Privacy Act 2020 and, where applicable, the Health Information Privacy Code 2020.

9. Your rights

Under the Privacy Act 2020 and the Health Information Privacy Code 2020, you have the following rights:

Right of access (IPP 6)
You may ask us whether we hold personal information about you and request a copy. We will respond within 20 working days. In limited circumstances we may decline access (for example, where disclosure would be a serious threat to health or safety), in which case we will explain our reasons.

Right of correction (IPP 7)
If you believe any information we hold about you is inaccurate, incomplete, or misleading, you may request a correction. If we agree, we will correct the information. If we disagree, we will attach a note of your requested correction to the record and, where applicable, notify anyone to whom the incorrect information was previously disclosed.

How to exercise your rights
Contact our Privacy Officer at [email protected] with the subject line “NZ Privacy — Access Request” or “NZ Privacy — Correction Request.” We may need to verify your identity before processing your request.

10. Cookies and website analytics

This website uses analytics tools to understand how visitors use the site. These tools may collect:

• Your IP address (which may be personal information if it can be linked to you)
• Pages visited, time on site, and browser/device type
• Referring website or search query

Google Analytics: We use Google Analytics to measure website traffic. Google Analytics uses cookies and may transfer data to Google’s servers in the United States. You can opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on.

We do not use advertising or retargeting cookies. We do not build behavioural profiles for advertising purposes.

You can disable cookies in your browser settings. Disabling cookies will not prevent you from using the website, but some features may behave differently.

11. Storage and security

We take reasonable technical and organisational steps to protect your personal information and health information from loss, misuse, unauthorised access, and disclosure, including:

• Encrypted storage for clinical images and health records
• Access controls limiting information to authorised clinical and coordination staff
• Confidentiality agreements with staff who access patient information
• Secure disposal of information when retention periods expire

No internet transmission is completely secure. While we take reasonable precautions, we cannot guarantee the security of information transmitted to us over the internet.

12. Retention

Health information (X-rays, clinical photos, treatment records): We retain health information for a minimum of 10 years from the date of last service, as required by the Health (Retention of Health Information) Regulations 1996. For patients who were under 16 at the time of treatment, records are retained until the patient’s 26th birthday, or 10 years from the last service date, whichever is later.

Enquiry information (no treatment): If you enquire but do not proceed with treatment, we retain your enquiry details for up to 2 years, after which they are securely deleted.

Analytics data: Aggregated analytics data is retained as configured in our analytics provider settings (typically 26 months for Google Analytics).

When retention periods expire, information is securely deleted or destroyed.

13. Privacy breach notification

If we experience a privacy breach that is likely to cause you serious harm, we are required by the Privacy Act 2020 to:

1. Notify the Office of the Privacy Commissioner as soon as practicable
2. Notify affected individuals directly

We maintain an internal privacy breach response process. If you believe your personal information has been compromised as a result of dealing with us, please contact our Privacy Officer immediately at [email protected].

14. How to make a privacy complaint

If you have a concern about how we have handled your personal information:

Step 1 — Contact us first
Email our Privacy Officer at [email protected] with “NZ Privacy Complaint” in the subject line. We aim to acknowledge your complaint within 5 working days and to resolve it within 20 working days.

Step 2 — Contact the Office of the Privacy Commissioner
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (OPC):

• Website: privacy.org.nz
• Phone: 0800 803 909 (NZ)
• Post: PO Box 10094, Wellington 6143, New Zealand

If conciliation through the OPC does not resolve the matter, you may take your complaint to the Human Rights Review Tribunal.

15. Children’s information

This website is not directed at children under the age of 16. If you are under 16, please have a parent or guardian contact us on your behalf. We do not knowingly collect personal information from children without parental consent.

16. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last reviewed” date at the top of this page. We encourage you to review this policy periodically.

If you have questions about this policy, please contact our Privacy Officer at [email protected].