This article is for PatientNotes users who practise in New Zealand. It explains what you are legally required to tell patients about AI-assisted clinical documentation, and gives you ready-to-use language you can copy directly into your intake forms, practice website, and verbal workflows.

The Privacy Amendment Act 2025 introduced a new Information Privacy Principle — IPP3A — which came into force on 1 May 2026. It applies to all personal information collected on or after that date.

IPP3A requires any agency (including a healthcare clinic) that collects personal information indirectly — meaning not directly from the patient themselves — to notify the patient about how that information is being processed. Because PatientNotes processes the content of a clinical consultation to generate documentation, this obligation applies to your practice.

The regulatory baseline is the Health Information Privacy Code 2020 (HIPC 2020), administered by the Office of the Privacy Commissioner. The Privacy Commissioner updated the HIPC in March 2026 to reflect the IPP3A requirements.

⚠️ Key rule: Identifiable patient health information cannot be entered into a generic generative AI tool. PatientNotes is purpose-built for healthcare, operates under a Data Processing Agreement, and stores data in accordance with HIPC 2020. However, you must still notify your patients that AI is used in your documentation workflow.

Patients must be told that their consultation will be processed by an AI documentation tool. This does not need to be technically detailed — plain language is sufficient and preferred.

Patients should understand that audio from the consultation (or a transcript of it) is used to generate a clinical note, and that the note is reviewed by their treating clinician before being stored in their health record.

Patients have the right to decline AI-assisted documentation. If a patient opts out, the clinician should document the session manually. You are not required to provide an explanation of why you use AI, but you must not pressure patients to accept it.

Copy any of the following into your practice intake forms, booking confirmation emails, or patient information sheets. Customise the clinic name and clinician title as needed.

[Clinic Name] uses PatientNotes, an AI-assisted clinical documentation tool, to help create accurate records of your consultations. Your consultation audio is processed by PatientNotes to generate a draft clinical note, which your clinician reviews and approves before it is saved to your health record. No identifiable health information is shared with third parties for advertising or commercial purposes.

If you prefer that AI is not used in documenting your consultation, please let your clinician know before your appointment begins. Your care will not be affected by your choice.

For questions about how your health information is handled, please contact us at [practice email] or refer to our Privacy Policy at [practice website/privacy].

AI-assisted clinical documentation

We use PatientNotes (patientnotes.app), a purpose-built AI clinical documentation platform, to assist in creating clinical records of your consultations. During or immediately following your appointment, audio from your consultation is securely transmitted to PatientNotes, which generates a structured clinical note. Your treating clinician reviews and edits the note before it is stored in your health record — the AI does not make clinical decisions and the note is not final until your clinician approves it.

PatientNotes operates under a Data Processing Agreement with our practice and handles your health information in accordance with the Health Information Privacy Code 2020 (HIPC 2020) and the Privacy Act 2020. Your data is not used to train AI models, is not shared with third parties for commercial purposes, and is deleted from the PatientNotes system within 30 days of your session.

You have the right to decline AI-assisted documentation. Please notify your clinician or our reception team before your appointment if you prefer your notes to be recorded manually. This will not affect your access to care or the quality of the clinical service you receive.

If you have questions about how your information is managed, please contact our Privacy Officer at [contact email].

We use AI to help with clinical notes

Our clinicians use PatientNotes — an AI tool — to help document your consultation. Your clinician reviews every note before it is saved. Your information is handled in accordance with the Health Information Privacy Code 2020.

If you prefer not to have AI used during your consultation, please let us know at reception before your appointment. This will not affect your care.

You may also wish to obtain verbal consent at the start of a new patient's first consultation. Here is a suggested script:

"Before we start, I just want to let you know that I use a tool called PatientNotes to help me document our consultation. It listens to our session and generates a draft note that I review and finalise. Your information is kept securely and isn't shared outside our practice. Are you happy to proceed on that basis? And if at any point you'd prefer I document manually, just let me know."

A patient's verbal agreement is sufficient. You do not need a signed consent form solely for the use of a documentation tool, but written disclosure (Option A or B above) is best practice and provides a clear record.

PatientNotes infrastructure is hosted in Australia (AWS ap-southeast-2). Under HIPC 2020, storing health information overseas is permissible provided the overseas provider offers comparable privacy protections and the arrangement is disclosed. PatientNotes operates under a Data Processing Agreement that meets these requirements. If you are asked by a patient, you can confirm their data is stored in Australia under equivalent privacy protections.

Not solely for AI documentation. Written or verbal disclosure is sufficient under IPP3A, provided patients have a genuine opportunity to opt out. Including the disclosure language in your intake paperwork (Option A or B) is the simplest way to demonstrate compliance if a complaint is ever made.

Requests for access to or deletion of information held in PatientNotes should be directed to our support team at [email protected]. Requests relating to records stored in your practice management system are handled by your practice in the usual way.

PatientNotes is not on the Te Whatu Ora NAIAEAG endorsement list, which is specific to tools operating within the public health system. Private allied health clinics are governed by HIPC 2020 directly, not by Te Whatu Ora endorsement requirements. PatientNotes complies with HIPC 2020, holds ISO 27001-aligned security policies, and operates under Data Processing Agreements with subscribing clinics.

No. Your integration with Cliniko or Nookal does not change your disclosure obligations under IPP3A. The consent and disclosure language above covers the PatientNotes processing step, which is separate from your practice management system.

If you have questions about compliance, data handling, or would like a copy of the PatientNotes Data Processing Agreement for your records, contact our support team via the chat below or at [email protected].