--- title: "Privacy Policy | Xia" canonical_url: "https://xia.co.nz/privacy-policy" last_updated: "2026-10-28T03:07:43.586Z" meta: description: "How Xia collects, uses and protects personal and patient information." "og:description": "How Xia collects, uses and protects personal and patient information." "og:title": "Privacy Policy" --- **Legal ** # **Privacy Policy** Last updated: 28 October 2026 This Privacy Policy explains how Guillaume Pacquet trading as Xia ("Xia", "we", "us" or "our") collects, holds, uses and protects personal information in connection with the Xia clinic management software, website and related services. We are committed to handling personal information in accordance with the Privacy Act 2020 and, where applicable, the Health Information Privacy Code 2020. ## 1. Xia and patient information Xia provides clinic management software to healthcare practitioners and clinics. Clinics using Xia may store personal and health information about their patients within the Xia service, including patient details, appointment information and clinical records. Where Xia stores or processes patient information on behalf of a clinic, the clinic remains responsible for its relationship with the patient and for collecting and using that information lawfully. Xia stores and processes that information as a service provider to the clinic. Xia does not use patient information for advertising, marketing or other purposes unrelated to providing the Xia service. We do not sell personal or patient information. ## 2. Information we collect about Xia customers and users When you create or use a Xia account, we may collect information including: - your name; - email address, phone number and other contact information; - clinic or business name and contact details; - practitioner and staff information; - professional or business information you provide to us; - account settings and user permissions; - subscription and billing information; - records of communications with Xia, including support requests; - information you provide when participating in trials, promotions or events; and - other information you choose to provide to us. Some information is required in order for us to create and operate your account or provide a paid subscription. If required information is not provided, we may not be able to provide some or all of the Xia service. ## 3. Patient and clinical information stored in Xia Information entered into Xia by clinics may include: - patient names and contact details; - demographic information; - appointment and booking information; - health information; - clinical notes; - treatment information; - ACC-related information; - documents or records uploaded by the clinic; and - other information entered by an authorised user of the clinic. This information belongs to and is controlled by the clinic using Xia, subject to the rights patients have under New Zealand law. Xia will only use or disclose patient information as necessary to provide, operate, secure and support the Xia service, where authorised by the clinic, or where required by law. ## 4. Technical and usage information When you access Xia or our website, we may automatically collect technical information such as: - IP address; - browser and device information; - login and authentication information; - activity and security logs; - error and diagnostic information; and - information about how the Xia service is used. We may use cookies or similar technologies where necessary to operate the website and Xia service, maintain sessions, remember preferences, provide security and understand how our services are being used. ## 5. How we collect information We may collect personal information: - directly from you when you create an account, communicate with us or use Xia; - from another authorised user within your clinic or organisation; - automatically when you use our website or software; - from service providers involved in operating Xia; and - from clinics when they enter patient or other information into Xia. ## 6. How we use personal information We may use personal information about Xia customers and users to: - create and manage Xia accounts; - provide and operate the Xia service; - manage subscriptions and payments; - provide customer support; - communicate with you about your account or the service; - send service-related notifications; - provide information about Xia products, features or offers where appropriate; - maintain the security and integrity of Xia; - prevent or investigate misuse, fraud or security incidents; - monitor, maintain and improve the performance of Xia; - meet our legal and regulatory obligations; and - administer our business. We will not use personal information for a purpose that is unrelated to the purpose for which it was collected unless permitted by law. ## 7. Service providers and third-party services We use third-party providers to help operate Xia. These may include providers of: - hosting and infrastructure; - payment processing; - email and messaging services; - monitoring, security and error reporting; - customer support and business administration; and - other technology services required to operate Xia. We only provide these service providers with information reasonably necessary for them to perform the relevant service. Xia may also integrate with third-party services selected or used by a clinic, such as Stripe. Information shared through those integrations may also be subject to the third party's privacy policy and terms. We do not sell personal information to third parties. ## 8. Information processed outside New Zealand Some technology or service providers used by Xia may operate or process information outside New Zealand. Where personal information is processed using overseas service providers, we will take reasonable steps to ensure that appropriate privacy and security protections are in place and that our use of those providers complies with applicable New Zealand privacy requirements. ## 9. Security We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, use, modification or disclosure. These measures may include: - encryption; - access controls; - authentication controls; - multi-factor authentication; - logging and monitoring; - backups; - infrastructure and network security; and - restrictions on access to personal and health information. No internet-based service can guarantee absolute security, but we regularly consider the security measures appropriate to the nature and sensitivity of the information held within Xia. ## 10. Privacy and security incidents If we become aware of a privacy or security incident affecting information held within Xia, we will investigate the incident and take reasonable steps to contain and address it. Where Customer Data belonging to a clinic is affected, we will notify the affected clinic without undue delay where notification is reasonably required and provide information reasonably necessary to assist the clinic in meeting its privacy obligations. Where Xia is responsible for notifying the Privacy Commissioner or affected individuals under the Privacy Act 2020, we will do so as required by law. ## 11. How long we keep information We retain personal information only for as long as it is reasonably required for the purpose for which it was collected or where retention is required by law. ### Customer Data When a Xia subscription is cancelled, the customer may request an export of their Customer Data before cancellation takes effect or during the 30 days following cancellation. Within 30 days after cancellation takes effect, Customer Data will be permanently deleted from Xia's active systems and backups and will no longer be recoverable. We will only retain Customer Data beyond this period where we are legally required, or legally prohibited from deleting particular information. Any information retained for this reason will be kept only for as long as required. ### Xia business records We may retain Xia's own business records, including subscription, invoice, payment, accounting and transaction records, for as long as reasonably required for our business or legal obligations. ## 12. Accessing or correcting your information You have the right to request access to personal information Xia holds about you and to ask for it to be corrected if you believe it is inaccurate. If you are a Xia customer or user and want to access or correct information Xia holds about you, contact us at support@xia.co.nz. If you are a patient seeking access to or correction of your clinical or health information stored within Xia, you should normally contact the clinic or healthcare practitioner responsible for your care. Xia will reasonably assist the clinic in responding to requests relating to information we store on its behalf. ## 13. Communications and marketing We may contact Xia customers and users about matters relating to their account, subscription, security or operation of the service. We may also send information about Xia, including new features, product updates or offers. Where required, you can unsubscribe from marketing communications using the unsubscribe option provided. Unsubscribing from marketing communications will not prevent us from sending important account, security or service-related messages. ## 14. Changes to this Privacy Policy We may update this Privacy Policy from time to time to reflect changes to Xia, our business practices, technology or applicable law. The current version will be made available through our website or Xia service. Where a change materially affects how we collect, use or disclose personal information, we will take reasonable steps to notify affected users. ## 15. Contact us If you have a question, concern, access or correction request, or wish to raise a privacy issue, contact: Xia Support [support@xia.co.nz](mailto:support@xia.co.nz) NZBN: 9429052859724 You may also make a complaint to the Office of the Privacy Commissioner if you believe your privacy rights have been breached.