Privacy Policy

Rose Optometry — store.roseoptom.co.nz Last updated: 19 August 2026

Our commitment in plain language

Rose Optometry has cared for Waikato eyes for over 50 years. Your trust is the foundation of that relationship, and this policy is written to earn it. In short:

• We collect only what we need to look after your eyes, supply your products and improve our service.
• Your health information is treated as health information — always — under the Health Information Privacy Code 2020.
• We use data, including AI-assisted tools, to make our care more personal and our service faster, and we tell you exactly how.
• You are in control. You can opt out of marketing, personalisation, AI-assisted analysis and research use at any time, without it affecting your clinical care. See section 10, Your Privacy Choices.
• We never sell your personal information.

Visique Rose Optometrists Limited, trading as Rose Optometry (NZBN 9429050762033) ("Rose Optometry", "we", "us", "our"), operates the online store at store.roseoptom.co.nz (the "Store") and the practice at 38 Lake Road, Frankton, Hamilton. This policy applies to the Store, our website, our patient communications and any app, kiosk or device we provide. It works alongside the Practice Privacy Statement you receive when you become a patient.

We comply with the Privacy Act 2020, the Health Information Privacy Code 2020 (HIPC), the Health Act 1956, the Health (Retention of Health Information) Regulations 1996, the Unsolicited Electronic Messages Act 2007, the Code of Health and Disability Services Consumers' Rights, and the Health Information Security Framework (HISO 10029) published by Health New Zealand | Te Whatu Ora, which sets the security standards we apply to health information.

1. Information we collect

Identity and contact. Name, date of birth, email, phone, billing and shipping addresses, NHI number where required for clinical or funded care, emergency contact, and communication preferences.

Health and clinical. Spectacle and contact lens prescriptions, pupillary distance, ocular measurements, eye-health history, medications, allergies, imaging (such as retinal photographs and OCT scans), test results, clinical notes, and the outcomes of care. Through the Store this is generally limited to what is needed to supply prescription products safely.

Purchase and account. Orders, products viewed and purchased, frames and lens choices, subscriptions (e.g. contact lens auto-replenishment), warranties, returns, payment method and transaction history. Card details are handled by PCI-DSS compliant payment providers; we never see your full card number.

Technical and behavioural. IP address, device and browser type, approximate location, pages and products viewed, time on site, referral source, search terms, cart activity, email opens and clicks, and interactions with our website, Store, booking system, chat tools and SMS/email. Collected via cookies, pixels, SDKs and server logs (section 8).

Communications. Emails, messages, chat transcripts, phone call notes, reviews, survey responses, and, where you are told in advance, recordings of phone or video consultations.

Information from others. Your GP, ophthalmologist or other health providers (with your consent or as permitted by HIPC), Health New Zealand and ACC where care is funded, our laboratories and suppliers, payment and fraud-screening providers, delivery partners, and publicly available sources. If you use Apple Pay, Google Pay, Shop Pay, Afterpay or similar, we receive the information those services provide to complete the transaction.

Inferred information. From the above we may derive insights — for example, that you are likely due for a recall, that you prefer a particular frame style, or that a product may be suitable for you. Inferences about your health are always treated as health information.

2. Why we collect it and how we use it

We only use health information for purposes connected with the purpose for which it was collected, or with your authorisation, or where HIPC otherwise permits (for example, to prevent a serious threat to health or safety, or where required by law).

3. Marketing: how it works and your choices

We want to keep you informed about eye health and the products and services that can help you, and a well-run practice needs to grow to keep investing in care and technology. So, with your consent (or, for existing customers, unless you opt out), we may:

• Email or text you about offers, new ranges, recalls, eye-health tips, events and loyalty benefits.
• Personalise the content and timing of those messages based on your purchases, browsing and preferences.
• Use your email address or phone number, in hashed (scrambled) form, to build custom or lookalike audiences and measure ads on platforms such as Meta, Google and TikTok. Those platforms do not receive your clinical information.
• Invite you to review us or refer friends.

We will not:

• Use your clinical diagnosis to target you with third-party advertising.
• Share your health information with advertisers or data brokers.
• Send marketing to anyone under 16 without a parent or guardian's consent.
• Send you marketing you have opted out of.

Every marketing email and SMS includes an unsubscribe link or STOP instruction, and you can change your preferences at any time (section 10). Opting out of marketing never affects your clinical care or transactional messages such as appointment reminders and order updates.

4. AI and automated tools

We use artificial intelligence and machine-learning tools to help our team work faster and to make your experience better. We want to be specific about what that means.

What we use AI for

• Clinical support. Tools that help our optometrists analyse imaging (e.g. retinal or OCT scans), flag findings for review, and assist with clinical documentation. These tools assist; a registered optometrist always makes the clinical decision and remains accountable for your care.
• Service and communications. Drafting and personalising emails, reminders and recalls; answering routine questions through chat or messaging tools; transcribing and summarising consultations (only where you have been told and have not objected); triaging enquiries so urgent matters reach a clinician faster.
• Store and recommendations. Suggesting lenses, frames, contact lenses and care products suited to your prescription, face measurements and preferences; virtual try-on; search and ranking.
• Operations and growth. Forecasting demand and stock, scheduling, detecting fraud and security threats, analysing de-identified trends, and measuring marketing performance.

Our AI principles

1. Human accountability. No decision that has a legal or similarly significant effect on you — including any clinical decision — is made solely by an automated system. You can always ask for a person to review an AI-assisted outcome.
2. Minimum data. We give AI tools the least information needed for the task. Wherever practical we use de-identified or aggregated data.
3. No training on your identifiable health information without consent. We do not allow third-party AI providers to train their general models on your identifiable personal or health information. Where we use a provider's AI service, we use business or enterprise terms that prohibit training on our data. If we ever wish to use identifiable health information to train or fine-tune a model of our own, we will ask for your explicit opt-in consent first.
4. Security. AI tools that touch health information must meet the same security standards as our clinical systems (HISO 10029) and are assessed before use.
5. Transparency. We will tell you when you are interacting with an automated assistant rather than a person, and when an AI tool has materially contributed to a recommendation made to you.
6. Your choice. You can opt out of AI-assisted personalisation, AI-assisted communications and the use of your data to improve our AI tools (section 10). Opting out may mean some features (like virtual try-on or tailored recommendations) are unavailable, but it will not affect your clinical care.

5. Research and the New Zealand Eye Research Centre

Rose Optometry supports eye-health research, including through the New Zealand Eye Research Centre (NZERC). Research helps us — and the profession — detect disease earlier and treat it better.

• Most research uses de-identified data (data that cannot reasonably identify you). De-identified data is not personal information under the Privacy Act, but we still apply strict controls to it.
• Any research that uses your identifiable health information will happen only with your explicit, informed consent, and where required, approval from a Health and Disability Ethics Committee.
• You may be invited to take part in studies. Taking part is always voluntary, and you can withdraw at any time.
• You can opt out of having even de-identified data drawn from your records used for research, and we will honour that going forward (section 10).

6. Who we share information with

We share personal information only as described here, and only with parties who are bound by contract or law to protect it.

• Your care team. Our optometrists, dispensing opticians and support staff; and, with your consent or as HIPC permits, your GP, ophthalmologist, other health providers and Health New Zealand | Te Whatu Ora (for example, for referrals, shared care records, funded services or public-health reporting required by law).
• Funders and insurers. Health NZ, ACC, Work and Income, Ministry of Social Development, and private insurers — to claim or verify funded or insured care.
• Laboratories and suppliers. Lens laboratories, frame and contact lens suppliers, and device manufacturers — only what is needed to make or supply your product.
• Platform and service providers. Shopify (Store hosting and checkout), payment providers (Shopify Payments, Apple Pay, Google Pay, Afterpay and others we offer), couriers, our practice-management and clinical-records software, cloud hosting, email/SMS platforms (e.g. Klaviyo), booking and recall tools, customer-support and chat tools, AI service providers (section 4), analytics and advertising platforms (e.g. Google, Meta), and IT and security providers.
• Professional advisers and authorities. Lawyers, accountants, auditors, regulators (including the ODOB, Office of the Privacy Commissioner and Health and Disability Commissioner), courts and law enforcement — where required or permitted by law.
• Business changes. If we merge with, acquire or sell all or part of our business, personal information may transfer to the new owner under the same protections.

Overseas disclosure. Some providers store or process data outside New Zealand (commonly Australia, the United States and the European Union). When they do, we rely on contractual safeguards and, where available, Privacy Act prescribed-binding-scheme or comparable-law protections so your information remains protected to a standard comparable to New Zealand law. Health information stays within systems meeting HISO 10029 requirements.

7. Security and retention

Security. We protect your information with encryption in transit (TLS) and at rest, role-based access, multi-factor authentication, logging and monitoring, staff privacy training, vendor due diligence, and regular review against the Health Information Security Framework (HISO 10029) and the Privacy Commissioner's guidance. No system is perfectly secure; if a privacy breach is likely to cause serious harm we will notify you and the Office of the Privacy Commissioner as the Privacy Act requires.

Retention. Clinical records are kept for at least 10 years from the date of your last care (Health (Retention of Health Information) Regulations 1996) and may be kept longer where clinically justified. Financial and order records are kept for at least 7 years (tax law). Marketing and analytics data is kept while you have an active relationship with us and for a reasonable period afterwards, then deleted or de-identified. Where you have opted out, we keep the minimum needed to honour that choice (e.g. a suppression list).

8. Cookies, pixels and similar technologies

We use:

• Essential — required for the Store, checkout, booking and security (including Shopify's session and checkout cookies). Cannot be switched off.
• Functional — remember your preferences, cart, logged-in state and accessibility settings.
• Analytics — e.g. Google Analytics, Shopify analytics, and our website analytics — to understand how our sites are used.
• Marketing — e.g. Meta Pixel, Google Ads, TikTok Pixel, Klaviyo tracking — to measure and personalise advertising and emails.

You can manage non-essential cookies through the cookie banner on our sites, your browser settings, and the platform opt-outs listed in section 10. The Store does not currently respond to browser "Do Not Track" signals, but honours the choices you make through our banner and your account preferences. See also https://www.shopify.com/legal/cookies.

9. Your rights

Under the Privacy Act 2020 and HIPC you can:

• Access the personal and health information we hold about you (usually free, within 20 working days).
• Correct it, or have a statement of correction attached if we disagree.
• Restrict or object to certain uses, including marketing, personalisation, AI-assisted analysis and research (section 10).
• Withdraw consent at any time for anything that relied on consent.
• Ask us to delete information we no longer need, subject to our legal and clinical record-keeping duties.
• Ask for a human review of any AI-assisted outcome that affects you.
• Complain to us, and if unresolved, to the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909) or, for clinical matters, the Health and Disability Commissioner (hdc.org.nz, 0800 11 22 33).

We may need to verify your identity before acting. We will never penalise you for exercising your rights.

10. Your Privacy Choices (opt-outs)

You can change any of these at any time. Opting out never affects your clinical care.

Requests are actioned within 10 working days (marketing and SMS opt-outs take effect as soon as practicable and within 5 working days under the Unsolicited Electronic Messages Act). We will confirm by email.

11. Children and whānau

We provide care to people of all ages. For patients under 16, a parent or guardian usually manages the Store account and receives communications; we tailor marketing and personalisation accordingly and do not build advertising profiles on children. Young people who are competent to make their own health decisions have their own privacy rights, and we respect them. If you manage information on behalf of a family member, please only share what is needed and what you are authorised to share.

12. Changes to this policy

We may update this policy as our services, technology or the law change. Material changes — including any new purpose for using health information or any change to AI or research use — will be notified by email or a prominent notice before they take effect, and will not apply to information already collected without your consent where the law requires it. The "Last updated" date shows the current version.

13. Contact us

Privacy Officer Rose Optometry (Visique Rose Optometrists Limited) Email: ops@roseoptom.co.nz Phone: 07 847 3195 Address: 38 Lake Road, Frankton, Hamilton 3204, New Zealand Website: roseoptom.co.nz