Find your programme

Privacy and terms

PREKURE Health Privacy Policy
Effective date: 11 August 2026 · Version 1.2

1. Who we are

This policy explains how Clinical Nu Limited, trading as PREKURE ("PREKURE", "we", "us" or "our"), collects, uses, discloses and protects personal information when you use PREKURE Health at prekurehealth.com.

Clinical Nu Limited (NZBN 9429046627742) is at B:HIVE, Smales Farm, 74 Taharoto Road, Takapuna, Auckland 0622, New Zealand. PREKURE is the agency collecting and holding the information described below.

PREKURE Health includes our website, PREKURE Weight, PREKURE Peri/Menopause, PREKURE Mental Fitness, PREKURE Diabetes and PREKURE Me, the questions for each programme, Action Plan Session booking and the related coach-preparation flow. We treat collected quiz answers as health information and handle them under the Privacy Act 2020 and the Health Information Privacy Code 2020. PREKURE Health is intended for adults aged 18 and over in New Zealand.

2. Who this policy covers

  • people who browse the website;
  • people who answer programme questions;
  • people who book an Action Plan Session; and
  • people whose booking or coaching records are held by PREKURE.

PREKURE Coaches must handle information they access through PREKURE in accordance with PREKURE's privacy and security requirements and applicable law.

3. The personal information we collect

3.1 If you only browse

We use limited first-party measurement to understand broadly how the website is used. It records a random tab-session identifier, broad device and referral categories, programme and page categories, page views and a fixed list of booking interactions. It does not record your name, email, quiz answers, free text, full web addresses or booking attendee details. We do not use Google Analytics, Microsoft Clarity or session recording. The random identifier is held in browser session storage, not an analytics cookie.

3.2 While you answer the questions

The questions may cover health conditions or risks, medicines, symptoms, wellbeing, goals and daily circumstances. We treat all answers, including optional free text, as health information.

Before a confirmed booking, your answers stay only in the session storage of your current browser tab so the website can show your programme reflection. They are not sent to PREKURE, Cal.com, Google, a coach, product analytics, Slack or application logs at that stage. Your browser controls when that session storage ends.

Completing the questions is voluntary if you are only viewing programme information. Saving the answers is a condition of booking an Action Plan Session through this page, not a legal requirement. If you do not authorise the collection, you cannot continue to booking through this page. Please do not provide information about another person.

3.3 When you continue to booking

The booking form asks for your name and email. Before Cal.com opens, PREKURE receives your email address, programme, and the questionnaire and privacy versions you accepted. PREKURE records that authorisation and creates a short-lived secure booking handoff. Your quiz answers are not included in that step.

Cal.com collects the name, email and scheduling details needed to make the booking. PREKURE does not put your quiz answers into Cal.com notes, booking metadata or web addresses.

3.4 After a confirmed Action Plan Session booking

PREKURE accepts quiz answers only after it verifies a genuine booking notification and the browser proves the same booking, programme and email. PREKURE then encrypts the answers, links them to your name, client record and exact booking, and records the applicable notice versions, consent time and privacy-safe audit events. There is no server copy of quiz answers for a person who does not complete a confirmed booking.

The website clears the browser copy only after PREKURE confirms durable storage. If storage fails, the answers remain in the tab so you can retry.

3.5 Other booking and service information

PREKURE may also hold booking status, coach assignment, communications you send to us, and records created to administer or provide your session. This policy does not claim that a PREKURE Health payment or separate client-intake system is currently operating. If paid services or further intake are introduced, PREKURE will provide the applicable terms and privacy information before collecting that information.

4. How we collect information

We collect information directly from you when you browse, answer questions, authorise collection, book or contact us. We collect booking status and scheduling details from Cal.com. We may receive service records from the PREKURE Coach assigned to you. Where information is collected indirectly, PREKURE will take the notification steps required by rule 3A of the Health Information Privacy Code 2020 unless an exception applies or you have already been told.

5. Why we collect and use information

  • Quiz answers: to prepare for and provide your Action Plan Session.
  • Booking details: to arrange, verify and administer the session.
  • Consent and notice records: to show what you authorised and when.
  • Contact details and communications: to respond and provide service messages.
  • First-party measurement: to run, secure and improve the website.
  • Audit records: to protect information and investigate privacy or security events.

We collect only what we reasonably need for these purposes. We will not use the information for an unrelated purpose without your authorisation or another lawful basis.

6. What we do not do with quiz answers

Authorising collection does not authorise PREKURE to use quiz answers for:

  • marketing, advertising or lead scoring;
  • artificial-intelligence or large-language-model processing;
  • training AI models;
  • sale to anyone;
  • insurance, employment, eligibility or pricing decisions;
  • diagnosis, prescribing or changing medicines; or
  • product analytics, web addresses, booking notes or application logs.

Any new use would require a fresh assessment, updated privacy information and an appropriate lawful basis before it starts.

The questions are not an emergency, diagnostic or prescribing service. Nobody at PREKURE reads or monitors what you type while it remains in your browser, and nothing you write triggers an alert. If you or someone else is in immediate danger, call 111. For urgent mental-health support in New Zealand, call or text 1737 free at any time.

7. Who may receive or read information

PREKURE holds the confirmed-booking quiz record. The PREKURE Coach assigned to your booking and PREKURE staff may read it where needed to prepare for, provide, administer or support the Action Plan Session, respond to a privacy request, or manage a security incident.

Our infrastructure providers process information only to provide their services to PREKURE. Regulators, professional advisers or emergency services may receive information where authorised or required by law, including where disclosure is reasonably necessary to prevent or lessen a serious threat to someone's life or health. There is no generic "partner" access, and PREKURE does not sell personal information.

8. Where information is held and processed

Amazon Web Services hosts the PREKURE Health application, database and encrypted backups in Sydney, Australia, on PREKURE's behalf. PREKURE remains responsible for information held by AWS as its infrastructure processor.

Cal.com processes booking details. Google Calendar and Google Meet may process appointment and meeting details supplied through scheduling. PREKURE does not send quiz answers to Cal.com or Google. These providers may process information outside New Zealand. Stripe is not part of the free Action Plan Session booking flow described in this policy.

Where an overseas disclosure occurs, PREKURE will use the safeguards or other basis required by information privacy principle 12 and rule 12 of the Health Information Privacy Code 2020.

9. Keeping information safe

PREKURE uses safeguards proportionate to health information. Confirmed quiz answers are protected by encrypted transport, encrypted database storage and an additional authenticated-encryption layer whose keys are separate from the database. The database is on a private network. Booking notifications are signature-verified, identifiers are stored in keyed hashed form where possible, upload grants are short-lived and single-use, and access is restricted and audited.

Confirmed-booking collection is configured to fail closed unless the required keys, notice versions, booking verification and retention gates are present. No system is completely secure, and PREKURE keeps its safeguards under review.

10. How long we keep information

Quiz answers that have not been stored after a confirmed booking remain under your browser's control; PREKURE has no server copy to retain or delete. PREKURE will not keep confirmed-booking quiz answers for longer than 365 days after they are stored unless applicable law requires a longer period. PREKURE may delete them sooner when they are no longer needed. PREKURE must approve and enforce the secure-disposal and backup-expiry process before confirmed-booking collection is enabled.

Cancellation or non-attendance after secure storage does not automatically delete the answers. A reschedule keeps the record linked to the booking. Other booking, communication, audit, analytics and security records are retained only while PREKURE has a lawful operational or legal purpose for them. We do not state a fixed health-record period here because the application of the Health (Retention of Health Information) Regulations 1996 depends on the record and service involved.

11. Marketing

PREKURE does not collect your email address in the questions. Booking a session is not agreement to receive marketing. Any marketing consent is separate and optional, and PREKURE does not use quiz answers or inferred health interests for marketing. Service messages about your booking are not marketing.

12. Your rights

You may ask PREKURE to:

  • confirm whether it holds personal information about you and provide access;
  • correct information, or attach your requested correction;
  • explain relevant uses or disclosures; and
  • consider withdrawal or deletion where no legal or operational reason requires retention.

PREKURE cannot access, correct or delete quiz answers while they exist only in your browser. We normally respond to formal Privacy Act requests within 20 working days and may ask for proportionate proof of identity before releasing health information. Withdrawing authorisation does not make earlier handling unlawful and cannot override a legal retention duty.

13. Age

PREKURE Health is intended for adults aged 18 and over in New Zealand. Do not use the questionnaire or booking flow if you are under 18. If you believe PREKURE has collected information about a person under 18 through this flow, contact us.

14. Privacy breaches

If a privacy breach has caused, or is likely to cause, serious harm, PREKURE will notify affected people and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

15. Contact and complaints

PREKURE's Privacy Officer is Kayla Lenferna de la Motte. Email privacy@prekure.com or write to Privacy Officer, PREKURE, B:HIVE, Smales Farm, 74 Taharoto Road, Takapuna, Auckland 0622, New Zealand.

You may also complain to the Office of the Privacy Commissioner or, for a concern about care, the Health and Disability Commissioner.

16. Changes to this policy

PREKURE may update this policy as the Service or legal requirements change. The current version and effective date will appear on this page. Material changes to collection purposes, recipients, AI use, overseas processing or retention will be reviewed before they take effect, and PREKURE will provide any additional notice required by law.