Draft for review. This wording has not been approved yet and may change before it applies.

Go—Practitioner

Privacy policy

Your information is stored in Australia under NZ privacy law.

Go—Practitioner is practice software for allied-health practices in Aotearoa New Zealand, run by Coreshift in partnership with Go—. The records it holds are stored in Sydney, Australia, and are handled under the Privacy Act 2020 and the Health Information Privacy Code 2020.

Who is responsible

If you are a client of a practice, your practice decides what is recorded about you and is responsible for it. We hold and process that information only on the practice's behalf, to run the software for them. We don't use it for anything else, and we don't sell it or use it for advertising.

If you work at a practice that uses Go—Practitioner, we are responsible for your account details: your name, email address, role and any professional registration or ACC provider number you enter.

What is held

• Contact details: name, date of birth, phone, email and address.
• What you tell the practice in intake forms, and the treatment consent you sign.
• Appointments, clinical notes and any files attached to them.
• Invoices and payments. Card details are held by Stripe, not by us.
• ACC claim details, when your treatment is ACC-funded.
• A record of every time someone at the practice opens your file.
• If you book online, the details you enter. Your internet address is checked to stop automated abuse and is kept only in a scrambled form.

How it is used

To book and remind you about appointments, keep your clinical record, bill you or ACC, and send the emails that go with those (confirmations, reminders, receipts and forms to fill in). Go—Practitioner does not send anything to ACC itself. Your practice lodges claims and invoices with ACC.

Where it is kept and who else handles it

• Supabase stores the records, in Sydney, Australia. They are encrypted when stored and when sent.
• Railway runs the app, in Singapore. It handles requests but doesn't keep a copy of the records.
• Stripe holds card details and takes payments. We never see or store full card numbers.
• Cloudflare sends our emails and checks the booking page for bots.

None of them receive your clinical notes except Supabase, which stores them.

How it is protected

• Each practice can only see its own records, and staff only see what their role allows.
• Every time someone opens a client record, it is logged.
• Signed clinical notes can't be changed. Corrections are added as dated addenda.
• The database is backed up every day.

How long it is kept

Health records are kept for at least 10 years after your last treatment, as the Health (Retention of Health Information) Regulations 1996 require. Staff accounts are kept while the person works at a practice using Go—Practitioner. The scrambled internet addresses from booking-page abuse checks can't be turned back into an address and are cleared as new bookings come in.

Seeing and correcting your information

You can ask to see the information held about you and ask for it to be corrected. Ask your practice first, because it holds your record. If you can't, write to us at support@go-practitioner.com and we will pass your request to the practice and help it answer.

If something goes wrong

If a privacy breach could cause serious harm, the practice and we will tell the Office of the Privacy Commissioner and the people affected, as the Privacy Act requires.

Cookies

We only use the cookies needed to keep staff signed in. There is no advertising or tracking.

Complaints

Tell your practice or us first. If you aren't happy with the answer, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Practices: the terms on which we handle your clients' information are in our data processing agreement.

Questions or concerns: support@go-practitioner.com. Last updated 2 November 2026.