Short version: the patient's health information belongs to the service that collected it, not to us. We hold it on your behalf, under your instruction, and we do nothing else with it. This page says that in enough detail to be useful to a privacy officer.
Version 1.1 · 7 October 2026 ·privacy@castellan.nz
Under the Privacy Act 2020 and the Health Information Privacy Code 2020, the ambulance or air rescue service is the agency that collects and holds the patient's health information. Castellan builds and operates the system it is held in. We process that information only on your instruction and only to provide the service — we are not a second agency with our own purposes for it.
Practically, that means a patient asking to see their record asks you, not us, and you can answer without our permission. It also means we cannot decide to do something new with that data on our own initiative. If we ever wanted to, we would have to ask you, in writing, and you could say no.
The clinical record your crews create: the job, observations, interventions, medicines, narrative, and any imaging or video attached to it. Collected by your clinicians for the care of that patient, held so it can be delivered to the receiving hospital, audited, and produced on request years later.
Name, registration number, practising scope, roster and duty state, the surfaces they are granted, and the record of what they did and when. This exists because a clinical record is worthless without attribution — every entry has to be traceable to the person who made it, and every controlled-drug signature to the person who signed it.
Who opened what, when, and — for sensitive acts like a national index lookup — why. This is a privacy control rather than a privacy cost: broad clinical access is only defensible when every reach is named.
Vehicle and aircraft state, checks, stock and controlled-drug movements, plus which device a record came from and whether it was created offline.
We do not track individual staff. The job map in the field app uses the device's location only while the map is open, to show where the job is from you. That location is shown on the screen and never stored. To work out the road route and the wind for the flight, the app sends it, rounded to about 100 metres for the route and about 1 kilometre for the weather, to a routing service and a weather service. Nothing else goes with it: no name, no job number, nothing about the patient. Map images come from Land Information New Zealand (LINZ) for the area on screen. A route is kept on the device for 24 hours so the map still works out of signal, then deleted. The app never asks for location in the background, so nothing follows a crew with the app closed.
Rule 6 of the Health Information Privacy Code gives a person the right to the health information held about them, and an ambulance record is exactly that. The request goes to your service, because your service is the agency — but a right with no practical route is a right on paper, so building that route is our job.
The patient is given a code at the end of the encounter, and redeems it without creating an account, because a route that requires a login is a route most people will never complete. Three things it does that comparable schemes do not: the patient's code is separate from the hospital's handover code, so it does not circulate through hospital workflows; it can be revoked and reissued if the paper is lost; and the patient can see who else has opened their record. Imaging and video are provided on request through your service rather than in a self-service download.
Until it ships, patient requests are handled by your service in whatever way you handle them today, and we will help you answer one at any time.
Health information in New Zealand must be retained for a minimum of ten years from the last date of service. We keep clinical records for at least that long, and for as long as your own retention policy requires beyond it — your policy governs, not ours.
Clinical records are append-only. A correction supersedes the entry it replaces and both are kept. This is deliberate and it has a privacy consequence worth stating plainly: there is no "delete this entry" for clinical history, for anyone, including us. Requests to correct a record are handled as corrections, with the original preserved — which is what a health record has to do.
When our contract ends, you get a complete export in an open format, and we delete our copies on your written confirmation. We will not hold your data hostage to a renewal.
Data is held in managed Postgres provided by Supabase, running on AWS. Our current region is Sydney, Australia, and the residency question is answered in full on the security page — including what to do if your organisation requires onshore New Zealand hosting.
Our sub-processors are listed here and this list is kept current. Anyone added gets notified to you before they touch anything of yours.
That is the whole list. There is no advertising network, no analytics vendor, and no third-party session recorder anywhere near a patient record.
If we become aware of a privacy breach affecting your data we will tell you without delay and in plain language — what happened, what was affected, what we have done, and what we recommend you do. You are the agency, so notification to the Privacy Commissioner and to affected individuals is your decision to make, and we will give you everything you need to make it quickly.
We will not wait until we have a complete picture before telling you there is a problem. A partial early warning is worth more to you than a tidy late one.
This website sets no cookies at all, and no advertising or tracking scripts run on it. We do count visits, using Cloudflare Web Analytics: it records the page you opened, the site you came from, and your browser, operating system and country. It assigns you no identifier and cannot follow you to any other website. The typeface is served by Google Fonts, so Google receives the request when the page loads.
If you email us, we keep the email so we can reply to it. That is all.
They usually make the product better. Ask before you buy rather than after — we would rather answer a hard question early than a complaint late.