Legal
Helius Therapeutics Ltd & Ora Pharm Ltd Group Companies
Privacy Policy
The rules that apply when you use this website.
VERSION 1.0 · LAST UPDATED AUGUST 2026
Table of Contents
About this policy
Helius Therapeutics Ltd is a brand of Ora Pharm Limited (we, us, our). This policy explains how we collect, use, store, share and protect any personal information and health information when you visit helius.co.nz, helius.com, hcp.helius.co.nz, contact us, or otherwise deal with us.
​
We are an “agency” under the Privacy Act 2020 and we handle personal information in accordance with that Act and its information privacy principles. Where we handle health information, the Health Information Privacy Code 2020 also applies. Section 11 explains what that means.
​
Our details:
​
-
Legal entity: Helius Therapeutics Limited
-
NZBN:
9429053658890
-
Registered office: HAMILTON LOCKE (NZ) LIMITED, Level 35, Vero Centre, 48 Shortland Street, Auckland, 1010 , New Zealand
-
Postal address: PO Box 58948, Botany, Auckland 2163, New Zealand
-
Email: enquiries@helius.co.nz
-
Phone: 0800 661 144
Our privacy officer
Section 201 of the Privacy Act 2020 requires every agency to appoint a privacy officer. Ours is:
​
-
Privacy Officer: Zoe Reece
-
Phone: 0800 661 144
-
Post: Attn: Zoe Reece, Privacy Officer, Helius Therapeutics Ltd, PO Box 58948, Botany, Auckland 2163, New Zealand
-
Our privacy officer is your first point of contact for any question, request or complaint about your personal information.
What we mean by personal information
Personal information is information about an identifiable individual. It includes obvious things like your name and email address, and less obvious things like an online identifier that can be linked back to you.
Health information is a particular kind of personal information. You may disclose health information in the course of contact you have with our customer service personnel. It includes information about your health or disabilities, health or disability services you have received, and information collected about you in the course of providing those services.
Information we collect directly from you
We only collect personal information where we need it for a lawful purpose connected with what we do. This enables us to respond to requests, supply our products and services and otherwise engage with you.
​
When you contact us
​
Through a form on helius.co.nz, helius.com, or hcp.helius.co.nz, by email to enquiries@helius.co.nz, or by calling 0800 661 144, we collect:
​
-
your name, email address, phone number and, if relevant, the organisation or practice you work for
-
if you are a medical practitioner we may collect your registration number, professional title and profession
-
the content of your enquiry and any information you choose to include in it
-
any follow-up correspondence between us
When you register for the health care professional portal at hcp.helius.co.nz
The portal is only for health practitioners who are authorised to prescribe or dispense medicines. Its purpose is to act as a repository of information that you may request access to from us. When you request information by completing a registration form, we collect:
​
-
your name and professional title
-
your professional registration number and the responsible authority you are registered with
-
your scope of practice and whether you hold a current practising certificate
-
your practice or pharmacy name and address, and your work email and phone number
-
your login credentials and account security information
-
a record of your registration, the terms you accepted and the date you accepted them
-
a record of the information you request and access through the portal
We collect this information so we can verify that you are entitled to receive information that may only be supplied to authorised prescribers and dispensers, and so we can respond to requests you make for that information. New Zealand law restricts who we may supply product information to, and we cannot give you portal access without it.
When you deal with us as a pharmacy, wholesaler, clinic, supplier or business partner
​
-
your name, role, employer and business contact details
-
information needed to set up and manage an account, order, contract or payment
When you apply for a job with us
​
-
your CV, cover letter, work history, qualifications, referee details and any information you provide during recruitment
When you subscribe to updates
​
-
your name, email address, professional details and your subscription preferences
Some of the information we collect is information we are required or authorised to collect by law, in particular under the Medicines Act 1981 and the Misuse of Drugs (Medicinal Cannabis) Regulations 2019, which impose traceability, product recall and adverse event reporting obligations on us and restrict who we may supply product information to.
You do not have to give us personal information. If you choose not to, we may not be able to answer your enquiry, verify your eligibility to request information through the portal, engage with you or process your application.
Information we collect from other people
Sometimes we collect personal information about you from someone other than you. Principle 3A of the Privacy Act 2020, which came into force on 1 May 2026, requires us to tell you when we do this. This section is how we do that, and we will also tell you directly where it is reasonable to do so.
What we collect indirectly, and where it comes from
What we collect
Where it comes from
Why
Professional registration and practising details
Publicly available registers maintained by responsible authorities under the Health Practitioners Competence Assurance Act 2003
To verify that a person is entitled to receive information that may only be supplied to authorised prescribers or dispensers
Business contact details for prescribers, pharmacies and clinics
Publicly available registers and websites, industry directories, conferences and events, and referrals from colleagues or business partners
To contact the right person about a business relationship or a request they or their organisation has made
Contact details and correspondence about an enquiry
​The person who made the enquiry on your behalf, or your employer or organisation
To respond to the enquiry
Referee information and, where you have agreed, background or reference checks
​Referees you have nominated and check providers
To assess a job application
Reports about a product or a suspected adverse reaction
Prescribers, pharmacies, patients, caregivers, wholesalers and regulators
To meet our quality, safety and pharmacovigilance obligations as a licensed manufacturer and supplier
Who receives it. The recipients are the same as those listed in section 8.
Your rights. You have the same rights of access and correction over indirectly collected information as over anything else. See section 15.
When we may not tell you. Principle 3A allows exceptions, including where the information is publicly available, where telling you is not reasonably practicable, where non-compliance would not prejudice your interests, or where telling you would prejudice the purpose of collection. We rely on an exception only where we have reasonable grounds to do so, and we record our reasons.
Information collected automatically when you visit our websites
When you visit helius.co.nz, helius.com, or hcp.helius.co.nz, our websites and the services behind them automatically collect technical information. This may include your IP address, device and browser type, operating system, the pages you view, the time and date of your visit, and the website you came from.
​
Cookies and similar technologies. We use cookies and similar technologies such as tags and pixels. A cookie is a small text file placed on your device.
​
We use them for:
​
-
Necessary functions. Making the websites work, keeping you logged in to the portal, remembering your settings and keeping everything secure. The sites will not work properly without these.
-
Analytics. Understanding how people find and use our websites so we can improve them. We currently use Google Analytics.
New Zealand law does not require us to obtain your consent before setting cookies.
There is no New Zealand equivalent of the European cookie consent rules. We tell you about them here because principle 3 requires us to be open about what we collect, and because we think you should know.
​
Your choices. You can:
​
-
manage your cookie preferences on our website by setting them the first time you log into the site, or by clicking on the link to the preference centre in the website footer
-
set your browser to refuse some or all cookies, or to tell you when a website sets one, though parts of our websites may then not work properly
-
opt out of Google Analytics using the browser add-on at tools.google.com/dlpage/gaoptout
-
adjust your advertising preferences with the relevant platform directly
We honour Do Not Track and Global Privacy Control signals sent by your browser where we are technically able to.
Some of the analytics and advertising providers we use are overseas companies that use the information they receive for their own purposes as well as ours. Section 10 explains how we handle that.
Why we collect your information and how we use it
We use personal information for the purposes it was collected for, and for directly related purposes. In practice that means:
​​
-
responding to your enquiry and corresponding with you
-
verifying that you are a health practitioner entitled to receive information that may only be supplied to authorised prescribers or dispensers
-
operating the health care professional portal, including managing your account, keeping it secure, and responding to requests you make through it
-
supplying products, and managing orders, accounts and payments
-
managing our relationships with prescribers, pharmacies, clinics, wholesalers, suppliers and partners
-
meeting our obligations as a holder of licences under the Medicines Act 1981 and the Misuse of Drugs (Medicinal Cannabis) Regulations 2019, including quality, traceability, product recall and adverse event reporting
-
responding to regulators including Medsafe, the Medicinal Cannabis Agency and the Ministry of Health
-
recruitment and employment
-
sending you updates you have asked for
-
improving our websites, products and services
-
protecting the security of our people, premises, systems and information
-
meeting our legal, tax, accounting and record-keeping obligations, and dealing with legal claims
We will not use your information for an unrelated purpose unless you authorise it or the Privacy Act allows it.
Who we share your information with
We share personal information only where we need to. Depending on the situation, that may be with:
​
-
Other businesses in our group, including Ora Pharm and NZ Grow Co., where this is one of the purposes the information was collected for
-
Our service providers, who hold or process information on our behalf. This includes website hosting and platform providers, email, document storage, our customer relationship management system, our email marketing platform, the platform behind the health care professional portal, IT support, accounting and professional advisers. They act on our instructions and may not use the information for their own purposes.
-
Wholesalers, distributors, pharmacies and prescribers, where this is necessary to supply products or respond to a request
-
Regulators and government agencies, including Medsafe, the Medicinal Cannabis Agency, the Ministry of Health, the Centre for Adverse Reactions Monitoring, the New Zealand Customs Service and Inland Revenue, where we are required or authorised to do so
-
Responsible authorities under the Health Practitioners Competence Assurance Act 2003, where we need to verify a practitioner’s registration
-
Analytics platforms, as described in section 6
-
Professional advisers, insurers, auditors and banks
-
A buyer or prospective buyer, where we sell or restructure all or part of our business
-
Anyone else you authorise us to share it with, or where the Privacy Act 2020 or another law permits or requires disclosure
​
We do not trade, rent or sell personal information to anyone for their own marketing purposes.
Marketing and how to stop it
We only send marketing and updates to people who have agreed to receive them, or where we are otherwise permitted to under the Unsolicited Electronic Messages Act 2007.
​
Every marketing email we send identifies us and includes a working unsubscribe link. You can unsubscribe at any time, at no cost, using that link or by emailing enquiries@helius.co.nz. We process unsubscribe requests promptly. You will still receive necessary operational and/or service messages, such as messages about your portal account, an order, a recall or a change to these documents.
Medicinal cannabis products are unapproved medicines in New Zealand and there are strict legal limits on what we may communicate, to whom, and when. We do not send unsolicited product information to anyone. Where we supply product information to a health practitioner, we do so in response to a request from that practitioner. Section 4 of our Terms of Use explains this.
Sending information outside New Zealand
Some of the systems we use are provided by overseas companies, and some information is stored on servers outside New Zealand, including but not limited to in Australia, the United States, the European Union, Ireland, South Korea, Taiwan, Israel and global multi-cloud networks such as AWS and Google Cloud.
​
There are two different situations, and we treat them differently.
​
Information held or processed on our behalf. Some providers only store or process information for us and do not use it for their own purposes. We remain responsible for that information. We select these providers carefully, and we require appropriate security and confidentiality commitments and prompt notification of any privacy breach.
​
Information disclosed to an overseas organisation that uses it for its own purposes. This applies to some analytics platforms. Before we disclose personal information to an overseas organisation in this way, principle 12 of the Privacy Act requires us to be satisfied that one of the grounds in that principle is met. In practice we rely on contractual commitments from the provider that the information will be protected in a way that, overall, provides comparable safeguards to those in the Privacy Act.
Health information
We manufacture and supply medicines. The Health Information Privacy Code 2020 applies to health agencies, and the definition of a health agency includes an agency that manufactures, sells or supplies medicines, medical devices or related products.
​
Where we collect, hold, use or disclose health information, the health information privacy rules in that Code apply instead of the information privacy principles. Those rules are similar but stricter in some respects, particularly around disclosure, secure disposal and what we may charge for access.
​
In practice this affects a limited but important set of information, such as:
​
-
reports of a suspected adverse reaction that identify a patient
-
information provided to us by or about a patient in connection with a specific supply
-
correspondence in which a person tells us about their own health or treatment
Where the health rules apply, they take the place of the corresponding information privacy principles referred to elsewhere in this policy. In particular, Rule 3A applies in place of principle 3A (section 5), Rule 12 in place of principle 12 (section 10), and Rules 6 and 7 in place of principles 6 and 7 (section 15).
​
The Code also contains disclosure gateways that have no equivalent in the information privacy principles. One is directly relevant to us: Rule 11(2)(k) permits a health practitioner to disclose health information to a Medical Officer of Health where an individual is, or is likely to become, dependent on a controlled drug, prescription medicine or restricted medicine, under section 20 of the Misuse of Drugs Act 1975 or section 49A of the Medicines Act 1981.
​
Most information we collect through our websites - practitioner registration details, business contact details, general enquiries, job applications and website analytics - is not health information, and the information privacy principles apply to it.
If you contact us about your own health or treatment, please keep in mind that we are a manufacturer and supplier, not your treatment provider. We cannot give you medical advice and we cannot discuss your treatment. Please talk to your prescriber or pharmacist.
Storing and securing your information
We hold personal information electronically in systems provided to us by reputable suppliers, and in some cases in hard copy at our premises.
​
We take reasonable steps to protect personal information against loss, unauthorised access, use, modification, disclosure and other misuse. These include access controls, restricting access to people who need it, staff training, and security and confidentiality requirements on our providers.
​
If you have a portal account, you are responsible for keeping your login details secure and for not sharing them. Please tell us as soon as you become aware, at enquiries@helius.co.nz, if you think someone else has access to your account.
​
No system is completely secure, and we cannot guarantee the security of information you send us over the internet.
​
Where we hold a document containing health information that is no longer to be kept, we dispose of it in a way that protects the privacy of the individual concerned.
How long we keep your information
We keep personal information only for as long as we need it for the purposes it may lawfully be used for, or for as long as we are required or permitted by law to keep it.
​
When we decide how long to keep something we consider:
​
-
what we collected it for and whether that purpose is finished
-
how sensitive it is
-
whether we have an ongoing relationship with you
-
our record-keeping obligations under the Medicines Act 1981, the Misuse of Drugs (Medicinal Cannabis) Regulations 2019, the Companies Act 1993, the Tax Administration Act 1994, employment law and health and safety law
-
the periods within which a legal claim could be made
-
whether the information is needed for a current or anticipated legal proceeding, investigation or regulatory request
Portal accounts that have been inactive for 36 months are closed and the account information is deleted, other than the record we are required to keep of who we supplied information to and when.
When we no longer need information, we securely destroy it or de-identify it.
If something goes wrong
If we have a privacy breach that it is reasonable to believe has caused, or is likely to cause, serious harm, Part 6 of the Privacy Act 2020 requires us to notify the Office of the Privacy Commissioner and the people affected as soon as practicable. We will do that, and we will tell you what happened, what we are doing about it, what you can do, and how to complain to the Privacy Commissioner should you wish to do so.
​
In some situations the Privacy Act allows us to give public notice instead of notifying people individually, or to delay or withhold notification to a particular individual. Where that happens we will still notify the Privacy Commissioner, and we will notify you later if circumstances change.
​
We have a breach response process, and we require our service providers to tell us promptly about any breach affecting information they hold for us.
Accessing and correcting your information
Under principles 6 and 7 of the Privacy Act 2020 you have the right to ask us:
​
-
to confirm whether we hold personal information about you, and to give you access to it
-
to correct it if you think it is wrong
How to make a request. Email enquiries@helius.co.nz, or write to the Privacy Officer at Zoe Reece, Privacy Officer, Helius Therapeutics Ltd, PO Box 58948, Botany, Auckland 2163, New Zealand. Tell us what information you are after so we can find it. We may need to verify your identity before we release anything. If you are making a request on someone else’s behalf, we will need evidence that you are authorised.
​
How long we take. We will respond as soon as reasonably practicable and no later than 20 working days after we receive your request. If we need longer, we will tell you within that 20 working days, explain why, and tell you how long we expect to take. You can complain to the Privacy Commissioner about an extension.
​
Charges. We do not charge for access or correction requests for personal information.
​
For health information, clause 6 of the Health Information Privacy Code 2020 in any case prevents a private sector health agency from charging, except for supplying the same or substantially the same information again within 12 months, or for a copy of an x-ray, video recording, MRI, PET or CAT scan image. Where a charge in either of those situations is likely to exceed $30 we will give you an estimate first.
​
If we say no. The Privacy Act allows us to refuse a request in certain circumstances. If we refuse, we will tell you why and tell you that you can complain to the Privacy Commissioner.
​
If we will not correct something. You can give us a statement of the correction you asked for. So far as reasonably practicable we will attach it to the information so it is read alongside it, and we will tell anyone we have disclosed the information to about the correction or the statement.
Complaints
If you are not happy with how we have handled your personal or health information, please tell our privacy officer at enquiries@helius.co.nz. We will look into it and come back to you.
​
Our privacy officer is also the person we have designated to deal with complaints alleging a breach of the Health Information Privacy Code 2020, as clause 7 of that Code requires.
​
You can also complain to the Office of the Privacy Commissioner at any time. You do not have to come to us first.
​
-
Website: privacy.org.nz
-
Phone: 0800 803 909
-
Email: enquiries@privacy.org.nz
-
Post: PO Box 10094, Wellington 6143
Children and young people
Our websites are not aimed at children. Where we do collect personal information from a child or young person, principle 4 of the Privacy Act 2020 requires us to take particular care that the collection is fair and not unreasonably intrusive, and we do. If you have a concern about information we hold about a child or young person, please contact our privacy officer.
Changes to this policy
We review this policy at least annually and update it when our practices change or the law changes. The version and date at the top of this page tell you when it was last updated. If we make a significant change we will say so on our websites, and portal users will be asked to review the updated policy at their next login.
Contact us
Privacy Officer: Zoe Reece
Phone: 0800 661 144
Post: Attn: Zoe Reece, Privacy Officer, Helius Therapeutics Ltd, PO Box 58948, Botany, Auckland 2163, New Zealand
Email: enquiries@helius.co.nz