How we protect your information

1. Who we are

Precision Health Testing ("PHT", "we", "our", "us") is a Hair Tissue Mineral Analysis (HTMA) practice operating in New Zealand. The practitioner is Gary Moller, registered Natural Health Practitioner. The registered practice address is 15 Heaton Terrace, Brooklyn, Wellington 6021, New Zealand.

We are the agency responsible for any personal and health information you provide to us through this website, our intake forms, our laboratory testing process, our consultations, and any related communications.

2. What we collect

The categories of information we may collect from you are listed below. We only collect what is necessary to deliver our services and run our practice lawfully.

Identification & contact information

• Full legal name
• Date of birth and biological sex (used for laboratory reference ranges)
• Email address and phone number
• Postal and shipping address

Health information

• Responses to our Mandatory Health Questionnaire (medical history, current symptoms, medications, supplements, lifestyle, dietary patterns)
• Hair samples submitted for laboratory analysis
• The Hair Tissue Mineral Analysis report returned by the laboratory
• Notes Gary records during reviews, consultations, and email correspondence with you
• Recommendations made to you in your report

Transaction information

• Order and invoice records (line items, totals, dates)
• Payment confirmation tokens (we do not see or store your full card number — see Section 5)
• Shipping records and courier tracking numbers

Technical information

• IP address, browser, device type, referrer, and pages visited (via privacy-respecting analytics)
• Cookies set by this website (see Section 10)

3. Why we collect it

We collect personal and health information for the following purposes, all consistent with the Information Privacy Principles in the Privacy Act 2020 and the more specific Health Information Privacy Code 2020:

• To provide the testing service — we need identification, contact details, and health context to ship a kit, instruct the lab, interpret your results, and write a protocol.
• To safeguard you — the Mandatory Health Questionnaire flags conditions or medications that change interpretation or that mean HTMA is not appropriate for you right now.
• To follow up — comparing baseline and follow-up reports requires we keep your prior records.
• To meet our legal obligations — tax invoicing, GST records, and consumer law require we retain transaction records for the periods set by NZ legislation.
• To improve the service — anonymised, aggregated patterns help Gary refine protocols across the wider client base. Individual records are never identifiable in this analysis.

4. How we use it

We use your information only for the purposes set out in Section 3. Specifically:

• To prepare and dispatch your collection kit
• To submit your hair sample to ARL Laboratories (USA) for analysis under your reference number
• To generate your interpretation, protocol, and recommendation summary, which is then emailed to you
• To respond to your questions during the protocol period
• To send you administrative communications (order confirmations, dispatch notices, report-ready notices)
• To send you optional newsletter content if — and only if — you have opted in

We will never use your health information for advertising, profiling, or sale.

5. Who we share with

We share your information only with the third parties strictly necessary to deliver the service. Each recipient is listed below with the specific purpose.

Recipient	Purpose	Information shared
ARL Laboratories (Texas, USA)	To analyse your hair sample and return the HTMA report	Reference number, name, date of birth, biological sex, sample. Lab does not receive your full Health Questionnaire responses.
Stripe (USA)	To process your payment	Name, email, billing address, card details (card details are sent directly from your browser to Stripe — we never see them)
GoHighLevel (USA)	To run our practice CRM, email, and order records	Contact details, order history, email correspondence, intake-form responses
Google Workspace (USA)	For Gary's email, document storage, and calendar	Email correspondence, attached PDF reports, consultation calendar
Xero (NZ/AU)	For accounting, GST, and tax records	Invoice metadata (name, line items, totals). Does not include health information.
Anthropic (USA)	To assist Gary in drafting protocol summaries	De-identified report data and questionnaire context — never your name, address, or contact details. Drafts are reviewed and approved by Gary before they are sent to you.
NZ Post / international couriers	To ship your kit and onward-courier your sample to ARL	Name, postal address, tracking number

We will never sell your data, rent your contact details, or share your information with marketers.

We may disclose your information if required by New Zealand law, by court order, or where there is a serious threat to your life or the life of another person.

6. International transfers

Several of our service providers are located outside New Zealand, principally in the United States. This means some of your information will be stored on servers located overseas. We rely on the following safeguards:

• Each provider is contractually bound by their own privacy and security obligations (Stripe, Google, Anthropic and others operate under enterprise-grade data protection regimes including GDPR-equivalent commitments).
• We minimise what is transferred internationally — for example, identifying details are stripped before any AI-assisted draft generation.
• By using our service you consent to these international transfers as required for delivery of the service you have purchased.

7. How we store and secure it

We take reasonable, current-best-practice technical and organisational steps to protect your information:

• All web traffic between you and our website is encrypted in transit using TLS.
• Data at rest in our CRM, document storage, and accounting software is encrypted by the provider.
• Account access is restricted to Gary and authorised PHT operators, protected by strong passwords and two-factor authentication.
• Access to your records is limited to the people who need it to deliver your service (Gary as practitioner, Mathieson Moller as practice operator).
• Hard-copy records, where they exist, are stored in a locked filing cabinet at the Wellington practice.

No method of transmission over the internet is 100% secure. While we apply commercially reasonable safeguards, we cannot guarantee absolute security. If we become aware of a privacy breach affecting your information we will notify you and the Office of the Privacy Commissioner promptly, in line with the mandatory breach notification provisions of the Privacy Act 2020.

8. Retention & deletion

Different categories of information have different retention periods:

• Health information — retained for ten (10) years from the date of your last test, in line with standard health-records practice in New Zealand. Held longer if necessary for follow-up testing or as required by law.
• Transaction and tax records — retained for at least seven (7) years as required by the Inland Revenue Department.
• Marketing contact data — retained until you unsubscribe or request deletion.

You may request earlier deletion under Section 9 below; we will comply unless we are required to retain the data by law.

9. Your rights

Under the Privacy Act 2020 and HIPC 2020 you have the following rights in respect of information we hold about you:

• Access — you may request a copy of any personal or health information we hold about you. We will respond within twenty (20) working days.
• Correction — if any information we hold is inaccurate, you may ask us to correct it. If we cannot agree, we will record your statement of correction alongside the original.
• Withdrawal of consent — you may withdraw your consent for us to use your information for marketing purposes at any time.
• Deletion — you may request deletion of your information, subject to the legal retention periods above.
• Complaint — if you are dissatisfied with how we have handled your information, you may complain to us first (Section 13). If unresolved, you may complain to the Office of the Privacy Commissioner.

To exercise any of these rights, email gary@precisionhealthtesting.com from the email address you have on file with us. We may need to verify your identity before releasing or amending records.

10. Cookies & analytics

This website uses a small number of cookies and similar technologies:

• Essential cookies — required for basic site function (session, security, checkout). These cannot be disabled.
• Analytics — we use privacy-respecting analytics to understand how the site is used at an aggregated level. We do not use analytics to identify individual visitors.

You can control cookies through your browser settings. Disabling cookies may affect your ability to complete a purchase.

11. Children

HTMA testing for children is permitted only when ordered by a parent or legal guardian. The parent or guardian is the contracting party for purposes of this policy and is responsible for completing the Mandatory Health Questionnaire on the child's behalf. We do not knowingly collect data directly from anyone under the age of 16.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of the page reflects the most recent change. Material changes (for example, a new third-party processor or a change in retention periods) will be communicated to active clients by email at least fourteen (14) days before the change takes effect.

13. Privacy contact

If you have any questions, concerns, or requests relating to this policy or to your personal information, please contact:

We aim to respond to all privacy enquiries within five (5) working days and to resolve substantive requests within twenty (20) working days as required by the Privacy Act 2020.