Privacy policy
Last updated: 15 September 2026
The Sleep Spot is operated by eastMED Pharmacy 2015 Limited. We respect your privacy and are committed to protecting the personal and health information we collect and hold.
This Privacy Policy explains how we collect, use, store and disclose your information when you visit our website, purchase products from us, contact us, interact with us through other channels, or use services provided by The Sleep Spot.
We handle personal information in accordance with the Privacy Act 2020 and, where applicable, health information in accordance with the Health Information Privacy Code 2020 and other applicable New Zealand law.
In this policy, “The Sleep Spot”, “we”, “us” and “our” refer to eastMED Pharmacy 2015 Limited trading as The Sleep Spot.
We aim to collect only the personal and health information that is reasonably necessary for the purposes described in this Privacy Policy.
1. Information We Collect
The information we collect depends on how you interact with us and the products or services you use.
Personal & Contact Information
We may collect information such as:
- your name and title;
- billing and delivery address;
- email address;
- telephone number;
- date of birth where required for a service;
- account information;
- order and purchase history;
- appointment information;
- correspondence and communications with us; and
- information you provide when making an enquiry, requesting support or completing a form.
Payment Information
When you make a purchase, payment information is processed through the payment methods and payment providers available through our store.
We may receive information about the status and details of a transaction that is necessary to process your order, issue a refund, reconcile payments or investigate a payment issue.
Payment providers may collect and process payment information in accordance with their own privacy and security practices.
We do not need to receive or retain your complete payment-card details where those details are processed directly by our payment provider.
Health Information
Where you use our sleep health, CPAP or related services, we may collect health information that is reasonably necessary to provide those services.
Depending on the service, this may include:
- your date of birth and, where relevant to the service, sex or gender information;
- information about your sleep and sleep-related symptoms;
- relevant medical or health history that you provide to us;
- sleep, health and health-related lifestyle information;
- health insurance information where relevant;
- details of healthcare professionals involved in your care;
- information about the products and medical devices you use;
- CPAP device details and prescribed or current therapy settings;
- CPAP usage and therapy data;
- information about mask fit, comfort, leaks or treatment issues;
- sleep test information, results and risk indications;
- information required for CPAP trials, treatment setup, optimisation, monitoring or treatment reviews;
- information provided by a healthcare professional, care facility or authorised representative in relation to your care;
- information required to provide technical or clinical support; and
- other health information you choose to provide to us.
We aim to collect only the health information reasonably necessary for the purpose for which it is being collected.
Healthcare Professionals
If you interact with us in a professional capacity, we may collect information such as your name, professional role, organisation, workplace contact details, communications with us, training or support interactions, and information necessary to coordinate the care or support of a customer or patient.
We may use this information to communicate with you, respond to enquiries, provide product or service information, provide training or technical support, coordinate patient care where appropriate, and maintain our professional relationship with you.
2. How We Collect Information
We generally collect information directly from you when you:
- place an order;
- create or use an account;
- contact us by email, telephone, text message, social media, online form or in person;
- make or attend an appointment;
- attend a consultation or mask fitting;
- undertake a sleep test;
- participate in a CPAP trial or monitoring service;
- ask us to configure, monitor or assist with a CPAP device;
- register for or use one of our services;
- subscribe to our marketing communications; or
- otherwise interact with us.
We may also receive information about you from another person or organisation where this is reasonably necessary and permitted by law.
This may include information from:
- your authorised representative or family member;
- a healthcare professional or sleep service involved in your care;
- a hospital, pharmacy or care facility;
- a CPAP device or therapy monitoring platform;
- a sleep testing platform;
- a manufacturer, distributor or supplier;
- a payment provider;
- a courier or delivery provider; or
- another service provider involved in providing a product or service to you.
Where we collect health information about you indirectly, we will take reasonable steps to ensure you are informed about the collection where required by applicable New Zealand privacy law, unless an applicable exception applies.
3. Why We Collect & Use Your Information
Depending on your relationship with us, we may collect and use your information where reasonably necessary to:
- process, fulfil and deliver orders;
- process payments and refunds;
- communicate with you about an order, appointment, service or enquiry;
- provide customer service and technical support;
- provide sleep testing and related information or reports;
- provide CPAP setup, configuration, trials, treatment support, monitoring, optimisation and treatment reviews;
- provide mask-fitting services;
- communicate with a healthcare professional involved in your care where appropriate, including providing relevant information or treatment outcomes where you have been referred to us for treatment or support and the disclosure is authorised or otherwise permitted by law;
- administer manufacturer warranties, registrations, guarantees and product support;
- maintain appropriate health, financial and business records;
- operate, maintain and improve our website, products and services;
- undertake appropriate statistical analysis, service evaluation or research in a manner permitted by law;
- detect or prevent fraud, misuse or security threats;
- send marketing communications where permitted;
- meet obligations relating to the supply and support of medical devices;
- comply with our legal, regulatory and professional obligations; and
- establish, exercise or defend legal rights.
Where health information is involved, we will use it for the purpose for which it was collected, a directly related purpose, or another purpose permitted by the Health Information Privacy Code 2020 or other applicable law.
Where practicable, we may use aggregated or de-identified information for statistical analysis, service evaluation, business planning and improvement of our products or services.
4. CPAP Monitoring, Sleep Testing & Health Services
Some of our services involve the collection and use of health information through specialist systems or platforms.
For example, CPAP devices may record therapy information that can be made available through a manufacturer's or service provider's remote monitoring platform. Sleep testing may also involve information being collected, stored, analysed or reported through specialist sleep testing systems.
Where you choose to use these services, relevant information may be accessible to authorised members of The Sleep Spot team, sleep physiologists and other healthcare professionals involved in providing or supporting the service.
We may use relevant health information to:
- conduct or support sleep testing;
- prepare or facilitate sleep test reports;
- configure or assist with CPAP therapy;
- monitor CPAP usage and therapy information;
- review treatment progress;
- identify equipment, mask or therapy-related issues;
- provide follow-up support;
- respond to your questions; and
- communicate relevant information to healthcare professionals involved in your care where authorised or otherwise permitted by law.
Access to health information is limited to people who reasonably require access for their role or the service being provided.
5. Sharing & Disclosure of Information
We do not sell or rent your personal or health information.
We may disclose information where reasonably necessary to provide our products or services, where you have authorised the disclosure, or where disclosure is otherwise permitted or required by law.
Depending on the circumstances, information may be disclosed to:
- payment processors and financial service providers;
- ecommerce and website service providers;
- courier and delivery providers;
- technology, hosting and cloud service providers;
- manufacturers, distributors or suppliers where necessary for warranty, product support, registration or other services;
- sleep testing and CPAP monitoring service providers;
- sleep physiologists and other healthcare professionals involved in providing services to you;
- healthcare professionals involved in your care where appropriate;
- professional advisers such as accountants, lawyers or insurers where reasonably necessary;
- government, regulatory or law-enforcement agencies where required or permitted by law; and
- other contractors and service providers acting on our behalf.
We will not disclose health information simply because another person requests it. Health information will only be disclosed where you have authorised the disclosure or another lawful basis for disclosure applies.
Where practicable, we limit the information shared with third parties to what is reasonably necessary for the relevant purpose.
Service providers acting on our behalf are expected to handle information appropriately and consistently with their contractual and legal obligations.
6. Information About Another Person
If you provide us with personal or health information about another person, you should only do so where you have appropriate authority or another lawful basis to provide that information.
In some circumstances, we may need to verify your identity or authority before providing information about another person or allowing you to act on their behalf.
Where we receive personal or health information about an individual indirectly, we will comply with applicable notification requirements unless an exception applies.
7. Marketing Communications
Where permitted, we may send you communications about our products, services, promotions, CPAP education, sleep health information and other news from The Sleep Spot.
You can unsubscribe from marketing emails at any time by using the unsubscribe link contained in our marketing emails.
You may still receive communications that are necessary to provide a product or service or manage our relationship with you, including order confirmations, shipping notifications, appointment or service communications, safety information and responses to your enquiries.
We may use service providers to help us manage and deliver marketing communications.
We do not intentionally provide identifiable health information collected through our health services to advertising platforms for personalised advertising.
8. Cookies, Analytics & Advertising
Our website uses cookies and similar technologies to operate our online store, remember preferences, understand website usage, improve our services and, where applicable, measure or support advertising.
These technologies may collect information such as:
- IP address;
- browser and device information;
- pages viewed;
- referring website;
- interactions with our website;
- approximate location derived from technical information; and
- information about purchases or other website activity.
Some cookies and similar technologies are necessary for our website and checkout to function. Others may be used for analytics, personalisation or advertising.
Third-party service providers may process information collected through these technologies in accordance with their own privacy practices.
You may be able to manage cookies through your browser or through privacy or cookie controls made available on our website. Blocking some cookies may affect how parts of the website function.
We do not intentionally provide identifiable health information collected through our sleep testing, CPAP monitoring or other health services to advertising platforms for personalised advertising.
9. Overseas Service Providers
Some of the technology and service providers we use may store or process information outside New Zealand.
This may include providers of ecommerce systems, cloud storage, email services, payment processing, analytics, CPAP monitoring, sleep testing or other technology services.
Where personal or health information is disclosed outside New Zealand, we will take reasonable steps to ensure that the disclosure complies with applicable New Zealand privacy requirements.
Where required, this may include ensuring that the recipient is subject to comparable privacy safeguards, using appropriate contractual protections, obtaining authorisation, or relying on another lawful basis for the disclosure.
10. Storage & Security
We take reasonable steps to protect personal and health information against loss, misuse, unauthorised access, disclosure, alteration and other misuse.
Depending on the nature of the information and systems involved, safeguards may include access controls, authentication, secure systems and service providers, staff confidentiality requirements, limiting access according to role and need, and appropriate physical and electronic security measures.
No method of electronic transmission or storage can be guaranteed to be completely secure. However, we take reasonable safeguards appropriate to the nature and sensitivity of the information we hold.
11. Retention of Information
We retain personal and health information only for as long as reasonably necessary for the purposes for which it may lawfully be used, or for any longer period required by applicable legal, regulatory or professional obligations.
Different types of information may therefore be retained for different periods.
Health information and records may be subject to specific minimum retention requirements. Financial and transaction records may also need to be retained for periods required by law.
Once information is no longer required to be retained and there is no lawful reason to continue holding it, we will take reasonable steps to securely delete, destroy or anonymise it.
12. Accessing & Correcting Your Information
You have rights under New Zealand privacy law to request access to personal or health information we hold about you and to request correction of that information.
If you would like to request access to your information, or believe information we hold about you is incorrect, incomplete or out of date, please contact us.
We may need to verify your identity or authority before providing access to information.
In some circumstances, applicable law permits or requires us to withhold information. If this applies, we will explain this where required.
If we do not make a correction you have requested, you may have the right to ask us to attach a statement of correction to the information.
These rights are subject to applicable New Zealand law and are not necessarily equivalent to an unrestricted right to require deletion of records that we are legally or professionally required to retain.
13. Privacy Breaches
If a privacy breach occurs, we will assess the circumstances and take appropriate steps to contain, investigate and respond to the breach.
Where a privacy breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals where required by the Privacy Act 2020.
14. Children & Young People
Our online store is not intended for children to make purchases independently.
However, some of our products or health-related services may be provided to children or young people.
Where this occurs, we will handle their information in accordance with applicable privacy law and take account of the circumstances, including the age and capacity of the child or young person and the role of a parent, guardian or authorised representative where appropriate.
15. Business Transfers
If all or part of our business is sold, reorganised, merged or transferred, personal information may be transferred as part of that transaction where permitted by law.
Any handling of personal or health information in connection with such a transaction will remain subject to applicable privacy requirements.
16. Third-Party Websites & Services
Our website may contain links to websites or services operated by other organisations.
We are not responsible for the privacy practices of independent third-party websites or services that we do not control.
We recommend reviewing the privacy information provided by those organisations before providing information directly to them.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, technology, services or legal requirements.
The current version will be published on our website and will show the date it was last updated.
Changes to this Privacy Policy will not remove or reduce rights you have under applicable law.
18. Contact Us & Privacy Complaints
If you have a question about this Privacy Policy, would like to request access to or correction of your information, or wish to make a privacy complaint, please contact:
Privacy Officer
The Sleep Spot / eastMED Pharmacy 2015 Limited
188 St Heliers Bay Road
St Heliers
Auckland 1071
New Zealand
Email: hello@thesleepspot.co.nz
We will endeavour to respond to privacy enquiries and concerns promptly and appropriately.
If you are not satisfied with our response, you may also make a complaint to the Office of the Privacy Commissioner of New Zealand.