Skip to main content

What New Zealand clinics must do when an AI agent answers the phone.

In New Zealand, the Privacy Commissioner says the Privacy Act applies to everyone using AI tools, and the Health Information Privacy Code covers health information held by clinics. Both require telling people when their information is collected. We found no law requiring an agent to say it is AI. Commercial texts need consent; voice calls fall outside that rule.

What to do

  1. 01Make callers aware their information is being collected, including when a call is recorded: the Privacy Act and the Health Information Privacy Code call for reasonable steps to do so, with exceptions.
  2. 02Get consent before any text or email that promotes services, name the sender and include a working unsubscribe. Voice calls are outside that Act.
  3. 03Protect call data with reasonable safeguards, check the listed grounds before personal information goes overseas, and report a breach likely to cause serious harm to the Privacy Commissioner as soon as practicable.

The rules that apply everywhere in New Zealand

The Privacy Act 2020 and, for clinics, the Health Information Privacy Code apply to a business using an AI agent, and we found no New Zealand law written for AI agents themselves. The Medical Council published guidance on AI in patient care in March 2026, and the Dental Council has guidance on responsible use of AI in oral health practice, updated November 2026. Both leave clinical decisions with the practitioner.

This is a guide for clinic owners, not legal advice. Every line points to the law or the regulator's own page, checked on 2026-11-14. Where we could not confirm something, the page says so.

How to read the labels. Yes, No and Partly rest on a law, rule or regulator statement we read. None found means we found no requirement or statement in the sources and pages we searched, which is not proof there is none. Not confirmed means the sources disagree or we could not read them. Where recording shows words instead, such as All parties, they give the rule in short form: whose consent is needed to record a call or to share the recording, or that the position is contested or not settled; each place page gives the full rule and its exceptions.

For every business

Rules that reach any business in New Zealand whose AI agent answers calls, chats and texts, books visits or handles records.

Can the agent record calls, and what must callers hear?

Yes

The Privacy Act requires reasonable steps to make people aware their information is being collected, which the Privacy Commissioner says includes audio recording, with limited exceptions. Information collected about someone from another person from 1 May 2026 also needs reasonable steps to make them aware, unless they already know or another exception applies. The Crimes Act interception offence excludes a party to the call. A separate code covers voice identification.

For an AI agent: the duty to make people aware their information is being collected applies to a recorded or transcribed call, with limited exceptions; whether details a caller gives about another person trigger the 2026 rule, and whether a vendor recording for the clinic is a party to the call, are not settled.

Does the agent have to say it is AI?

None found

We found no New Zealand law or regulator rule that makes an agent say it is AI. The Fair Trading Act bans misleading conduct and does not mention AI. The Privacy Act and Health Information Privacy Code require telling people when their information is collected. Medical Council guidance says patients should know when AI is used in their care: a simple statement for low-risk AI, explicit information for high-risk AI.

For an AI agent: the sources we read do not show that staying silent about AI breaks a rule, and whether it could count as misleading is unsettled. The Medical Council guidance leaves out purely administrative AI but says such systems should still be used in a transparent and responsible way. The Dental Council guidance names administration: when AI is used for it, patients are told what information is being collected and why.

Can the agent call and text people?

Partly

Commercial texts and emails need the recipient's consent, clear sender details and a working unsubscribe. A message that confirms or completes a transaction the person agreed to is not commercial. Voice calls, including calls with a recorded or synthetic voice, are outside that Act, and we found no other rule on marketing voice calls.

For an AI agent: texts that promote services need consent, sender details and an unsubscribe; the regulator's examples of confirmation messages are orders, not clinic bookings, and whether a recall or reminder text is commercial is not decided.

Where can the data go, and who answers for a breach?

Yes

Organisations must protect personal information with reasonable safeguards, including against misuse by a service provider they give it to. Overseas disclosure needs a listed ground, such as comparable safeguards, and we found no law requiring data to stay in New Zealand. A breach likely to cause serious harm must be reported to the Privacy Commissioner as soon as practicable; the Act states no number of hours.

For an AI agent: Privacy Commissioner guidance says a clinic stays responsible for information a provider stores or processes solely on its behalf, and whether sending data to such a vendor overseas counts as a disclosure is not settled.

What are the rules on automated decisions, staff use and penalties?

Partly

We found no Privacy Act right to human review of an automated decision, and no AI-specific employment rule. Monitoring or recording staff must follow the Privacy Act. A privacy complaint goes to the Privacy Commissioner, then can go to the Human Rights Review Tribunal within six months of the complaint closing. Failing without reasonable excuse to report a notifiable breach carries a fine of up to $10,000.

For an AI agent: call recordings or scores of staff fall under the Privacy Act, and a privacy complaint about what the agent did goes to the Privacy Commissioner first.

For clinics

Extra rules for clinics, where calls and records carry health details.

Does health privacy law cover this clinic?

Yes

The Health Information Privacy Code replaces the Privacy Act principles for health information held by health agencies, including doctors and dentists, and also covers agencies providing services in respect of health information, including under an agreement with another agency. Its rule 3A, on health information collected from someone other than the person or their representative, applies only to information collected from 1 May 2026.

For an AI agent: a voice-agent vendor handling health information may itself be covered by the Code depending on its role, which the pages we read do not decide, and health details a caller gives about another person may fall under rule 3A.

What rules cover call notes, AI scribes and records?

Partly

Providers must keep health information for at least 10 years from the day after services were last provided. The Health Information Privacy Code bars keeping health information longer than lawfully needed and gives people a right of access. Medical Council guidance says to check AI output for accuracy, and Dental Council guidance says to check AI-generated records.

For an AI agent: whether a call recording or transcript counts as health information under the Regulations is not decided, and we did not capture their exceptions; the guidance asks for AI-generated records to be checked for accuracy.

What about clinical advice, triage and a way to reach a person?

Partly

Medical Council guidance says a doctor must be satisfied AI is safe, suitable and clinically justified before using it in patient care. The Code of Rights gives a right to communication the consumer can understand; the Human Rights Act bars less favourable service because of disability, with a limit in section 52. We found no rule that requires offering a human instead of an AI phone agent.

For an AI agent: a caller who cannot use the agent because of a disability can raise an effective communication or discrimination issue, and the Medical Council guidance does not say whether a booking-only agent is in scope.

For dental offices

What the Dental Council and the health privacy rules say for dental offices using an AI agent.

Who regulates dentists here, and has it said anything about AI?

Yes

The Dental Council, set up under the Health Practitioners Competence Assurance Act 2003, regulates dentists and other oral health practitioners. Its practice standards are mandatory minimum standards. Its AI guidance, updated November 2026, says dentists remain accountable for their practice, and does not name voice agents. An updated framework adding lines on AI takes effect on 14 December 2026 and is not yet in force.

For an AI agent: only a registered person may use a title that implies a practitioner, whether an AI agent's wording could imply one is not decided, and the Council's AI guidance does not name voice agents.

What must the agent leave to the dentist?

Partly

Dental Council standards say a practitioner must practise within their competence or refer on. Its AI guidance says AI is not a substitute for clinical judgement, and the updated framework (from 14 December 2026, not yet in force) says the same of clinical decisions. We found no Dental Council practice standard on teledentistry; virtual consultation appears only in the updated framework.

For an AI agent: the guidance leaves clinical judgement with the dentist, and the Council's staff standard speaks of people and does not mention AI phone agents.

What are the rules on advertising and contacting patients?

Yes

The Dental Council advertising standard says not to advertise in a way likely to mislead, deceive or confuse the public, and testimonials need written permission and must be genuine, current and typical. The ASA code, which is self-regulation and not law, has its own testimonial rule. Texts that promote services need consent; we found no rule on marketing voice calls.

For an AI agent: whether a call script counts as advertising under the standard was not tested, and where the standard applies a testimonial needs written permission.

For plastic surgery and cosmetic clinics

What the Medical Council and consumer rules say for plastic surgery and cosmetic clinics, with surgery kept apart from injectables.

Who regulates surgeons and cosmetic practice here?

Yes

The Medical Council registers doctors, sets standards and reviews doctors when performance, conduct or health is a concern. Its Statement on cosmetic procedures (2017) is the standard for doctors performing them; a revision was consulted on in 2025 and is pending, with no final version found. Only a registered person may use a title that states or implies a practitioner of a particular kind.

For an AI agent: the Council's 2026 AI guidance does not cover purely administrative AI, and where booking ends and care begins is unsettled.

What are the rules on ads, photos and before-and-after images?

Yes

Medical Council standards say ads must not glamorise or foster unrealistic expectations, and testimonials must not be used on platforms the doctor controls. Before and after photos must show realistic outcomes, be of the doctor's own patients and be unaltered. The ASA code, which is self-regulation, also bars unrealistic body image, inappropriate urgency and undue pressure.

For an AI agent: the doctor is responsible for advertising a third party writes on their behalf, and whether a phone answer counts as an advertisement was not tested.

What rules cover injectables, med spas and office surgery?

Partly

The Medical Council statement treats injections as non-surgical category 2 procedures, which listed vocational doctors may perform, or others in a collegial relationship with an accredited colleague. A joint statement of seven authorities expects an in-person consultation before first prescribing any therapeutic product. Separately, surgery must be done in facilities with adequate backup services.

For an AI agent: Medsafe's guideline says public ads for prescription medicines need set wording, whether a phone answer is an advertisement was not tested, and the statements are written for doctors and do not mention AI phone agents.

What about after-surgery calls and urgent symptoms?

Yes

For category 1 surgery, the Medical Council statement requires the surgeon to be personally available for at least two weeks afterwards, or to have a formal arrangement. Patients must get written aftercare information in plain language, including who to contact if the surgeon is unavailable. The Council's telehealth statement says telehealth, including phone calls, should not be used for potentially serious or high-risk conditions needing a physical examination.

For an AI agent: these statements are written for doctors and do not mention AI phone agents.

Which regulator governs your clinic

Your clinicWho regulates the people who treat patients
Dental officeThe Dental Council (Te Kaunihera Tiaki Niho) regulates dentists and other oral health practitioners under the Health Practitioners Competence Assurance Act 2003.
Plastic surgery clinicThe Medical Council of New Zealand regulates doctors, including surgeons, and its Statement on cosmetic procedures (2017) is the standard for doctors performing cosmetic procedures.
Medical aesthetics or injectables clinicThe Medical Council regulates doctors who inject, and its cosmetic statement treats injections as a non-surgical category that listed vocational doctors, or others in a collegial relationship with an accredited colleague, may perform. Medsafe, part of the Ministry of Health, publishes the guideline on advertising medicines. Nurses and other practitioners have their own regulators, which we did not research.

Dates coming up

  1. 2026-12-14The Dental Council's updated standards framework, which adds lines on AI and virtual consultations, takes effect and replaces the current framework.
  2. 2026-12-14From the same date, the updated framework says a dentist remains responsible for clinical decisions when using AI tools.
  3. 2026-12-14From the same date, the updated framework says a practitioner needs to understand how an AI tool collects, stores and uses patient data.
  4. 2026-12-14From the same date, the updated framework says to check, before a virtual consultation, that the patient can use the digital platform and that it creates no communication barrier.

What we could not confirm

  • Whether staying silent about AI could count as misleading conduct under the Fair Trading Act, and how much of the privacy notice must be spoken aloud on a call, are not settled.
  • Whether a vendor that records a call for the clinic is a party to it under the Crimes Act, or whether sending data to a vendor that only processes it for the clinic is a disclosure under the overseas rule, is not decided by the text we read.
  • Whether details a caller gives about another person, such as a parent booking for a child, trigger the 2026 rule on collecting information from someone else is not decided.
  • Whether a recall or reminder text counts as a commercial message is not decided.
  • Whether call recordings and transcripts count as health information for the 10 year keeping rule, and where booking ends and patient care begins under the Medical Council's AI guidance, are unsettled.
  • We could not confirm whether a clinic doing surgery must have its premises approved by a health regulator, whether the Medical Products Bill, a Cabinet-agreed proposal and not law, has been introduced or passed, or whether the Medical Council's revised cosmetic statement has been finalised.

Aida is made by Attainment, the company that wrote this guide.

Aida is Attainment's AI agent for clinic phones and messages. Each practice's opening notice, AI disclosure and call handling are set with us before launch, using the rules where it operates; what the law requires is not optional, and this guide does not replace that check. The guide stands on its own whether or not you look at the product.