What New Zealand clinics must do when an AI agent answers the phone.
In New Zealand, the Privacy Commissioner says the Privacy Act applies to everyone using AI tools, and the Health Information Privacy Code covers health information held by clinics. Both require telling people when their information is collected. We found no law requiring an agent to say it is AI. Commercial texts need consent; voice calls fall outside that rule.
What to do
- 01Make callers aware their information is being collected, including when a call is recorded: the Privacy Act and the Health Information Privacy Code call for reasonable steps to do so, with exceptions.
- 02Get consent before any text or email that promotes services, name the sender and include a working unsubscribe. Voice calls are outside that Act.
- 03Protect call data with reasonable safeguards, check the listed grounds before personal information goes overseas, and report a breach likely to cause serious harm to the Privacy Commissioner as soon as practicable.
The rules that apply everywhere in New Zealand
The Privacy Act 2020 and, for clinics, the Health Information Privacy Code apply to a business using an AI agent, and we found no New Zealand law written for AI agents themselves. The Medical Council published guidance on AI in patient care in March 2026, and the Dental Council has guidance on responsible use of AI in oral health practice, updated November 2026. Both leave clinical decisions with the practitioner.
This is a guide for clinic owners, not legal advice. Every line points to the law or the regulator's own page, checked on 2026-11-14. Where we could not confirm something, the page says so.
How to read the labels. Yes, No and Partly rest on a law, rule or regulator statement we read. None found means we found no requirement or statement in the sources and pages we searched, which is not proof there is none. Not confirmed means the sources disagree or we could not read them. Where recording shows words instead, such as All parties, they give the rule in short form: whose consent is needed to record a call or to share the recording, or that the position is contested or not settled; each place page gives the full rule and its exceptions.
For every business
Rules that reach any business in New Zealand whose AI agent answers calls, chats and texts, books visits or handles records.
Can the agent record calls, and what must callers hear?
YesThe Privacy Act requires reasonable steps to make people aware their information is being collected, which the Privacy Commissioner says includes audio recording, with limited exceptions. Information collected about someone from another person from 1 May 2026 also needs reasonable steps to make them aware, unless they already know or another exception applies. The Crimes Act interception offence excludes a party to the call. A separate code covers voice identification.
For an AI agent: the duty to make people aware their information is being collected applies to a recorded or transcribed call, with limited exceptions; whether details a caller gives about another person trigger the 2026 rule, and whether a vendor recording for the clinic is a party to the call, are not settled.
- Office of the Privacy Commissioner: Privacy Commissioner: can an agency record me without telling me?“Generally speaking, an agency must tell you if it is collecting your personal information”
- Office of the Privacy Commissioner: Privacy Act 2020, information privacy principle 3: what to tell people“When an organisation collects personal information directly, it must take reasonable steps to make sure that the person knows:”
- Parliamentary Counsel Office (New Zealand Legislation): Privacy Act 2020, information privacy principle 3A (1 May 2026)“If an agency collects personal information about an individual other than from the individual concerned, the agency must take any steps that are, in the circumstances, reasonable to ensure that the individual concerned is aware of”
- Parliamentary Counsel Office (New Zealand Legislation): Privacy Act 2020 section 25A: start date of principle 3A (1 May 2026)“IPP 3A does not apply to personal information collected before 1 May 2026”
- Office of the Privacy Commissioner: Privacy Commissioner guidance on principle 3A: exceptions (1 May 2026)“it will still need to tell the person concerned unless an exception applies”
- Parliamentary Counsel Office (New Zealand Legislation): Crimes Act 1961 section 216B: interception and the party exception“(a) is a party to that private communication”
- Office of the Privacy Commissioner: Biometric Processing Privacy Code 2025: scope“Biometric information relates to people’s physical or behavioural features. For example, a person’s face, fingerprints, voice, keystroke patterns, or how they walk.”
Does the agent have to say it is AI?
None foundWe found no New Zealand law or regulator rule that makes an agent say it is AI. The Fair Trading Act bans misleading conduct and does not mention AI. The Privacy Act and Health Information Privacy Code require telling people when their information is collected. Medical Council guidance says patients should know when AI is used in their care: a simple statement for low-risk AI, explicit information for high-risk AI.
For an AI agent: the sources we read do not show that staying silent about AI breaks a rule, and whether it could count as misleading is unsettled. The Medical Council guidance leaves out purely administrative AI but says such systems should still be used in a transparent and responsible way. The Dental Council guidance names administration: when AI is used for it, patients are told what information is being collected and why.
- Our search (2026-11-14): No rule found requiring a caller to be told they are speaking to AI
- Parliamentary Counsel Office (New Zealand Legislation): Fair Trading Act 1986 section 9: misleading and deceptive conduct“No person shall, in trade, engage in conduct that is misleading or deceptive or is likely to mislead or deceive”
- Office of the Privacy Commissioner: Privacy Act 2020, information privacy principle 3: what to tell people“When an organisation collects personal information directly, it must take reasonable steps to make sure that the person knows:”
- Office of the Privacy Commissioner: Health Information Privacy Code, rule 3(1): telling the person (1 May 2026)“must take any steps that are, in the circumstances, reasonable to ensure that the individual concerned (and the representative if collection is from the representative) is aware of”
- Medical Council of New Zealand: Medical Council guidance on AI in patient care, paragraph 7: transparency“Patients should know when AI is being used in their care.”
- Dental Council: Dental Council guidance on responsible use of AI: informed consent“Before using AI in patient care, explain how it will be used, and its benefits and limitations, so patients can make an informed decision.”
- Medical Council of New Zealand: Medical Council guidance on AI in patient care: scope“This guidance does not cover AI used only for non-clinical, operational, or administrative tasks that do not relate to patient care.”
- Medical Council of New Zealand: Medical Council guidance on AI in patient care, paragraph 7: low-risk and high-risk AI“For low-risk AI, this can be explained in a simple statement that describes how AI is used in their care and how their data is protected. For high-risk AI that influences clinical decisions, you must explicitly inform the patient.”
- Medical Council of New Zealand: Medical Council guidance on AI in patient care: administrative AI“However, these AI systems should still be used in a transparent and responsible way”
- Dental Council: Dental Council guidance on responsible use of AI: privacy and information“When you use AI for patient consultations, records, or administration, you’re handling personal health information.”
- Dental Council: Dental Council guidance on responsible use of AI: privacy duties“tell patients what information is being collected and why”
Can the agent call and text people?
PartlyCommercial texts and emails need the recipient's consent, clear sender details and a working unsubscribe. A message that confirms or completes a transaction the person agreed to is not commercial. Voice calls, including calls with a recorded or synthetic voice, are outside that Act, and we found no other rule on marketing voice calls.
For an AI agent: texts that promote services need consent, sender details and an unsubscribe; the regulator's examples of confirmation messages are orders, not clinic bookings, and whether a recall or reminder text is commercial is not decided.
- Parliamentary Counsel Office (New Zealand Legislation): Unsolicited Electronic Messages Act 2007 section 9: consent“A person must not send, or cause to be sent, an unsolicited commercial electronic message that has a New Zealand link”
- Parliamentary Counsel Office (New Zealand Legislation): Unsolicited Electronic Messages Act 2007 section 11: sender details and unsubscribe“the principal message includes a functional unsubscribe facility that the recipient may use to instruct the person who authorised the sending of the principal message”
- Parliamentary Counsel Office (New Zealand Legislation): Unsolicited Electronic Messages Act 2007, Schedule: voice calls“a call that involves a recorded or synthetic voice”
- Our search (2026-11-14): No rule found on marketing or automated voice calls
- Department of Internal Affairs: Department of Internal Affairs FAQ: messages that confirm a transaction“The Unsolicited Electronic Messages Act states that an electronic message that facilitates, completes or confirms a commercial transaction the recipient previously agreed to is not a commercial electronic message.”
Where can the data go, and who answers for a breach?
YesOrganisations must protect personal information with reasonable safeguards, including against misuse by a service provider they give it to. Overseas disclosure needs a listed ground, such as comparable safeguards, and we found no law requiring data to stay in New Zealand. A breach likely to cause serious harm must be reported to the Privacy Commissioner as soon as practicable; the Act states no number of hours.
For an AI agent: Privacy Commissioner guidance says a clinic stays responsible for information a provider stores or processes solely on its behalf, and whether sending data to such a vendor overseas counts as a disclosure is not settled.
- Parliamentary Counsel Office (New Zealand Legislation): Privacy Act 2020, information privacy principle 5: security“everything reasonably within the power of the agency is done to prevent unauthorised use or unauthorised disclosure of the information”
- Parliamentary Counsel Office (New Zealand Legislation): Privacy Act 2020, information privacy principle 12: overseas disclosure“A believes on reasonable grounds that B is subject to privacy laws that, overall, provide comparable safeguards to those in this Act”
- Our search (2026-11-14): No rule found requiring data to stay in New Zealand
- Parliamentary Counsel Office (New Zealand Legislation): Privacy Act 2020 section 114: notifiable privacy breaches“An agency must notify the Commissioner as soon as practicable after becoming aware that a notifiable privacy breach has occurred”
- Office of the Privacy Commissioner (OPC): OPC: working with third-party providers“Your responsibility for the personal information stored or processed by a third-party provider comes from Section 11 of the Privacy Act.”
What are the rules on automated decisions, staff use and penalties?
PartlyWe found no Privacy Act right to human review of an automated decision, and no AI-specific employment rule. Monitoring or recording staff must follow the Privacy Act. A privacy complaint goes to the Privacy Commissioner, then can go to the Human Rights Review Tribunal within six months of the complaint closing. Failing without reasonable excuse to report a notifiable breach carries a fine of up to $10,000.
For an AI agent: call recordings or scores of staff fall under the Privacy Act, and a privacy complaint about what the agent did goes to the Privacy Commissioner first.
- Our search (2026-11-14): No right to human review of an automated decision found
- Our search (2026-11-14): No AI-specific employment rule found
- Employment New Zealand: Employment New Zealand: monitoring, recording and filming at work“Using cameras, software or other equipment to monitor, record and film employees at work must be done in line with the Privacy Act 2020 and privacy principles.”
- Office of the Privacy Commissioner: Privacy Commissioner: the Human Rights Review Tribunal“You have six months from when OPC closes your complaint to file a claim in the HRRT.”
- Parliamentary Counsel Office (New Zealand Legislation): Privacy Act 2020 section 118: failing to notify a breach“fails to notify the Commissioner of a notifiable privacy breach under section 114 commits an offence and is liable on conviction to a fine not exceeding $10,000”
For clinics
Extra rules for clinics, where calls and records carry health details.
Does health privacy law cover this clinic?
YesThe Health Information Privacy Code replaces the Privacy Act principles for health information held by health agencies, including doctors and dentists, and also covers agencies providing services in respect of health information, including under an agreement with another agency. Its rule 3A, on health information collected from someone other than the person or their representative, applies only to information collected from 1 May 2026.
For an AI agent: a voice-agent vendor handling health information may itself be covered by the Code depending on its role, which the pages we read do not decide, and health details a caller gives about another person may fall under rule 3A.
- Office of the Privacy Commissioner: Health Information Privacy Code 2020: who it covers (1 May 2026)“all agencies providing personal or public health or disability services such as primary health organisations, rest homes, supported accommodation, doctors, nurses, dentists, pharmacists and optometrists;”
- Office of the Privacy Commissioner: Health Information Privacy Code 2020, clause 4(2)(j) (1 May 2026)“an agency which provides services in respect of health information, including an agency which provides those services under an agreement with another agency; or”
- Office of the Privacy Commissioner: Health Information Privacy Code 2020, rule 3A and its start date (1 May 2026)“(5) Rule 3A does not apply to health information collected before 1 May 2026.”
Who is accountable for what the agent says and does?
PartlyThe Code of Rights, a legally binding code, gives every consumer the right to services that follow legal, professional and ethical standards, and requires informed consent, except where the Code or law provides otherwise. Medical Council guidance says doctors stay responsible for clinical decisions and must not use AI to impersonate themselves. Dental Council guidance says dentists stay accountable when using AI.
For an AI agent: the guidance leaves clinical decisions with the doctor or dentist, and the Medical Council guidance does not say whether a branded assistant voice counts as impersonation.
- Health and Disability Commissioner: Code of Rights, Right 4(2): standards“Every consumer has the right to have services provided that comply with legal, professional, ethical, and other relevant standards.”
- Health and Disability Commissioner: Code of Rights, Right 7(1): informed consent“Services may be provided to a consumer only if that consumer makes an informed choice and gives informed consent, except where any enactment, or the common law, or any other provision of this Code provides otherwise.”
- Medical Council of New Zealand: Medical Council guidance on AI in patient care, paragraph 4: clinical judgement“AI is not a substitute for your clinical judgement, and you remain responsible for all your clinical decisions and actions.”
- Medical Council of New Zealand: Medical Council guidance on AI in patient care, paragraph 6: no impersonation“you must not use AI to impersonate yourself in medical practice, including through avatars or chatbots.”
- Dental Council: Dental Council guidance on responsible use of AI: your responsibilities“You remain accountable for your practice, even when using AI”
What rules cover call notes, AI scribes and records?
PartlyProviders must keep health information for at least 10 years from the day after services were last provided. The Health Information Privacy Code bars keeping health information longer than lawfully needed and gives people a right of access. Medical Council guidance says to check AI output for accuracy, and Dental Council guidance says to check AI-generated records.
For an AI agent: whether a call recording or transcript counts as health information under the Regulations is not decided, and we did not capture their exceptions; the guidance asks for AI-generated records to be checked for accuracy.
- Parliamentary Counsel Office (New Zealand Legislation): Health (Retention of Health Information) Regulations 1996, regulation 5 (as at 10 July 2026)“means a period of 10 years beginning on the day after the date shown in the health information as the most recent date on which a provider provided services to that individual”
- Office of the Privacy Commissioner: Health Information Privacy Code 2020, rule 9(1): retention (1 May 2026)“A health agency that holds health information must not keep that information for longer than is required for the purposes for which the information may lawfully be used.”
- Office of the Privacy Commissioner: Health Information Privacy Code 2020, rule 6(1): access (1 May 2026)“(a) confirmation of whether the health agency holds any health information about them; and”
- Medical Council of New Zealand: Medical Council guidance on AI in patient care, paragraph 4: check AI output“you should check the accuracy of any AI output and confirm it is appropriate for the individual patient before using it for patient care or including it in patient records.”
- Dental Council: Dental Council guidance on responsible use of AI: records accuracy“check AI-generated records for accuracy.”
What about clinical advice, triage and a way to reach a person?
PartlyMedical Council guidance says a doctor must be satisfied AI is safe, suitable and clinically justified before using it in patient care. The Code of Rights gives a right to communication the consumer can understand; the Human Rights Act bars less favourable service because of disability, with a limit in section 52. We found no rule that requires offering a human instead of an AI phone agent.
For an AI agent: a caller who cannot use the agent because of a disability can raise an effective communication or discrimination issue, and the Medical Council guidance does not say whether a booking-only agent is in scope.
- Medical Council of New Zealand: Medical Council guidance on AI in patient care, paragraph 1: safe and suitable“Before using AI in patient care, you must be satisfied that it is safe and suitable for the patient, and clinically justified.”
- Health and Disability Commissioner: Code of Rights, Right 5(1): effective communication“Every consumer has the right to effective communication in a form, language, and manner that enables the consumer to understand the information provided.”
- Parliamentary Counsel Office (New Zealand Legislation): Human Rights Act 1993 section 44: goods and services“to treat any other person less favourably in connection with the provision of those goods, facilities, or services than would otherwise be the case”
- Our search (2026-11-14): No rule found requiring a human instead of an AI phone agent
For dental offices
What the Dental Council and the health privacy rules say for dental offices using an AI agent.
Who regulates dentists here, and has it said anything about AI?
YesThe Dental Council, set up under the Health Practitioners Competence Assurance Act 2003, regulates dentists and other oral health practitioners. Its practice standards are mandatory minimum standards. Its AI guidance, updated November 2026, says dentists remain accountable for their practice, and does not name voice agents. An updated framework adding lines on AI takes effect on 14 December 2026 and is not yet in force.
For an AI agent: only a registered person may use a title that implies a practitioner, whether an AI agent's wording could imply one is not decided, and the Council's AI guidance does not name voice agents.
- Dental Council: Dental Council: role and regulatory functions“The Dental Council is established under the Health Practitioners Competence Assurance Act 2003 (HPCA Act) to protect the health and safety of the public by ensuring oral health practitioners are competent and fit to practise.”
- Dental Council: Dental Council patient records standard: status of the standards (1 December 2020)“to the Council’s standards by practitioners is mandatory.”
- Dental Council: Dental Council guidance on responsible use of AI: accountability“You remain accountable for your practice, even when using AI”
- Dental Council: Dental Council standards framework: updated framework (14 December 2026 (not yet in force))“The new framework comes into effect on 14 December 2026.”
- Parliamentary Counsel Office (New Zealand Legislation): Health Practitioners Competence Assurance Act 2003 section 7: titles (as at 10 July 2026)“A person may only use names, words, titles, initials, abbreviations, or descriptions stating or implying that the person is a health practitioner of a particular kind if the person is registered”
What rules cover records, consent, intake forms and x-rays?
YesDental records must be kept at least 10 years from the day after the last care, or until properly transferred. The record includes completed questionnaires, radiographic images, clinical photographs and consent documents. Informed consent comes before care unless another lawful basis exists. A dentist using remote servers stays responsible for their security. We found no Dental Council text aimed at an AI agent taking intake or handling images.
For an AI agent: the standards we read do not say how an automated intake is to be recorded, and whether the audio of a recorded call is part of the record is not addressed.
- Dental Council: Dental Council patient records standard: keeping records (1 December 2020)“You must ensure that your patients’ records are retained for a minimum of 10 years from the day following the last date on which care was provided, or the records are properly transferred.”
- Dental Council: Dental Council patient records standard: parts of the record (1 December 2020)“Radiographic images, clinical photographs, and models”
- Dental Council: Dental Council informed consent standard: consent before care“You must obtain the informed consent of the patient before providing care, unless there is some other”
- Dental Council: Dental Council patient records standard: cloud and remote servers (1 December 2020)“If you are using remote servers hosted on the internet to manage and/or store patient information (also termed ‘cloud computing’), you remain responsible for the security of that information.”
- Our search (2026-11-14): No Dental Council text found on an AI agent taking intake or imaging
What must the agent leave to the dentist?
PartlyDental Council standards say a practitioner must practise within their competence or refer on. Its AI guidance says AI is not a substitute for clinical judgement, and the updated framework (from 14 December 2026, not yet in force) says the same of clinical decisions. We found no Dental Council practice standard on teledentistry; virtual consultation appears only in the updated framework.
For an AI agent: the guidance leaves clinical judgement with the dentist, and the Council's staff standard speaks of people and does not mention AI phone agents.
- Dental Council: Dental Council standards framework: professional standard 8“You must practice within your professional knowledge, skills and competence, or refer to another health practitioner”
- Dental Council: Dental Council guidance on responsible use of AI: clinical judgement“AI is not a substitute for clinical judgement”
- Dental Council: Dental Council updated standards framework: clinical decisions and AI (14 December 2026 (not yet in force))“You remain responsible for clinical decisions when using artificial intelligence tools.”
- Our search (2026-11-14): No Dental Council practice standard on teledentistry found
- Dental Council: Dental Council patient records standard: responsibilities for staff (1 December 2020)“dental practice owners are responsible for ensuring that staff understand and comply with the legal obligations of the HIPC”
What are the rules on advertising and contacting patients?
YesThe Dental Council advertising standard says not to advertise in a way likely to mislead, deceive or confuse the public, and testimonials need written permission and must be genuine, current and typical. The ASA code, which is self-regulation and not law, has its own testimonial rule. Texts that promote services need consent; we found no rule on marketing voice calls.
For an AI agent: whether a call script counts as advertising under the standard was not tested, and where the standard applies a testimonial needs written permission.
- Dental Council: Dental Council advertising standard: misleading advertising (1 September 2020)“You must not advertise in a way that will or is likely to mislead, deceive, or confuse the public.”
- Dental Council: Dental Council advertising standard: testimonials (1 September 2020)“Make sure if your advertisement contains or refers to any personal testimonial, that written permission to use the testimonial has been obtained”
- Advertising Standards Authority (self-regulation): ASA Therapeutic and Health Advertising Code 2025: testimonials (1 April 2026 for new ads, 1 July 2026 for all ads)“Patient or consumer testimonials in advertisements, where not prohibited by law, must comply with the Code, be authenticated, genuine, current and typical.”
- Parliamentary Counsel Office (New Zealand Legislation): Unsolicited Electronic Messages Act 2007 section 9: consent“A person must not send, or cause to be sent, an unsolicited commercial electronic message that has a New Zealand link”
- Our search (2026-11-14): No rule found on marketing or automated voice calls
For plastic surgery and cosmetic clinics
What the Medical Council and consumer rules say for plastic surgery and cosmetic clinics, with surgery kept apart from injectables.
Who regulates surgeons and cosmetic practice here?
YesThe Medical Council registers doctors, sets standards and reviews doctors when performance, conduct or health is a concern. Its Statement on cosmetic procedures (2017) is the standard for doctors performing them; a revision was consulted on in 2025 and is pending, with no final version found. Only a registered person may use a title that states or implies a practitioner of a particular kind.
For an AI agent: the Council's 2026 AI guidance does not cover purely administrative AI, and where booking ends and care begins is unsettled.
- Medical Council of New Zealand: Medical Council: what we do“We serve Aotearoa New Zealand by protecting the health and safety of the public. We do this by setting and promoting standards for doctors and physician associates.”
- Medical Council of New Zealand: Medical Council Statement on cosmetic procedures: purpose (1 November 2017)“The statement may be used by the Health Practitioners Disciplinary Tribunal, the Council and the Health and Disability Commissioner as a standard by which your conduct is measured.”
- Medical Council of New Zealand: Medical Council consultation on regulating doctors performing cosmetic procedures“The consultation closed on Wednesday, 24 September 2025.”
- Parliamentary Counsel Office (New Zealand Legislation): Health Practitioners Competence Assurance Act 2003 section 7: titles (as at 10 July 2026)“A person may only use names, words, titles, initials, abbreviations, or descriptions stating or implying that the person is a health practitioner of a particular kind if the person is registered”
- Medical Council of New Zealand: Medical Council guidance on AI in patient care: scope (10 March 2026)“This guidance does not cover AI used only for non-clinical, operational, or administrative tasks that do not relate to patient care.”
What are the rules on ads, photos and before-and-after images?
YesMedical Council standards say ads must not glamorise or foster unrealistic expectations, and testimonials must not be used on platforms the doctor controls. Before and after photos must show realistic outcomes, be of the doctor's own patients and be unaltered. The ASA code, which is self-regulation, also bars unrealistic body image, inappropriate urgency and undue pressure.
For an AI agent: the doctor is responsible for advertising a third party writes on their behalf, and whether a phone answer counts as an advertisement was not tested.
- Medical Council of New Zealand: Medical Council Statement on cosmetic procedures: advertising (1 November 2017)“Advertising and promotional material must not glamorise products and services or foster unrealistic expectations.”
- Medical Council of New Zealand: Medical Council Statement on advertising: testimonials (1 April 2022)“Testimonials can create unrealistic patient expectations and must not be used in your advertisement or quoted on any platforms you control that advertise your services.”
- Medical Council of New Zealand: Medical Council Statement on advertising: before and after photos (1 April 2022)“If you use “before and after” photos you must ensure that they”
- Medical Council of New Zealand: Medical Council Statement on advertising: responsibility (1 April 2022)“You are responsible for the content of your advertisement, even if a third party wrote the advertisement on your behalf.”
- Advertising Standards Authority (self-regulation): ASA Therapeutic and Health Advertising Code 2025: rule 1(c) (1 April 2026 for new ads, 1 July 2026 for all ads)“Advertisements must not promote an unrealistic sense of body image”
What rules cover consultations, cooling-off periods, consent and deposits?
PartlyA Medical Council statement requires at least seven days between the first consultation and a category 1 procedure (surgery that cuts beneath the skin), and written consent reconfirmed on the day. Consumer Protection says a deposit is generally not refundable, with three exceptions, and an excessive cancellation fee can be an unenforceable penalty. We found no general cooling-off right for in-clinic bookings on its page.
For an AI agent: the seven day gap applies to category 1 surgery and the treating doctor is responsible for obtaining consent; the statement is written for doctors and does not mention AI phone agents.
- Medical Council of New Zealand: Medical Council Statement on cosmetic procedures: period of reflection (1 November 2017)“There must be a period of reflection of at least seven days between any initial consultation and the performance of a category 1 cosmetic procedure.”
- Medical Council of New Zealand: Medical Council Statement on cosmetic procedures: written consent (1 November 2017)“A patient’s informed written consent should be obtained at a pre-procedure consultation within a reasonable time period before the day of the procedure and consent must be reconfirmed on the day the procedure occurs.”
- Consumer Protection (MBIE): Consumer Protection: paying a deposit“Generally, a deposit is not refundable.”
- Consumer Protection (MBIE): Consumer Protection: penalty clauses“Any term of a standard form contract that says you must pay an excessive amount for a breach of contract (an amount that is much more than the loss that the supplier would suffer) is a penalty.”
- Consumer Protection (MBIE): Consumer Protection: contracts and sales agreements, cancelling“You can only cancel a contract in certain situations.”
What rules cover injectables, med spas and office surgery?
PartlyThe Medical Council statement treats injections as non-surgical category 2 procedures, which listed vocational doctors may perform, or others in a collegial relationship with an accredited colleague. A joint statement of seven authorities expects an in-person consultation before first prescribing any therapeutic product. Separately, surgery must be done in facilities with adequate backup services.
For an AI agent: Medsafe's guideline says public ads for prescription medicines need set wording, whether a phone answer is an advertisement was not tested, and the statements are written for doctors and do not mention AI phone agents.
- Medical Council of New Zealand: Medical Council Statement on cosmetic procedures: category 2 (1 November 2017)“A non-surgical procedure (although in some cases it may involve piercing the skin), such as non-surgical cosmetic varicose vein treatment, laser skin treatments”
- Medical Council of New Zealand: Medical Council Statement on cosmetic procedures: category 2 performers (1 November 2017)“may also perform a category 2 procedure if he or she is in a collegial relationship with a vocationally registered surgeon, dermatologist or NZSCM-trained general practitioner”
- Dental Council: Principles for quality and safe prescribing: in-person first“An in-person consultation is expected if prescribing any therapeutic product for the first time”
- Medsafe (Ministry of Health): Medsafe guideline: advertising of therapeutic products“It is lawful in New Zealand to advertise prescription and non-prescription medicines that have been granted consent to their sale, supply or distribution (approved), to the public.”
- Medical Council of New Zealand: Medical Council Statement on cosmetic procedures: facilities (1 November 2017)“Carry out all surgical procedures in facilities where there are adequate and appropriate backup services available to address any foreseeable operative complications.”
What about after-surgery calls and urgent symptoms?
YesFor category 1 surgery, the Medical Council statement requires the surgeon to be personally available for at least two weeks afterwards, or to have a formal arrangement. Patients must get written aftercare information in plain language, including who to contact if the surgeon is unavailable. The Council's telehealth statement says telehealth, including phone calls, should not be used for potentially serious or high-risk conditions needing a physical examination.
For an AI agent: these statements are written for doctors and do not mention AI phone agents.
- Medical Council of New Zealand: Medical Council Statement on cosmetic procedures: follow-up (1 November 2017)“Provide appropriate follow-up. At a minimum follow-up for a category 1 procedure requires that you be available personally for at least two weeks post procedure”
- Medical Council of New Zealand: Medical Council Statement on cosmetic procedures: aftercare information (1 November 2017)“Following any category 1 procedure, provide patients with written information in lay language which tells them:”
- Medical Council of New Zealand: Medical Council Statement on telehealth (August 2023)“Telehealth consultations should not be used for patients with potentially serious or high-risk conditions requiring a physical examination.”
Which regulator governs your clinic
Dates coming up
- 2026-12-14The Dental Council's updated standards framework, which adds lines on AI and virtual consultations, takes effect and replaces the current framework.
- 2026-12-14From the same date, the updated framework says a dentist remains responsible for clinical decisions when using AI tools.
- 2026-12-14From the same date, the updated framework says a practitioner needs to understand how an AI tool collects, stores and uses patient data.
- 2026-12-14From the same date, the updated framework says to check, before a virtual consultation, that the patient can use the digital platform and that it creates no communication barrier.
What we could not confirm
- Whether staying silent about AI could count as misleading conduct under the Fair Trading Act, and how much of the privacy notice must be spoken aloud on a call, are not settled.
- Whether a vendor that records a call for the clinic is a party to it under the Crimes Act, or whether sending data to a vendor that only processes it for the clinic is a disclosure under the overseas rule, is not decided by the text we read.
- Whether details a caller gives about another person, such as a parent booking for a child, trigger the 2026 rule on collecting information from someone else is not decided.
- Whether a recall or reminder text counts as a commercial message is not decided.
- Whether call recordings and transcripts count as health information for the 10 year keeping rule, and where booking ends and patient care begins under the Medical Council's AI guidance, are unsettled.
- We could not confirm whether a clinic doing surgery must have its premises approved by a health regulator, whether the Medical Products Bill, a Cabinet-agreed proposal and not law, has been introduced or passed, or whether the Medical Council's revised cosmetic statement has been finalised.
Aida is made by Attainment, the company that wrote this guide.
Aida is Attainment's AI agent for clinic phones and messages. Each practice's opening notice, AI disclosure and call handling are set with us before launch, using the rules where it operates; what the law requires is not optional, and this guide does not replace that check. The guide stands on its own whether or not you look at the product.