Privacy & security

Health data, treated like it matters

Recoup handles patient information on behalf of your practice. This page says plainly where it lives, who can see it, and where it goes — including the AI that drafts notes and letters.

Hosted in SydneyYour practice's data and the app itself run in Sydney — the closest major region to New Zealand.
Encrypted, and kept apartEncrypted in transit and at rest, with a private database space for every practice.
No recordingsTreatment-note dictation is never recorded or stored as audio. Drafts only happen when you ask.
Privacy Act & HIPCBuilt for the Privacy Act 2020 and the Health Information Privacy Code 2020.

Last updated 3 October 2026 · See also our Terms of use and Clinical disclaimer

Recoup is software your practice uses to run ACC claims, invoicing, payments, treatment notes, letters and reports. Your practice remains the agency responsible for its patients' information under the Privacy Act; Recoup holds and processes it on your behalf and on your instructions. Recoup is provided by Kotahi Health Limited (NZ company number 9464403, NZBN 9429054012288). This page sets out, plainly, where that information lives, who can see it and where it goes.

Where your data lives

Recoup's application and database are hosted in Sydney, Australia. Information is encrypted in transit (TLS) and at rest. Every subscribing practice has its own private database space, so one clinic's data is never mixed with another's.

The secrets that connect you to other systems — your Cliniko API keys and your ACC digital certificates — are stored encrypted with a separate key that is not kept in the database, and are never sent back to a browser.

Signing in and who can see what

  • Each person has their own login. Passwords are stored only as a salted one-way hash, sessions are kept in secure, HTTP-only cookies, and repeated failed sign-ins are slowed down.
  • Setting or resetting a password ends that person's other sessions.
  • Anyone can add a passkey (Face ID, Touch ID, Windows Hello or a device PIN) and sign in with it instead of a password. Recoup stores only the passkey's public key; the private key never leaves the person's device, and a passkey only works on Recoup's own web address, so it can't be phished.
  • Admin logins see the whole practice. Practitioner logins are for clinical and claim work — their appointments, notes, the practice's ACC45s, their own earnings — and practice-wide money and settings stay with admins.
  • Recoup staff do not routinely look at your data. If support needs to, we ask first.

Cliniko

Recoup connects to your Cliniko account with an API key you provide and syncs your clinics, practitioners, patients, appointments and invoices every hour. You can revoke that key in Cliniko at any time.

Recoup only writes to Cliniko when you ask it to:

  • Treatment notes a practitioner saves from Recoup. These use that practitioner's own Cliniko key, so each note is filed under the person who wrote it.
  • A copy of each lodged ACC45 in the patient's treatment notes, and a claim summary in appointment notes — both switched off until an admin turns them on in Settings.

Recoup never deletes anything in Cliniko.

ACC

ACC45 claims, ACC32 requests, documents, invoices and payment and cover checks travel over ACC's official, certificate-authenticated APIs. Every request and every reply is logged, so there is always a record of what was sent to ACC and what ACC said.

AI treatment notes and letters

Recoup can draft treatment notes and letters using Claude, an AI model provided by Anthropic. This is how it works:

  • Dictation happens in your browser. Recoup does not record or store audio. Speech is turned into text by the browser's own speech service, and the words stay on the screen until you choose to draft.
  • Nothing is sent until you press Draft. Then the words of the session, the note template's headings and — only if you tick it — previous notes, are sent to Anthropic to write the draft. A letter sends what you said and the claim details you chose to include.
  • You are the author. Every draft is read and edited by the practitioner before it is saved or sent. The AI is told to write only what was said, never to add findings.
  • Anthropic does not use this data to train its models under its commercial terms. Anthropic's processing may take place outside New Zealand and Australia.
  • Your style examples are private. Notes a practitioner uploads to teach Recoup their writing style are visible only to that practitioner.
  • Recoup's logs record how many notes and letters were drafted — never patient names, transcripts or the note text.

The in-app help assistant also uses Claude. It receives your question and the page you are on — never patient information.

Patient intake and ACC45 pre-fill links

  • Patients see a short form that sends only what they type, plus their signature and their answers to ACC's declaration. It creates a draft claim for your practice to check and lodge; it never reads anything back.
  • Details passed on from your intake form travel in the part of the link that browsers never send to a server, and are cleared from the address bar as soon as the page has read them.
  • On a shared reception iPad, the form clears itself after a few idle minutes and when it is sent.
  • The public form is protected against automated abuse and limited in how often it can be used.

Email, billing and the services we rely on

Recoup uses a small number of specialist providers to deliver the service:

  • Vercel and Neon — hosting and database, in Sydney.
  • Anthropic — AI drafting of notes and letters, and the help assistant, as above.
  • Resend — sends the emails you ask Recoup to send: invoices, reminders and letters.
  • Stripe — handles your subscription payments. Card details go straight to Stripe and never reach Recoup.

Cliniko and ACC are systems your practice already uses; Recoup connects to them on your behalf.

Your data is yours

You can export your claims, invoices, payment records and reports as CSV, and notes and letters as PDF, at any time. If you leave Recoup, your data is deleted on request.

If something goes wrong

If we become aware of a breach affecting your practice's information, we will tell you promptly and give you what you need to meet your own obligations under the Privacy Act.

What we collect

  • Practice and account details — your practice's name, clinics, ACC identifiers and settings; each person's name, email and role; and, for subscriptions, billing contact details (card details go to Stripe, never to us).
  • Information synced from Cliniko — clinics, practitioners, patients (names, dates of birth, contact details), appointments and invoices.
  • Information you enter or create — ACC45 claims and their declarations, diagnoses, invoices, payment records, treatment notes, letters and messages.
  • Information patients send through an intake or ACC45 pre-fill link.
  • Replies from ACC — claim numbers, cover decisions and payment details.
  • Basic usage and performance data — which pages were opened and how quickly they loaded, without patient details — so we can keep Recoup fast and fix faults.

What we use it for

Only to provide Recoup to your practice: to show and process your information, lodge with ACC and email what you ask us to, bill your subscription, keep the service secure, and support you when you ask. We do not sell information, use patient information for advertising, or use it to train AI models.

Information held outside New Zealand

Recoup's servers are in Sydney, Australia, and some providers (Anthropic, Resend and Stripe) may process information in other countries, including the United States. We choose providers that protect information to a standard comparable to New Zealand's, under contracts that limit their use of it to providing their service to us, as Information Privacy Principle 12 requires.

How long we keep it

Your practice's information is kept for as long as your practice uses Recoup, because it forms part of your clinical and financial records. When a practice leaves, its information is deleted on written request, except anything we must keep by law (for example, our own billing records). ACC exchanges are logged for audit and kept with your practice's data.

Cookies

Recoup uses only the cookies it needs to keep you signed in and to remember small settings on your device. There are no advertising or tracking cookies, and this website does not use analytics trackers.

Access, correction and complaints

Under the Privacy Act 2020 you can ask to see, and to correct, personal information held about you. Practice staff can do this through their own practice or by emailing us. Patients should contact their practice, which is responsible for their records and can ask us to help. If you are not satisfied with how a privacy concern has been handled, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

We will update this page when how we handle information changes, and tell practice admins about any material change before it takes effect.

Questions or requests

Kotahi Health Limited is responsible for Recoup. Email support@recoup.nz about anything to do with privacy, security, access or deletion, and a person will reply. Patients asking about their own information should contact their practice, which can ask us to help.