COVID-19: The vaccine and your privacy

As part of our COVID-19 vaccine programme, we need to collect some of your details. Find out what we record, where it's kept, who can access it and more.

Last updated: 13 July 2021

On this page:


Information about your COVID-19 immunisation/s will be recorded in our COVID Immunisation Register (CIR). The CIR is used to help control COVID-19 by providing information about immunisation coverage across the population, and to keep a record of the immunisations you have received or choose not to receive.

Information about your immunisations will be kept up-to-date, even if you change your doctor or go to a health service in another part of the country.


What we record in the CIR

The following details will be recorded:

  • your name, date of birth, gender, ethnicity and health number (National Health Index or NHI)
  • your address and contact details
  • details about the vaccination/s you receive
  • any reactions you have to the vaccine
  • confirmation of priority category for vaccination eg. phase 1a.

The CIR will also record if you decide not to get a COVID-19 vaccine, including if there are medical reasons why you don’t, or if you do not want to be contacted further by the vaccination programme.


Providing your information

By law, all health services are required to keep complete and accurate records. To have the vaccine, we need to collect your information and record it on the CIR, as it is the clinical record of your immunisation treatment. This means there is no ability to opt out.


Accessing and correcting your information

You can access or correct your information, such as updating contact details, by sending an email to either of the below email addresses and asking for access to your information.

Email [email protected]
Email [email protected]

We are working on a plan for you to have secure access to information about yourself and will make further information available about this in future.


Who can access the information on the CIR

Only those people with a role in managing this vaccine programme and related administration can see, add or change the information held in the CIR. Contact tracers can see vaccine information in the CIR to help them identify a person’s risk of exposure to the virus from a close contact. Access to the CIR is limited to those with logon access rights, and all access is recorded and can be audited.

These people may include those involved in administering the vaccine, people who conduct contact tracing, and health professionals who work with you, such as your family doctor, nurse or midwife. Everyone who accesses the CIR is trained to keep the information safe.


After your information is collected

The information collected as part of the vaccination process may be used for:

  • managing your health
  • keeping you and others safe
  • planning and funding health services
  • carrying out authorised research
  • training health care professionals
  • preparing and publishing statistics
  • improving government services.

Some information, such as information about reactions to the vaccine, will be shared with other organisations who provide health services.

Information may also be used for statistical analysis and research purposes, in line with usual Ministry of Health processes and when permitted by the Privacy Act and Health Information Privacy Code.

If we need to use CIR information for other purposes, we will have this reviewed by the Chief Privacy Officer at the Ministry of Health and discuss it with the Office of the Privacy Commissioner to make sure your privacy interests are fully considered.

Vaccine data

Our vaccination dashboard shows a snapshot of our vaccination progress. Data includes:

  • number of people who have received their vaccination so far
  • cumulative vaccinations by DHB
  • cumulative vaccinations by ethnicity.

Vaccine data


Sharing information with employers

Your employer may request confirmation of you receiving a vaccine as part of meeting their obligations under the Health and Safety at Work Act. If your employer wishes to request access to this information, they should contact us at the email below, and provide appropriate confirmation that you agree to the release of this information.

Email: [email protected]  

If you work at the border and are required to be tested under the Required Testing Order, your name and details will be registered on the Border Workforce Testing Register and your vaccination status will be visible to your employer. This is to ensure that only vaccinated workers perform certain roles at the border under the Vaccinations Order.

Border Workforce Testing Register

Vaccinations Order


Storing your information

The CIR operates on a Salesforce platform, which is hosted on Amazon Web Services servers in Sydney, Australia.


How long your information is kept

The information will be held in compliance with our standards. It will be kept for a minimum period of 10 years from the date of your last interaction with the CIR, and longer as clinically determined to be appropriate (in case future medical care providers wish to refer back to these records about you).


CIR Privacy Impact Assessment

COVID-19 Immunisation Register (CIR) Privacy Impact Assessment (PDF, 1.21 MB)

COVID-19 Immunisation Register (CIR) Privacy Impact Assessment (Word, 1.12 MB)


Contact us

If you have questions about your privacy, get in touch with:

Email [email protected]

In this section

Back to top