Best Data Room for Healthcare & life sciences in New Zealand (2026)

A persistent New Zealand myth is that a health deal turns on the science. Get the molecule working or the device reading accurately, and the rest is paperwork. It is a comfortable belief. It is also wrong in a way that costs founders real money at the table.

Acquirers and specialist investors already assume the science has a chance; they would not be in the room otherwise. What they spend diligence hours on is different: whether you own the thing, whether you can legally sell it, and whether the trail of consents, ethics approvals and regulatory correspondence survives a close reading.

That reframing changes how you build the room. A brilliant clinical result attached to a contested inventorship claim, a lapsed renewal fee, or a trial run without clean participant consent is a liability wearing a good headline number.

This page is about the room that holds all of it. It is shaped for the specific risks of a New Zealand health or life sciences transaction, not a generic trade sale.

What actually gets scrutinised in a NZ life sciences deal?

A life sciences data room is not organised like a trading company’s. The value and the risk sit in workstreams a generalist adviser would not think to ask for, and a buyer’s technical, regulatory and legal reviewers each pull from a different corner of the room.

Structuring by workstream, rather than the familiar corporate-legal-financial split, lets three specialist teams work in parallel. The regulatory reviewer traces the Medsafe file, patent counsel reads the estate, and the commercial team works the licences. None of them waits on the others.

The table below maps those workstreams to what a New Zealand health or biotech buyer expects inside each. Read it as a folder skeleton, not a wish list: build these folders first, populate them privately, then invite anyone in.

For the wider question of what documents go in a data room, the general checklist still sits underneath these health-specific folders.

The six workstreams a NZ health or biotech buyer expects to find, and what sits inside each.

Workstream	What the buyer expects to see
IP and patent estate	Granted patents and applications by jurisdiction, renewal status, assignment deeds, inventorship records, freedom-to-operate opinions, trade-secret registers
Regulatory and Medsafe	Product classification, WAND notifications for medical devices, Medsafe correspondence, ISO 13485 quality records, any TGA or FDA filings for export markets
Clinical and preclinical	Trial protocols, HDEC ethics approvals, participant consent templates, adverse-event logs, data safety monitoring records, CRO and site agreements
Chain of title	University or CRI licence and assignment agreements, sponsored-research terms, founder IP transfers, employee and contractor invention assignments
Commercial and licensing	Distribution and supply agreements, licence deals with royalty terms, Health NZ Te Whatu Ora contracts, key-opinion-leader arrangements
Data and privacy	Data-flow maps, privacy impact assessments, participant and patient data holdings, breach records, hosting and cross-border transfer arrangements

Little of this is the standard corporate binder. A room that holds only the constitution, the cap table and the management accounts is not diligence-ready for a health deal, and a buyer will notice within the first afternoon.

How does the Health Information Privacy Code shape the room?

Health information is the most tightly regulated category of personal data in New Zealand. A room full of it is a compliance surface, not just a filing system.

The Privacy Act 2020 and the Health Information Privacy Code 2020 sit on top of every folder that touches a patient, a trial participant or any identifiable individual. Their rules do not pause because you are mid-transaction.

A deal is exactly when careless disclosure happens. Pressure is high, timelines are short, and the temptation to upload everything and let the buyer sort it out is strongest at the worst possible moment.

The disciplined answer is a filter you run before every upload. Buyers assessing a clinical programme need protocols, consent templates, aggregate outcomes and safety data. They almost never need the identifiable participant records themselves, and handing those over can breach the Code even mid-deal.

Run every file through one filter

Run the tree above and most documents sort themselves. A file with no identifiable information goes to its workstream folder under normal permissions. If it holds identifiable data, ask whether an aggregate or de-identified version answers the buyer. Only the genuine exceptions reach a restricted clean-team folder.

You remain accountable as the agency that holds the information, wherever it is hosted. The hosting location and the access log become part of your own compliance record.

The Office of the Privacy Commissioner expects reasonable safeguards over health information, and its Health Information Privacy Code governs collection, use and disclosure inside a data room like any other holding.

Our explainer on the Privacy Act 2020 and data rooms walks through the notifiable-breach rules that bite if access goes wrong.

Where should identifiable patient and participant data live?

Sometimes the deal genuinely needs raw records. A buyer’s clinical statistician may want to re-run an endpoint, or an acquirer may need to audit source data before it pays for a programme. That is real, and refusing outright can stall a deal that should close.

The answer is not to say no. It is to say “clean team”. A clean-team folder is a ring-fenced space that only named external reviewers can open, walled off from the buyer’s commercial staff, deal principals and anyone who could use the identities competitively.

Who can open the clean-team folder

Inside that folder the controls tighten a further notch. Grant access as a short, named list, and log every entry:

• Named external reviewers only. The buyer’s clinical statistician, regulatory expert or patent counsel, added by name rather than by organisation.
• Commercial staff and deal principals excluded. No one who could act on the underlying identities gets in.
• View-only, download disabled. Identifiable clinical data never lands on a laptop it should not.
• Dynamic watermarking. Every page carries the reviewer’s identity across it.
• Full access log. You can later hand your privacy officer or counsel a record of exactly who opened what.

Treat every identifiable record as the exception that has to justify itself, not the default.

Can you protect an unfiled patent while a buyer inspects it?

The patent estate is usually the single most valuable thing in a life sciences deal, and the easiest to damage during diligence. Two risks dominate, and they pull in opposite directions:

• A competitor posing as a buyer, or a genuine buyer who later walks, sees enough of your unfiled or trade-secret material to erode its value.
• The diligence process itself becomes a public disclosure that destroys novelty on something you have not filed yet, which under New Zealand patent law can be fatal to a later application.

In a health deal the room’s job is to let a buyer verify the estate without ever creating the disclosure that undermines it.

So the crown-jewel material lives under the tightest controls: unfiled invention disclosures, trade-secret formulations, and the freedom-to-operate analysis. Keep it view-only, dynamically watermarked, download disabled, and limited to the buyer’s patent counsel rather than its whole deal team.

Granted patents and published applications can sit more openly, because they are already public. But the connective tissue that reveals your strategy is staged and released only as a buyer clears each gate.

When you weigh providers on the comparison table, read the permission-granularity and watermarking rows through the lens of your most sensitive IP, not your average document. A room that watermarks well but cannot restrict a single folder to two named reviewers is the wrong room for a biotech estate.

How do you handle IP that came from a university or CRI?

Much New Zealand health IP is not born in a company at all. It comes out of a university lab or a Crown Research Institute, passes through a licence or an assignment, and only then lands in the startup that hopes to sell it.

Every step in that journey is a place the chain of title can break.

A buyer will trace ownership all the way back to origin, so the chain-of-title documents belong front and centre rather than buried:

• The licence or assignment agreement with the university or CRI.
• The sponsored-research terms that set who owns background and foreground IP.
• Every founder, employee and contractor invention assignment along the way.

Gaps here are one of the most common reasons health deals stall. Any of these can turn a clean sale into a negotiation about who actually owns the asset:

• An inventor who never signed an assignment.
• A research contract that left background IP with the institution.
• A student contributor with an unresolved claim.

Surfacing a complete chain early removes the question before a buyer thinks to ask it.

Confirm the company’s own records match the entity that holds the IP. A buyer that finds a patent assigned to a dormant shell or a founder’s personal name will treat it as a title defect until you prove otherwise.

What does a Medsafe and clinical file need from the room?

Regulatory diligence in a New Zealand health deal is fundamentally a completeness test. A buyer is rarely re-litigating whether Medsafe was right. It is checking that your regulatory history is intact, consistent and free of surprises, because a gap reads as hidden risk, and hidden risk moves price.

Any of these will trigger a deeper dig:

• A missing WAND notification for a medical device.
• An ethics approval that does not match the protocol version actually run.
• An adverse-event log with unexplained holes.

The room’s job is to make completeness visible so those digs never start.

The timeline shows why sequencing matters. The regulatory reviewer arrives early, and the clinical and IP deep dive overlaps it, so the file has to be traceable from day one rather than assembled under pressure in week six.

Ethics approvals run through the Health and Disability Ethics Committees under the Ministry of Health, and a reviewer will expect each approval to line up with the protocol version actually used. Three capabilities carry most of that weight, and they are worth checking before you sign anything.

Make the regulatory file survive scrutiny

Completeness is the test. Build the file so a reviewer can trace every product from classification to its latest correspondence without emailing you.

1. 1

   Version everything, keep the audit trail

   Ensure the protocol, the consent form and the ethics approval visibly line up, and that nothing was quietly swapped. A reviewer must be able to see the history, not just the latest file.

2. 2

   Index by product, then by stage

   Give each product an indexed, exportable path from classification and WAND notification through to the latest Medsafe correspondence, so a regulatory reviewer never has to ask for the next document.

3. 3

   Route the technical questions

   Regulatory reviewers ask precise questions that must reach your regulatory affairs lead or CRO, not a general inbox. Use assigned Q and A so every answer carries the right authority and a clean record.

Careful question handling matters even more here. A loose answer to a regulatory question is not just untidy; it can misstate your compliance position on the record. Keep the thread, keep the owner, keep the timestamp.

How much should a health data room cost in New Zealand?

There is no single right room. A seed-stage medtech raising on a single device is a different animal from a clinical-stage biotech being acquired by offshore pharma, and a plan built for one is almost always wrong for the other.

Match the room to the deal, and read the middle column of the table before the price. In life sciences it is the volume of regulatory and clinical material, not the headline deal value, that drives how much room you actually need.

Indicative NZD, GST-exclusive. Most providers price per project or on request; confirm the live quote.

Deal profile	What the room needs	Indicative NZD
Early-stage raise (single device or programme)	One controlled space, workstream folders, watermarking, a clean audit trail, light disclosure set	~$0 to $500/mo; a 14-day free trial covers a short raise
Clinical-stage or licensing deal	Multiple reviewers in parallel, staged release, restricted clean-team folders for raw data, full audit export	~$600 to $2,000/mo, per-room or per-page for the deal term
Acquisition by pharma or offshore acquirer	Large regulatory and clinical data sets, many users, ANZ support hours, ISO 13485 and consent records, heavy assurance	~$2,500 to $6,000+, per-project quote, usually per-page

These are indicative figures, not quotes. Most vendors publish GST-exclusive USD, so add 15% GST and expect the New Zealand number to move with the exchange rate.

The pricing overview has provider-by-provider notes, and the cost driver to watch is per-page overage on a document-heavy regulatory file.

Which room actually fits which health deal?

Because the three deal profiles need genuinely different things, a capability that is essential for one is often wasted spend on another. A clean-team folder is non-negotiable for a clinical acquisition and irrelevant to a seed raise. ISO 13485 alignment matters to a device maker and not at all to a software-only diagnostics play.

The matrix below maps the capabilities that decide health deals against the three profiles, so you can see at a glance what to insist on and what to stop paying for.

Which capabilities each health deal profile actually needs. Verify against the specific plan you are quoted.

Capability	Early-stage raise	Clinical / licensing	Pharma acquisition
Granular per-folder permissions	✓	✓	✓
Dynamic watermarking, download off	✓	✓	✓
Clean-team folder for raw participant data	✗	✓	✓
Assigned, routed Q and A	✗	✓	✓
ISO 27001 or SOC 2 certification	helpful	✓	✓
ISO 13485 alignment	✗	helpful	✓
Full exportable audit trail	helpful	✓	✓
ANZ-hours support desk	✗	helpful	✓

Read the matrix in both directions. Use it to check that a cheap plan has not quietly dropped the clean-team control your privacy officer will demand, and equally to check that an expensive one is not billing you for ISO 13485 assurance a diagnostics raise will never touch.

What should you verify before you commit for a health deal?

Once you have matched the room to your deal, a short check on the provider itself protects you from the two failures that bite hardest in health transactions: a data-handling gap your privacy officer cannot sign off, and a regulatory reviewer who cannot get the completeness they need.

• Assurance your compliance team will accept. Encryption in transit and at rest, granular permissions, dynamic watermarking, and independent certification such as ISO 27001 or SOC 2. For a business running a quality system, ISO 13485 alignment is a fair question. Our guide to data room security in New Zealand covers what to insist on.
• Hosting and cross-border clarity. Confirm in writing where health information will be hosted and who can reach it, because you stay accountable under the Health Information Privacy Code. Most rooms host offshore, which can be acceptable if the contract meets your privacy officer’s requirements, but check rather than assume.
• Restricted access for raw participant data. The ability to build a clean-team folder that only named external reviewers can open, so identifiable clinical data never reaches a buyer’s commercial staff.
• Routed questions and an exportable audit trail. Regulatory and clinical reviewers ask precise questions, so you need a threaded record of every answer plus a full access log you can hand to counsel.

For a business with real IP and real regulatory history, a shared drive fails every one of these tests: no per-file permissions, no watermarking, no audit trail. Those are exactly the controls you want when unfiled IP and health data are in play.

A free trial lets you stand up a proper room, build the workstream folders privately, and invite investors or a buyer under NDA before committing to a paid plan.

Questions NZ health and biotech teams ask about data rooms

Can I put identifiable patient or trial-participant data in the room?

Only where the deal genuinely requires it, and even then behind a restricted permission set. In most health diligence a buyer needs protocols, consent templates, aggregate outcomes and safety data, not the identifiable records themselves. De-identify or aggregate before you upload, and treat any raw participant data as clean-team material that only named external reviewers can open.

Does diligence risk breaching a patent I have not filed yet?

It can, which is why unfiled invention disclosures and trade-secret material should never sit openly in the room. Keep them view-only, watermarked, download-disabled and limited to the buyer's patent counsel, and stage their release until a buyer has cleared earlier gates. A controlled reveal lets a buyer verify the estate without a disclosure that undermines novelty under the Patents Act 2013.

How should I handle IP that came out of a university or CRI?

Put the chain-of-title documents front and centre, because a buyer will trace ownership back to its origin. That means the licence or assignment agreement with the university or Crown Research Institute, the sponsored-research terms, and every founder, employee and contractor invention assignment along the way. A gap here is a common reason health deals stall, so surfacing a clean chain early removes a question before it is asked.

Do I need a paid room for an early-stage medtech raise?

For anything with real IP and real regulatory history, yes. A shared drive gives you no per-file permissions, no watermarking and no audit trail, the exact controls you want when unfiled IP and health data are in play. A free trial lets you stand up a proper room, build the workstream folders privately, and invite investors under NDA before committing to a paid plan.

Where does health information have to be hosted for a New Zealand deal?

The Health Information Privacy Code does not mandate onshore hosting, but it keeps you accountable for information you hold wherever it sits. Most virtual data rooms host offshore, which can be fine if the contract and security meet your requirements. Confirm the hosting location in writing, check the certifications, and have your privacy officer sign off before uploading anything identifiable.

How is life sciences data room pricing structured here?

Most providers price per project, per page or per user for a single deal, while advisers running many rooms a year use flat-rate subscriptions. In life sciences the cost driver is usually the volume of regulatory and clinical material rather than the deal value, so ask how per-page overage is charged, add 15% GST, and work from a written quote rather than an indicative range.

Keep reading

• ChecklistWhat documents go in a data roomThe general folder checklist that sits underneath the health-specific workstreams.Read guide
• Buyer's guideData room security in New ZealandEncryption, permissions, watermarking and certifications to insist on for health data.Read guide
• ComplianceThe Privacy Act 2020 and data roomsNotifiable breaches and what they mean for health information you hold.Read guide
• Use caseData rooms for financial institutionsHow regulated, audit-heavy diligence works when the buyer is a bank or insurer.Read guide
• Use caseData rooms for technology, media and telecomIP-led diligence for a software or diagnostics-software play.Read guide