Medtech Limited v Midlands Health Network Limited

[2018] NZHC 3090

IN THE HIGH COURT OF NEW ZEALAND AUCKLAND REGISTRY

I TE KŌTI MATUA O AOTEAROA TĀMAKI MAKAURAU ROHE

CIV-2018-404-2544

[2018] NZHC 3090

BETWEEN

MEDTECH LIMITED

Plaintiff

AND

MIDLANDS HEALTH NETWORK LIMITED

First Defendant

Continued next page

Hearing:	On the papers
Counsel:	A Lloyd and J Spring for Plaintiff
Judgment:	27 November 2018

JUDGMENT OF WHATA J

This judgment was delivered by me on 27 November 2018 at 4.00 pm, pursuant to Rule 11.5 of the High Court Rules.

Registrar/Deputy Registrar Date: ………………………….

Solicitors:           Minter Ellison Rudd Watts, Auckland

MEDTECH LTD v MIDLANDS HEALTH NETWORK LTD [2018] NZHC 3090 [27 November 2018]

AND  PINNACLE INCORPORATED

Second Defendant

AND  PINNACLE VENTURES LIMITED

Third Defendant

AND  VALENTIA TECHNOLOGIES

(NZ) LIMITED

Fourth Defendant

[1]    Medtech Ltd (Medtech) claims the defendants have, among other things, wrongfully conspired to use Medtech’s software product called Medtech Web Advanced Form (Medtech Web). Medtech knows this because they were inadvertently sent emails between the first and fourth defendants referring to the fourth defendant’s use of Medtech Web. Medtech claims the fourth defendant is a competitor and not authorised to use it.

[2]    Initially, Medtech sought search orders in respect of each of the defendants to obtain evidence of the conspiracy. The application was made without notice. I convened a conference about this. I indicated that I was not prepared to make search orders of the kind mooted (involving the cloning of all information touching and concerning the use of the Medtech products). I indicated however that I was prepared to grant orders preserving the same information and invited the plaintiff to file a revised application clearly identifying the scope of any injunctive relief.

[3]    A memorandum to that effect was filed, together with an affidavit from an IT expert as to the most appropriate method for securing the information. The orders now sought relate to the following classes of documents:

(a)Emails between the defendants about Medtech’s products;

(b)Files and documents relating to Medtech’s products;

(c)The development environment where the defendants have installed Medtech’s products; and

(d)Evidence of any attempted or actual non-compliance with orders to disclose information.

[4]Medtech’s application has been narrowed to:

(a)Restraining the defendants from modifying or destroying the material sought;

(b)Requiring the defendants’ solicitors to take immediate steps to copy the material; and

(c)Requiring the defendants’ solicitors to store in a secure location the material sought (unable to be accessed by the defendants until further order of the court).

[5]    Accompanying the amended application is an affidavit sworn by Barry Foster, Technical Director at Streamlined Litigation Support. He has over 20 years’ experience as an information security specialist and has provided computer forensic services in support of both criminal prosecutions and civil litigation.

[6]    He recommends producing a forensic image (a complete copy of the drive including previously deleted data and other information such as file system information and metadata) of the following:

(a)All defendants’ email servers;

(b)All defendants’ file servers including files and folders relating to Indici;

(c)All devices from all defendants on which the Medtech software is installed or licensed; and

(d)The fourth defendants’ software development environment.

[7]    He opines that it is better to take complete copies of the defendants’ data now, rather than using more limited key-word searches. The latter approach, he says, will be unable to capture any deleted files and will be more intrusive, time consuming, and costly. Once the data has been preserved, and discovery begins, key-word search terms can be used to extract relevant material.

[8]    Finally, Mr Foster comments on the time and costs involved in a preservation exercise. He estimates that each device would be able to be forensically imaged in one day, at a cost of approximately $2,800 (excluding GST and disbursements). Obtaining

evidence that the defendants’ devices have been installed with Medtech software would cost approximately $1,000 per device (excluding GST and disbursements).

[9] At a subsequent telephone conference Mr Lloyd for the plaintiff indicated he would be willing to limit the content subject to the orders to only data on the defendants’ email servers ([3](a) above). While this is a sensible limitation, I remain concerned about the intrusion into the defendants’ privacy involved with copying and retaining their data. As such, I have resolved to make the order sought at [4](a); namely, an order restraining the defendants from modifying or destroying the documents listed at [3]. An urgent inter partes hearing will be required to determine whether forensic imaging should also be undertaken. My reasons now follow.

The parties

[10]The parties are:

(a)The plaintiff – Medtech is a software company that produces, among other things, practice management solutions for health professionals.

(b)The first defendant - Midlands Health Network Ltd (Pinnacle) is a primary health care innovator and development company.

(c)The second defendant – Pinnacle Incorporated has a membership of medical professionals throughout the Midland region of New Zealand

(d)The third defendant – Pinnacle Ventures Ltd (Venture) is a not for profit organisation that built the software solution “indici” and operates a IT infrastructure hosting service.

(e)The fourth defendant – Valentia Technologies (NZ) Ltd (Valentia) is a developer and innovator of software solutions.

The Licence

[11]   Medtech claims that in 2011, it entered into a commercial licence arrangement with Pinnacle for the use of Medtech32 – Advanced Forms. The alleged terms of the Licence are that:

(a)The license is non-transferable;

(b)Use of the licensed software is restricted to Pinnacle and a defined list of permitted users only;

(c)Pinnacle must notify Medtech as soon as it becomes aware of any unauthorised use or breach of the license;

(d)Pinnacle will not themselves, and will not permit others to, create a derivative product, modify, revise, vary, and/or alter the software;

(e)Each installation of the software must be pursuant to a license;

(f)No unlawful copies are to be made of the software;

(g)Pinnacle will protect the software from being accessed or copied;

(h)Pinnacle will not do anything in connection with the software which could bring Medtech’s reputation into disrepute or have a material and adverse effect on Medtech’s interests;

(i)Pinnacle indemnifies Medtech from and against any liability, damage, loss, cost or expense suffered or incurred as a direct or indirect result of any act or omission by Pinnacle or any of the permitted users in breach of the licence agreement or through any other negligence; and

(j)Medtech’s IP ownership is preserved.

[12]   Medtech further claims that at no time has Pinnacle sought or Medtech given permission for Valentia to use the Medtech Web software. Medtech says that contrary to the abovementioned terms, and without any authority from Medtech, the four defendants have conspired to use Medtech Web.

The evidence of conspiracy

[13]   The affidavit evidence of Nirosh Samaraweera (Head of Solutions Sales, Medtech) refers to the following correspondence. On 11 February 2018, David Oldershaw, Pinnacle’s CEO, emailed Nirosh saying that Pinnacle was struggling to obtain a licence for Medtech Web. On 21 February 2018, David followed up with Nirosh, introducing the new CIO for Pinnacle, Valerio Malez. David had asked Valerio to follow up with Mark Robinson (Primary Health Organisation Manager, Medtech) about obtaining the licence for Medtech Web.

[14]   On 21 February 2018, Mark emailed David, apologising for the lack of progress on the issue of Pinnacle obtaining the licence for Medtech Web. The next day, Mark emailed Ankit Sharma (Administration Lead, Medtech) internally at Medtech, requesting that he issue a licence for Medtech Web to Pinnacle, and explaining the purpose of doing so. He did this on the 23rd, emailing the Medtech32 licence key (Licence Key), which had an expiry date of 31 March 2018 to Phillip Duncan (Programme Manager, Pinnacle).

[15]   On 26 February 2018, Phillip Duncan emailed Ankit Sharma (copying in Mark Robinson) stating:

Hi Ankit, we’ve had an internal discussion around this now, and I’ve been tasked with getting my hands on the latest documentation around the implementation of Webconnect/Web advanced forms.

[16]   On 28 February 2018, Mark Robinson then emailed Phillip Duncan the Medtech documentation to use the Medtech Advanced Forms Web titled “Medtech ADVFORMS SCRIPTING REFERENCE version 1.0”. This document is said to constitute important confidential information in relation to how Medtech Web operates.

[17]   On 6 April 2018, Valerio emailed Nirosh saying that the Licence Key had expired. Valerio then forwarded to Nirosh the email containing the Licence Key. The email Valerio forwarded to Nirosh not only contained the Licence Key, but also correspondence earlier in the email chain between Pinnacle and Valentia confirming that Pinnacle had shared the Licence Key for Medtech Web with Valentia without any authorisation to do so.

[18]   The email chain contains an email sent by Phillip Duncan to David, Valerio and others at Pinnacle on 23 February 2018 forwarding the Licence Key. The email said “Break out the champagne!” and then suggested that they “Catch up on Monday, to talk through how we are going to use this in reality”.

[19]   The same email trail suggests that on 4 April 2018, Valerio forwarded the same email to Nayyar Mansoor, Business Analyst at Valentia. Nayyar responded on the same day:

Thanks that’s the same key we had before but its actually expired on 31 March so we need the new key.

Threshold for injunction

[20]The threshold for injunctive relief is well known:1

(a)There must be a serious case to answer;

(b)The balance of convenience should favour the injunction; and

(c)An assessment of the overall justice of the position should favour the injunction.

Serious case to answer

[21]   While pithy, the evidence is nevertheless sufficient to support a serious case of conspiracy to unlawfully use Medtech software. The email correspondence self-

1      American Cyanamid Co v Ethicon Ltd [1975] AC 396, [1975] 1 All ER 504 (HL). See also NZ Tax Refunds Ltd v Brooks Homes Ltd [2013] NZCA 90 at [12].

evidently suggests that the fourth defendant, Valentia, has had access to and been using the Medtech Web software without any express authorisation to do so. I am also satisfied that the orders are necessary to keep secure any information held by the defendants in respect of the Medtech Web product.

Balance of convenience

[22]   The balance of convenience plainly favours the grant of orders in relation to preservation of data, subject to the usual reserving of leave to the defendants to challenge the ex parte orders on short notice. Ordinarily, the defendants would be obliged to keep secure the relevant information as part of their usual discovery obligations. These orders simply secure that outcome, against a backdrop where there is clear evidence of misuse of Medtech’s property.

[23]   However, I am not satisfied I should proceed, ex parte, to make orders requiring the defendants to forensically image their servers and devices. While it appears this may be a relatively simple task, and the information will remain in the control of the defendants, it is nevertheless an invasive and potentially disruptive process. While there is reasonable cause to suspect a conspiracy of the type alleged has taken place, I prefer to afford the defendants an opportunity to oppose such an invasion of their private data. Having said all of that, the defendants should be under no illusion that such orders are likely unless undertakings to similar effect are given. Furthermore, any hint of destruction may result in the directors of the defendant companies being held in contempt of court.

Outcome

[24]   The interim ex parte orders restraining the defendants from modifying or destroying the documents listed at [3] are granted, subject to the condition that the defendants have leave to apply to have the orders set aside on 24 hours-notice. An urgent hearing is to be set down to determine whether orders requiring the forensic imaging of the defendants’ devices are required.

[25]Costs are reserved.