Project 10
CareOps ANZ
Health data · NZ
Health-information handling for access and correction requests, including the response deadlines attached to them.
01 · Evidence
The result, with the gap left visible.
A privacy request's clock. NZ counts 20 working days — the unit matters as much as the number.
The code computes dueAt = receivedAt + 30 days. There is no working-day arithmetic anywhere in the codebase — no weekend skip, no public-holiday table. Here the wrong unit puts the deadline on a Sunday, two days past the statutory Friday, so a response filed on the Saturday is reported compliant when it is a breach. The size of the gap — and its sign — changes with every request date, which is why it survived review.