Privacy Policy

HealthDoc Digital Healthcare Ltd is the data controller for personal data processed through this platform. Our registered address and data protection contact details are available on request by contacting our Data Protection Officer at dpo@healthdoc.health.

We collect the following categories of personal data:

Personal identity data: Your name, date of birth, gender, and relevant patient identifiers you choose to provide.

Contact data: Email address, phone number, postal address, Eircode, and WhatsApp number (optional).

Health data: Chief complaint, questionnaire answers, allergies, current medications, medical history, and any documents issued during consultations. This constitutes special category data under Article 9 of the GDPR and is processed only with your explicit consent and for the performance of our healthcare services contract.

Financial data: We do not store your full card details. Stripe, our payment processor, handles all card data under PCI DSS compliance. We store only masked card identifiers and transaction references.

Technical data: IP address, browser type, operating system, and session cookies necessary to provide the service.

We process your personal data on the following legal bases:

- Performance of contract: Processing necessary to provide the appointment booking and consultation service you have requested.
- Legal obligation: Clinical records must be retained under applicable Irish clinical and professional regulatory requirements.
- Legitimate interests: Platform security, fraud prevention, and service improvement, where these do not override your fundamental rights.
- Explicit consent: Processing of health (special category) data, and sending marketing communications. You may withdraw consent at any time.

- Clinical records (health data, consultation notes, documents): retained in accordance with applicable Irish clinical record requirements.
- Financial records: retained in accordance with applicable tax and accounting requirements.
- Marketing preferences: Until you withdraw consent or request erasure of these preferences.
- Account data: 30 days after you submit an account deletion request, after which your data is permanently deleted (subject to legal retention obligations above).

Under the GDPR you have the following rights:

- Right of access (Subject Access Request): You may request a copy of all personal data we hold about you.
- Right to erasure: You may request deletion of your data. Note that clinical records may need to be retained where legal or professional obligations apply.
- Right to portability: You may receive your data in a machine-readable format.
- Right to rectification: You may correct inaccurate or incomplete data.
- Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.
- Right to restrict processing: You may request we limit how we use your data while a dispute is being resolved.

To exercise any of these rights, email dpo@healthdoc.health or use the Subject Access Request form in your account settings.

We use the following cookies:

- Essential session cookies: Required to maintain your login session and provide the core service. These do not require your consent.
- Analytics cookies: Used to understand how patients use the platform and improve our service. These are only placed with your explicit consent via our cookie banner.
- Chat cookie (hd_chat): Keeps your website chat conversation linked to your browser so you can carry on where you left off. It is strictly necessary for the chat, is set only when you start a chat, and lasts 30 days. It does not require your consent.

We do not use advertising or tracking cookies. We do not share cookie data with third-party advertising networks.

Our public website has a chat you can use to ask general questions about HealthDoc without creating an account. It starts with an automated menu of common questions and can put you in touch with a member of our team.

What we collect: The messages you send, your name and email address if you choose to give them, the page you started the chat on, and your browser type.

Why we collect it: To answer your questions and keep a record of the conversation, based on our legitimate interest in responding to enquiries. We only email you replies to your chat if you tick the consent box in the chat. You can turn email replies off at any time from the chat menu or the link in any chat email.

Who can see it: HealthDoc admin staff who handle website enquiries.

How long we keep it: Chats with our automated menu only are deleted after 30 days. Other chats are deleted after 180 days without activity. These are our default periods and may be adjusted.

Please don't share health details: The chat is for general questions only. Please don't share medical information in it — book a consultation to speak to a doctor. In an emergency call 112 or 999.

Emails: Chat reply emails are sent through our email provider, Resend.

Deleting your chat: You can permanently delete your conversation at any time using "Delete conversation" in the chat menu, or ask us to delete it by emailing dpo@healthdoc.health.

We use the following third-party data processors:

Firebase (Google) — Authentication and user identity
Daily.co — Video consultation infrastructure
Resend — Transactional email delivery, including website chat reply emails
Cloudflare R2 — Encrypted document storage

All processors are bound by data processing agreements and are prohibited from using your data for any purpose other than providing services to us.

Some of our processors (including Firebase) are US-based companies. Transfers of your personal data to these processors are covered by EU Standard Contractual Clauses or another valid transfer mechanism where applicable.

To submit a Subject Access Request or exercise any other data rights, please email dpo@healthdoc.health with the subject line "Data Subject Request". We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (dataprotection.ie).

We will notify you of material changes to this policy by email at least 30 days before the changes take effect. The current version is always available at this URL.