Privacy Policy

HealthDoc Digital Healthcare Ltd is the data controller for personal data processed through this platform. Our registered address and data protection contact details are available on request by contacting our Data Protection Officer at dpo@healthdoc.health.

We collect the following categories of personal data:

Personal identity data: Your name, date of birth, gender, and relevant patient identifiers you choose to provide.

Contact data: Email address, phone number, postal address, Eircode, and WhatsApp number (optional).

Health data: Chief complaint, questionnaire answers, allergies, current medications, medical history, and any documents issued during consultations. This constitutes special category data under Article 9 of the GDPR and is processed only with your explicit consent and for the performance of our healthcare services contract.

Financial data: We do not store your full card details. Stripe, our payment processor, handles all card data under PCI DSS compliance. We store only masked card identifiers and transaction references.

Technical data: IP address, browser type, operating system, and session cookies necessary to provide the service.

We process your personal data on the following legal bases:

- Performance of contract: Processing necessary to provide the appointment booking and consultation service you have requested.
- Legal obligation: Clinical records must be retained under applicable Irish clinical and professional regulatory requirements.
- Legitimate interests: Platform security, fraud prevention, and service improvement, where these do not override your fundamental rights.
- Explicit consent: Processing of health (special category) data, and sending marketing communications. You may withdraw consent at any time.

- Clinical records (health data, consultation notes, documents): retained in accordance with applicable Irish clinical record requirements.
- Financial records: retained in accordance with applicable tax and accounting requirements.
- Marketing preferences: Until you withdraw consent or request erasure of these preferences.
- Account data: 30 days after you submit an account deletion request, after which your data is permanently deleted (subject to legal retention obligations above).

Under the GDPR you have the following rights:

- Right of access (Subject Access Request): You may request a copy of all personal data we hold about you.
- Right to erasure: You may request deletion of your data. Note that clinical records may need to be retained where legal or professional obligations apply.
- Right to portability: You may receive your data in a machine-readable format.
- Right to rectification: You may correct inaccurate or incomplete data.
- Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.
- Right to restrict processing: You may request we limit how we use your data while a dispute is being resolved.

To exercise any of these rights, email dpo@healthdoc.health or use the Subject Access Request form in your account settings.

We use the following cookies:

- Essential session cookies: Required to maintain your login session and provide the core service. These do not require your consent.
- Analytics cookies: Used to understand how patients use the platform and improve our service. These are only placed with your explicit consent via our cookie banner.

We do not use advertising or tracking cookies. We do not share cookie data with third-party advertising networks.

We use the following third-party data processors:

Firebase (Google) — Authentication and user identity
Daily.co — Video consultation infrastructure
Resend — Transactional email delivery
Cloudflare R2 — Encrypted document storage

All processors are bound by data processing agreements and are prohibited from using your data for any purpose other than providing services to us.

Some of our processors (including Firebase) are US-based companies. Transfers of your personal data to these processors are covered by EU Standard Contractual Clauses or another valid transfer mechanism where applicable.

To submit a Subject Access Request or exercise any other data rights, please email dpo@healthdoc.health with the subject line "Data Subject Request". We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (dataprotection.ie).

We will notify you of material changes to this policy by email at least 30 days before the changes take effect. The current version is always available at this URL.