Data Protection & GDPR Compliance

Governance

Accountability arrangements:

• Person responsible for data protection: doctor@chatdochealth.com
• Supervisory authorities: UK ICO (ico.org.uk), registration ZB936605 for Medic World Ltd; Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) for Cyprus matters, as applicable.
• Records of processing activities are maintained under Article 30 and reviewed annually
• All clinicians and staff are bound by confidentiality and receive data protection training

Processors and sub-processors

When Medic World Ltd processes clinical information solely on Dr Emmanuel’s instructions, a written Article 28 GDPR agreement is required between them before that processing. It must cover instructions, confidentiality, security, sub-processors, rights requests, breach assistance, deletion or return and audits. This notice does not confirm that the agreement has been signed.

• Cloud hosting, database, file storage and serverless functions — hosting of all patient records, EEA region
• Resend — transactional email delivery of reports and prescriptions
• Stripe — payment processing (no health data is shared)
• Lovable AI Gateway — processes questionnaire content to produce the draft AI-supported assessment, with no training on your data
• Domain and content delivery provider — serves the website

We inform patients before adding a new processor that handles health data.

Retention schedule

Data is deleted or anonymised at the end of these periods:

• UK testing health data, including symptoms, answers, photographs, AI output and testing messages: maximum 90 days from each submission, then deleted or irreversibly anonymised. Keeping your account does not extend this limit. Shorter ChatGPT draft limits still apply.
• Medical records, photographs, reports and prescriptions: 6 years from last contact
• Consultation chat messages: 6 years from last contact
• Consent records and audit logs: 6 years
• Uploaded identity documents: maximum 30 days from upload, then securely deleted; a minimal verification outcome may be retained separately where necessary. Identity images are not retained as clinical photographs.
• Payment and accounting records: 6 years
• Inactive accounts with no consultation: 12 months
• Contact and support messages: 24 months
• Analytics data: 14 months

Technical and organisational measures

Article 32 security controls in operation:

• Access-controlled messaging
• HTTPS / TLS in transit
• Private photograph storage with short-lived signed access links
• Row-level database security so patients see only their own records and clinicians only their assigned cases
• Separate clinician and administrator roles, with least-privilege service credentials
• 30-minute inactivity sign-out and secure session handling
• Audit logging of record access, exports and administrative actions
• Encrypted backups with restoration testing

Personal data breach procedure

Steps we follow if an incident occurs:

• 1. Report — anyone who suspects an incident reports it to doctor@chatdochealth.com immediately
• 2. Contain — access is revoked, credentials rotated and the cause isolated
• 3. Record — the incident is logged in the internal breach register with time, categories of data and number of people affected
• 4. Assess — we evaluate the likelihood and severity of risk to patients
• 5. Notify the authority — within 72 hours of becoming aware, where a risk is likely
• 6. Notify patients — without undue delay where the risk is high, in clear language with practical advice
• 7. Review — root-cause analysis and corrective actions are recorded and tracked to completion

Data protection impact assessment (DPIA)

A DPIA is required where processing is likely to create a high risk under Article 35 GDPR. We do not currently claim that a DPIA has been completed or that residual risks have been approved.

• The responsible controllers must document the assessment, necessary safeguards and any requirement for supervisory-authority consultation before high-risk processing proceeds.

Handling data subject requests

How we deal with your requests:

• Requests can be made from the Privacy and your data page in your account, or by email
• We verify identity through your registered account before releasing any data
• We respond within one month, extendable by two further months for complex requests, and we tell you if we extend
• Erasure requests are honoured unless we must retain the medical record to meet a legal obligation; in that case we restrict processing instead and explain why
• Every request and its outcome are recorded for accountability