Privacy Notice

• Name;
• Date of birth;
• Birth Sex;
• Email address;
• Mobile number;
• Contact details of next of kin;
• GMS number;
• PPSN;
• Account details;
• Records of payment; and
• Home address and eircode.

• Medical and surgical history;
• Consultation dates/appointments;
• Consultation responses;
• Clinical notes;
• Medication details;
• Symptoms;
• Diagnoses;
• Allergies;
• Individual health identifier;
• Religion;
• Sexual orientation;
• Family members;
• Family history;
• Contact details of next of kin;
• Vaccination details;
• Laboratory test results;
• Genetic data;
• Reports, correspondence and clinical information received where you are referred by Webdoctor to a specialist or consultant;
• Information relating to the outcome of the referral and any recommendations made by a consultant or specialist;
• Diagnostic assessments (e.g. x-ray, and other laboratory test reports); and
• Other data which is necessary and proportionate to provide medical care.

• Apps, browsers and devices that you use to access webdoctor.ie services;
• Device data including unique identifiers, browser type and settings, device type and settings, operating system and application version number; and
• Information about the interaction of you and your browsers and devices with our services, including IP address, crash reports, system activity, and the date, time and referrer URL of your request.

Please see our Cookies Policy for more information.

• Marketing preferences;
• Name;
• Email address;
• Mobile number; and
• Home address and eircode.

• Aggregated data generated from Basic Administrative Details (as described above) which will also be anonymised; and
• Aggregated data generated from Medical Information (as described above) which will also be anonymised.

Please note: when your Personal Data is aggregated and/or anonymised, it will not identify you.

• Basic Administrative Details (as described above); and
• Medical Information (as described above).

• Image, audio and/or video recordings at our in-person clinic(s) generated via CCTV.

To provide medical treatment and services

It is necessary to process your Personal Data for the purposes of:

• preventive or occupational medicine;
• medical diagnosis;
• the provision of medical care, treatment or social care;
• protecting the vital interests of patients; and
• the management of health or social care systems and services;

We will collect, use, store and otherwise process your Personal Data for the following purposes:

• to provide and support our medical services;
• so that our medical team can make a clinical decision if the service (and treatment) is safe and suitable for you; and
• to input into our clinical decision support system to assist our medical personnel in the decision making process.

• Basic Administrative Details
• Medical Information

To provide and manage our administrative services to you

It is necessary to process your Personal Data in order to enter into and perform our contract with you.

IMPORTANT:

It is a contractual requirement for us to collect your Personal Data for the purposes set out and, in the event that you do not provide us with your Personal Data, we will not be able to enter into or perform our contract with you or provide you with the requested services.

We will collect, use, store and otherwise process your Personal Data for the following purposes:

Provide you with our service:

• to provide and support the services described in the Webdoctor terms and conditions, including billing for our services.

Communicate with you:

• to alert you of new messages from your doctor, and so that our team can contact you if required; and
• depending on the service selected, to provide you with a prescription or medical certificate or home test kit.

• Basic Administrative Details
• Medical Information

To comply with our legal obligations

It is necessary for us to collect and process your Personal Data in order to comply with the legal obligations imposed on us under applicable Irish or European Union law (as implemented or amended from time to time).

We will process your Personal Data to comply with applicable laws and regulations to which we are subject. This may include:

• complying with legal obligations under Irish and European laws (including the Infectious Diseases Regulations 1981–2024);
• complying with regulatory and professional obligations applicable to the provisions or medical services (including requirements relating to clinical governance, audit and reporting); and
• responding to, and cooperating with, requests or orders from public and government authorities, courts or regulators in accordance with our obligations.

• Basic Administrative Details
• Medical Information
• Clinical Governance, Audit and Reporting Data
• CCTV Data

Your consent

We may process your Personal Data if you provide us with consent to do so. If you give consent, you agree to the processing of your Personal Data for the specific purposes outlined.

IMPORTANT:

Your consent is voluntary, and you have the right to withdraw it at any time. If you choose not to provide your consent or withdraw it, we will not be able to process your Personal Data for the purposes specified. It will not affect your medical care or your ability to use our service.

Please note that in cases where your Personal Data are anonymised (with your consent), the right to withdraw consent will no longer apply to data because it is anonymous (and therefore does not identify you).

We will collect, use, store and otherwise process your Personal Data for the following purposes:

Third party disclosure requests:

• to share your Personal Data with a third party recipient where you have requested or consented to such sharing (e.g. your insurance company, your solicitor or your bank).

Improvements and Health Research:

• To improve our service and to help us make better clinical decisions, we (or third parties who we partner with) may analyse information about how to find improvements in medical treatment or diagnosis, and to make clinicians aware of risks, as well as other health research purposes.
• Where we are not under a legal obligation to process your Personal Data for this purpose, we will request your explicit consent to anonymise and aggregate your Personal Data (including your Medical Information) for such research.

NOTE: We may from time to time publish research based on aggregated and anonymous data (i.e., any details which would identify you, such as your name, date of birth, contact details, are removed so that you are not identifiable).

• Basic Administrative Details
• Medical Information
• Aggregated Clinical Data

Marketing:

• If you consent to receive marketing updates, we use your information to keep you informed about our service (such as when we release new services or products or run special offers), services you are interested in, general health topics and about exclusive offers.

• Marketing Data

Cookies and tracking technologies:

• Where we collect your Personal Data by using cookies on our website, which are not essential for the website to operate, we require your consent to do so. Please see our Cookies Policy for more information.

• Device and Network Information

To serve our patients – our legitimate interests

Depending on our business needs, it is necessary to process your Personal Data where we have legitimate business interests to do so.

IMPORTANT:

Before we process your Personal Data to pursue our legitimate interests for the purposes identified, we determine if such processing is necessary and we carefully consider the impact of our processing activities on your fundamental rights and freedoms. On balance, we have determined that such processing is necessary for our legitimate interests and that the processing which we conduct does not adversely impact on these rights and freedoms.

You have certain rights when we process your Personal Data on this basis, such as the right to object. For more information on exercising this right, we encourage you to read section 8 of this Notice.

We will collect, use, store and otherwise process your Personal Data for the following purposes:

• to record telephone calls for training and verification purposes.

• Basic Administrative Details

When you visit our in-person clinic(s), we may collect, use, store and otherwise process your Personal Data for the following purposes:

• to monitor our in-person clinic(s) (using CCTV) to ensure the security, safety and protection of our staff, vendors and visitors.

• CCTV Data

To be a party in legal claims

It may be necessary for us to collect and process your Personal Data to investigate, establish, exercise or defend actual or potential legal claims.

We will collect, use, store and otherwise process your Personal Data for the following purposes:

• to file legal proceedings;
• to investigate, establish, exercise or defend a legal claim; and
• to settle legal claims.

• Basic Administrative Details
• Medical Information
• CCTV Data

To protect your vital interests and health in the public interest

It may be necessary to process your Personal Data to protect your vital interests or for reasons of public interest in the area of public health. For example, to protect against serious national or cross-border threats to your health, subject to suitable and specific measures to safeguard your rights and freedoms.

We will collect, use, store and otherwise process your Personal Data to protect you and public health in relation to outbreaks of disease whether in accordance with Irish, or European Union law, protocols of the Irish Government (including without limitation, Government Departments), recommendations from the World Health Organisation, public health or health & safety guidance or otherwise.

• Basic Administrative Details
• Medical Information
• Clinical Governance, Audit and Reporting Data

If you have been treated by our clinicians / medical personnel, we will retain your Personal Data for a minimum period based on the following criteria:

• Adult (18 years old and older): eight years after last treatment or death.
• Children and young people: until the patient’s 25th birthday, or 26th if the young person was 17 at the conclusion of treatment, or eight years after the patient’s death.
• Maternity records: 25 years after the birth of the last child.
• Records of a mentally disordered patient: 20 years after last treatment or eight years after death.
• Patients who have committed suicide (not included in mentally disordered persons as above): 10 years.
• Cause of death certificate counterfoils: 2 years.

This criteria may of course change if the law or national guidelines require it.

• Patient care is team based and access to your Personal Data is crucial for your safety and continuity of care.
• The sharing of Personal Data within the Webdoctor team is on a need-to-know basis, depending on the role the member of staff has in your care.
• All our clinicians and staff are bound by a confidentiality clause in their contracts. Also, under Medical Council guidance, it is a condition of registration to abide by the guidance set out by the Medical Council, which includes a requirement to respect patient confidentiality.

• Third-party service providers who assist us in operating and delivering our services; and
• Service providers who otherwise provide support services or require your personal data to perform the services requested by us.

• Consultants, specialists, laboratories, diagnostic providers and other healthcare professionals to whom you are referred or from whom we receive reports or test results relevant to your care, or to whom we are required to share your Personal Data in order to meet our legal and regulatory obligations (e.g. for clinical governance, audit and reporting requirements).

• [External advisors such as lawyers, insurers, auditors and professional advisers, as necessary to protect our legitimate and legal interests.]

• [Parties to transactions or potential transactions (and their legal and professional advisors) involving Webdoctor.]

• Regulatory authorities, public bodies and law enforcement agencies (where we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request) such as courts, tribunals, the DPC, An Garda Síochána, Revenue, Department of Social Protection, the Medical Council, the Coroner, the HSE or other competent authorities and public health bodies.

• Other disclosures can be made with your explicit consent. This could be a request from an insurance company, employer or legal proceedings request but any disclosure must be with, and limited to, the authority provided by you.

You have the right to access the Personal Data we process about you. If you exercise this right, you will receive confirmation about whether we process your Personal Data and, if so, a copy/copies of your Personal Data.

Accessing your Personal Data:

You can export a copy of the data associated with your Webdoctor account anytime using the export functionality under your “My Account” feature. This will be in a machine-readable format and can be used in other healthcare systems.

You have the right to request that we amend any inaccurate Personal Data that we have about you.

Where you exercise your right to rectification, we may request proof of identity to ensure we are dealing with the correct person to make sure that your Personal Data is only updated by you.

You have a right to request, in certain circumstances, the deletion of your Personal Data – for example if you exercise the right to object and we do not have an overriding reason to continue processing your Personal Data or if we no longer need to process your Personal Data.

Account Deactivation, Deletion and Erasure:

If you have not actually used any medical services, when you delete your account, we permanently delete your Webdoctor account and all the information associated with this account. Once your account is deleted you will not be able to use our service and if you change your mind you will have to re-register.

The only exception is if you have had a consultation with our medical personnel, in which case we deactivate your account and keep your data for the minimum periods as set out in section 4 above.

Deactivation of your account means you will not be able to use our service and if you change your mind, you will have to contact support at info@webdoctor.ie to reactivate your account.

You have a right to withdraw your consent to our processing of your Personal Data at any time.

Aggregated Clinical Data

Please note that in cases where your Personal Data are anonymised (with your consent), the right to withdraw consent will no longer apply to data following the anonymisation process because the data is anonymous (and therefore does not identify you).

You can withdraw your consent at any time before your Personal Data is anonymised by e-mailing DPO@webdoctor.ie or updating your account settings. You understand that any data which forms part of Aggregated Clinical Data will be used in accordance with the Patient FAQ.

Marketing and cookies

You can withdraw your consent by updating your cookies preferences and/or unsubscribing using the “unsubscribe” link in any e-mails we send you.