DrDoctor Patient Platform Privacy Notice

This Privacy Notice sets out the way in which we use your personal information when accessing drdoctor.thirdparty.nhs.uk, login.drdoctor.co.uk, my.drdoctor.co.uk, manage.drdoctor.co.uk and video.drdoctor.co.uk (collectively referred to as our “Patient Platform”). This Privacy Notice also sets out how we use your personal data whilst accessing our service through the NHS App or when using NHS login details.

Personal data means information relating to an individual who can be identified, directly or indirectly, from that piece of information. Examples of personal data include but are not limited to: your name, email address, phone number and occasionally other contact details.

You are provided with access to this Privacy Notice when you register with us and it is available on our website and Patient Platform at all times.

References to “us”/” we”/ ”our” in this Privacy Notice means DrDoctor (registered: ICNH Ltd.) which is registered in England and Wales under company number 08149394. Our trading address is DrDoctor, The Grain House, 46 Loman Street, London SE1 0EH. We are registered at the UK Information Commissioner’s Office under number Z3313550.

Where DrDoctor act as a Data Processor

DrDoctor’s Patient Platform is an extension of the service provided to you by your healthcare provider. Our healthcare services provided to you as a data subject are on instruction of your healthcare provider, and as such, we act as a data processor for this information. Your healthcare provider acts as a data controller and gives us specific instructions on how to process your information so you are able to receive the best care possible. These instructions are captured in a contract between us and your healthcare provider.

Where we process personal data in this manner, we (as DrDoctor) do not need a lawful basis to process your data as this is defined by your healthcare provider.

If you have any questions around how your healthcare provider captures and uses your personal data then you can contact your healthcare provider directly or read their Privacy Policy which should be on their website.

Please note that if you access our services using your NHS login details, the identity verification services are managed by NHS England. NHS England is the controller for any personal information you provided to NHS England to get an NHS login account and verify your identity, and uses that personal information solely for that single purpose.

For this personal information, our role is of a data processor and we must act under the instructions provided by NHS England (as the data controller) when verifying your identity. For further information you can view NHS login’s privacy notice, and NHS App’s privacy notice on the NHS website. This restriction does not apply to the personal information you provide to us separately.

If you are employed by a healthcare provider, you may access our services for using the staff-facing portal of our Patient Platform and as such, we act as a data processor for the information provided within this frame.

Where DrDoctor act as a Data Controller or Joint Data Controller

There are limited circumstances where we act as a data controller. These cases are separate to those where we obtain and process data on behalf of your healthcare providers.

In all these circumstances, we obtain personal data from you directly rather than from your healthcare provider.

One example of when DrDoctor act as a data controller can include surveys that we collect through our Patient Platform.

However, where we wish to collect this information and become a data controller then we will obtain your consent. If you don’t wish to give consent then you are still able to access the services your healthcare provider has contracted us to provide.

To be able to provide you with our services, we will need to collect and process your personal data. We collect different types of personal information from different sources, such as your healthcare provider. We do not have access to your full medical or health records and information we collect is limited to what is listed below.

Personal data we collect to identify you as a patient of a healthcare provider

We collect the following personal data about you when you log in to our Patient Platform so that we can verify your patient records:

• Name
• Date of birth
• Address details

We collect the following personal data to pass back to your healthcare provider(s):

• Appointment booking or change requests
• Medical assessment responses
• Feedback on the service

Personal information we collect automatically when you visit our Patient Platform

We may also collect certain information by automated means, such as cookies and web beacons whenever you visit our Patient Platform. This could include IP address, browser type, operating system, referring URLs, information on actions taken on, and dates and times of visits.

Some cookies we collect are strictly necessary for the Patient Platform to function correctly. Without these cookies the functionality may be impaired so we automatically apply them but you are informed about them when you log in.

Currently we do not collect any analytical cookies or any cookies other than those strictly necessary for the Patient Platform to function. Please note that any cookies collected are not designed to identify you, it is all aggregated and therefore strictly anonymised.

Personal information we collect from your healthcare provider

We collect personal data about you from healthcare providers to facilitate your use of the services. This information can include:

• Name
• Gender
• Date of birth
• Date of death
• Phone number
• Email
• NHS Number
• Medical Reference Number (e.g. hospital number)
• Postal Address
• Default language preference
• Consent to contact
• Referral and appointment letters
• Clinical report information (including diagnoses, outcomes, procedure codes and follow up information for each appointment)
• Appointment details
• Waiting list details (including information on if you are waiting for a confirmed appointment with a healthcare provider, the doctor to be seen by you for each appointment, as well as information on repeat and follow up appointments needed)
• Referral data (including your details, the healthcare provider you are being referred from and doctor making the referral, the healthcare provider you are referred to and the reason for the referral, along with tracking details used nationally)

Personal information we process through the NHS App or NHS Login

NHS England provides a service to NHS patients in England through the NHS App and NHS website to securely view summary details of their scheduled secondary care appointments with acute NHS Trusts, and to enable them to access further details about those appointments from the NHS App. If your healthcare provider has signed up for this, we will process personal data for this purpose and share your data with NHS England.

If you are accessing our services through the NHS App, we are required to process your information to authenticate your credentials and provide you with the information you need to access the service and be able to review and manage your appointments. The data we collect will include:

• Name
• Date of birth
• Date of death
• Medical Reference Number (e.g. hospital number)
• NHS Number
• Gender
• Appointment details
• Configuration session details

Personal data we collect if you are healthcare provider staff

• Name
• Contact details
• Email address
• Clinic and specialty
• Role
• Geolocation
• IP Address
• Product analytics and behavioural data
• Demographics for administration of account management

Personal information we collect directly from you

As we have explained above, there a few limited cases, where we act as the data controller for your personal data. For instance, when conducting surveys or when we request feedback on the services we provide via our Patient Platform. In such cases, we only collect information which is necessary for our goals, for instance

• Survey responses; and
• Feedback/reviews.

Where we are acting on behalf of your healthcare provider, we use your personal data for the following purposes:

• To send you communications from your healthcare provider via email and SMS
• To register you onto our Patient Platform and services and manage your profile, including asking you how you would prefer to be contacted (different channels and contact details), language preferences, etc
• To allow you and your healthcare providers to book and reschedule appointments and to manage any cancellations
• To provide you with information about the care you receive from your healthcare provider. This includes leaflets, videos, text and supporting information
• To allow you to change or cancel appointments and interact with your healthcare provider
• To provide video consultations between you and your healthcare provider
• To allow you to request that a healthcare provider update the details they hold on record for you
• To record information on how your care is progressing
• To maintain your account and registration which we need to do to provide the services to you
• To allow us to investigate and address queries, questions and complaints and respond to any feedback from your healthcare provider
• To understand the effectiveness of the services provided by the healthcare provider and allow a healthcare provider to benchmark against other healthcare providers
• Subject to the authorisation from your healthcare provider, to de-identify your personal data, i.e. anonymise, and use it for research to improve our ability to provide patient care in the future

Where we are acting for both NHS England and your healthcare provider for use of the NHS app:

• Authenticating you as a user to make sure that the credentials are correct
• Ensuring that you are provided with the correct information about your appointment
• Making an appointment booking change request to your healthcare provider
• Allowing you to access letters from your healthcare provider

Where we are acting independently as the main responsible party then we may use your personal data for the following purposes:

• To develop and improve our products by seeing how you use our services and Patient Platform
• To understand user experiences and address any issues raised
• To improve your experience when using our Patient Platform and services
• To update you on any developments or information about our services. These are strictly service emails and do not include marketing

Users of our services need to be over 16 years old. If you are under 16, then the service may only be used by your parent or legal guardian.

No, we do not make automated decisions about you.

In most cases, we are not the data controller of your data and therefore do not need to have a lawful basis for handling your data. Instead, we process your data on behalf of your healthcare provider and we strictly follow their instructions. You should visit your healthcare provider’s privacy notice, or contact your healthcare provider to find out more information.

Where we engage with you directly to collect your personal data for reasons outside of your healthcare (such as surveys and engagement about our platform), we rely on the following lawful bases to process your personal data under the UK General Data Protection Regulation:

For non-special categories of personal data:

• Article 6(1)(a) – Consent; and
• Article 6(1)(f) – Legitimate interest.

For special categories of personal data, we rely upon the following exemptions:

• Article 9(2)(a) – Explicit consent.

All the data we collect about you as an individual is protected with multiple levels of security including industry leading encryption and access controls.

Your data is stored in our data centres that are accredited to the standards set out by the NHS and GCHQ/CESG for protecting the healthcare information of UK citizens. We use Microsoft Azure UK data centres which meet a broad set of international and industry specific compliance standards such as ISO 27001, HIPAA, FedRAMP and SOC 2. We use Azure ExpressRoute to connect to the health and social care network. All data traffic which flows through this route is securely encrypted.

When you use the Patient Platform and services your access is controlled using 2-factor authentication unless you have been given the option to disable this when using a username and password.

We ensure that all data is backed up and we have a comprehensive Business Continuity Planning & Disaster Recovery plan in place in the event of an unexpected disruption in service or business operations.

Please note that we do not and never will sell your personal data to third parties.

Your personal data is available to you as well as clinical and administration staff working at your relevant healthcare providers.

In order for us to effectively deliver our services, we use third party suppliers. The following third parties process limited amounts of personal data as strictly necessary for them to provide their service:

NHS app

For the NHS app, we also share your personal data with the following organisations in order for the NHS app to effectively function:

• Servita – Technology provider which ingests personal data into an aggregator by an API before sending to NHS England
• NHS England – Host of the NHS App

Please note that we may be legally required to share your personal data with law enforcement agencies, regulators, courts or other public authorities.

The safety and integrity of our service user’s data is very important to us. At DrDoctor, we risk assess each data sub-processor we use and where possible, we also ensure that all security measures and appropriate safeguards are put in place to protect your information and comply with the data protection legislation.

All organisations who we share data with are presented to and signed off by your healthcare provider’s information governance and data protection teams.

We transfer your personal data outside of the UK when we have a lawful route of doing so.

Transfers from the UK to the European Economic Area (“EEA”) are deemed lawful on the basis of adequacy regulations. When we transfer data from the UK to the US or any non-EEA country we rely on any of the following: an adequacy decision, the EU-US Data Privacy Framework, Standard Data Protection Clauses and international transfer risk assessments to ensure that your data is safe to be transferred.

Where we process your personal data on behalf of your healthcare provider, your personal data is stored until your healthcare provider ceases to be a DrDoctor client or until we are instructed by your healthcare provider to delete your data. In that case your data will be deleted or anonymised within 30 days of the end of the contractual relationship.

We will keep your information for no longer than is necessary and as required to fulfil our legal obligations. If your data is no longer needed, we delete or anonymise it where we have the appropriate lawful basis to do so.

If we rely on consent to process your personal data, then we will only retain your data for as long as you consent to us holding it, or as long as reasonably need to use that information.

When determining the relevant retention periods for personal data we hold on you, we will take the following factors into account:

• Our contractual obligations and rights in relation to the information involved
• Whether we have consent from you to retain the personal data
• Legal obligation(s) under applicable law to retain data for a certain period of time
• Statute of limitations under applicable law(s)
• Legal claims or potential disputes
• If you have made a request to have your information deleted
• Guidelines issued by relevant data protection authorities

By law, you have a number of rights (subject to certain conditions) when it comes to your personal data:

• The right to object to processing;
• The right of access;
• The right to rectification;
• The right to erasure;
• The right to restrict processing;
• The right to data portability;
• The right to lodge a complaint; and
• The right to withdraw consent.

For more information about your rights, you can visit the Information Commissioner’s Office website.

In relation to personal data we process on behalf of your healthcare provider or NHS England, you will need to contact your relevant healthcare provider to exercise your rights. You are welcome to provide your request to us, but after we confirm your identity we will forward your query onto your healthcare provider to action.

In all other instances where we are processing your data independently, we will be responsible for handling your requests.

How to exercise your right

You can exercise any of the above rights by contacting us at support@drdoctor.co.uk

In relation to feedback we collect from you using TrustPilot via our Patient Platform, if you wish to exercise any of your data protection rights, such as the right to erasure, please contact TrustPilot directly as they host this data. You also have the option to delete your own comments directly via TrustPilot.

Timeline

We will always aim to respond to your request as soon as we can. Generally, this will be within one month from when we receive you request. We are entitled to extend the time to respond to your request where it is complex but will notify you if it is going to take longer to deal with.

Verifying your identity

In order to comply with your request, we will need to verify your identity so that we do not disclose any of your personal data to the wrong person. To that end, we may ask for confirmation of your identity as part of the process which may include requesting further documentation and processing more personal data.

Charging a fee or refusals

We usually act on requests and provide information free of charge. However, there are exceptions. If your request is excessive, repeated or manifestly unfounded, we may charge you a reasonable fee to cover our administrative costs or refuse to act on the request.

As a patient, you can opt out of DrDoctor in a number of ways depending on what is required. Please note that you can opt-out only where we use your personal data to provide you with a service related to your direct care and where an alternative service is available. You are encouraged to talk to your healthcare provider in such circumstances to understand your opting-out options.

Where applicable, you can opt-out of DrDoctor’s services in the following circumstances:

• If you would like to update your contact preferences or remove a contact method from use, then this can be set by using our web portal;
• If you would like to stop all notifications to your phone, then this can be achieved by replying ‘STOP’ to any message; and
• If you would like to stop any information being shared with DrDoctor, then you will need to contact your healthcare provider who will make this change so long as they can continue to provide you with direct care through an alternative means.

We are always happy to talk. If you have any questions, concerns or complaints about how your personal data is being used, then please email support@drdoctor.co.uk and we will do everything we can to help.

We have a designated Data Protection Officer. You can contact them at dpo@drdoctor.co.uk.

Alternatively, you can also contact the Information Commissioner’s Office (“ICO”), the UK’s independent regulatory office in charge of upholding information rights for further information or to make a complaint.

You can contact the ICO in one of the following ways: