Privacy Policy - Doktu Telemedicine Platform

Effective Date: 8/23/2026

Last Updated: 8/23/2026

Version: 1.0

1. Controller Information

Data Controller: Doktu Limited (Company No. 16820348)

Address: 24 St. Marys Close, Epsom, Surrey, KT17 2BA, United Kingdom

Email: doktu@doktu.co

Phone: +44 7448 888 747

Data Protection Officer: doktu@doktu.co

2. Legal Basis for Processing Health Data

Under the General Data Protection Regulation (GDPR) Article 9, we process your health data based on the following legal grounds:

Primary Legal Basis: Article 9(2)(h) - Healthcare Provision

We process your health data as it is necessary for:

  • Medical diagnosis and assessment
  • Provision of healthcare and medical treatment
  • Management of healthcare services
  • Communication with healthcare professionals

This processing is conducted under contract with licensed healthcare professionals who are subject to professional secrecy obligations under EU and Member State law.

Secondary Legal Basis: Article 9(2)(a) - Explicit Consent

Where required, we obtain your explicit consent for processing health data for specific purposes including:

  • Storing consultation history for continuity of care
  • Sharing data with specialists for referrals
  • Using anonymized data for service improvement

3. Data We Collect

3.1 Health Data (Special Category Data)

  • Medical history and symptoms
  • Consultation notes and diagnoses
  • Prescription information
  • Treatment recommendations
  • Vital signs and measurements
  • Medical images or documents you provide

3.2 Personal Data

  • Name, date of birth, gender
  • Contact information (email, phone, address)
  • Payment information
  • Account credentials
  • Communication records
  • Technical data (IP address, browser information)

3.3 Video Consultation Data

  • Video and audio recordings (if consented)
  • Chat messages during consultations
  • Screen sharing content
  • Technical metadata from Zoom integration

4. How We Use Your Data

4.1 Healthcare Purposes (Article 9(2)(h))

  • Facilitating video consultations with doctors
  • Maintaining medical records for continuity of care
  • Enabling prescription management
  • Supporting follow-up care
  • Emergency medical situations

4.2 Service Management (Article 6(1)(b))

  • Account management and authentication
  • Payment processing
  • Customer support
  • Service improvement and optimization

4.3 Legal Compliance (Article 6(1)(c))

  • Regulatory reporting requirements
  • Professional licensing compliance
  • Tax and accounting obligations
  • Law enforcement requests

5. Data Sharing and Recipients

5.1 Healthcare Professionals

Your health data is shared with:

  • The doctor(s) you consult with
  • Specialist doctors for referrals (with your consent)
  • Emergency services (in life-threatening situations)

5.2 Service Providers

We share limited data with:

  • Supabase: Database hosting and management (EU-based servers)
  • Zoom: Video consultation services (GDPR-compliant configuration)
  • Stripe: Payment processing (PCI DSS compliant)
  • Cloud storage providers: For secure data backup (EU-based)

5.3 Legal Requirements

We may disclose data when required by:

  • Court orders or legal proceedings
  • Regulatory authorities
  • Law enforcement agencies
  • Public health authorities

6. International Data Transfers

All health data is processed and stored within the European Union. Any transfers outside the EU are conducted under appropriate safeguards:

  • Adequacy decisions by the European Commission
  • Standard Contractual Clauses (SCCs)
  • Binding Corporate Rules (BCRs)

7. Data Retention

7.1 Health Data

  • Active medical records: Retained for 10 years after last consultation
  • Consultation recordings: Deleted after 30 days unless consent given for longer retention
  • Prescription data: Retained as required by national pharmacy regulations

7.2 Personal Data

  • Account data: Retained while account is active plus 3 years
  • Payment data: Retained for 7 years for tax compliance
  • Marketing data: Retained until consent is withdrawn

8. Your Rights Under GDPR

8.1 Access Rights (Article 15)

You have the right to obtain confirmation of data processing and access to your personal data.

8.2 Rectification Rights (Article 16)

You can request correction of inaccurate or incomplete personal data.

8.3 Erasure Rights (Article 17)

You can request deletion of your data, subject to legal retention requirements.

8.4 Restriction Rights (Article 18)

You can request restriction of processing in certain circumstances.

8.5 Portability Rights (Article 20)

You can request transfer of your data to another healthcare provider.

8.6 Objection Rights (Article 21)

You can object to processing based on legitimate interests.

8.7 Consent Withdrawal

You can withdraw consent at any time for processing based on consent.

9. Security Measures

We implement appropriate technical and organizational measures:

  • End-to-end encryption for video consultations
  • AES-256 encryption for data at rest
  • Multi-factor authentication for healthcare professionals
  • Regular security audits and penetration testing
  • Staff training on data protection
  • Incident response procedures

10. Data Breach Notification

In case of a data breach affecting your rights and freedoms:

  • We will notify the supervisory authority within 72 hours
  • We will inform you without undue delay if high risk is involved
  • We will document all breaches and remedial actions taken

11. Supervisory Authority

You have the right to lodge a complaint with your national data protection authority:

  • United Kingdom: Information Commissioner's Office (ICO)
  • Bosnia and Herzegovina: Agency for Personal Data Protection (AZLP)
  • Other countries: Your national data protection authority

12. Contact Information

For any privacy-related questions or to exercise your rights:

Email: doktu@doktu.co

Data Protection Officer: doktu@doktu.co

Address: 24 St. Marys Close, Epsom, Surrey, KT17 2BA, United Kingdom

Phone: +44 7448 888 747

13. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. We will:

  • Notify you of material changes via email
  • Post updates on our website
  • Maintain previous versions for reference

This privacy policy complies with GDPR, ePrivacy Directive, and applicable national healthcare data protection laws.