Privacy Policy
Your privacy is important to Doctonica. We've developed this Privacy Policy so that you may understand how we collect, use, disclose, transfer, and store your information.Roles and responsibilities
Doctonica is both a data controller and a data processor but for different parts of the data.
- Doctonica mainly acts as a data processor: As a company providing a Calendar and booking service to practitioners. We process data on behalf of the practitioner who defines what happens with this data (modification, removal, transfer, GDPR rights …) and the practitioner remains owner of the data. This data includes the Patient profile, the appointment data and the optional doctor/patient notes linked to the appointments. This also applies when the practitioner implements a synchronisation with our services using a gateway provider.
- Doctonica plays the role of controller: For patients with a Doctonica account, only for the account data (preferences, name, address, phone, email, address, ratings, etc.) which is there only to facilitate the management of the patient's appointments using our online services. During each booking, we basically copy the data from the Doctonica account into the Doctor patient profile and appointment, from where on this copy becomes controlled by the practitioner. As part of the Doctonica account we also control a logical link to the Doctor appointments, allowing us to show the patient's practitioners and appointments.
Patient
The patient is the person using the Doctonica services directly or indirectly through the practitioner to find and manage their medical appointment. In GDPR terms, the patient is always the data-subject (final owner of personal data) and always has the right to define what happens with its data unless there are legal obligations to the request (eg. court order, criminal investigation, …).Practitioner
The practitioner is the person or legal entity that sub-contracts Doctonica to provide them an online agenda and to collect the related patient data. The practitioner is the final receiver of the patient's data (DOCTOR-PATIENT) and defines the purpose of processing and data collection. It is their responsibility to ensure the patient data is handled securely and according to the regulation when selecting sub-contractors like Doctonica or a Doctonica connected gateway partners. This security enforcement is done in good confidence and by the use of data processing agreements provided by Doctonica that clearly define what Doctonica is allowed to do with the data in name of the practitioner, and what is the level of security Doctonica implements to protect this data. In GDPR terms, the practitioner is always the controller (Main responsible) of the patient data and the related appointment data (DOCTOR-PATIENT).Gateway partner
Many different medical softwares exist and are in use by practices/cabinets internally. Gateway partners are legal entities (sometimes the same as the medical software provider) that are specialized in linking some data from the medical software with the Doctonica services. For integrations with Doctonica only the practitioner's data (DOCTOR-PATIENT) is concerned. This can be from the medical software to Doctonica, from Doctonica to the medical software, or in both direction depending on the needs of the practitioner. Doctonica also provides external plugins like calendar synchronisations that sync Doctonica agenda's to exchange, gsuite, outlook, … which are also considered as gateway partners.
In GDPR terms, Gateway partners are always processors (sub-contractor) of the practitioner. The practitioner must have a data processing agreement in place with the gateway partner in which the practitioner clearly defines what can be done with their data and for what purpose and how it is secured. Gateway partners are seen by Doctonica as a sub-processor of the practitioner which received the credentials/permissions to act on their behalf. Therefore, no special data processing agreement is required between Doctonica and the Gateway partner, unless there is a special additional personal data processing involved that requires additional arrangement.
The “Doctonica” application, website and back end refers to Andaveo LTD (C96766)Our Privacy Principle
As your privacy is important to Doctonica, we only process your data in respect with the following principles.
- We always use your personal data in a fair, trustworthy and transparent way for specified, explicit and legitimate purposes.
- You have the right to be clearly informed about how we use your personal data. We will always be transparent to you about the data we collect and the way we use it.
- If you have concerns about how we use your personal data, we assist you in understanding our treatments.
- We will take all reasonable steps to protect your information from abuse and to keep it safe.
- We are committed to all European and national privacy regulations and shall cooperate with your national supervisory authority regarding privacy where necessary.
Collection and Use of Personal Information
Personal data can be used to identify or contact, directly or indirectly a single person. You may be asked to provide your personal data anytime you are in contact with Doctonica through our website/app platform managed by our entity or through the integration of our services on the website of your practitioner.
Doctonica ensures that only the data that is timely and relevant to what is necessary for the pursuit of the declared purposes is collected, processed and stored.
No legal provision requires you to send us the personal data we request, but, failing to provide them, may disallow us to provide the required service, to answer your questions or to adapt our services to your needs.
Here are some examples of the types of personal data Doctonica may collect to provide medical appointment and follow-up services via our website platform and how we may use it:What categories of data are handled by Doctonica
When you book an appointment without creation of a Doctonica user account, we may collect personal identification data, including your surname, first name, phone number, postal address, e-mail address, date of birth, age, sex, nationality, number of ID card or passport, social identification number, your signature, etc …; traffic information for each call or internet session. This traffic information contains the called numbers, the identification of phone number, the data and the duration of the communication or the date, video consultation quality information, the duration and the data volume of the internet session; moments of connection; computer identification data obtained under the access granted to the Doctonica website mainly IP address, your email address, cookies, electronic signature; care-related data, including the reason for the practitioner's appointment, the specialty of the practitioner, the frequency of the appointments, the name of the attending physician, the history and feedback* of the appointments, and any data belonging to the medical record that you share with the practitioner or the practitioner wants to share with you; data relating to the civil or professional status, in particular your marital status, family composition, your profession, …;
When you create a Doctonica user account, we may, in addition to the data mentioned above, collect other data as data relating to your login and password, as well as data relating to preference data, historical data.
Processing activities, data characteristics and legal basis of processing
How we use your personal data
The personal data we collect is intended to enable us: to match your appointment requests with practitioner availabilities, to inform you and your practitioner on the status of appointments and follow-up services, to collect feedback*, to setup an encrypted end-to-end video consultation, to transmit your personal data to the practitioner to handle your appointment, to conduct online payments and to provide for both support for the appointment and related agenda management.
If additionally, you create a Doctonica user account, the collected data allows us to set up and manage your personal data profile, preferences and feedback*, to manage links to your doctor appointments and its history, to facilitate taking new appointments with practitioners linked to your account, to manage your online payments and to improve the quality of our service.
For each purpose listed above, the collection and processing of data shall be carried out in accordance with the legislation in force and with the regulations on the protection of personal data, including the European Union Regulation (EU) 2016/679. April 27, 2016.
Therefore, the collection and processing are based either on the fact that the processing is necessary for the performance of the service to which you are party or the execution of measures taken at your request; whether the treatment is necessary to fulfil a legal obligation to which we are subject; on your consent; an interest recognized as legitimate on our part.Legitimate interest is the legal basis when Doctonica collects and processes data to provide its users with the highest possible quality of service, as well as the best possible tracking of their appointments and their related communications (verifications of your contact data, confirmations, reminders and feedback*). The same applies when Doctonica collects and processes data to improve the functioning of its Site and to carry out optional satisfaction surveys on its services in order to improve them. Feedback is defined as the quality evaluation by the patient of the services rendered by the Practitioner. This information may be used by your practitioner and Doctonica in its raw or aggregated form to publicly promote the provided services.
Who takes care of your data
Your data may be shared with some of our internal departments in the strict framework of their assignments, including members of service management, legal and compliance, internal audit and the IT department.
If you request an appointment or video consultation via our website, only your practitioner is controller of your personal and appointment data and is responsible to execute your privacy rights and takes care of your data. All related requests should be addressed to the practitioner, or we will forward them for you. Doctonica, as a subcontractor of the practitioner, can only act on the personal data upon explicit instruction by the practitioner.
If you create a Doctonica user account, Doctonica becomes the controller only for the data collected to create this account and provided by you when you are logged in (personal data profile, preferences, service feedback, links to your doctor appointments/video consultations and its history). For this part Doctonica is responsible to execute your privacy rights and takes care of your data. All data collected by your practitioner from you or transferred by Doctonica from your account to the practitioner remains on the sole control of the practitioner as previously mentioned.Storage of the IP address for security purposes
We store the complete IP address transmitted by your web browser for a period of seven days for the purpose of identifying, limiting and eliminating attacks on our website. After this period, we delete or anonymise the IP address. The legal basis is Art. 6 para. 1 lit. f GDPR.Cookies and Other Technologies
Doctonica websites, online services, interactive applications, email messages may use “cookies” and other technologies such as Geolocalisation, pixel tags and web beacons. These technologies help us better understand user behaviour, tell us which parts of our websites people have visited, and facilitate and measure the effectiveness of your experience. As requested by EU regulation, we treat data collected by cookies and other technologies as personal information.
Most browsers are set to automatically accept cookies. In general, you can prevent the storage of cookies on your hard disk by selecting “Do not accept cookies” in your browser settings. You can also configure your browser to ask permission before storing cookies. Finally, you can delete previously set cookies at any time.
Please refer to the instructions of your browser on how to implement this measure. If you set your privacy setting as such, however, it may happen that you cannot fully use all the features of our website.
Therefore, you are informed that your browsing on Doctonica's website or use of online services and interactive applications may be limited. This could also be the case when Doctonica or one of its service providers can not recognize, for technical compatibility purposes, the type of browser used by the terminal, the language and display settings, or the country from which the terminal seems connected to the Internet.
If necessary, Doctonica declines all responsibility for the consequences related to the degraded functioning of the Site and the services offered by Doctonica, resulting either from the refusal of Cookies or from the impossibility for Doctonica to register or consult the Cookies necessary for their operation because of your choice.
Our website uses Google Analytics and Google Ads. This is a service by Google Inc. (“Google”) for analysing accesses to websites and allows us to improve our internet presence. The data collected by means of a cookie (IP address, access time, access duration) is transmitted to Google servers in the USA and stored there. The evaluation of the activities on our website is transmitted to us in the form of reports. Google may pass on the collected data to third parties, if required by law or if third parties process this data on behalf of Google. However, to avoid that Google can have a possible direct personal relationship to you, we use the function “anonymized”. Thus, IP addresses are processed only shortened. This tracking will only be enabled if you opt in for Performance cookies using our cooking manager at which moment we do this processing on the basis of Art. 6 para. 1 lit. a GDPR.
Some browser extensions exist which allow you to disable and control Google Analytics tracking.
Doctonica uses so-called web fonts provided by Google on the website for the uniform display of fonts.
The above mentioned Google processing are done by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
When you visit a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly. To do this, the browser you are using must connect to Google's servers. This gives Google knowledge that our website has been accessed via your IP address. The use of Google Web Fonts is in the interest of a uniform and appealing presentation of our online offers.
If your browser does not support web fonts, a default font is used by your computer.
For more information about Google Web Fonts, see:
https://developers.google.com/fonts/faq
and in the privacy policy of Google:
https://policies.google.com/privacy
Third party providers
Doctonica uses several specialised third-party providers in accordance to Art. 28 GDPR. Each of these providers are carefully selected and are bound to privacy, secrecy, security and compliance with the GDPR regulation using a data processing agreement between Doctonica and the third party.Online payments
Doctonica uses Stripe Payments Europe Ltd (subsidiary of Stripe Inc) to keep your personal and payment information secure. Thousands of companies around the world trust Stripe to process payments for their users. You can consult Stripe's privacy policy here (https://stripe.com/en-lu/privacy). You can consult their cookie policy here (https://stripe.com/cookies-policy/legal). The processing of the payment data and placing of related cookies by Stripe only takes place for reasons of visit indicating they require online payments. This type of processing is based on Art. 6 para. 1 lit. b GDPR, which refers to the contractual (pre-)requirement between the patient and the practitioner.Map services
We embed map services that are not stored on our servers. To ensure calling up our web pages with embedded map services does not automatically lead to third-party content being loaded, we require your consent for functional cookies and its related communications. Once you agree, our data processing agreement with Google ensures that data communicated with this third party is not used for other purposes.
The embedding takes place on the basis of your consent in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR, provided that you have given your consent.Marketing and advertising
In addition to providing our services, and on explicit opt-in for newsletter by the user, we will use your personal data to communicate with you about our offers or marketing promotions and to recommend other services that may interest you. These offers may contain references to new web and information offers in line with the present processing purposes.
If you no longer want to receive these recommendations or newsletters from us, you can object to this at any time by disabling this in your settings, contacting us or by using the link that you find in each of our communications.No Disclosure to Third Parties
Your personal data will not be disclosed to third parties unless you have expressly given your consent, or if we are obliged to disclose it for example due to a court order or an official order.
Only in the event of a corporate selling of assets/stock, or during a corporate divestiture, merger or dissolution, we might share your data with the new legal entity where the purposes defined in this notice remain the same.Transfer outside the European Union
We do not transfer any of your personal data to servers outside Europe Union (EU) or the European economic area (EEA) unless that processing is covered by an adequacy decision stated by the European Commission, or the processing is covered with a dedicated processing agreement with Standard Contractual Clauses and appropriate supplementary measures as recommended by the European Data Privacy Board. This also applies to all our sub-contractors.
In any case, if a transfer is performed to a third country or international organization not covered by an adequacy decision stated by the European Commission, or a dedicated processing agreement with Standard Contractual Clauses and appropriate supplementary measures as recommended by the European Data Privacy Board, you will be informed before any processing to be able to assert your right to oppose it.Protection of Personal data
Doctonica takes the security of your personal data very seriously. Doctonica online services protect your personal information during transit using encryption. When your personal data is stored by Doctonica, we use computer systems with limited access housed in facilities using physical security measures. Data is stored in encrypted form including when we utilize third-party storage.
Doctonica works with other companies, such as email and SMS providers, to provide its services. The selection of third party follows a comprehensive selection process. In this selection process, each individual service provider is carefully selected for its suitability in terms of technical and organizational data protection skills. A contract for the personal data processing of data will only be concluded if it complies with the identified security requirements including European and national regulations requirements.
If you create a Doctonica user account through our website, we recommend for security reasons to use a reliable password to protect your personal data and to always keep this password secret. By reliable password, we mean at least 6 characters long including a combination of letters, numbers and symbols. Your password must also be changed periodically (we recommend every 6 months).Integrity and Retention of Personal data
Doctonica makes it easy for you to keep your personal data accurate, complete, and up to date. We will retain your personal data for the period necessary to fulfil the purposes outlined in this Privacy Statement and not longer than 2 years of non-activity, unless a longer retention period is required by your practitioner or permitted by the national law. To protect this data from accidental or malicious destruction, when we remove it from our services, we may not immediately remove the remaining copies of our servers or backup systems. The complete destruction will occur after a complete cycle of backup.Access to Personal data
You can help ensure that your personal data and preferences are accurate, complete, and up to date by logging in to your account. For other personal data we hold, we will provide you with access (including a copy) for any purpose, including to request that we correct the data if it is inaccurate or delete the data if Doctonica is not required to retain it by law or for legitimate business purposes. In that case, access, correction, or deletion requests can be made through our Data Privacy Officers (see contacts below).Our Company Wide Commitment to Your Privacy
To make sure your personal information data is secure, we communicate our privacy and security guidelines to Doctonica employees and strictly enforce privacy safeguards within the company.Privacy Questions and Rights
When processing your personal data, the GDPR grants you as a data subject certain rights:- Right of information (Art. 15 GDPR) - You have the right to obtain confirmation as to whether personal data concerning you are being processed; if this is the case, you have the right to be informed of this personal data and to receive the information specified in Art. 15 GDPR.
- Right of rectification (Art. 16 GDPR) - You have the right to request without delay the rectification of incorrect personal data concerning you and, if necessary, the completion of incomplete data.
- Right of deletion (art. 17 GDPR) - You have the right to demand that personal data concerning you be deleted immediately if one of the reasons listed in Art. 17 GDPR applies.
- Right to restrict processing (Art. 18 GDPR) - You have the right to request the restriction of the processing if one of the conditions listed in Art. 18 GDPR is met, e.g. if you have lodged an objection to the processing, for the duration of the examination by the controller.
- Right to data transferability (Art. 20 GDPR) - In certain cases, which are listed in detail in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, common and machine-readable format or to request the transfer of such data to a third party.
- Right of objection (Art. 21 GDPR) - If data is collected on the basis of Art. 6 Para. 1 lit. f GDPR (data processing to safeguard legitimate interests) or on the basis of Art. 6 Para. 1 lit. e GDPR (data processing to safeguard public interests or in the exercise of official authority), you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrably compelling reasons for processing which are worthy of protection and outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
- Right of appeal to a supervisory authority (Art. 77 GDPR) - Under Art. 77 GDPR, you have the right to appeal to a supervisory authority if you believe that the processing of data concerning you is in breach of data protection regulations. In particular, the right of appeal may be lodged with a supervisory authority in the Member State of your habitual residence, your place of work or the place of the suspected infringement.
When a privacy question or request is received we shall do our best to address the specific concern or query which you are seeking to raise. If you are unsatisfied with the reply received, you may refer your complaint to the national data authority.
Doctonica may update its Privacy Statement from time to time. When we change the policy in a material way, a notice will be posted on our website along with the updated Privacy Statement.
If there are any major changes that are inconsistent with the purpose for which the data was collected, we will ask for a renewed consent.
Responsible of this website
The below list gives an overview of the websites and which entity is responsible. For any questions and queries feel free to contact us at:
info@doctonica.com