Privacy policy

1. Data controller

Controller: Dr Taisiya Minorskaya, healthcare professional in Valencia.

Privacy contact: dra.minorskaya@gmail.com.

The controller provides private healthcare services as an individual practitioner and is not required to appoint a data protection officer.

2. Data collected

The home consultation request form collects the patient’s email address, postcode, language, age and sex, together with a brief description of the main symptoms and their duration. The phone number, preferred date and preferred time are optional.

The form does not request or transmit the requester’s first name or surname.

Fields marked as required are necessary to review and respond to the request. The form cannot be submitted without them.

Age, sex and the description of symptoms are requested solely to make a preliminary assessment and determine whether a home consultation is appropriate. The symptom description is health data and belongs to a special category of personal data.

The symptom field is limited to 300 characters. Use it only to describe the main symptoms and when they began. Do not send medical documents, images, a full medical history, diagnoses that are not necessary for the request or data about unrelated third parties.

To protect the form against misuse, the service temporarily processes technical connection data, including the IP address and request origin. The IP address is converted into an opaque identifier before rate-limit records are created.

To demonstrate that privacy information was provided, a random request identifier, server date and time, the version of the displayed policy and confirmation that it was read are recorded. This record does not contain the email address, phone number, message or IP address. The same identifier is included in the email received, so the two items can be linked while that email is retained.

When you visit the website, the hosting service and external resources required to display it may receive ordinary technical data, such as the IP address, browser type, requested page and access date and time. The website uses Render and Cloudflare infrastructure, as well as Google Fonts resources.

3. Purpose and legal basis

The data is used only to make a preliminary assessment of the reason for the consultation, consider whether a home visit is suitable and feasible, respond to the request, agree the conditions of the consultation and prepare the requested medical care.

The legal basis for handling the request is taking steps, at the data subject’s request, before providing a service under Article 6(1)(b) GDPR. Technical anti-fraud and anti-abuse controls rely on the legitimate interest in maintaining the security and availability of the form under Article 6(1)(f) GDPR.

Symptoms, as health data, are processed when necessary for medical diagnosis, assessment and the provision of healthcare by a professional bound by confidentiality, under Article 9(2)(h) GDPR, applicable healthcare law and the relationship with the healthcare professional.

The checkbox confirming that this policy has been read records that privacy information was provided; it does not make consent the legal basis for processing.

The minimum confirmation record is processed to meet and demonstrate the controller’s legal information and accountability obligations under Article 6(1)(c) GDPR. Where retaining information is necessary for the establishment, exercise or defence of legal claims, processing relies on the legitimate interest under Article 6(1)(f) GDPR.

No profiling is performed and no decisions are made solely by automated means that produce legal effects or similarly significantly affect the requester. Automated form checks are limited to preventing fraud, abuse and repeated submissions.

4. Operation, recipients and service providers

The website sends the request directly to a Django application controlled by the controller. The application validates the request and converts it into an email sent to the mailbox designated for handling requests. The requester’s email address is used as the reply-to address.

The application does not store the form contents in a database. Once the mail server confirms delivery, a minimum pseudonymised privacy-confirmation record is stored in a separate privacy_audit schema in the same PostgreSQL database hosted by Render. It contains only the random identifier, date and time, notice version and affirmative confirmation.

Separately, opaque identifiers derived from the IP address, counters, timestamps and hashes of verification challenges are held in ephemeral storage to apply rate limits and prevent repeat submissions. Form contents are not included in these records.

Data is not sold, disclosed for advertising or used for profiling. Render Services, Inc. hosts the website, application and database; Cloudflare supports the delivery and protection of web resources; and Google provides font resources and email delivery and receipt through Gmail. Data may also be disclosed where required by law or a competent authority.

The mailbox used is a free Gmail account created for the controller’s professional activity and used exclusively to manage communications relating to her practice. It is not used for advertising or shared with other people. Access is protected by a dedicated password and two-step verification. The account is not part of Google Workspace and is used under the terms applicable to Google’s Gmail service.

These providers may process data in the United States or other countries outside the European Economic Area. Transfers to Render rely, where applicable, on the EU–US Data Privacy Framework or the standard contractual clauses incorporated into its data processing agreement. Transfers to Google and Cloudflare use the safeguards recognised in their applicable terms, including the EU–US Data Privacy Framework where applicable. You may request further information or a copy of the safeguards from the contact in section 1.

5. Retention

The Django gateway does not retain the form contents after generating the email. Technical rate-limit events have operating windows no longer than 24 hours, and challenge hashes are used no longer than the validity of the relevant challenge. Expired records are removed during subsequent maintenance operations and, in all cases, when the ephemeral storage is renewed.

The pseudonymised privacy-confirmation record is retained for 1,825 days from confirmed submission and then deleted by a scheduled task. This period is used to demonstrate compliance with the duty to provide information and, where appropriate, to address possible claims; the record is not part of the medical record. The need for and proportionality of this period are reviewed periodically.

The copy received by email is kept in the operational mailbox while needed to respond to and process the request. The mailbox is reviewed at least monthly to remove closed requests that are no longer needed. A copy may be kept with restricted access for the applicable limitation period only where necessary to comply with a legal obligation or establish, exercise or defend a legal claim, after which it is deleted. If healthcare is ultimately provided, only information legally required in the medical record is retained under applicable healthcare law.

6. Your rights

You may request access, rectification, erasure, restriction, object to processing or, where applicable, data portability by emailing dra.minorskaya@gmail.com and stating which right you wish to exercise. Only the information strictly necessary to verify the requester’s identity may be requested. You may also lodge a complaint with the Spanish Data Protection Agency.

7. Security and confidentiality

The service restricts authorised request origins, size and format, and frequency of use. It also uses signed single-use verification challenges and automated controls against abusive submissions. These measures reduce risk, although no internet-connected system can guarantee absolute security.

The email account is used only for professional activity, is protected by two-step verification and does not automatically forward requests to other personal accounts.

The form must not be used for emergencies. Only the main symptoms and their duration should be provided; do not send clinical documents, images or a full medical history.

8. Requests concerning minors

When the consultation is for a minor, the request must be made by their parent or legal representative. The child’s age, sex and symptoms are then processed solely to manage and prepare the requested care.

9. Analytics and cookies

Google Analytics 4 is used throughout the website to measure page views, engagement and clicks on Doctoralia booking links and WhatsApp contact links. The Google tag is not downloaded and analytics is not activated until the visitor gives consent. Refusing analytics does not restrict access to the website content or services.

The legal basis is consent under Article 6(1)(a) GDPR. The choice is stored locally in the browser and can be changed or withdrawn at any time using the “Cookie settings” button available on every page. When consent is withdrawn, the website disables analytics and deletes the Analytics cookies accessible to it.

After consent, Google Analytics may set the first-party cookies _ga and _ga_<identifier>, which distinguish users and preserve session state, with a default maximum lifetime of two years. Form contents and health information are not sent to Analytics. Google Ireland Limited provides the service and may make international transfers subject to the safeguards in its applicable terms. See the Google Privacy Policy and Google’s information about Analytics cookies.