Doctor Information Text

CALLENDOC DATA PROTECTION POLICY - HEALTHCARE PROFESSIONAL VERSION

Last Updated: November 2025

CALLENDOC is committed to protecting your professional data and patient data in compliance with UK data protection law. This policy explains what personal data we collect about you as a healthcare professional, how we use it, who we share it with, and your rights.

1. DATA CONTROLLER INFORMATION

1.1 WHO WE ARE

Data Controller:
Callendoc Ltd.
London, United Kingdom

Callendoc Ltd. is the data controller responsible for determining how and why your professional data is processed.

Data Protection Officer (DPO): [email protected]

1.2 CONTACT INFORMATION

• Data Protection Officer: [email protected]
• Privacy Inquiries: [email protected]
• General Inquiries: [email protected]
• Mailing Address: Callendoc Ltd., Data Protection Officer, London, United Kingdom
• Response Commitment: Within 30 calendar days

2. PROFESSIONAL DATA CATEGORIES WE COLLECT

2.1 IDENTITY & PROFESSIONAL DATA

• Full name and professional title
• Professional registration number
• Qualifications and credentials
• Areas of specialization
• Professional indemnity insurance details
• Date of birth

Purpose: Account creation, professional verification, compliance
Legal Basis: Contract, Legal obligation

2.2 CONTACT INFORMATION

• Professional email address
• Contact phone number
• Professional address
• Banking details for payment

Purpose: Platform communication, payment distribution, support
Legal Basis: Contract, Legitimate interests

2.3 PROFESSIONAL COMPLIANCE DATA

• Professional registration verification records
• Background check results
• Insurance verification records
• Professional conduct history
• Regulatory body verification

Purpose: Professional verification, regulatory compliance
Legal Basis: Legal obligation, Legitimate interests

2.4 CONSULTATION & APPOINTMENT DATA

• Consultation dates and times
• Appointment status and duration
• Consultation type (video/voice/text)
• Patient anonymized data
• Consultation notes you create

Purpose: Service delivery, record-keeping, fee management
Legal Basis: Contract, Legitimate interests

2.5 FINANCIAL & PAYMENT DATA

• Banking details for fee payment
• Transaction history
• Invoice information
• Payment records
• Tax information

Important Note: Banking details encrypted and securely stored
Purpose: Payment distribution, financial records
Legal Basis: Contract, Legal obligation (tax)

2.6 COMMUNICATION DATA

• Professional messages and notes
• Support requests and responses
• Complaint records
• Professional correspondence
• Email communications

Purpose: Service delivery, support, compliance
Legal Basis: Contract, Legitimate interests

2.7 TECHNICAL & USAGE DATA

• IP address
• Device information (type, OS)
• Browser information
• Cookie identifiers
• Login dates and times
• Features and pages accessed
• Error reports

Purpose: Platform improvement, security, analytics
Legal Basis: Legitimate interests, Consent (analytics)

3. LAWFUL BASES FOR PROCESSING

3.1 UK GDPR LAWFUL BASES

(A) CONTRACT

We process data because:

• Necessary to operate the Platform for your use
• Required for consultation management
• Necessary for payment distribution
• Required for professional account management

(B) LEGAL OBLIGATION

We process data because:

• Healthcare laws require professional verification
• Tax laws require financial records
• Professional regulation requirements
• Court orders or legal requests
• Regulatory body requests

(C) LEGITIMATE INTERESTS

We process data because:

• Platform improvement and analytics
• Fraud prevention and security
• Professional conduct investigations
• Business continuity
• Regulatory compliance

(D) EXPLICIT CONSENT

We process data based on your explicit consent for:

• Marketing communications (optional)
• Analytics cookies (optional)
• Biometric data (if applicable, optional)

Withdrawing Consent: You may withdraw consent anytime at [email protected] with no penalty.

4. PURPOSES & USE OF YOUR DATA

4.1 PLATFORM SERVICE DELIVERY

• Create and manage your professional account
• Manage your professional profile
• Manage appointment bookings and consultations
• Process payments and distribute your fees
• Provide customer support
• Manage consultation records

4.2 PROFESSIONAL VERIFICATION & COMPLIANCE

• Verify professional registration
• Conduct background checks
• Verify indemnity insurance
• Maintain regulatory compliance records
• Respond to regulatory inquiries

4.3 SECURITY & FRAUD PREVENTION

• Detect unauthorized access
• Prevent fraud and platform misuse
• Protect against cyberattacks
• Monitor suspicious activity
• Investigate security incidents

4.4 LEGAL & REGULATORY COMPLIANCE

• Comply with healthcare laws
• Comply with tax obligations
• Respond to legal requests
• Investigate professional conduct complaints
• Defend against legal claims

4.5 SERVICE IMPROVEMENT

• Analyze Platform usage
• Improve features and functionality
• Develop new services
• Troubleshoot technical issues

5. WHO WE SHARE YOUR DATA WITH

5.1 PROFESSIONAL REGULATORS

• GMC, GDC, HCPC (registration verification)
• Regulatory bodies (when legally required)
• Professional conduct investigations
• Complaint-related disclosures

5.2 SERVICE PROVIDERS & PROCESSORS

Cloud Infrastructure: AWS (EU/UK regions)
Payment Processors: Stripe, PayPal
Communications: SendGrid (email), Twilio (SMS)
Analytics: Google Analytics (anonymized)

All processors have Data Processing Agreements ensuring GDPR compliance.

5.3 AUTHORIZED THIRD PARTIES

• Accountants and auditors (financial data only)
• Lawyers (legal advice, disputes)
• Insurance providers
• Regulatory bodies (when legally required)

5.4 LEGAL REQUIREMENTS

We may disclose data when:

• Required by law (court order, subpoena)
• Necessary for public safety
• To prevent crime or fraud
• Required by healthcare regulators
• Required by professional bodies

5.5 PATIENTS YOU CONSULT WITH

• Professional profile (name, credentials, specialization)
• Contact information for appointment coordination
• Only information necessary for patient care

5.6 NO SELLING OR COMMERCIAL USE

Callendoc will NOT:

• Sell your professional data
• Share your credentials for commercial purposes without consent
• Transfer your data to third-party providers

6. DATA RETENTION PERIODS

Professional Account Data: Duration of use plus 6 years after termination (legal requirement)

Consultation Records: 10 years minimum (professional standards)

Professional Verification Records: 10 years (regulatory requirement)

Transaction & Financial Data: 7 years (tax and financial regulations)

Professional Compliance Records: 10 years

Backup Data: 6 months

Analytics Data: 26 months (then anonymized)

You may request deletion subject to legal retention requirements.

7. YOUR DATA RIGHTS AS A HEALTHCARE PROFESSIONAL

7.1 RIGHT TO ACCESS

You have the right to:

• Request a copy of your professional data
• Know what data we hold about you
• Know why we process your data
• Know how long we retain it
• Know who we share it with

How to Request: Email [email protected] with your full name and professional account email
Response Time: Within 30 calendar days
Cost: Free of charge

7.2 RIGHT TO RECTIFICATION

You have the right to:

• Correct inaccurate professional information
• Complete incomplete data
• Update outdated information

How to Exercise: Update directly through your professional profile or email [email protected]

7.3 RIGHT TO ERASURE (Right to Be Forgotten)

You have the right to request deletion when:

• Data no longer necessary for purpose
• You withdraw consent
• You object to processing
• Processing unlawful

Exceptions (Data May Not Be Deleted):

• Legal obligation to retain (healthcare, tax, professional records)
• Financial or tax records (7 years)
• Professional regulatory records (10 years)
• Legal dispute or claim

7.4 RIGHT TO RESTRICT PROCESSING

You have the right to limit how we use your data, such as restricting to storage only or stopping marketing communications.

7.5 RIGHT TO DATA PORTABILITY

You have the right to:

• Receive your professional data in portable format
• Obtain data in machine-readable format (CSV, JSON)

7.6 RIGHT TO OBJECT

You have the right to object to:

• Marketing communications (unsubscribe anytime)
• Processing based on legitimate interests

7.7 RIGHT TO WITHDRAW CONSENT

You may withdraw consent:

• At any time
• Without penalty
• Immediate effect

How to Withdraw: Email [email protected]

8. INTERNATIONAL DATA TRANSFERS

8.1 WHERE YOUR DATA IS STORED

Primary Storage:

• United Kingdom data centers
• AWS UK region (primary)
• EU servers (backup)

Data Protection:

• Stored in UK/EU only
• Never transferred outside UK/EEA without safeguards
• GDPR-compliant jurisdictions only

9. SECURITY MEASURES

Technical Safeguards:

• TLS 1.2+ encryption in transit
• AES-256 encryption at rest
• Role-based access control
• Multi-factor authentication
• 24/7 security monitoring

Organizational Safeguards:

• Annual data protection training
• Incident response procedures
• Background checks for staff
• Confidentiality agreements

Physical Security:

• ISO 27001 certified data centers
• 24/7 surveillance and monitoring
• Biometric access controls
• Environmental protections

10. CONTACT & COMPLAINTS

10.1 DATA PROTECTION CONTACT

Data Protection Officer (DPO): [email protected]
Response Commitment: Within 30 calendar days

10.2 COMPLAINTS PROCEDURE

Step 1: Contact Callendoc

• Email: [email protected]
• Describe concern in detail
• Provide relevant documentation

Step 2: Callendoc Investigation

• Investigation within 20 days
• Written response to complaint
• Remedial action if necessary

Step 3: Regulatory Complaint

If dissatisfied, you may complain to:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Phone: 0303 123 1113
Website: www.ico.org.uk

11. REGULATORY BODY COMPLAINT

You may also report data protection concerns to your professional regulatory body:

• GMC: General Medical Council (doctors)
• GDC: General Dental Council (dentists)
• HCPC: Health and Care Professions Council

12. INCIDENT RESPONSE

If your professional data is breached:

• You will be notified within 72 hours
• Notification includes scope and remediation steps
• UK GDPR requirement for breach notification

13. CHANGES TO THIS POLICY

We may update this policy for:

• Changes in our data practices
• Regulatory changes
• Technology improvements

Changes will be posted with updated effective date. For material changes, we notify you via email.

ACKNOWLEDGMENT

By using Callendoc as a healthcare professional, you:

• Acknowledge reading this Data Protection Policy
• Understand your rights under UK GDPR
• Consent to data processing as described
• Accept the security measures implemented
• Know how to exercise your rights

Questions or concerns? Contact: [email protected]

This Data Protection Policy complies with:

• UK General Data Protection Regulation (GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR) 2003
• Professional Conduct Standards (GMC, GDC, HCPC)
• Healthcare Data Protection Laws

Last Updated: November 2025
Effective Date: November 2025