Data protection legislation generally differentiates between controllers and processors of personal data to establish the responsibility for such data. It is the controller who determines the purpose and means of the processing of personal data. A processor processes personal information on behalf of a controller based on the controller’s instructions.

Trustedoctor processes personal data both as a processor and a controller. When you share data with a Service Provider through the Trustedoctor Platform (including when you receive care or other services from them), we will mostly only act as a data processor of such data, meaning that we process it “in the background” as instructed by your Service Provider while such Service Provider will be the controller of your data. In other cases, however, Trustedoctor is the controller of your data.

Please note that this Privacy Policy only sets out how your personal data is handled by us. It does not cover how your data is handled by any other person (including your Service Provider). We do not control the Service Providers who provide services through the Trustedoctor Platform and are not responsible for their privacy statements. For information regarding how your data is handled by the Service Providers, we recommend that you take a look at the privacy notice of the relevant Service Provider. Trustedoctor Platform provides supporting services that allow providers and receivers of healthcare and related services to connect with each other on a secure online platform. We are not a healthcare provider and do not practice medicine or provide medical care or advice. While you might use the Trustedoctor Platform to, amongst other things, store health records and receive healthcare and related services, Trustedoctor is not responsible for maintaining, and has no control over, records of the care and services you receive. Therefore, such records do not form part of, and are not subject to, the terms of this Privacy Policy. You should refer to the Service Provider from whom you are receiving medical care or services through the Trustedoctor Platform for records of the care provided.

Personal data, or personal information, is any information about a person from which he or she can be identified. It does not include data where the identity has been removed (anonymous data).

Depending on your interactions with us, we may process different kinds of personal data about you for various purposes:

• Basic account data

  We collect data that relates to your account on the Trustedoctor Platform and your relationship with us. This includes the basic data collected about you when you register for an account on the Trustedoctor Platform or otherwise communicate with us regarding your account such as your identity and contact data. Such data may include your name, date of birth, gender, photograph, geographical location, passport number, address, e-mail address, phone number, etc. It may occasionally also include your physiological data such as your height and weight. If you are a Professional User, we may also, depending on your role on the Trustedoctor Platform, collect professional data such as your job titles, employer, employment history, education, specialty, patient base, number of surgeries performed, academic recognition and professional endorsement. We use this data in order to administer and manage our relationship with you and your account, including to register you as a new user, verify your identity and create your profile, sign you up as a Professional User on the Trustedoctor Platform (if applicable), notify you about changes to the Trustedoctor Platform or our policies, market externally that you are affiliated with us (if you are a Professional User and have given us your permission), and communicate with you as necessary in order to provide you with the information, products and services that you request (such as to contact you about a request you have made and answer any queries you may have).

• Marketing and communications preferences

  We may also collect your preferences in receiving marketing from us and our third parties and your communication preferences.
  We only process such data with your consent to market and promote our business and that of your Service Provider, including providing you with newsletters.

• Usage and technical data

  We collect usage and technical data about your visit to the Trustedoctor Platform, including the date and time of your visit, communications metadata (such as scrolling, clicks / button presses, and mouse-overs), any phone number used to call our customer service number, the IP address used to connect to the Trustedoctor Platform, your login information, settings, browser type and version, app version and mobile operating system.
  We use such data to manage our relationship with you, to administer, protect and improve the Trustedoctor Platform and for internal operations, including: (a) troubleshooting, system maintenance and support; (b) anonymising such usage and technical data for data analysis, testing, reporting, research, and statistical and survey purposes; (c) ensuring you receive information relevant to you and that content from the Trustedoctor Platform is presented in the most effective manner for you and for your devices; (d) monitoring and keeping records of our communications with you; (e) asking you to leave a review or take a survey; and (f) keeping the Trustedoctor Platform safe and secure.

• Health and medical data collected in connection with Trustedoctor's introduction services

  At times, Trustedoctor acts as a concierge to help users navigate among different Service Providers and the services offered by them. As part of this service, we make introductions of users of the Trustedoctor Platform, at the user's option, to Service Providers who matches the criteria for services sought by the user.
  If you make an enquiry for or sign up to a service that enables such introductions, we may, in order to provide you with the services you seek, collect health and medical data about you (such as your medical history and records), in addition to the categories of data listed above.
  We do this in order to provide you with the information, products and services that you seek, including to provide you with information about Service Providers who may be suitable to provide the medical services you seek and to share your medical and other data with Service Providers as necessary for them to provide the services you request.

Additional purposes

We also process any data about you available on the Trustedoctor Platform as necessary for us to comply with legal obligations placed on us from time to time, including to: (a) prevent prohibited or illegal activities; (b) prevent breaches of Applicable Data Protection Laws; (c) comply with our obligations relating to your personal data, including when you exercise your rights under Applicable Data Protection Laws and make requests; and (d) deal with disputes and legal claims.

We may also anonymise your personal data for analysis, research or statistical purposes (which, if it includes sensitive data such as health data, we will only do with your explicit consent) as well as collect and process aggregated data such as statistical or demographic data. Anonymised and aggregated data is not considered personal data in law as it will not directly or indirectly reveal your identity. However, if we combine or connect any anonymised or aggregated data with your personal data such that it can directly or indirectly identify you, we treat the combined data as personal data and use it in accordance with this Privacy Policy.

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for any other purpose then, unless you have already given your consent for us to do so, we will notify you, explain the legal basis which allows us to do so and where necessary ask for your explicit consent.

Your Content

The Trustedoctor Platform allows you to input, upload, store, send and receive content such as text, messages and other communications, and audio, video, images, documents and other files, including medical records and written and imaging reports (collectively, “Content”) through your account.

You control your Content on the Trustedoctor Platform. We will only store your Content, keep it safe and otherwise process it in accordance with your instructions. We do not access or view your Content unless it’s necessary to comply with our legal obligations or enforce our policies, or you expressly give us permission to do so. This may be, for example, where you make an enquiry for or sign up to a service that enables you to receive introductions from us to Service Providers and have given us your permission to access your Content, or where you contact our support team for help with specific Content on your account (such as if you can’t find a file you believe should be on your account) in which case we may ask for your limited permission to look at your Content to the extent necessary.

We collect data about you in different ways:

• Directly from you or someone acting on your behalf. You may directly give us personal information by filling in forms on the Trustedoctor Platform or by corresponding with us by e.g. phone, e-mail or the chat function on the Trustedoctor Platform. If someone is using the Trustedoctor Platform on your behalf, they may also give us personal information about you. Depending on the services available to you this may include, for instance, your identity, contact, professional, financial and health and medical information that you provide when you register on the Trustedoctor Platform or receive our assistance in navigating among different Service Providers.

• Collected by us through automated technologies or interactions with you. We automatically collect various usage, technical and transactional information about you by using cookies, server logs and other similar technologies. We may also receive technical information about you if you visit other websites employing our cookies.

• From other sources. We may receive personal data about you from other users of the Trustedoctor Platform and Trustedoctor Partners. We are also working closely with third parties (including, for example, business partners, charity partners, sub-contractors for technical, , analytics providers , as well as search information providers and may receive contact, transactional or technical information about you from them.

We do not knowingly collect personal data about children under the age of 18 without the consent of their parent or legal guardian. If you are under 18, you are not allowed to provide personal data to us directly. Please make sure your parent or legal guardian uploads any of your personal data on your behalf to the Trustedoctor Platform.

We use cookies to distinguish you from other users of the Trustedoctor Platform. We only use cookies that are required for the Trustedoctor Platform to function safely and properly. For detailed information on the cookies we use and the purposes for which we use them see our Cookie Policy.

In order for us to process your personal data, we need to have a lawful basis for doing so under Applicable Data Protection Laws. Our lawful basis will generally depend on the data in question and the specific context in which we collect it.

We process your personal data primarily on the following legal bases:

• Contract - We will normally process your personal data only where we need this data to perform the contract we have entered into with you and be able to deliver the services you have requested from us in a secure manner (for example, to register you as a new user on the Trustedoctor Platform, contact you about a booking or order you have made and send you booking confirmation.

• Legitimate interests – We may also process your personal data when it is necessary for our legitimate interests (or those of a third party). We will balance our legitimate interests against any possible impact on to you (both positive and negative), your rights or freedom. Where our interest and needs are overridden by your interests, rights or freedom, we will not process your personal data (unless you provide us with your consent or required by law). Among other things, we use your personal data to further our legitimate interests to provide you with our services and manage our relationship with you, ascertain how our customers use our services, carry out administrative and IT operations, help detect or prevent security incidents, develop our business, and generally to keep the Trustedoctor Platform safe and protect our business as well as our customers and third parties.

• Legal obligation – In some cases we may also process your personal data where necessary to comply with a legal obligation, to resolve disputes or in anticipation of litigation, to enforce our agreements or to protect our rights or property or those of third parties (even if your personal data is subject to a deletion request from you).

• Consent – We may also process your personal data where we have your consent to do so. Other than in certain instances where we8 collect special category data about you (as explained below), we will only occasionally rely on consent as a legal basis for processing your personal data. For instance, we will rely on your consent if you have agreed to us sending direct marketing communications to you. You have the right to withdraw your consent at any time by contacting us or by opting out via the unsubscribe link provided in the footer of the communication received.

Please note that if you receive care or other services from Service Providers on the Trustedoctor Platform, such Service Provider will rely on their own lawful bases for processing your data.

Under data protection legislation some personal information, including information about your health, is treated as more sensitive and gets extra protection (special category data). When you add your medical records or disclose information about your medical history on the Trustedoctor Platform, we usually just store your data on your behalf and/or pass that data securely to your selected Service Provider as per your instructions. Where we send such data to your Service Provider, they will be responsible for any medical data shared with them and we can only act in relation to such data in accordance with their instructions. Such data is outside of the scope of this Privacy Policy and is a matter between you and your selected Service Provider.

However, we may also at times, depending on the services you use, collect and process special category data about you, such as health and medical information. This will typically be if you make an inquiry for or sign up on the Trustedoctor Platform to a service that enables you to receive introductions from us to Service Providers. We need to do this in order for us to assist you in identifying a Service Provider who is suitable to provide you the services you seek and to ensure they are provided with sufficient information about your case to provide the appropriate care. To lawfully process such special category data, we must, in addition to having a lawful basis, meet a separate condition for the processing. We only process special category data if:

• we have your explicit consent to do so; and/or

• it is necessary to bring or defend legal claims.

If you have consented to receiving newsletters or marketing messages from us, you can ask us to stop at any time by following the opt-out links on the relevant newsletters or messages or by contacting us. Where you do so, this will not apply to personal data provided to us for other purposes and we will still use your contact information to communicate with you for other purposes (e.g. regarding an appointment you have booked).

We never sell or allow your personal information to be used by third parties for their own marketing purposes.

In certain situations, we may share your personal information for the purposes explained in this Privacy Policy with a limited number of third parties:

• Service Providers or other users of the Trustedoctor Platform. Depending on the services you use, we may, when you ask us to do so or otherwise with your consent, share your personal information with Service Providers or other users of the Trustedoctor Platform. All Professional Users have undertaken to us that they will comply with all privacy and security laws applicable to your interactions with them. However, we are not responsible for any violations of privacy and security laws by any Service Providers or other users of the Trustedoctor Platform. Where you choose to share or consent to us sharing your data with any third parties that are not under our control (including other users of the Trustedoctor Platform), they are responsible for such data. How they handle your data is determined by their policies and local regulations and we recommend you read them.

• Your parent or legal guardian, or other persons who use your account. If you are a minor or do not have legal capacity, we may share your personal information with your parent or legal guardian supervising your use of the Trustedoctor Platform under their account. We may also share your information with other persons who use your account unless we believe they are not authorised to do so.

• Third party service providers who help us run our business and provide services to you on our behalf. This includes IT suppliers (including suppliers of data storage and web hosting services), maintenance and database management providers, analytics providers as well as other service providers and select contractors where it is necessary for us to operate or optimise the Trustedoctor Platform and for the administration of services on it. Where we engage such third-party service providers, they will be acting as processors on our behalf to carry out such data processing functions, meaning they will access and use this data to provide services to us only in accordance with our instructions and must provide reasonable assurances that they will appropriately safeguard the data and treat it in accordance with Applicable Data Protection Laws. We require all such service providers to respect the security of your personal data and to treat it in accordance with the law.

• Professional advisers. This can include lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services, acting as processors or controllers of your information.

• Regulators, governmental bodies and any other person where we are required to for legal reasons. We may disclose or share your personal data with, for example, regulators, law enforcement and other authorities who require reporting of processing activities in certain circumstances, courts or other relevant persons (acting either as processors or controllers) (i) if we reasonably believe that disclosure is compelled/required by applicable law, regulation, legal process or a government request, (ii) to establish, exercise or defend our legal rights, (iii) to enforce our agreements and policies, (iv) to protect the security or integrity of our business and services, or (v) to protect our rights, property, or safety or those of our customers or others. This includes exchanging information with other companies and organisations for the purposes of preventing fraud and reducing credit risk.

• Acquirors or successors. If Further Underwriting International, S.L.U. merges with a third party or its shares or substantially all of its assets are acquired by a third party (through e.g. a sale, merger, reorganisation or similar event), personal data held by us about our customers will likely be one of the assets transferred to the buyer or successor entity in order to maintain service continuity under our contracts with such customers. In such an event, we will take steps with the aim of ensuring that your privacy rights continue to be protected.

• Our business or charity partners where the data has been aggregated or anonymised and can no longer be linked to you as an individual. Occasionally we may anonymise your personal data or aggregate it with other data (such as in charts or tables) so that it can no longer be associated with you (if such data includes sensitive data about you such as health data, we will only do so with your explicit consent). We may do this for analysis, research or statistical purposes, to improve our services or for systems administration purposes. In accordance with Applicable Data Protection Laws, we may share such anonymous or aggregated information with third parties indefinitely without your consent or further notice to you.

We may also share your personal data with any other person where we have obtained your explicit consent to do so.

We do not store your personal data on your computer or mobile device. All your personal data is securely stored in the cloud.

The cloud storage servers we use to store your data are based in the European Economic Area ("EEA") and the United Kingdom. We do not transfer or store your personal data outside this area except in certain specific cases. This will typically be where you interact or communicate with a Service Provider or a user of the Trustedoctor Platform who is located outside the EEA or the United Kingdom in connection with the provision or receipt of services, in which case we may transfer your personal data to them as required in connection with those services.

In addition, your data may be transferred outside this area in connection with the provision of services by third-party service providers who act as processors on our behalf and help us enable some of the functions of the Trustedoctor Platform. For example, we use a chatbot business-messenger service to enable live chat and messaging functionality on the Trustedoctor Platform to provide tech support to users. This service is provided by a third-party provider whose servers are based in the United States. The video provider we use to enable video consultations on the Trustedoctor Platform is also based in the United States. While no video or audio media is permanently stored on any of the video provider’s servers, such media may in certain circumstances be temporarily stored in flash memory in the United States for the duration of the video/audio session, or if the session is recorded, a media file may be temporarily stored on servers in the United States for a short time (from a few seconds to a few days). We may also use certain other third-party service providers from time to time. We have safeguards in place with all these providers to ensure your data is adequately protected.

In the limited circumstances where we transfer your personal information outside the EEA and the United Kingdom, we will only do so in accordance with Applicable Data Protection Laws, that is, if we can ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is in place:

• the country to which your personal data is being transferred has been deemed to provide an adequate level of protection for personal data by the European Commission (or, in the case of transfers from the United Kingdom, the competent authority for the United Kingdom);

• our contracts with the recipient include standard contractual clauses approved by the European Commission (or, in the case of transfers from the United Kingdom, by the competent authority for the United Kingdom) which give personal data the same protection it has in Europe; or

• an alternative data transfer mechanism that ensures sufficient safeguards for such transfer in compliance with Applicable Data Protection Laws (including the EU/UK-US Data Privacy Framework or any new version of it adopted pursuant to Applicable Data Protection Laws) is in place.

Please contact us if you want more information about partners we may use who store data outside of the EEA and the United Kingdom or further information on the specific mechanism used by us when transferring your personal data out of this area.

If none of these safeguards are available in respect of a proposed transfer of your personal data outside the EEA and the United Kingdom, we will explain the possible risks to you of the proposed transfer, following which, if you provide your explicit consent, we may proceed with the transfer.

Your personal data may also be transferred and stored outside the EEA and the United Kingdom by Service Providers (or their processors) or by independent third-party suppliers . Such transfers are outside our control and you should refer to their privacy notices for more details.

We do not make any kinds of solely automated decisions about you (meaning decisions made without any human involvement) which could affect you in legal or similarly significant ways.

Our staff only have access to your personal information to the extent they need it in order to provide you with access to the Trustedoctor Platform and the services available on or through it.

Communications (including those containing sensitive medical records like operations, habits, permanent medication, drug allergies and permanent diagnoses) internally between our servers (e.g. between application server and databases) are handled via secure socket layer (“SSL”) encryption, providing an industry-standard level of protection for data in-transit. You should always make sure that your browser can validate the Website’s certificate. All uploaded data is stored in encrypted form and the encrypted values generated are signed using a message authentication code (MAC) so that the underlying value cannot be modified once encrypted.

The cloud storage provider that we use has certifications for compliance with the leading security frameworks/standards and holds an array of security compliance certifications, including ISO 27001 (one of the most widely recognised, internationally accepted independent security standards), SOC 1, FISMA, FedRAMP, PCI DSS Level 1, ISO 9001 and ISO 27018. In addition, the provider aligns its HIPAA risk management program with FedRAMP and NIST 800-53, which are higher security standards that map to the HIPAA Security Rule.

All data travelling between your device and our cloud servers is also encrypted using industry standard methods.

Where we have given you (or where you have chosen) a password to access the Trustedoctor Platform, you are responsible for keeping this password confidential. Your passwords are stored on our servers in encrypted form using a one-way hashing algorithm and you can opt to use two-factor authentication (2FA) to login and access your account. Please be reminded that you must protect any passwords or other credentials associated with your account.

You should be aware that the transmission of information via the internet is never completely secure and we cannot guarantee the security of your data transmitted to the Trustedoctor Platform, although we will do our best to protect your personal data. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

You are in control of and can delete the Content on your account at any time. If you do so, it will no longer be accessible to you or others who may access your account. You should be aware that if you share any Content with another user of the Trustedoctor Platform, copies of such Content may be accessible to them through their accounts even after you delete it from your account.

We will generally only hold your personal data for as long as necessary to fulfil the specific purposes for which we collected or process it as set out in this Privacy Policy, or in line with any legal and regulatory requirements or guidance in respect of retention periods. In most cases, this will be until you cancel your account or delete the information from your account. In some circumstances you can also ask us to delete some or all of the personal data that we hold about you – see the section below for more information. Where you contact us and we keep a record of that correspondence, we will keep that for as long as is reasonably required unless you ask us to delete it.

However, even after you or we delete any of your information, we may retain minimised logs of your account activity for longer periods for legal reasons.

We may occasionally anonymise your information so that it can no longer be associated with you (which, if it includes sensitive data such as health data, we will only do with your explicit consent), for research or statistical purposes, in which case we may use this information indefinitely without further notice to you. For more details about our retention policies, please contact us.

You have certain rights in relation to your personal information, including the following:

You will generally not have to pay a fee to exercise any of your rights as a user, although we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We could also refuse to comply with your request in these circumstances.

When you make a request to exercise your rights, we may need to ask for proof of your identity and/or ownership of your account before fulfilling your request. We may also contact you to ask for further information in relation to your request.

Please note that if your request pertains to data that you have shared with a Service Provider, such Service Provider will be responsible for granting your request.

The Trustedoctor Platform may, from time to time, contain links to third party websites which are outside our control and are not covered by this Privacy Policy. If you follow a link to any of these websites it may allow third parties to collect or share data about you. Please note that these websites have their own privacy policies and that we do not accept any responsibility or liability in respect of these policies. Please check these policies before you submit any personal data to these websites.

We keep our Privacy Policy under regular review (for example, to reflect changes we make to our services or to reflect changes in the law or best practice). The most current version of this Privacy Policy will be available on the Website. Please check back periodically to see any updates or changes to this policy.

If you have any questions, comments or complaints about this Privacy Policy and our privacy practices, or any issues, concerns or problems in relation to your personal data, or wish to notify us of data which is inaccurate, please contact us at [email protected].

If you are not satisfied with our response you can contact the corresponding Supervisory Authority:
The Information Commissioner's Office (ICO) in the UK (for UK residents):
Information Commissioner's Office, Wycliffe House, Water Lane, SK9 5AF, Cheshire, United Kingdom
Phone: 03031231113 (local rate) or 01625545745 (national rate), www.ico.org.uk
Further Underwriting International, S.L.U. is registered with the Information Commissioners Office, registration number ZB611569
Or
Spanish Data Protection Agency in Spain (for other countries):
www.aepd.es