This is a starting template, not legal advice Before going live with real patients, have this reviewed by a solicitor familiar with Irish health data law and by your medical indemnity insurer (e.g. Medisec, MPS). It's written to reflect GDPR's rules on "special category" health data, but your specific setup (payment processor, hosting location, any third parties) needs to be checked against it.

Privacy & GDPR Notice

Data controller: GP4U (contact: admin@gp4u.ie)

What we collect

When you book a consultation we collect your name, date of birth, contact details, and the health information you provide in your intake questionnaire and during your consultation. This is "special category" data under GDPR, and we only process it to provide you with medical care, which is a lawful basis under Article 9(2)(h) (health care provided by a health professional).

How we use it

To arrange and carry out your consultation
To keep a clinical record, as required by Medical Council guidance
To process payment (via Stripe — Stripe does not receive your health information, only payment details)
To respond to messages you send us about your care

How long we keep it

Medical records are retained in line with Medical Council of Ireland guidance (currently a minimum of 8 years for adult patients; longer for children — until age 25, or 26 if a note was made at 17). Update this section to match your own retention policy once confirmed.

Your rights

You can download a copy of everything we hold about you, or request that your account and data be deleted, from the "My Data & Privacy" section of your patient portal. Deletion requests are reviewed by a person rather than actioned automatically, since GPs are legally required to retain clinical records for a minimum period (see "How long we keep it" above) — we will delete what can legally be deleted and respond within one month. You can also ask us to correct information we hold, or ask questions about how it's used, by emailing admin@gp4u.ie. You have the right to complain to the Data Protection Commission (dataprotection.ie) at any time.

Security

Video consultations and messages are transmitted over encrypted connections, and the site itself is only served over HTTPS. Clinical notes, prescriptions, sick cert/referral letter details, and your intake answers are also encrypted at rest in our database. Payment is handled entirely by Stripe — GP4U never sees or stores your card details.

Terms of Use

GP4U is intended for non-emergency GP consultations. If you are experiencing a medical emergency, call 112/999 or attend your nearest Emergency Department immediately. Consultations are provided by GPs registered with the Irish Medical Council. In some cases, your GP may advise that an in-person examination is required and decline to treat remotely — this is for your safety.