Your complete medical file is not made available to every clinic on the marketplace. The Health Data Privacy and Sharing Notice calls the approach progressive disclosure: before you select or affirmatively engage a clinic, request-level sharing is limited to what is reasonably necessary to route the request or work out whether a clinic may be able to help.
Before you choose a clinic
Where it is reasonably practicable, pre-engagement information is de-identified or pseudonymised. Section 2 of the Notice says it does not include direct identifiers such as your full name, personal contact details, account credentials or complete medical file.
That is the point at which a clinic is deciding whether your request is something it handles. It does not need to know who you are to answer that.
See how clinics appear in your results.
When you engage a clinic
When you select a clinic, request an evaluation, send a message or book a consultation, GetClinic may transmit what is reasonably necessary for that request. Section 3 lists what that can include:
- your name, contact details, age or date of birth, and other identifying information
- the treatment you are interested in and your requested timing
- medical history, symptoms, medications, allergies and prior procedures you provide
- medical photographs, scans, X-rays, test results, reports or other documents you choose to share
- messages, consultation information, and what is needed to prepare a clinic offer or booking
- anything else you specifically ask GetClinic to transmit to that clinic
Sharing is tied to the clinic you choose, the feature you use and the service you request, unless another disclosure is required by law or is lawfully permitted to protect vital interests in an emergency.
What the clinic does with it
The clinic you select is an independent healthcare provider. Once it receives your information for its own healthcare purposes, Section 4 says it may become an independent controller or equivalent regulated healthcare entity. It may then use the information for medical evaluation, consultation, diagnosis, treatment planning, informed consent, medical records, billing, aftercare and its own legal obligations.
GetClinic does not control the clinic's medical decisions or its legally required clinical records. Your clinic may give you its own privacy notice, consent forms and medical-record rules, and those are worth reading.
Seven things GetClinic does not do
Section 6 of the Notice is a list of prohibitions rather than intentions. GetClinic does not:
- sell patient health information
- use patient health information, private medical uploads or private patient-clinic messages for targeted or cross-context behavioural advertising
- place advertising pixels or equivalent cross-context advertising trackers in authenticated medical-document, consultation or private health-information areas
- authorise service providers acting on its behalf to use patient health information for their own advertising or unrelated general-purpose model training
- treat uploading a medical photograph, scan or testimonial for healthcare purposes as permission to use it for advertising or promotion
- intentionally record a medical consultation without a lawful basis and any notice or permission the law requires
- disclose your complete health file to every clinic on the marketplace
See what happens to photographs you upload.
Accepting the terms is not health-data consent
The Notice opens by saying it is not a blanket consent to use or disclose your health information, and that where the law requires a separate consent, authorisation or other affirmative permission, GetClinic will request it separately before the relevant processing or disclosure. Section 5 of the Consumer Health Data Privacy Policy carries the same rule: acceptance of the patient terms or the general privacy policy is not treated as blanket consent to collect or disclose health information for unrelated purposes.
You can withdraw a consent as the law permits. Withdrawal does not make earlier lawful processing unlawful, and it may stop GetClinic or the clinic continuing something that needs the information.
How long it is kept
Section 9 gives an indicative operational target: health data held by GetClinic for marketplace purposes is generally targeted for deletion or de-identification around 24 months after your last relevant interaction, unless a shorter or longer period is required or justified.
A clinic may have separate legal obligations to keep clinical records for much longer, and a deletion request to GetClinic does not automatically delete records the clinic is independently required or permitted to retain.
GetClinic is a technology marketplace. The clinic you choose provides your healthcare and is responsible for it. This is general information about how GetClinic works, not medical advice. Only the clinic's qualified healthcare professionals can decide what treatment is right for you.
See the full Health Data Privacy and Sharing Notice. See deleting health data you have shared.