Your privacy rights and how to use them

You do not need to know which privacy law applies to you before making a request. That is the opening rule of the Privacy Rights and Data Request Portal: tell GetClinic what you want to do, and GetClinic identifies the request type, determines which privacy or consumer-health-data rules apply, verifies your identity only as far as reasonably necessary, and routes any clinic-controlled part of the request appropriately.

What you can ask for

The Portal lists eleven named request types, plus an "other privacy request" option for anything that does not fit.

Request	What it means
Access or copy	Ask whether GetClinic processes information about you, and get a copy
Correct	Fix inaccurate information, or complete information that is materially incomplete
Delete	Delete personal information or consumer health data where the right applies
Restrict processing	Limit certain processing where the law gives you that right
Object to processing	Object on an applicable legal ground, including direct marketing
Portability or export	Get eligible data in a structured, machine-readable format
Withdraw consent	Stop future processing that depends on a permission you gave
Consumer health data access and recipient list	Confirm collection or sharing, and get the legally required list of recipients
Consumer health data deletion	Delete consumer health data, with downstream propagation where required
Automated decision or profiling	Exercise rights concerning qualifying automated decision-making
Appeal	Challenge a refusal or partial refusal where an appeal right exists

Rights vary by jurisdiction and by processing context, so listing a request type does not mean every right applies to every person or every record. Section 2 is explicit that GetClinic will not deny intake because you picked the wrong label.

See the full Portal.

How to send a request

There are three routes. The preferred one is the Privacy Rights and Data Request Portal in the patient privacy centre or in-product privacy settings. You can also email [email protected]. If an accessibility barrier stops you using the ordinary Portal, you can use [email protected], [email protected] or another accessible route, and the deemed-timely rule in the Patient Accessibility Statement applies to the first clear request received that way.

A request is not invalid because you sent it to a different GetClinic channel or did not use a particular legal phrase or form. You do not need to create an account to make a request, and Section 5 asks you not to send medical records, passport scans or identity documents in an ordinary email just to get started. GetClinic provides a secure route when that evidence is genuinely needed.

How GetClinic checks who you are

Verification is described in Section 7 as risk-based and proportionate. Where it is sufficient, GetClinic should prefer low-data methods: an authenticated session, a code or link sent to a contact point already on file, or confirmation of limited account details. Information collected only to verify identity is not reused for marketing or profiling.

One detail matters for timing. Section 7 states that the system must apply the deadline rule of the law governing the request and must not assume every privacy clock pauses during verification.

How long it takes

You get a request or reference ID, and the Portal may show the request as Received, Verification needed, In review, Action in progress, Completed, Partially completed or partially refused, Refused with an appeal available, Appeal in review, or Closed.

GetClinic aims to acknowledge a rights request within two business days. Section 9 is clear that this target does not replace a shorter legal deadline and does not postpone the legal receipt time.

Regime	Baseline	Extension
EU GDPR	Generally one month from receipt	Up to two further months, with notice and reason inside the first month
UK GDPR	Generally one calendar month	Up to two further months for complexity or number
Washington consumer health data	Within 45 days	One 45-day extension, with notice. Authentication effort does not extend the initial clock
California consumer privacy	Generally 45 calendar days	One 45-day extension where permitted

Where several laws cover the same request, Section 10 says GetClinic uses the shortest applicable deadline rather than one global period.

See exporting a copy of everything.

If a request is refused

Requests are free by default, and Section 15 says no automatic fee is built into the Portal. A refusal or partial refusal comes with the reason, to the extent the law permits GetClinic to give it, and with the appeal, regulator-complaint or judicial-remedy information the law requires.

Section 16 requires the appeal route to be conspicuous and substantially as easy to use as the original request, reusing your existing request ID and prior verification where that is reasonably safe. For Washington consumer health data appeals the decision comes within 45 days, and a denial must include the route to contact the Washington Attorney General.

Exercising a right cannot be held against you

Section 17 says exercising a privacy right does not, by itself, make you medically unsuitable, cancel a booking, justify a worse marketplace ranking, or authorise a clinic to retaliate. A feature may stop working if it cannot lawfully operate without data you asked to delete, and that consequence is not treated as punishment.

GetClinic is a technology marketplace. The clinic you choose provides your healthcare and is responsible for it. This article is general information about how GetClinic works, not medical advice.

See deletion, and what it does not reach. See the Patient Privacy Policy.