For beneficial owners, controllers, directors, authorized signatories, officers and other business representatives
Version 1.0 | Published September 1, 2026
1. Who This Notice Applies To
This Notice explains how GetClinic Inc. processes personal information about individuals connected with a clinic, hospital, healthcare group or other business that GetClinic verifies for marketplace, payment, compliance, safety or legal purposes. It is primarily for people whose information may be provided to GetClinic by the Clinic or obtained from business registries, regulators, payment providers or other sources rather than collected directly from the individual.
GetClinic Inc., 74 E Glenwood Ave, Unit #5895, Smyrna, DE 19977, United States, is the controller for the GetClinic business-verification processing described in this Notice. Privacy contact: [email protected].
2. Information We May Process
identity and contact information, such as name, date of birth where needed, nationality, residence country, business email/phone and role;
ownership and control information, including percentage ownership, voting/control rights and ownership-chain information;
director, officer, authorized-signatory and authority information;
government or registry identifiers and identity-document evidence where reasonably required;
business, facility, licensing, insurance, tax, banking and payout-beneficiary information that relates to you;
sanctions, politically exposed person and other compliance-screening results where applicable;
verification, audit, fraud, security, dispute and reviewer records; and
criminal-offence data only in the limited circumstances described in Section 5.
3. Where We Get the Information
the Clinic or business you own, control, direct, represent or work with;
you directly, including through a secure verification flow;
corporate, professional, healthcare or other public/official registries;
payment service providers, banks or verification providers where relevant to a permitted payment/verification process;
sanctions, PEP, fraud, security or compliance-screening providers; and
publicly available sources where use is lawful and proportionate.
4. Why We Use It and Our Lawful Bases
We use business-verification information to verify Clinic identity and ownership/control; confirm authorized representatives; prevent impersonation, fraud and payout redirection; support sanctions and payment-provider checks; verify marketplace eligibility; protect Patients and the platform; investigate discrepancies; maintain audit evidence; and comply with applicable legal or regulatory requirements.
Depending on the processing and jurisdiction, our ordinary lawful basis may include our legitimate interests in operating a trustworthy healthcare marketplace, preventing fraud and abuse, securing payment and account changes, and verifying counterparties; compliance with a legal obligation where one applies; or another lawful basis appropriate to the specific processing. Where we rely on legitimate interests, we assess necessity, proportionality and the impact on the individual.
5. Criminal-Offence Data
Information about a natural person's criminal allegations, investigations, proceedings, convictions or related security measures receives additional protection. For EEA processing subject to GDPR Article 10, GetClinic will process such information only where the ordinary lawful basis is satisfied and the processing is under official authority or specifically authorized by applicable Union or Member-State law providing appropriate safeguards. For UK processing subject to UK GDPR Article 10, GetClinic will also identify the applicable authorization under UK law, such as a relevant Data Protection Act 2018 Schedule 1 condition, and maintain any required policy documentation or other safeguards.
We do not treat a general desire to prevent fraud as a universal authorization to collect criminal-offence data. If the required jurisdiction-specific authorization is not documented, we do not request that category of natural-person information through the standard KYB flow.
6. Who We May Share Information With
Where lawful and necessary, we may share relevant information with:
- GetClinic personnel and approved service providers that support verification, security, compliance, legal or platform operations;
- payment service providers or banks where a payment or payout verification process requires the information;
- professional advisers, auditors, insurers or transaction counterparties subject to appropriate confidentiality and need-to-know controls;
regulators, courts, law-enforcement or other authorities where disclosure is legally required or otherwise lawful; and
another GetClinic group entity or successor as part of a lawful corporate transaction, subject to applicable protections.
7. International Transfers
GetClinic is a U.S. company and may process verification information outside the country where you live. Where EEA/UK transfer rules apply, GetClinic uses an applicable lawful transfer mechanism and supplementary safeguards where required. Information about applicable EU/UK representative and transfer arrangements is made available through GetClinic's legal-information pages.
8. How Long We Keep Verification Information
Our operational target is to retain the completed business-verification record and evidence for six years after the later of the last verification decision or termination of the relevant Clinic relationship, unless law requires earlier deletion or a longer period is reasonably necessary for a legal hold, regulator/payment-provider inquiry, fraud/sanctions investigation or dispute. Where a less intrusive verification reference can replace a full identity-document copy without weakening audit integrity, we prefer the reference.
9. Your Rights
Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability or objection, and to complain to a data-protection authority. Some rights may be limited where information must be retained for legal, regulatory, fraud-prevention, establishment/defence-of-claims or verification-integrity purposes.
To exercise a privacy right or ask a question, contact [email protected].
10. Automated Screening and Human Review
GetClinic may use automated tools to support registry checks, document verification, sanctions/PEP screening, fraud detection or discrepancy flagging. Under the current GetClinic verification workflow, the final GetClinic KYB status is assigned by a designated reviewer rather than inferred solely from an automated score or a successful third-party API response.
11. When We Received Your Information From Someone Else
If we did not obtain your personal information directly from you, we provide this Notice through the secure verification flow, direct communication, a current notice delivered by the Clinic on our behalf, or another auditable route within the period required by applicable law, unless a documented legal exemption applies. You can ask us about the categories and source of information we hold about you.
12. Updates and Contact
We may update this Notice as our verification practices or legal requirements change. Material changes will be reflected in a new published version. Privacy: [email protected]. Legal: [email protected]. Where an EU or UK Article 27 representative is required, current representative details are published through GetClinic's legal-information pages.