Privacy Rights & Data Request Portal

Patient privacy requests, consumer health data requests, consent withdrawal and appeals

1. What This Portal Is For

This Privacy Rights & Data Request Portal (the “Portal”) is GetClinic's patient-facing intake route for requests concerning personal information and consumer health data processed by GetClinic.

The Portal supplements GetClinic's Patient Privacy Policy, Consumer Health Data Privacy Policy, Health Data Privacy & Sharing Notice, Patient Accessibility Statement and other applicable privacy notices. It does not reduce rights available under mandatory law.

Discoverability. GetClinic should link the then-current Portal from its Patient legal/privacy center and relevant in-product privacy controls. The next controlled Patient Marketplace Terms update should name this Portal so Patients can find the unified rights route without having to infer it from a generic privacy-contact reference.

You may use the Portal whether you have a GetClinic account or not. Where applicable law permits GetClinic to require use of an existing account for security, GetClinic may ask you to authenticate through that account, but GetClinic will not require you to create a new account merely to exercise a privacy right where law prohibits that requirement.

2. Requests You Can Make

Rights vary by jurisdiction and processing context. Providing a request type in the Portal does not mean that every listed statutory right applies to every Patient or every item of data. GetClinic will not deny intake merely because you selected the wrong label.

3. Consumer Health Data Requests

Health information may be regulated differently from ordinary personal information. GetClinic's Health Data Privacy & Sharing Notice states that GetClinic does not sell Patient health information and does not use private health information for targeted or cross-context behavioral advertising.

Where a consumer-health-data law such as the Washington My Health My Data Act applies, the Portal supports requests to confirm whether GetClinic is collecting, sharing or selling consumer health data; access the data; obtain a legally required recipient list; withdraw consent to future collection or sharing; request deletion; and appeal a refusal.

Where applicable law requires downstream deletion, GetClinic will notify the affiliates, processors, contractors or third-party recipients to whom the deletion request must legally be propagated and will keep evidence of that instruction. For consumer health data covered by the Washington My Health My Data Act, deletion extends to archived and backup systems; where deletion must be delayed to enable restoration of those systems, that delay may not exceed six (6) months from authentication of the deletion request. For other data or laws, the applicable legal rule and lawful technical deletion cycle controls.

A request to withdraw health-data consent can affect a feature or service that cannot lawfully or safely operate without the data. GetClinic will explain the material consequence where reasonably necessary.

4. GetClinic Data vs. Clinic Medical Records

GetClinic and a selected Clinic can be independently responsible for different copies and uses of your information. GetClinic is responsible for privacy requests concerning processing for which GetClinic is the controller or equivalent responsible entity. A Clinic may be independently responsible for medical evaluation, diagnosis, Treatment planning, medical records, billing, aftercare and other healthcare processing.

A deletion request to GetClinic therefore does not automatically erase a medical record that a Clinic is independently required or permitted to keep. GetClinic will not tell you that a Clinic record was deleted unless GetClinic has reliable evidence that the responsible Clinic completed the applicable action.

If your request clearly concerns both GetClinic and a Clinic, GetClinic may route or forward the Clinic-controlled portion to the Clinic, provide you with the Clinic contact route, or otherwise cooperate as applicable. You should not have to understand controller/processor terminology merely to get the request to the right place.

5. How to Submit a Request

Preferred route. Use the Privacy Rights / Data Request Portal made available in the GetClinic patient privacy/legal center or in-product privacy settings when available.

Email route. You may also submit a privacy request to [email protected]. A request sent to another GetClinic channel should be routed internally when it clearly seeks to exercise a privacy right; GetClinic will not intentionally reject a request solely because you did not use a particular legal phrase or form.

Accessible route. If an accessibility barrier prevents you from using the ordinary Portal, you may use [email protected], [email protected] or another accessible route GetClinic makes available. Where a privacy right is deadline-sensitive, the Patient Accessibility Statement's deemed-timely rule applies to the first clear request received through the alternative route.

Representative route. If you are in the European Union or the United Kingdom you may also submit a request through GetClinic's Article 27 representative at https://app.prighter.com/dsr/12490498497.

Do not send unnecessary medical records, passport scans, national identity documents or other highly sensitive material in an ordinary email merely to start a request. GetClinic will provide a secure verification/upload route when such evidence is genuinely necessary.

6. Information the Portal Should Ask For

The public request form should collect only information reasonably needed to find the relevant account/data, understand the request and communicate securely. The standard form should include:

• your name;
• the email address or phone number associated with your GetClinic use, if any;
• your country/state or other jurisdiction information reasonably necessary to identify applicable rights;
• whether you are requesting for yourself or acting as an authorized representative;
• the request type(s) you want to exercise;
• a short description of the data, feature, Clinic, Booking or time period involved if that helps identify the records;

• your preferred response language or accessibility format, where reasonably available; and
• a secure contact method for status updates.

The form should not make a diagnosis, treatment history, government identifier, passport number or medical-document upload mandatory merely to submit the request.

7. Identity and Authority Verification

GetClinic may need to verify that a requester is the person to whom the information relates, or that a representative is authorized to act for that person. Verification is risk-based and proportionate.

Where reasonably sufficient, GetClinic should prefer low-data verification methods such as an authenticated existing session, verification link/code sent to an established contact point, confirmation of limited account information, or another secure method already associated with the account.

GetClinic will not request more verification information than reasonably necessary for the request and risk. Information collected solely for identity/authority verification will not be repurposed for unrelated marketing or profiling.

If GetClinic cannot authenticate a request with commercially reasonable efforts, it may request additional information reasonably necessary to authenticate the request. The system must apply the deadline rule of the law governing that request; it must not assume that every privacy clock pauses during verification.

8. Authorized Representatives, Parents and Guardians

A legally authorized representative may submit a request where applicable law permits. GetClinic may ask for reasonable evidence that the representative may act for the Patient and may directly verify the Patient where legally appropriate.

A parent, guardian or other authorized person may exercise rights for a minor or another person lacking legal capacity where permitted by law. GetClinic should request the minimum evidence reasonably necessary to establish that authority.

Using a representative does not require the Patient or representative to create a new GetClinic account where applicable law prohibits such a requirement.

9. What Happens After You Submit

GetClinic will create a request record and provide a request/reference ID. The Patient-facing Portal may show statuses such as:

• Received;
• Verification needed;
• In review;
• Action in progress;
• Completed;
• Partially completed / partially refused;
• Refused - appeal available where applicable;

• Appeal in review; and
• Closed.

GetClinic aims to acknowledge a rights request within two (2) business days. That acknowledgement target does not replace a shorter legal deadline and does not postpone the request's legal receipt time.

10. Response Deadlines

The legal deadline depends on the law and request. GetClinic will use a deadline engine that applies the shortest applicable response deadline to each request/scope rather than assuming one global period.

A request received by GetClinic's Article 27 representative is treated as received by GetClinic on the date the representative receives it.

If several laws apply to the same data/request, GetClinic should operationally use the shortest applicable deadline unless a legal rule requires a different calculation for a particular scope.

11. Access and Data Delivery

Where an access right applies, GetClinic may provide confirmation of processing, a copy of eligible personal information and the supplementary information required by applicable law, such as purposes, categories, sources, recipients/recipient categories, retention information and applicable rights.

Where a consumer-health-data law requires a specific list of third parties and affiliates that received consumer health data, the response will include the legally required recipient information and available active email address or other online contact mechanism.

Where portability applies, GetClinic will provide eligible data in a structured, commonly used and machine-readable format. GetClinic may exclude or protect information concerning another person, privileged material, security secrets, anti-fraud logic or other information that law permits or requires GetClinic to withhold.

Sensitive exports, especially health data, should be delivered through a secure authenticated download or other protected delivery mechanism. Ordinary email should be used for notifications or low-risk correspondence rather than as the default attachment channel for a full medical-data export.

12. Correction

Where correction/rectification applies, GetClinic will correct inaccurate personal information within the scope of GetClinic's responsibility and, where required, communicate the correction to recipients.

A privacy correction request is not a mechanism to rewrite a Clinic's professional medical opinion, diagnosis or lawfully maintained clinical record. If the disputed information is Clinic-controlled clinical content, GetClinic may route the request to the Clinic while correcting any GetClinic-controlled factual account information that is actually inaccurate.

13. Deletion

Deletion rights are not absolute. GetClinic may retain data where applicable law permits or requires retention, including for legal obligations, fraud/security, payment/transaction evidence, legal claims, regulatory requirements or other permitted purposes. Any retained data should be limited to the lawful retained purpose and not used as though the deletion request never occurred.

Where a Washington consumer-health-data deletion right applies, deletion must extend through GetClinic's relevant network and be propagated to applicable affiliates, processors, contractors and third parties. Consumer health data stored in archived or backup systems may be deleted on the legally permitted delayed cycle, but that delay may not exceed six (6) months from authentication of the deletion request. This six-month cap controls over any more general backup, archive, retention or technical-deletion wording in this Portal for MHMDA-covered consumer health data.

Deletion from GetClinic does not automatically delete a Clinic medical record the Clinic independently must or may retain.

14. Restriction, Objection, Marketing and Consent Withdrawal

Where restriction applies, GetClinic will limit processing as required and will manage the restricted status so the data is not accidentally used for an incompatible purpose.

A valid objection to direct marketing will be handled promptly and will not be held merely because a broader privacy request remains under review.

Withdrawal of consent or authorization applies prospectively. GetClinic will stop future processing or sharing that depends on the withdrawn permission, subject to legally permitted retention or another independent lawful basis. Where the withdrawal prevents a requested healthcare-marketplace feature from operating, GetClinic will explain the material consequence where appropriate.

15. Refusals, Partial Responses and Fees

Privacy-rights requests are free by default. GetClinic will not build an automatic fee into the Portal.

A fee or refusal based on a request being manifestly unfounded, excessive or repetitive may be used only where the applicable law permits it and GetClinic can document the required basis. Any fee/refusal must receive privacy/legal approval before being communicated.

If GetClinic refuses or only partially fulfills a request, the response will explain the reason to the extent legally permitted and provide available appeal, regulator-complaint or judicial-remedy information required by applicable law.

16. Appeals

Where applicable law provides an appeal right, the Portal will provide an appeal route that is conspicuous and substantially as easy to use as the original request route.

An appeal should reuse the existing request ID and prior identity/authority verification where reasonably safe rather than forcing the Patient to restart the process. GetClinic may request updated verification only where reasonably necessary.

For Washington consumer-health-data appeals, GetClinic will provide a written decision within 45 days of receipt of the appeal. If the appeal is denied, GetClinic will provide the legally required online mechanism, if available, or other method through which the consumer may contact the Washington Attorney General.

For GDPR/UK GDPR refusals, GetClinic will provide information about the right to complain to the applicable supervisory authority and seek a judicial remedy where required.

17. Non-Discrimination and No Retaliation

GetClinic will not unlawfully discriminate or retaliate against a Patient for exercising a privacy or consumer-health-data right. Exercising a privacy right does not, by itself, make a Patient medically unsuitable, cancel a Booking, justify a worse marketplace ranking, or authorize a Clinic to retaliate.

A feature may become unavailable if GetClinic or the Clinic cannot lawfully or safely provide it without data the Patient has validly requested to delete or stopped consenting to. That functional consequence is not treated as punishment for exercising the right.

18. Security, Confidentiality and Request Records

GetClinic will restrict internal access to privacy requests and response data according to role and business need. Request records can contain sensitive health information and should not be exposed in ordinary support tooling beyond what the assigned personnel need.

GetClinic may retain a limited compliance record of the request, identity/authority verification, legal scope, actions taken, recipients notified, decision, appeal and timestamps where reasonably necessary to demonstrate compliance, resolve disputes or satisfy law. A deletion request does not require GetClinic to recreate deleted substantive data inside the audit record.

Request exports and supporting identity documents must use approved secure storage and access controls and must not be used for unrelated analytics, advertising or general-purpose model training.

19. If the Portal Is Unavailable

A Portal outage does not suspend your privacy rights. Send the request to [email protected]. If an accessibility problem affects the Portal or email route, contact [email protected] and clearly state that you are making a privacy/data request.

GetClinic will use the first clear receipt timestamp through an available GetClinic route for legal timing, subject to any specific authentication rule under applicable law. A technical outage or accessibility barrier should not be used to manufacture lateness.

20. Contact