GetClinic Patient Privacy Policy

Key Privacy Commitments

• We use data minimization: before you engage a Clinic, request-level information is shared in de-identified or pseudonymized form where reasonably practicable. Identifying details and health information are transmitted only when you select or engage a Clinic, when needed for the service you request, or where another lawful basis permits the disclosure.
• We do not sell Patient health information. We do not use Patient health information, private medical uploads, or private Patient-Clinic messages for cross-context behavioral advertising.
• We do not intentionally record a medical consultation without an applicable lawful basis and any notice or permission required by law.
• Payment card and bank details are generally handled by regulated payment service providers; GetClinic does not need to store full card security codes to operate the marketplace.
• Uploading a medical photograph, scan, or testimonial for healthcare or marketplace purposes does not give GetClinic a general advertising right to use it.
• You may exercise applicable privacy rights by contacting privacy@getclinic.com or through available in-product privacy controls.

Navigation

• 1-3 Scope, roles and definitions
• 4-7 Data we collect, sources, purposes and legal bases
• 8-12 Health data, Clinic sharing, payments, communications and cookies
• 13-17 Advertising, automated tools, recipients, transfers and retention
• 18-22 Security, account choices and regional privacy rights
• 23 Separate Consumer Health Data Privacy Policy
• 24-31 Minors, marketing, legal disclosures, changes and contact information

1. Who We Are and Scope

This Patient Privacy Policy (the “Policy”) explains how GetClinic, Inc. (“GetClinic,” “we,” “us,” or “our”) collects, uses, discloses, stores, protects and otherwise processes personal information when an individual uses GetClinic as a Patient, prospective Patient, authorized representative, or other consumer user.

This Policy applies to GetClinic websites, mobile applications, Patient accounts, marketplace search and matching, messaging, document upload, consultation technology, Booking functionality, payment interfaces, support, reviews and related Patient-facing services (the “GetClinic Services”).

This Policy does not govern a Clinic’s independent processing of personal information for diagnosis, Treatment, clinical records, informed consent, medical billing, aftercare or other healthcare purposes. A selected Clinic may provide its own privacy notice, and its obligations may differ by country and healthcare law.

This Policy should be read with the Patient Marketplace Terms of Service, Consumer Health Data Privacy Policy, Cookie Policy, Booking & Deposit Terms, Refund & Cancellation Policy, and any additional health-data notice or transaction-specific notice presented when required.

2. Our Privacy Role and the Clinic’s Privacy Role

2.1 GetClinic as controller

For the purposes described in this Policy, GetClinic generally determines why and how personal information is processed to operate the GetClinic marketplace and is therefore a controller, business, regulated entity or equivalent responsible party under applicable privacy law.

2.2 Selected Clinics as independent healthcare recipients

When you choose to engage a Clinic and GetClinic transmits information so the Clinic can evaluate, consult with, book or treat you, the Clinic may process that information for its own healthcare purposes. For those purposes the Clinic may be an independent controller or equivalent regulated healthcare entity. GetClinic does not control the Clinic’s medical records, diagnosis, Treatment decisions or legally required clinical retention.

2.3 Service providers and processors

GetClinic uses vendors to provide hosting, communications, video, customer support, security, payment, analytics and other infrastructure. Where those providers process personal information only on GetClinic’s instructions, they act as processors, service providers or equivalent contracted providers and are subject to applicable confidentiality, security and data-processing obligations.

3. Definitions

Capitalized marketplace terms such as “Patient,” “Clinic,” “Booking,” “Treatment,” “Clinic Offer,” “Clinic Booking Deposit,” “Collection Route,” “PSP” and “GetClinic Services” have the meanings given in the Patient Marketplace Terms of Service unless this Policy states otherwise.

“Personal information” or “personal data” means information relating to an identified or reasonably identifiable person and includes equivalent concepts under applicable privacy law.

“Health information” includes information concerning physical or mental health, healthcare services, symptoms, diagnoses, treatment interests, medical history, medications, allergies, medical images, laboratory information, consultation information and other information that reveals or can reasonably infer health status. Depending on applicable law, health information may be special category data, sensitive personal information, consumer health data or protected medical information.

4. Personal Information We Collect

We do not intentionally collect information that is not reasonably relevant to the GetClinic Services. Please do not upload third-party health or identity information unless you are authorized to provide it.

4.1 Mobile app permissions

Depending on the feature you choose to use, a GetClinic mobile application may request device permission for the camera or photo library to upload medical photographs or documents; microphone and camera access for an audio/video consultation; and notifications for Booking, message or security alerts. These permissions are requested through the device operating system and can generally be changed in device settings. Precise location permission is not required for ordinary marketplace use unless a specific location feature is introduced and separately disclosed.

5. Where We Obtain Information

• from you directly when you create an account, search, submit a request, upload a document, message a Clinic, book, pay, request support or submit a review;
• from a parent, guardian or other person legally authorized to act for you;
• from a selected Clinic or healthcare professional, for example Booking status, Clinic Offer information, consultation or scheduling information, Treatment updates, payment/refund status or information the Clinic asks GetClinic to transmit to you;
• from PSPs, fraud-prevention, identity-verification and security providers;
• automatically from your browser, device, app and cookies or similar technologies, subject to applicable consent requirements;
• from other service providers that support operation of the GetClinic Services.

If we receive personal information about you from a source other than you, we provide information required by applicable law unless an exception applies or you already have the information.

6. Why We Use Personal Information

7. Legal Bases for Processing in the EEA and UK

Where the EU GDPR, UK GDPR or a similar lawful-basis regime applies, GetClinic relies on one or more lawful bases appropriate to the specific processing. The same information may be processed under different bases for different purposes.

Important health-data point

Under European and UK data-protection law, health data receives additional protection. A normal contract lawful basis by itself is not sufficient for special-category health data; an additional lawful condition must also apply.

GetClinic will request a separate explicit consent or authorization where that is the appropriate condition for the activity.

8. Health and Sensitive Information

GetClinic is designed for healthcare marketplace use, so Patient activity may reveal sensitive health information even where you do not upload a formal medical record. For example, searching for a procedure, requesting a quotation, scheduling a specialist consultation or booking a Treatment may reveal information about your health.

We apply additional safeguards to health information, including access controls, data minimization, purpose limitation, security controls, and additional consent or authorization mechanisms where required.

We do not treat your acceptance of general marketplace terms as unlimited permission to collect, infer, disclose or use health information for unrelated purposes.

We do not sell Patient health information. We do not use health information, medical uploads or private Patient-Clinic messages for targeted advertising or cross-context behavioral advertising.

We do not authorize service providers acting on our behalf to use Patient health information for their own advertising or unrelated model training.

8.1 HIPAA and other healthcare privacy laws

Some Clinics and some specific service relationships may be subject to the U.S. Health Insurance Portability and Accountability Act (HIPAA) or other healthcare confidentiality laws. GetClinic is a marketplace and is not automatically a HIPAA covered entity merely because a Patient submits health information directly to GetClinic. Where GetClinic processes information in a role that is subject to HIPAA or another healthcare privacy law, the applicable statutory and contractual safeguards apply in addition to this Policy. Nothing in this Policy reduces rights that cannot lawfully be waived.

9. Sharing Information With Clinics

9.1 Limited information before engagement

Before you select or affirmatively engage a Clinic, GetClinic limits request-level sharing to what is reasonably necessary for marketplace routing or to determine whether a Clinic may be able to help. Where reasonably practicable, this pre-engagement information is de-identified or pseudonymized and does not include direct identifiers such as your full name, personal contact details, account credentials, or complete medical file. Identifying details and identifiable health information are transmitted only after you choose or engage the Clinic, where needed to provide the product or service you requested, or where another lawful basis permits the disclosure.

9.2 Additional information after you select or engage a Clinic

When you choose to engage a Clinic, request an evaluation, send a message, book a consultation or otherwise ask the Clinic to provide services, GetClinic may transmit identifying, contact and health information reasonably necessary for that request, subject to applicable law and any separate permission required.

9.3 No blanket disclosure to all Clinics

We do not make your complete medical file available to every Clinic merely because you use GetClinic. Sharing is tied to the Clinics you choose, the features you use and the service you request, unless another disclosure is required by law or necessary to protect vital interests in an emergency where legally permitted.

9.4 Clinic responsibility after receipt

Once a Clinic receives information for its own healthcare purposes, the Clinic may independently determine how to use and retain that information under healthcare, medical-record and privacy law. A deletion request to GetClinic does not automatically require an independent Clinic to delete a medical record it is legally required to retain.

10. Payments, Deposits and Financial Information

Clinic-related payments may be processed using a third-party PSP or other approved payment infrastructure identified in the applicable Collection Route. The PSP may collect card, bank, billing, identity, device and fraud information under its own privacy terms and applicable financial-services law.

GetClinic may receive transaction metadata needed to operate the Booking, confirm Payment Effect, process or facilitate refunds, reconcile payment status, prevent fraud, respond to disputes and maintain records. This may include payer name, payment method type, token, last four digits, amount, currency, authorization status, PSP reference and refund or chargeback status.

GetClinic does not need to store a card security code to operate the marketplace and does not intentionally request that Patients send full card credentials through ordinary messages or document uploads.

11. Messages, Documents, Consultations and Support

Messages and documents transmitted through GetClinic may contain personal and health information. We process them to deliver the communication, maintain the Patient account and Booking record, support the requested Clinic relationship, investigate complaints or security incidents, and comply with legal obligations.

GetClinic will not intentionally record an audio or video consultation without an applicable lawful basis and any notice or permission required by law. A Clinic may separately create clinical records where required by healthcare law.

Support communications may be reviewed by authorized GetClinic personnel and contracted support providers to resolve the issue and maintain appropriate records.

12. Cookies, Analytics and Similar Technologies

GetClinic may use strictly necessary cookies and similar technologies to keep you signed in, secure the platform, remember essential settings, route traffic and maintain core functionality.

Optional analytics, personalization or advertising technologies are governed by the Cookie Policy and applicable consent interface. Where law requires consent before optional cookies or similar technologies are used, GetClinic will request that consent separately; acceptance of the Patient Terms or this Policy is not cookie consent.

Browser signals. Some browsers send a “Do Not Track” signal. There is no common industry standard for how a website must respond to that signal, and GetClinic does not currently respond to Do Not Track. GetClinic does honour a legally recognised Global Privacy Control signal where applicable law requires it, and you can change your choices at any time through the cookie settings control described in the Cookie Policy.

We do not intentionally place advertising pixels or similar cross-context behavioral advertising technologies inside private medical-upload areas, the contents of private Patient-Clinic messages, or the content of a medical consultation for the purpose of targeted advertising.

13. Sale, Sharing and Targeted Advertising

GetClinic does not sell Patient health information or medical records for monetary consideration.

GetClinic does not use or disclose Patient health information for targeted advertising or cross-context behavioral advertising. Sharing information with a Clinic you select in order to provide the evaluation, consultation, Booking or Treatment-related service you requested is not undertaken as a data-broker sale of your health information.

For non-health information, if GetClinic ever engages in activity that applicable law defines as a “sale,” “sharing” or targeted advertising requiring an opt-out, GetClinic will provide the required notice and opt-out control. Where a legally recognized Global Privacy Control signal applies, GetClinic will process it as required by law.

14. Automated Tools, Matching and Artificial Intelligence

GetClinic may use automated systems, algorithms or machine-assisted tools to support search, ranking, matching, translation, fraud detection, security, spam detection, content moderation, customer support or product functionality.

Where GetClinic offers live transcript translation during a consultation or meeting, that feature is provided by an artificial-intelligence service and the transcript text is processed for that purpose by GetClinic’s AI provider in the United States. The Teleconsultation and Meeting Platform Terms describe the notice you receive before that feature is used.

Marketplace matching and ranking are not medical diagnosis or medical advice. GetClinic does not use an automated system to make the Clinic’s final decision about whether you are medically suitable for Treatment. Medical suitability is determined by the Clinic or its healthcare professionals.

Where applicable law gives you rights concerning solely automated decisions that produce legal or similarly significant effects, GetClinic will provide the required information and safeguards, including human review where required.

If GetClinic introduces a materially new use of identifiable health information for artificial-intelligence or machine-learning purposes beyond providing, securing or improving the requested GetClinic Services, we will update the applicable notice and obtain additional permission where required by law before that use.

15. Who We Disclose Personal Information To

We require service providers acting on our behalf to process personal information only for authorized purposes and with appropriate confidentiality and security protections. A selected Clinic is not merely GetClinic’s processor when it independently uses Patient information to provide healthcare.

16. International Data Transfers

GetClinic is a U.S. company and operates an international healthcare marketplace. Your personal information may therefore be processed in the United States, the country of a selected Clinic, and other countries where GetClinic or its service providers operate. Those countries may have privacy laws different from those in your home country.

Where the EU GDPR or UK GDPR restricts an international transfer, GetClinic will use an available lawful transfer mechanism where required, such as an adequacy decision or regulation, European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, together with any required transfer assessment and supplementary safeguards.

A transfer to a Clinic you deliberately select in another country may also be necessary to provide the international healthcare marketplace service you requested. Applicable transfer rules and any required consent, contract or safeguard will be assessed for the relevant data flow.

You may contact privacy@getclinic.com to request information about applicable transfer safeguards and how to obtain a copy where the law provides that right.

17. How Long We Keep Information

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to legal, accounting, tax, fraud-prevention, security, chargeback, dispute and record-retention requirements. The periods below are indicative operational targets, not guaranteed minimum holding periods: we may delete information sooner when it is no longer needed and retain it longer where an unresolved dispute, legal hold, security incident, tax/accounting obligation or other lawful requirement applies.

When information is no longer required, we delete it, de-identify it, anonymize it or otherwise dispose of it in accordance with applicable law and operational capability. Backup copies may persist for a limited recovery cycle before being overwritten.

A Clinic may have independent medical-record retention duties. Deletion from GetClinic does not automatically delete information from a Clinic’s lawful independent records.

18. Security

GetClinic uses technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration or disclosure. Depending on the system and risk, measures may include encryption in transit and at rest, access controls, authentication, role-based permissions, logging and monitoring, backups, secure development practices, vulnerability management, vendor due diligence and incident-response procedures.

Health information and authentication data receive heightened protection appropriate to their sensitivity. Access should be limited to personnel and providers with a legitimate need to perform their role.

No internet service or storage system can guarantee absolute security. You are responsible for protecting your account credentials and should promptly notify support@getclinic.com if you believe your account has been compromised.

Where applicable law requires notification of a qualifying personal-data or health-data breach, GetClinic will provide notifications to affected individuals and/or authorities as required. Where GetClinic is subject to the U.S. Federal Trade Commission Health Breach Notification Rule (16 C.F.R. Part 318), we will follow its applicable notification requirements for qualifying breaches of unsecured PHR identifiable health information.

18.1 Audit records

GetClinic keeps an audit record of changes made through the GetClinic Services and of access to health information. When an account, Booking, message, document or other record is created, changed or deleted, the audit record shows who did it, when, from which application and IP address, and which fields changed. When a member of a Clinic’s team is shown your contact details or downloads a document or attachment you uploaded, and when a GetClinic staff member opens your patient details or exports data that includes them, that access is recorded too. Other views of your Booking by a Clinic are not recorded.

Sensitive values are not written into the audit record in readable form. Your email address, phone number, date of birth, identity and passport numbers, bank details, address, name on a Booking, medical notes and diagnosis are replaced by a marker and a one-way hash of the value. The record shows that a field changed, and whether it changed to a particular value, but does not contain the value itself. Audit records cannot be edited or deleted by the applications that write them. A record leaves our live system only once it has been copied to the archive and the copy verified; the one change we make to a record is the pseudonymization described below. They are kept for 13 months in our live system and then for 7 years in a locked archive (see Section 17).

Audit records are read by authorized GetClinic staff for security, support, compliance and accountability purposes, and may be provided to a regulator on request where the law requires or permits it. Every export of audit records requires a stated reason and is itself recorded. A Clinic’s administrators can see what their own team members did on that Clinic’s account. The Clinic’s view does not include your patient record or any record of who viewed your information.

If you delete your account, we do not delete the audit records, because they are the evidence of what happened to your information. Once the 30-day period in which you can cancel a deletion request has ended and your account is removed, your email address and account identifiers in those records are replaced with a pseudonym that does not identify you on its own, and identifying values in recorded changes to your own account record are removed. Free text typed by a GetClinic staff member or a member of a Clinic’s team about an action, such as the reason given for a change, is kept as written. The record of the action itself stays.

19. Your Choices and Account Controls

• You can choose which Clinics to contact or engage and can avoid uploading health information that is not reasonably needed for the requested evaluation.
• You can update certain account information through your account or by contacting GetClinic.
• You can withdraw optional marketing consent or unsubscribe from marketing without stopping necessary transactional communications.
• You can manage optional cookies through the applicable consent interface where available.
• You can request closure of your Patient account, subject to legal, payment, security, dispute, fraud-prevention and retention obligations. You can cancel a deletion request for 30 days; after that period your account is removed and the audit records are treated as described in Section 18.1.
• Where processing is based on consent, you may withdraw that consent prospectively. Withdrawal does not make earlier lawful processing unlawful and may affect our ability to provide a feature that requires the information.

20. General Privacy Rights

Depending on where you live and the law that applies, you may have rights to:

• access or obtain a copy of personal information about you;
• correct inaccurate or incomplete information;
• delete personal information, subject to lawful exceptions;
• restrict or limit certain processing;
• object to processing based on legitimate interests or direct marketing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent;
• opt out of certain sale, sharing or targeted-advertising activities where applicable;
• appeal a refusal of a privacy request where applicable;

• complain to a competent privacy or data-protection authority.

To exercise a right, email privacy@getclinic.com or use an available in-product privacy request tool. We may need to verify your identity and authority before fulfilling a request. We will not discriminate against you for exercising a legally protected privacy right.

An authorized agent may submit a request where applicable law permits it. We may ask for evidence of authorization and may separately verify the Patient’s identity unless law provides otherwise.

21. EEA and United Kingdom Privacy Rights

If the EU GDPR, UK GDPR or equivalent European data-protection law applies, you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, together with rights relating to certain automated decisions. You also have the right to lodge a complaint with the data-protection supervisory authority competent for your location or the relevant processing.

Where GetClinic relies on legitimate interests, you may object on grounds relating to your particular situation. GetClinic will stop the processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms or the processing is needed for legal claims, as applicable.

Direct marketing objections are honored as required by law.

21.1 Representatives and Data Protection Officer

GetClinic is not established in the EEA or UK. Where Article 27 of the EU GDPR, the UK GDPR, or another applicable rule requires a local representative, GetClinic appoints that representative and publishes the representative’s legal name, address and contact information so Patients and regulators can contact that representative directly. GetClinic has appointed the representatives identified below.

Data Protection Officer. EU GDPR Article 37 and the UK GDPR require a Data Protection Officer in specified circumstances, including where an organization’s core activities consist of large-scale processing of special-category data. GetClinic assesses this requirement against its actual processing scale, volume, geographic reach and duration. GetClinic will appoint and publish contact details for a Data Protection Officer where legally required. If GetClinic concludes that appointment is not currently required, it will document and periodically reassess that conclusion.

Appointed representative: We value your privacy and your rights as a data subject and have therefore appointed Prighter EU Rep GmbH for the European Union and Prighter Ltd for the United Kingdom, together with the local partner entities listed below, as our privacy representatives and a point of contact for you.

EU representative (GDPR Article 27): Prighter EU Rep GmbH, Schellinggasse 3, 1010 Vienna, Austria.

The EU representative also acts through: Prighter Privacy IRL Ltd, 9 Clare Street, Dublin 2, D02 HH30, Ireland; Prighter Germany GmbH, c/o Luther Rechtsanwaltsgesellschaft mbH, Heidestrasse 40, 10557 Berlin, Germany; and Prighter CH GmbH, Obergrundstrasse 17, 6003 Lucerne, Switzerland.

UK representative (UK GDPR Article 27): Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom.

Contacting a representative: Either representative is an addressee for requests from supervisory authorities, including the Information Commissioner's Office, and from data subjects, alongside privacy@getclinic.com. Contacting a representative does not affect your right to complain to your own supervisory authority.

Exercising your rights through Prighter: You can also send a privacy-rights request, for example a request to access or erase personal data, to our representative at https://app.prighter.com/dsr/12490498497. You may still use privacy@getclinic.com or the accessible routes in the Privacy Rights & Data Request Portal.

22. California Privacy Notice

This Section applies to California residents to the extent the California Consumer Privacy Act, as amended (“CCPA”), applies to GetClinic and the information at issue. It supplements the rest of this Policy.

The categories of personal information GetClinic may collect are described in Section 4 and may include identifiers, customer records, commercial/transaction information, internet or electronic network activity, geolocation information, audio/visual information, professional or medical-related information you provide, sensitive personal information, and inferences derived from marketplace activity.

GetClinic collects these categories from the sources described in Section 5, uses them for the purposes described in Sections 6-14, and discloses them to the recipient categories described in Section 15.

Where the CCPA applies, California residents may have the right to know/access, delete, correct, opt out of sale or sharing, limit certain uses/disclosures of sensitive personal information, and receive non-discriminatory treatment for exercising those rights.

GetClinic does not sell Patient health information. GetClinic does not use or disclose Patient health information for cross-context behavioral advertising. If GetClinic engages in CCPA-defined sale or sharing of other personal information, GetClinic will provide the legally required “Do Not Sell or Share My Personal Information” mechanism and honor applicable Global Privacy Control signals.

Requests may be submitted to privacy@getclinic.com or through any designated privacy request method published by GetClinic. We may verify identity and, for an authorized-agent request, verify the agent’s authority as permitted by law.

23. Consumer Health Data Privacy Policy

GetClinic maintains a separate Consumer Health Data Privacy Policy for consumer health data governed by the Washington My Health My Data Act and similar U.S. consumer-health-data laws where applicable. That separate policy describes the categories of consumer health data we collect, the purposes and sources, categories of data shared, recipient categories and specific affiliates where applicable, consent rules, deletion and appeal rights, sale restrictions, and healthcare-geofencing restrictions.

Where applicable law requires a separate and conspicuous link, GetClinic will publish the Consumer Health Data Privacy Policy through a distinct link, including a prominent homepage link where required. For consumer health data covered by that policy, the separate Consumer Health Data Privacy Policy supplements this general Policy and controls to the extent mandatory consumer-health-data law requires a more specific rule.

24. Children, Minors and Authorized Representatives

A Patient generally must be at least 18 years old to create and control a GetClinic Patient account. A parent, guardian or other legally authorized representative may use GetClinic for a minor or another person where permitted by law and the Clinic.

Where information concerns a minor, GetClinic may request evidence of parental responsibility or other authority when reasonably necessary. We apply additional care to children’s information and obtain parental or guardian consent where required by applicable law.

GetClinic does not knowingly sell personal information of minors or use a minor’s health information for targeted advertising.

25. Transactional Communications and Marketing

GetClinic may send transactional communications needed to operate your account and requested services, including messages about account security, Clinic communications, Bookings, consultations, payment status, refunds, privacy requests and support. These are not marketing merely because they are sent by email, SMS, push notification or another electronic channel.

Marketing communications are handled separately. Where consent is required, GetClinic will obtain it before sending the marketing, and the record of that consent identifies the wording you were shown and when you agreed to it. Marketing email is sent only where a current opt-in is on record for your address; if we cannot find one, the message is not sent.

Every marketing email carries an unsubscribe link and the header your mail application uses to offer you a one-click unsubscribe. Either one stops marketing email to that address. You can also unsubscribe by writing to privacy@getclinic.com or support@getclinic.com, and withdrawing your consent stops future marketing email without affecting anything already sent lawfully. When you unsubscribe we record it against your address so that it is not undone by a later import, a new list or a different part of the platform.

Unsubscribing from marketing does not stop necessary service communications. A booking confirmation, a payment receipt, a security alert or a password reset is not gated by a marketing preference, and unsubscribing does not stop us sending any of them.

There is one situation in which no email reaches you at all, and it is not about your preferences. If mail to your email address fails permanently, we record that address and stop sending to it, because it is not accepting mail. While that record is in force nothing arrives: bookings, consultations, payments and account security as well as marketing. That is a delivery problem rather than a decision to withhold anything from you, and it is not permanent, because the record can be lifted once the address works again. A GetClinic staff member can also stop email to an address by hand, for example where you ask us to, with the same effect.

If you think email to your address has been stopped, write to support@getclinic.com from an address that works and tell us where we should reply. If you cannot receive our reply by email, use the Privacy Rights & Data Request Portal or write to privacy@getclinic.com. You can still record that you do not want marketing email while the address is stopped, so that your choice applies if email to it starts working again.

GetClinic does not use Patient health information to create targeted advertising audiences.

26. Testimonials, Reviews and Promotional Use

If you voluntarily submit a public review, the content you choose to publish may be visible to other users. You should avoid including unnecessary sensitive or identifying information in a public review.

GetClinic will not use identifiable Patient health information, medical photographs or Treatment testimonials for advertising or promotional purposes merely because they were uploaded for healthcare, Booking, support or marketplace purposes.

Before using identifiable Patient health information, medical photographs or Treatment testimonials for advertising or promotion, GetClinic will obtain any separate consent or authorization required by applicable law. Where a signed or specially prescribed authorization is required, GetClinic will obtain that form before the promotional use.

27. Legal Requests, Safety and Protection of Rights

GetClinic may preserve or disclose personal information where reasonably necessary to comply with applicable law, a valid legal process, regulatory requirement, sanctions or financial-crime obligation; protect the rights, safety or security of Patients, Clinics, GetClinic or others; investigate fraud or abuse; enforce applicable terms; or establish, exercise or defend legal claims.

We assess requests for personal information and seek to limit disclosures to what is lawfully required or reasonably necessary. Where legally permitted and appropriate, we may challenge overbroad or invalid requests.

28. Corporate Transactions

If GetClinic is involved in a merger, acquisition, financing, reorganization, insolvency, asset sale or similar corporate transaction, personal information may be disclosed to advisers and transaction parties subject to appropriate confidentiality and security measures. Any successor that becomes responsible for the information must handle it consistently with applicable privacy law and any notice obligations.

A corporate transaction does not convert Patient health information into an asset that may be freely used for unrelated advertising or sold contrary to applicable law or the commitments in this Policy.

29. Third-Party Services and Links

GetClinic may link to or integrate with third-party services, including Clinic websites, PSPs, maps, communication tools or app-store services. A third party may process information under its own privacy notice when you interact directly with that service or when it independently determines the purposes of processing.

GetClinic is not responsible for an independent third party’s privacy practices merely because its service is linked from GetClinic. We encourage you to review the privacy information of the selected Clinic, PSP and other independent services relevant to your transaction.

30. Changes to This Policy

GetClinic may update this Policy to reflect changes in law, the GetClinic Services, data practices, security requirements, vendors or international operations. The updated version will show a new “Last Updated” or effective date.

Where a change materially affects how we use sensitive or health information, we will provide additional notice or obtain additional consent or authorization where required by applicable law before applying the new use.

We will not treat a policy update as retroactive permission for a materially different use of health information where applicable law requires fresh consent or authorization.

31. Contact Information and Privacy Requests

GetClinic, Inc. is a Delaware corporation and is the controller/contact responsible for the GetClinic Patient marketplace processing described in this Policy, except where another entity is expressly identified for a specific processing activity.

For questions about a Clinic’s medical records, diagnosis, Treatment, clinical privacy practices or legally required healthcare retention, contact the selected Clinic directly. GetClinic may assist with routing a marketplace privacy concern but does not replace the Clinic’s independent privacy responsibilities.

GetClinic provides the marketplace. You choose the Clinic. Your health information should follow that choice - not travel farther than necessary.