Draft — pending legal review

This document is a draft. Operator details shown in [square brackets] have not been filled in yet, and the text has not been reviewed by counsel.

GDPR Notice for EU/EEA Users

Last updated:: 2 November 2026
Effective:: [Effective Date]
Version:: 2026-11-02

Additional information for users in the European Economic Area and the United Kingdom.

1. Who this applies to

GP Emergency Referral is designed for clinicians and hospitals in India. This notice applies where the EU or UK General Data Protection Regulation ("GDPR") applies to our processing — for example if you use the Platform while in the European Economic Area or the UK. The controller is [Company Name]. It supplements the Privacy Policy, which lists the data we process, our processors and retention periods.

2. Lawful bases

Lawful bases for processing
Processing	Lawful basis
Account, verification, referrals, calls, notifications	Performance of a contract (Art. 6(1)(b)) — providing the service you signed up for.
Patient health information in referral summaries and notes	Art. 6(1)(b)/(f) together with Art. 9(2)(h) — processing necessary for medical diagnosis and the provision of health care, under the responsibility of health professionals subject to professional secrecy (Art. 9(3)); and Art. 9(2)(c) where needed to protect vital interests.
Call recordings	Consent (Art. 6(1)(a), and Art. 9(2)(a) for any health data discussed), given through the recording notice; legitimate interests in clinical governance and misuse investigation (Art. 6(1)(f)).
Device location for nearest-hospital search	Consent (Art. 6(1)(a)) through your browser or app permission prompt.
Security, rate limiting, audit logs, misuse control	Legitimate interests (Art. 6(1)(f)) in keeping the Platform safe and accountable.
Payments and accounting records	Legal obligation (Art. 6(1)(c)) and contract (Art. 6(1)(b)).

3. Your rights

Access to your personal data and a copy of it (Art. 15).
Rectification of inaccurate data (Art. 16).
Erasure, where the conditions of Art. 17 apply.
Restriction of processing (Art. 18).
Data portability for data you provided, in a machine-readable format (Art. 20).
Objection to processing based on legitimate interests (Art. 21). We do not use your data for direct marketing or profiling.
Withdrawal of consent at any time, without affecting processing before withdrawal (Art. 7(3)).
We do not make decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22). Hospital ranking is a sort order for the referring doctor, who makes the decision; misuse strikes are applied only after review by a platform admin.

To exercise these rights, email [DPO/Data Protection contact] or our Grievance Officer. We respond within one month, extendable by two further months for complex requests, and may ask you to verify your identity.

4. International transfers

Your data is processed in India, where our Platform is operated, and by service providers in other countries (see the Privacy Policy). India has no EU adequacy decision. Where we transfer personal data from the EEA or UK to India or another third country, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), or on a provider's certification under the EU–US Data Privacy Framework, with supplementary measures such as encryption in transit and strict access controls. You can request a copy of the relevant safeguards from us.

5. Complaints to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state where you live, work or where the alleged infringement took place (Art. 77), or with the UK Information Commissioner's Office. The list of EU authorities is published by the European Data Protection Board at edpb.europa.eu. We would appreciate the chance to address your concern first.

Grievance Officer: [Grievance Officer Name]
Email: [Grievance Officer Email]
Phone: [Grievance Officer Phone]
Data protection contact: [DPO/Data Protection contact]
Postal address: [Company Name], [Registered Address]

6. EU representative

If we become required to appoint a representative in the EU under Art. 27, their details will be published here. Until then, contact us using the details above.