Policy
Privacy notice
This page says what we collect when you book, why we need it, and how long we keep it.
TODO(liliana): this notice is a draft. It needs your sign-off, and your confirmation that you are the data controller for your private practice
Who is responsible for your information
Dr Liliana Grosu is responsible for the information you give when you book. In data protection law, she is the data controller.
TODO(liliana): your ICO registration number, and the legal name and address to show here
What we collect
When you book, we ask for your name, your email address and your mobile number. We record the time of your appointment.
You can add a short note if there's something practical Dr Grosu should know.
We record what you paid and any refund. We never see or store your card details.
Why we collect it
We use your details to confirm your booking, to send you a reminder, and to contact you about your appointment. The law allows this because we need them to provide the appointment you've booked.
A booking with Dr Grosu says something about your health. So we treat every booking as health information, and we protect it that way.
Documents you send
Documents you add on your appointment page are stored privately with Cloudflare, in the European Union. Only Dr Grosu and the person who runs this website for her can open them. We delete them 12 months after your appointment, with your other details. If your appointment is cancelled, we delete them by the next day. You can remove a document yourself until your appointment.
TODO(liliana): approve the wording above about uploaded documents, and confirm who can open them
Documents you email go to the practice's inbox. Dr Grosu uses them to prepare for your appointment, and she manages them in that inbox.
TODO(liliana): which email provider the practice inbox is with (Gmail, Outlook or another), so it can be named here
Who else handles your information
Cloudflare hosts this website and stores your booking.
Stripe takes your payment. Stripe handles your card details under its own privacy notice.
Resend sends our emails to you.
TODO(liliana): where each company stores the information, checked against their current terms before launch (PRIVACY_AND_COMPLIANCE ยง3)
How long we keep it
We delete your name, email address, mobile number and note 12 months after your appointment.
TODO(liliana): confirm how long to keep booking details after the appointment (12 months is assumed)
Your rights
You can ask for a copy of your information. You can ask us to correct it or to delete it. To do any of these, email bookings@drgrosu.co.uk.
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.