Privacy Policy · Healthting

Who we are

Healthting is an online platform that connects patients with verified doctors and home care nurses. The data controller is [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], [COUNTRY].

For any question about this policy or your data, write to support@healthting.com. [IF A DATA PROTECTION OFFICER IS APPOINTED, ADD THEIR CONTACT HERE.]

What we collect

Only what the platform needs to work. The table below is the full picture, grouped by why we hold it.

Category	What it includes	Why
Account	Username, email address, a hashed password, your role, email verification status, and the time you last signed in.	To create your account, sign you in, and confirm your email address. Passwords are stored as a one-way hash, so nobody at Healthting can read yours.
Profile	First and last name, date of birth, gender, phone number, street address, city, state, postcode, precise location coordinates, and any profile or banner picture you upload.	So clinicians know who they are treating, and so the directory can sort by how far each professional is from you.
Professional credentials	For doctors and nurses: qualification, licence number, biography, certificates you upload, and the days and hours you work.	So patients can check who they are booking, and so availability is real.
Health data	Blood type, allergies, medications, past and current medical conditions, surgeries, past illnesses, immunisations, prescriptions and prescription files, medical history documents, appointment descriptions, and any prescription photo or PDF attached to a nursing request.	To provide care. This is special category data and is treated as such.
Messages	The content of conversations between you and a professional you are connected to.	So you can ask follow-up questions between visits.
Community posts	Anything you post publicly in the community, under your display name.	Community posts are public by design and visible to anyone, including search engines.
Technical	A session cookie identifying your account, a cookie remembering your chosen language, and the standard server logs your requests generate.	To keep you signed in, show the site in your language, and keep the service secure.

The AI Doctor, and what leaves our servers

This deserves its own section, because it is the one place your health information is sent to a company that is not Healthting.

When you use the AI Doctor, the symptoms you describe and relevant context from your health profile are sent to OpenRouter, which routes the request to a third-party language model provider in order to generate a response. That text leaves our infrastructure. It is sent for the purpose of answering your question and nothing else, but you should treat the AI Doctor as a conversation that involves a third party, and avoid putting anything in it you would not want handled outside Healthting.

The AI Doctor gives guidance, not a diagnosis, and does not replace a consultation with a qualified professional. In an emergency, call your local emergency number.

Other services we rely on

Loading a page can cause your browser to contact these services directly, which means they receive your IP address:

Service	When it is contacted	What it receives
OpenStreetMap	Whenever a map is displayed.	Your IP address and the area of the map being viewed.
OSRM routing	Only when you ask for directions to a clinic or a professional.	Your starting coordinates and the destination coordinates.
Google Fonts	On every page, to load the site's typefaces.	Your IP address.
Nominatim (OpenStreetMap)	Only when you search for a place by city or country while setting your location.	Your IP address and the text you searched for.
ipwho.is	Only if you press "Locate me approximately" after your browser has refused GPS access.	Your IP address, which it converts to an approximate city.

We do not sell your data, and we do not share it with advertisers. There are no advertising or analytics trackers on the platform.

Who can see your health data

You, at any time, from your account.
A doctor or nurse you have connected to, for the care you asked them to provide. A nursing request shares your details and any prescription you attach only after the nurse has accepted the connection, which is why that step exists.
Healthting staff, only where strictly necessary to operate the service or to investigate a security or safety issue, and subject to confidentiality obligations.
Authorities, where we are legally required to disclose. If that happens we will tell you unless the law prevents us.

Professionals you have not connected to cannot see your record. Other patients never can.

Our legal basis for using your data

Where the GDPR applies, we rely on the following bases. Health data is special category data under Article 9, and the relevant exemption for providing care is Article 9(2)(h).

What we do	Basis
Run your account and provide the service you asked for	Performance of a contract (Art. 6(1)(b))
Handle health data to deliver care	Provision of health care (Art. 9(2)(h)), with Art. 6(1)(b)
Send the AI Doctor your description of your symptoms	Your explicit consent, given by choosing to use that feature (Art. 9(2)(a))
Keep the platform secure and prevent abuse	Legitimate interests (Art. 6(1)(f))
Meet record-keeping obligations	Legal obligation (Art. 6(1)(c))

How long we keep it

Your account and its contents are kept while your account is open. When you delete your account we begin deletion of your personal data, except where we are legally required to keep records for longer.

Your rights

Subject to the retention rules above, you can ask us to:

Give you a copy of the data we hold about you.
Correct anything that is wrong.
Delete your account and your personal data.
Export your data in a portable format.
Restrict or object to particular uses, including withdrawing consent for the AI Doctor at any time by not using it.

Write to support@healthting.com and we will respond within [RESPONSE PERIOD, ONE MONTH UNDER GDPR]. If you think we have handled your data badly you can complain to your local data protection authority.

Security

Passwords are stored hashed, never in plain text. Access to health data is restricted to the account it belongs to and the professionals connected to it. Uploaded files are stored per account.

No system is perfectly secure. If a breach affects your data and is likely to put you at risk, we will tell you and the relevant authority as required by law.

Children

Healthting is not intended for children under [AGE] without the involvement of a parent or guardian. If you believe a child has created an account without that involvement, contact support@healthting.com and we will look into it.

Changes to this policy

If we change this policy we will update the date at the top of the page. If a change materially affects how your health data is used, we will tell you directly rather than relying on you to notice.