DocMap Logo
← Back to Policies and Terms

Privacy Policy

Effective Date: From 12/12/2024

Last Updated: 13/07/2026

Your Privacy as a Valued Patient

At DocMap, safeguarding your personal information is essential to the trust we build with you. We are committed to protecting your privacy while helping you connect with healthcare providers easily and securely.

Our Commitment to You

Transparency

You have the right to understand what personal information we collect, how we use it, and with whom we share it.

Protection

We treat your personal data with care and use industry-leading security practices to keep it safe.

Purpose

We only collect the information needed to help practitioners facilitate the appointments you request and improve the services we provide.

Support

If you have any questions or concerns, you can contact our privacy lead at admin@docmap.co.uk.

What Personal Information We Collect

To help facilitate and improve your healthcare appointment experience, we may collect:

  • Full name
  • Email address
  • Phone number
  • Treatment or service you are requesting
  • Preferred appointment date
  • Attendance status for telehealth sessions (whether you attended or missed the appointment) when using our integrated video conferencing service, such as Zoom.
  • Medical history, conditions, medications, and allergies (when you choose to provide them in your profile or during guided-care triage).
  • Insurance policy details and emergency contact information.
  • In-app chat messages, appointment notes, and case-summary documents linked to your account.

Why We Use This Information

We use your information to:

  • Identify and contact you.
  • Match you with suitable healthcare providers.
  • Help practitioners manage and confirm your appointment.
  • Send you appointment-related communications.
  • Record and process attendance information for billing accuracy, understanding patient demand, and assessing practitioner engagement.
  • Improve the quality, efficiency, and reliability of our services.
  • Attendance information is anonymised before analysis and is never used to identify individuals in reporting.

AI-Assisted Services

DocMap offers several AI-assisted features to help you find care and understand health topics. These services process special category health data only with your explicit consent (or, for the booking platform, under contract where you provide health information voluntarily). None of these services provide clinical diagnosis or treatment.

Guided Care triage

An in-portal conversational flow that helps match you with appropriate specialists for specific pathways (for example, endometriosis). You must give explicit consent to health-data processing before the flow begins, and you may separately opt in to outreach from practitioners.

Vera health assistant

An endometriosis education chat in the patient portal. Vera provides cited, educational information only — not diagnosis or prescribing — and is currently in evaluation. Chat sessions are ephemeral (cleared after idle timeout). Inference is processed in the EU via our Vera gateway. Please do not share unnecessary identifying details in your questions. Read the Vera Terms and Privacy notice.

DocMap Concierge (clinic websites)

An embeddable chat widget that clinics may add to their website. Visitors must consent to AI processing before chat begins, and must give separate consent before any contact details are shared with the clinic. DocMap Concierge does not provide clinical advice. Read the Concierge Terms and Privacy notice.

DocMap WhatsApp Specialist Triage

A separate WhatsApp-based triage service with its own privacy notice (see the WhatsApp section below). It uses explicit consent for health-data processing and human operator review of AI-assisted drafts. Read the WhatsApp Service policies.

Legal Basis for Processing

Under the UK GDPR, our legal bases for processing your personal data are:

Contractual Necessity (Article 6(1)(b))

To process your appointment request and communicate with providers.

Legitimate Interests (Article 6(1)(f))

To operate and improve our service efficiently and securely, including tracking session attendance to improve service delivery.

Consent (Article 6(1)(a))

For AI-assisted triage and education features, analytics, session replay, and cookie-based technologies where required.

Special category health data (Article 9(2)(a))

Where you provide health information in guided care, Vera, WhatsApp triage, Concierge chat, or your medical profile, we rely on your explicit consent unless another lawful condition applies and is documented separately.

How We Collect Your Information

We collect your personal information directly from you when you:

  • Submit an appointment request through our platform.
  • Contact our support team.
  • Update your preferences or contact information.
  • Join or miss a telehealth session using our integrated video conferencing service (e.g., Zoom), which records attendance metadata.
  • Use AI-assisted features such as Guided Care, Vera, or the DocMap Concierge widget on a clinic website.
  • Contact us via WhatsApp Specialist Triage (see the separate WhatsApp privacy notice below).

Who We Share Your Information With

We only share your information when necessary to provide the service you've requested:

Healthcare providers

To manage and schedule your appointment, and — where you have set a per-booking consent flag — to share relevant health profile information.

Technology and service partners

We use trusted third-party providers to operate the platform. They process data only on our instructions and under data processing agreements. Key partners include:

  • Amazon Web Services (UK, London region) — databases, file storage, and email delivery.
  • Stripe — practitioner billing and payment processing (card data is handled by Stripe; DocMap does not store full card numbers).
  • Stream (GetStream) — secure in-app messaging between patients and practitioners.
  • Google Firebase — push notifications and analytics (only when you consent via our cookie banner).
  • PostHog (EU region) — masked session replay on signup screens only (only when you consent).
  • Google — sign-in, calendar sync, and maps (where you choose to use these features).
  • Zoom and Microsoft Teams — telehealth and calendar integrations (where enabled by you or your practitioner).
  • AI inference providers (including OpenRouter and, for Vera, Modal in the EU) — to power AI-assisted triage, matching, and education features after consent.
  • Meta Platforms — WhatsApp Business API for the Specialist Triage service (see WhatsApp notice below).

A fuller sub-processor register is available in our suite compliance documentation on request.

Legal authorities

Only when required to comply with legal obligations.

International data transfers

We store primary platform data in the United Kingdom (AWS London region). Some partners may process data outside the UK — for example, AI inference providers, Stripe, Stream, Meta (WhatsApp), and Google. Where data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework, depending on the provider.

How We Protect Your Information

We use secure systems and protocols to protect your data from unauthorised access, loss, or misuse. Access to your data is restricted to authorised personnel and partners who require it to fulfil the service.

In the event of a suspected data breach, we will notify affected individuals and relevant authorities, as required by law.

How Long We Keep Your Data

We retain your personal information only as long as necessary to:

  • Fulfil the purpose it was collected for (e.g., booking and managing an appointment).
  • Meet legal, regulatory, or contractual obligations.
  • Account and profile data: for the duration of your account, plus any statutory retention period.
  • WhatsApp Specialist Triage conversations: up to 12 months (see WhatsApp privacy notice).
  • Vera chat sessions: ephemeral — cleared after idle timeout; not stored in a persistent database.
  • Analytics and session replay data: according to your cookie preferences, typically up to 12 months.
  • Database backups: up to 35 days after live deletion of your data.

Once no longer needed, your information is securely deleted or anonymised.

Your Rights

You have the following rights under the UK GDPR:

  • Access: Request a copy of your personal data.
  • Correction: Request correction of any inaccurate or incomplete information.
  • Deletion: Request deletion of your data when it is no longer needed.
  • Restriction: Ask us to limit the way we use your data.
  • Objection: Object to our use of your data based on legitimate interests.
  • Data Portability: Request a copy of your data to transfer to another provider.

To exercise these rights, contact us at admin@docmap.co.uk.

Automated Decision-Making and AI

DocMap uses AI to assist with specialist matching, triage conversations, and educational responses (including Guided Care, Vera, Concierge, and WhatsApp Triage). These systems support — but do not replace — human review where patient-facing outputs are involved. We do not make solely automated decisions that produce legal or similarly significant effects about you without human involvement. You may contact us to request information about how AI was used in your interaction.

Updates to This Privacy Policy

We may update this privacy policy from time to time. If we make significant changes, we will notify you through email or in-platform messaging.

Change Log:

  • 12/12/2024: Initial Policy Published.
  • 04/05/2025: Policy updated.
  • 14/08/2025: Added information about collection and use of telehealth session attendance data.
  • 13/07/2026: Added AI-assisted services (Guided Care, Vera, Concierge), named sub-processors, international transfers, updated retention periods, and corrected automated decision-making statement.
  • 13/07/2026: Added dedicated Vera and Concierge service policy pages; aligned billing and cancellation policies with platform configuration; broadened WhatsApp Specialist Triage scope.

Contact Us

For any questions about this policy or your data rights, please contact our privacy lead:

📧 admin@docmap.co.uk

📧 support@docmap.co.uk (general support)

📍 DocMap Ltd, 16.01 Makers Building, 1 Jasper Walk, London, N1 7TW, United Kingdom

You may also contact the UK Information Commissioner's Office (ICO) if you are not satisfied with our response.

DocMap WhatsApp Service (Specialist Triage)

Privacy notice for the WhatsApp Service

The notice below applies specifically when you use the DocMap WhatsApp Service (also referred to as DocMap Specialist Triage). The WhatsApp Service relies on different lawful bases under UK GDPR (notably explicit consent for health data under Article 9(2)(a)) and uses different processors than the booking platform — so we keep the two notices side-by-side to make it clear what applies to you.

This section sets out how DocMap collects, uses, and protects your personal data when you use the DocMap WhatsApp Service (also referred to as DocMap Specialist Triage). It is in addition to the booking platform privacy notice above.

Last updated: March 2026

1. Who we are

DocMap Specialist Triage (“DocMap”, “the Service”) is operated by DocMap Ltd, a company registered in England and Wales.

Data Controller
DocMap Ltd
Data protection enquiries
admin@docmap.co.uk
General enquiries
support@docmap.co.uk
Website
docmap.co.uk

DocMap Ltd is the data controller for personal data processed through the DocMap WhatsApp Service.

2. What this section covers

This part of the privacy policy applies when you:

  • Send messages to our WhatsApp Business number
  • Use the DocMap web application
  • Interact with our specialist referral and triage services

It applies to patients who contact us via WhatsApp, as well as healthcare operators who use the DocMap dashboard.

3. What data we collect

3.1 Data you provide directly

Phone number

Examples: Your WhatsApp number

Purpose: Identify your conversation, contact you with responses

Health information

Examples: Symptoms, conditions, diagnoses, surgical history, treatment history

Purpose: Understand your needs and match you with appropriate specialists

Location and travel preferences

Examples: City, region, willingness to travel

Purpose: Find specialists in accessible locations

Insurance and funding status

Examples: Private, NHS, self-funding, insurer name

Purpose: Filter specialists who accept your funding arrangement

Conversation messages

Examples: All messages you send to our WhatsApp number

Purpose: Provide the triage service, maintain conversation context

3.2 Data we generate

Intent classification

AI-generated categorisation of your message (e.g., "specialist search", "condition inquiry")

Specialist recommendations

Matched specialists based on your described needs

Conversation summaries

AI-generated summaries of your conversation for internal case management

Case records

Internal records tracking the status of your referral

3.3 Technical data

WhatsApp message IDs

Meta-assigned identifiers for each message

Timestamps

When messages are sent and received

Session metadata

Conversation state used for multi-turn interactions

4. Special category data

Your health information constitutes special category data under UK GDPR (Article 9). For the core triage and referral facilitation service, we rely on:

  • Explicit consent (Article 9(2)(a)): We provide clear information about processing (including AI-assisted analysis) and ask you to agree before we rely on your data for that purpose. Continuing the conversation after receiving our data notice may not be sufficient on its own for all processing — we record a clear affirmative step where required.

We do not rely on Article 9(2)(h) (health or social care processing) for the core DocMap triage service, because DocMap is a referral facilitation and information service, not a regulated healthcare provider delivering direct clinical care. If we introduce processing that requires a different Article 9 condition in future, we will update this policy and obtain appropriate consent or other lawful grounds before that processing begins.

You may withdraw your consent at any time (see Section 9).

5. How we use your data

Each processing activity has a primary lawful basis. Special category (health) data requires both an Article 6 basis and an Article 9 condition.

WhatsApp triage: responding to messages, maintaining conversation history, AI intent classification, specialist matching

Consent (Art. 6(1)(a)); Explicit consent for health data (Art. 9(2)(a))

Internal notifications to our clinical operations team (e.g. new conversation alerts)

Legitimate interests (Art. 6(1)(f)) — not for unrelated marketing

Compliance with law and regulatory requests

Legal obligation (Art. 6(1)(c)) where applicable

Where we use AI observability tools, prompts may contain message content: that processing is covered by the same consent basis as the triage service.

Future services (clinical trial outreach, research, or commercial data use): These are not covered by the table above until we publish a separate notice and, where required, obtain additional explicit consent.

6. How we store and protect your data

6.1 Data storage

AWS DynamoDB

Stored: Message archive, patient records, case data

Location: EU (London, eu-west-2)

Encryption: AES-256 at rest, TLS in transit

Upstash Redis

Stored: Live conversation data, session state

Location: EU

Encryption: Encrypted at rest and in transit (TLS)

We do not describe LLM traces as “anonymised” where they may still contain identifiable health information in context.

6.2 Security measures

  • All data in transit is encrypted using TLS 1.2 or higher
  • All data at rest is encrypted using AES-256 or equivalent
  • Access to patient data is restricted to authorised operators via authenticated sessions
  • WhatsApp webhook payloads are verified using HMAC-SHA256 signatures
  • We conduct regular security reviews of our infrastructure

7. Who we share your data with

We share personal data with the following categories of recipients, all of whom are bound by data processing agreements:

Amazon Web Services (AWS)

Purpose: Hosting

Data shared: All stored data

Transfer basis: UK Adequacy / SCCs; data remains in eu-west-2

Upstash

Purpose: Caching and real-time conversation state

Data shared: Conversation data

Transfer basis: DPA in place; EU hosting

Meta (WhatsApp Business API)

Purpose: Messaging channel

Data shared: Messages, phone numbers

Transfer basis: Meta DPA; EU–US Data Privacy Framework

OpenRouter / LLM providers

Purpose: AI processing

Data shared: Conversation text (in prompts)

Transfer basis: DPA in place; SCCs for US transfers

Pinecone

Purpose: Specialist search (vector similarity)

Data shared: Messages for retrieval

Transfer basis: DPA in place; pseudonymised session identifiers

We do not sell your personal data to any third party.

We do not share your health data with the specialists we recommend unless you explicitly instruct us to do so (e.g., by requesting an introduction or referral).

8. How long we keep your data

WhatsApp messages

Up to 12 months from last message, then deleted from live systems

Patient case records

Up to 12 months from case closure, then deleted from live systems

AI observability traces

Typically 90 days (or as configured), then deleted

Session and cache data

24 hours to 90 days (varies by type)

Consent records

Retained for the duration of the relationship and as required for legal claims

Backups: Cloud infrastructure may retain copies of deleted data for a limited period after deletion from live databases — commonly up to 35 days. We delete or overwrite backup copies in line with our infrastructure settings.

Aggregated or truly anonymised statistics (where no individual can be identified) may be retained longer — only where we can demonstrate anonymisation under UK GDPR.

9. Your rights

Under UK GDPR, you have the following rights:

Right of access (Article 15)

You can request a copy of all personal data we hold about you. We will provide this in a machine-readable format (JSON) within 30 days.

Right to rectification (Article 16)

You can ask us to correct any inaccurate personal data.

Right to erasure (Article 17)

You can ask us to delete your personal data. We will delete it from live systems within 30 days of your request, subject to the backup retention note in Section 8. To request erasure, message us on WhatsApp with “Delete my data” or email admin@docmap.co.uk.

Right to restrict processing (Article 18)

You can ask us to stop processing your data while we resolve a concern.

Right to data portability (Article 20)

You can request your data in a structured, commonly used, machine-readable format (JSON). We will provide this within 30 days.

Right to object (Article 21)

You can object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.

Right to withdraw consent

You can withdraw your consent at any time by:

  • Messaging us on WhatsApp with “Withdraw consent” or “Stop processing”
  • Emailing admin@docmap.co.uk

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at admin@docmap.co.uk or message us directly on WhatsApp.

10. Automated decision-making

We use AI systems to:

  • Classify the intent of your messages
  • Recommend specialists based on your described symptoms, location, and preferences
  • Generate draft responses for our operators to review before sending

These AI systems assist our human operators — they do not make final decisions about your care or referrals without human review. You have the right to request human review of any AI-assisted decision.

11. Children's data

Our service is not directed at individuals under the age of 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us immediately at admin@docmap.co.uk.

12. Changes to this section

We may update this section from time to time. Material changes will be communicated via:

  • A notice on our website
  • A message on WhatsApp (for active patients)

The “Last updated” date at the top of this section indicates when it was last revised.

13. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)

Website: ico.org.uk

Phone: 0303 123 1113

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We encourage you to contact us first at admin@docmap.co.uk so we can try to resolve your concern directly.

14. Contact us

For any questions about this section or your personal data:

Admin / data protection
admin@docmap.co.uk
General
support@docmap.co.uk
WhatsApp
Message our business number directly
Post
DocMap Ltd, 16.01 Makers Building, 1 Jasper Walk, London, N1 7TW, United Kingdom

For details about the WhatsApp Service Terms and our GDPR compliance measures, see DocMap WhatsApp Service Terms & GDPR Compliance.