Privacy Policy

1. Introduction

This Privacy Policy explains how Crotech Ltd., operating under the brand EUDoctor (“EUDoctor”, “we”, “us”, “our”), collects, uses, stores, and protects personal data in connection with the operation of the EUDoctor digital health platform.

EUDoctor operates as a digital intermediary platform facilitating interactions between users and independent licensed healthcare providers. EUDoctor does not provide medical services and does not engage in medical diagnosis, treatment, or prescribing.

All healthcare services are provided exclusively by independent medical professionals, who remain solely responsible for clinical decisions and patient care.

2. Data Controller

The data controller responsible for personal data processing is:

Crotech Ltd. (Registration No. C 111272)

HORECA Building, 3rd Floor Triq L-Imgarr Xewkija, Għawdex, XWK 9012 Malta

Email: info@eudoctor.co

3. Scope of This Policy

This Privacy Policy applies to all personal data processed in connection with the operation and use of the EUDoctor platform, including:

• User registration and account management
• Booking and facilitation of consultations
• Communication between users and healthcare providers
• Payment processing
• Customer support services
• Platform security and monitoring

This policy covers data processed through https://eudoctor.co, web-based applications, mobile applications, internal systems, and authorised third-party service providers acting on behalf of EUDoctor.

4. Platform Role and Healthcare Disclaimer

EUDoctor operates as a technology platform and digital intermediary facilitating access to independent licensed healthcare providers.

EUDoctor does:

• Facilitates access to independent healthcare providers
• Provides digital infrastructure
• Acts as a payment agent on behalf of independent healthcare providers
• Enables secure communication between users and providers

EUDoctor does not:

• Provide healthcare services
• Diagnose medical conditions
• Prescribe medication
• Control or influence medical decisions
• Assume clinical or professional responsibility

Healthcare providers remain solely responsible for all medical services, clinical judgments, prescriptions, and patient care.

For the purposes of data protection law, independent healthcare providers act as separate and independent data controllers in relation to medical and clinical data processed in the course of providing healthcare services.

EUDoctor acts as a data controller for platform, account, and payment-related processing and as a technical service provider supporting healthcare providers’ professional activities.

5. Categories of Personal Data

EUDoctor processes the following categories of personal data.

5.1 Identification Data

Full name, email address, phone number, date of birth, and country of residence.

5.2 Health and Consultation Data

Symptoms, medical history, consultation notes, diagnoses, prescriptions, and treatment recommendations.

This data constitutes special category personal data under Article 9 GDPR.

5.3 Account and Usage Data

Login records, session data, platform activity logs, and user preferences.

5.4 Technical Data

IP address, device information, browser type, operating system, and error logs.

5.5 Payment and Transaction Data

Transaction identifiers, payment status, invoices, and billing information.

EUDoctor does not store payment card details. All card data is processed exclusively by Stripe in accordance with applicable payment regulations.

5.6 Communication Data

In-platform messages, support requests, and email correspondence.

5.7 Analytics and Cookie Data

Usage statistics, performance metrics, and cookie identifiers (Google Analytics 4).

6. Legal Basis for Processing

EUDoctor processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation).

All processing activities are based on one or more of the legal bases set out in Articles 6 and 9 GDPR, depending on the nature and purpose of the processing.

6.1 Performance of a Contract – Article 6(1)(b) GDPR

EUDoctor processes personal data where such processing is necessary for the performance of a contract with the user, including:

• Ceation and management of user accounts
• Booking and facilitation of consultations
• Provision of platform access
• Processing of payments
• Delivery of customer support

Without such processing, EUDoctor would be unable to provide its platform services.

6.2 Compliance with Legal Obligations – Article 6(1)(c) GDPR

Certain personal data is processed in order to comply with legal and regulatory obligations, including:

• Accounting and tax requirements
• Financial record retention
• Anti-fraud obligations
• Regulatory reporting
• Dispute resolution

Such processing is mandatory and cannot be objected to by users.

6.3 Protection of Vital Interests – Article 6(1)(d) GDPR

In exceptional circumstances, personal data may be processed where necessary to protect the vital interests of a user or another person, including in medical emergencies.

This basis is used only where no other lawful basis is applicable.

6.4 Legitimate Interests – Article 6(1)(f) GDPR

EUDoctor processes certain personal data based on its legitimate interests in:

• Ensuring platform security
• Preventing fraud and misuse
• Maintaining service quality
• Improving platform functionality
• Managing business operations

Such processing is conducted in accordance with balancing tests to ensure that user rights and freedoms are not overridden.

6.5 Consent – Article 6(1)(a) GDPR

Where required by law, EUDoctor processes personal data based on user consent, including for:

• Marketing communications
• Optional analytics
• Non-essential cookies

Users may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing prior to withdrawal.

6.6 Processing of Health Data – Article 9(2)(h) GDPR

Health-related personal data constitutes special category data under Article 9 GDPR.

EUDoctor processes such data solely for the purpose of facilitating medical consultations between users and independent healthcare providers, in accordance with Article 9(2)(h) GDPR.

Such processing is carried out under the responsibility of licensed medical professionals.

EUDoctor acts as a technical and organisational facilitator and does not exercise clinical judgment.

Medical and consultation records are stored and maintained within the EUDoctor platform solely for the purpose of enabling secure access, continuity of care, legal compliance, and record-keeping obligations of independent healthcare providers.

6.7 Processing Under Professional Secrecy – Article 9(3) GDPR

Health data is processed only by, or under the responsibility of, healthcare professionals subject to professional secrecy obligations.

EUDoctor implements technical and organisational safeguards to support compliance with professional confidentiality requirements.

6.8 Processing in Support of Healthcare Providers – Article 28 GDPR

To the extent that EUDoctor processes health-related data in support of healthcare providers’ professional activities, such processing is governed by Article 28 GDPR and related contractual arrangements.

Such processing is limited to technical and organisational functions and does not extend to clinical decision-making.

6.9 Automated Processing and Profiling

EUDoctor does not engage in automated decision-making or profiling producing legal or similarly significant effects within the meaning of Article 22 GDPR.

7. Purposes of Processing

EUDoctor processes personal data for the following purposes:

• To operate, maintain, and improve the platform
• To facilitate consultations between users and independent healthcare providers
• To enable secure communication
• To process payments and manage transactions
• To provide customer support services
• To ensure platform security and integrity
• To comply with applicable legal and regulatory obligations

Personal data is not processed for purposes incompatible with those listed above.

8. Consent Management

Where processing is based on user consent in accordance with Article 6(1)(a) and Article 7 GDPR, users may withdraw consent at any time.

• EUDoctor maintains records of consent, including:
• User identifier
• Date and time of consent
• IP address
• Applicable policy version

Withdrawal of consent does not affect the lawfulness of prior processing but may affect the availability of certain platform services.

9. Data Sharing and Recipients

EUDoctor shares personal data only where necessary for the operation of the platform, the facilitation of medical consultations, and compliance with legal obligations, and in accordance with applicable data protection laws.

Personal data is not sold, licensed, or disclosed for unrelated commercial purposes.

9.1 Healthcare Providers

Personal and health-related data is shared with independent licensed healthcare providers solely for the purpose of delivering medical consultations and related services.

Providers access only data required for their professional duties.

Each provider is subject to professional confidentiality obligations and applicable data protection laws.

EUDoctor does not control medical decision-making.

9.2 Payment and Financial Service Providers

Personal data related to payments is shared with authorised payment service providers, including Stripe, for the purpose of processing transactions, preventing fraud, and complying with financial regulations.

EUDoctor does not store or process full payment card details.

All payment providers operate under regulatory and contractual safeguards.

EUDoctor facilitates the collection and settlement of payments on behalf of healthcare providers in accordance with contractual arrangements and applicable financial regulations.

9.3 Technical and Infrastructure Service Providers

EUDoctor engages selected third-party providers to support platform operations, including:

• Cloud hosting
• Data storage
• Email delivery
• Analytics services
• Customer support systems

These providers process data solely on EUDoctor’s instructions and under written data processing agreements.

Access is limited to what is necessary for service delivery.

9.4 Legal and Regulatory Authorities

Personal data may be disclosed to competent public authorities, courts, or law enforcement agencies where required by applicable law, regulation, or valid legal process.

Disclosures are limited to the scope required by law.

9.5 Corporate and Business Transactions

In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of such transaction, subject to applicable data protection safeguards.

Users will be notified where legally required.

9.6 International Data Recipients

Where data is shared with recipients located outside the European Economic Area, EUDoctor ensures appropriate safeguards in accordance with GDPR, including Standard Contractual Clauses or adequacy decisions.

9.7 Confidentiality and Security Obligations

All data recipients are subject to contractual, statutory, or professional confidentiality obligations.

Recipients are required to implement appropriate technical and organisational measures to protect personal data.

9.8 Limitation of Liability for Third-Party Processing

EUDoctor is not responsible for independent processing activities conducted by healthcare providers within the scope of their professional practice, except where required by applicable law.

Healthcare providers remain solely responsible for their clinical records and decision-making.

9.9 Prohibition of Unauthorised Disclosure

Personal data shall not be disclosed to third parties for marketing, profiling, or unrelated commercial purposes without explicit user consent or legal obligation.

10. International Data Transfers

Where personal data is transferred outside the European Economic Area, EUDoctor ensures that such transfers are conducted in accordance with Chapter V of the GDPR.

Appropriate safeguards are implemented, including:

• Standard Contractual Clauses adopted by the European Commission
• Adequacy decisions issued under Article 45 GDPR
• Supplementary contractual, technical, and organisational measures

EUDoctor assesses the legal and security environment of recipient jurisdictions where required and implements additional protections where necessary.

EUDoctor primarily utilises cloud infrastructure located within the European Economic Area and, where applicable, with providers offering EU-based data hosting options.

11. Data Retention

EUDoctor retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, regulatory, contractual, and operational obligations.

Retention periods are determined based on:

• Applicable healthcare regulations
• Accounting and tax legislation
• Limitation periods for legal claims
• Contractual requirements
• Platform operational needs

11.1 Medical and Consultation Records

Health-related data and consultation records are retained in accordance with applicable healthcare regulations and professional standards.

Such data may be retained for extended periods where required by law or necessary for the establishment, exercise, or defence of legal claims.

Access to archived medical records is restricted.

11.2 Financial and Transaction Records

Payment, invoice, and transaction data is retained in accordance with accounting, tax, and financial regulations.

Such records cannot be deleted upon user request where statutory retention obligations apply.

11.3 Account and Usage Data

Account-related data is retained for the duration of the user relationship and for a reasonable period thereafter to:

• Resolve disputes
• Prevent fraud
• Comply with legal obligations

Inactive accounts may be anonymised or pseudonymised.

11.4 Support and Communication Records

Customer support communications are retained for quality assurance, dispute resolution, and legal compliance purposes.

11.5 Anonymisation and Pseudonymisation

Where retention is required but identification is no longer necessary, data is anonymised or pseudonymised where technically feasible.

12. Data Subject Rights

EUDoctor respects the rights of users in accordance with Chapter III of the General Data Protection Regulation (GDPR).

Users may exercise their rights by submitting a request to info@eudoctor.co.

Requests must include sufficient information to verify the identity of the requester.

EUDoctor may refuse to act on requests where identification cannot be reasonably established.

12.1 Right of Access – Article 15 GDPR

Users have the right to obtain confirmation as to whether personal data concerning them is being processed and, where that is the case, access to such data.

Access requests include:

• Purposes of processing
• Categories of data
• Recipients
• Retention periods
• Safeguards for international transfers

12.2 Right to Rectification – Article 16 GDPR

Users may request correction of inaccurate or incomplete personal data.

Medical data corrections may require validation by the relevant healthcare provider.

12.3 Right to Erasure – Article 17 GDPR

Users may request erasure of personal data where applicable.

This right is subject to legal and regulatory limitations as set out in Section 13.

12.4 Right to Restriction of Processing – Article 18 GDPR

Users may request restriction of processing where:

• Data accuracy is contested
• Processing is unlawful
• Data is no longer needed
• Objection is pending

Restricted data is processed only where legally permitted.

12.5 Right to Data Portability – Article 20 GDPR

Users may request receipt of personal data in a structured, commonly used, and machine-readable format, where processing is based on consent or contract and carried out by automated means.

12.6 Right to Object – Article 21 GDPR

Users may object to processing based on legitimate interests.

EUDoctor will assess such objections and cease processing unless compelling legitimate grounds exist.

12.7 Right to Withdraw Consent – Article 7(3) GDPR

Where processing is based on consent, users may withdraw consent at any time.

Withdrawal does not affect the lawfulness of prior processing.

12.8 Right Not to Be Subject to Automated Decision-Making – Article 22 GDPR

Users have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

EUDoctor does not engage in such automated decision-making.

12.9 Verification and Response Procedures

All requests are subject to identity verification.

EUDoctor may request additional information where necessary.

Requests are processed within one month, extendable where permitted by law.

12.10 Limitations and Abuse Prevention

EUDoctor reserves the right to refuse or charge reasonable fees for manifestly unfounded or excessive requests, in accordance with Article 12(5) GDPR.

12.11 Right to Lodge a Complaint

Users have the right to lodge a complaint with a supervisory authority in their place of residence, place of work, or place of alleged infringement.

13. Erasure and Restriction of Processing

EUDoctor assesses erasure requests in accordance with Article 17 GDPR.

The right to erasure is not absolute and may be limited where processing is necessary for:

• Compliance with legal obligations
• Public interest in public health (Article 9(2)(i) GDPR)
• Establishment, exercise, or defence of legal claims
• Regulatory compliance

13.1 Erasure Requests

Users may submit erasure requests via info@eudoctor.co.

Each request is reviewed on a case-by-case basis.

Where erasure is granted, personal data is securely deleted or anonymised.

Where erasure is denied, users are informed of the legal basis for retention.

13.2 Restriction of Processing

Where erasure is not permitted, processing may be restricted under Article 18 GDPR.

Restricted data is:

• Archived
• Access-limited
• Excluded from active processing
• Retained only for legally permitted purposes

13.3 Medical Records and Legal Retention

Medical records and related documentation may be subject to mandatory retention periods under healthcare regulations.

Such records cannot be erased upon request where retention is legally required.

13.4 Financial Records and Tax Compliance

Financial and transaction records are retained in accordance with tax and accounting laws.

Such data cannot be erased while statutory retention obligations apply.

13.5 Confirmation of Processing Outcome

Users are informed of the outcome of erasure or restriction requests, including the legal basis for any refusal.

14. Security Measures

EUDoctor implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction.

Security measures are designed in accordance with the sensitivity, scope, and risks associated with the processed data.

14.1 Technical Safeguards

EUDoctor applies technical safeguards including:

• Encryption of data in transit using industry-standard protocols
• Secure authentication mechanisms
• Role-based access control
• Network security controls
• Regular software updates and patch management
• Secure backup and recovery systems
• Vulnerability scanning and penetration testing (where appropriate)

14.2 Organisational Safeguards

Organisational measures include:

• Restricted access to sensitive systems
• Confidentiality obligations
• Defined access approval procedures
• Internal security policies
• Incident response procedures

Access is granted on a need-to-know basis.

14.3 Access Logging and Monitoring

Access to personal and health data is logged and monitored.

Logs include:

• User identifiers
• Access timestamps
• Accessed resources
• Administrative actions

Logs are protected against unauthorised modification.

14.4 Data Segregation

Production data is logically separated from development and testing environments.

Live personal data is not used for development without appropriate safeguards.

14.5 Risk Management

Security risks are periodically assessed.

Where material risks are identified, appropriate mitigation measures are implemented.

15. Data Breach Management

EUDoctor maintains procedures for the detection, investigation, and management of personal data breaches.

A personal data breach includes any incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

15.1 Incident Identification and Containment

Upon detection of a suspected breach, EUDoctor will:

• Immediately assess the incident
• Contain and limit further impact
• Secure affected systems
• Preserve relevant evidence

15.2 Impact Assessment

EUDoctor will evaluate:

• Type and volume of affected data
• Number of affected users
• Potential risks to rights and freedoms
• Likelihood of harm

15.3 Regulatory Notification

Where required under Articles 33 and 34 GDPR, EUDoctor will:

• Notify the competent supervisory authority within 72 hours
• Notify affected users without undue delay

Notifications will include legally required information.

15.4 Remediation and Prevention

Following an incident, EUDoctor will:

• Implement corrective measures
• Strengthen controls
• Update procedures
• Document lessons learned

15.5 Documentation

All data breaches and security incidents are documented in an internal incident register.

Documentation includes:

• Incident description
• Timeline
• Response actions
• Outcomes

16. Cookies and Tracking Technologies

EUDoctor uses cookies and similar technologies to ensure proper operation of the platform and to improve user experience.

EUDoctor implements a cookie consent management mechanism that enables users to accept, reject, or customize non-essential cookies in accordance with applicable ePrivacy and data protection requirements.

Cookies and tracking technologies are used for the following purposes:

• Essential platform functionality
• Security and fraud prevention
• Analytics and usage monitoring (Google Analytics 4)
• Performance optimisation

Where required by law, EUDoctor obtains user consent prior to the use of non-essential cookies.

Users may manage cookie preferences through browser settings or available platform tools.

Further information is provided in the Cookie Policy.

17. Mobile Application and Device Permissions

When users access the EUDoctor platform via the mobile application (iOS or Android), certain device-level permissions may be requested in order to enable essential platform functionality.

EUDoctor applies the principles of privacy by design and privacy by default in accordance with Article 25 GDPR when developing and maintaining its mobile application.

17.1 Camera Access

The mobile application may request access to the device camera for the purpose of conducting real-time video consultations with independent licensed healthcare providers.

Camera access:

• is activated only during active consultation sessions
• is not used for background recording
• does not enable continuous monitoring
• does not result in automatic recording or storage of video content by EUDoctor unless explicitly required by law or separately consented to

Video communication is transmitted using encrypted channels.

Users may enable or disable camera access at any time through device settings.

Legal basis: Article 6(1)(b) GDPR and Article 9(2)(h) GDPR.

17.2 Microphone Access

The mobile application may request access to the device microphone for audio communication during consultations.

Microphone access:

• is activated only during active consultation sessions
• is not recorded or stored by EUDoctor
• is not used for background monitoring

Users may revoke microphone access via device settings.

Legal basis: Article 6(1)(b) GDPR.

17.3 Biometric Authentication

The application may allow users to enable biometric authentication (Face ID, fingerprint, or device-level biometric systems) for secure login.

Biometric authentication:

• is processed exclusively on the user's device
• is not transmitted to EUDoctor servers
• is not stored, accessed, or controlled by EUDoctor

Biometric templates remain protected within the device manufacturer’s secure environment.

Legal basis: Article 6(1)(b) GDPR.

17.4 Device Storage Access

Limited local device storage may be used to:

• securely store authentication tokens
• maintain encrypted session continuity
• support app functionality

No medical records are stored in unsecured local storage.

17.5 Calendar Access

If permitted by the user, the application may access the device calendar to allow users to save consultation reminders locally.

Calendar data:

• remains stored on the user's device
• is not transmitted to EUDoctor servers

Users may revoke calendar access at any time.

17.6 Push Notifications

The EUDoctor mobile application may send push notifications to users for:

• appointment reminders
• account-related notifications
• service updates
• security alerts

Push notifications are sent via secure notification services provided by the mobile operating system provider (e.g., Apple Push Notification Service (APNs) or Firebase Cloud Messaging (FCM)).

Push notifications:

• do not contain sensitive medical details
• are limited to essential service-related information
• may be disabled by users through device or application settings

Legal basis:

• Article 6(1)(b) GDPR (service-related notifications)
• Article 6(1)(a) GDPR (where marketing or optional notifications require consent)

17.7 Device and Diagnostic Data

When accessed via mobile device, EUDoctor may automatically collect limited technical and diagnostic data, including:

• device type
• operating system version
• IP address
• application version
• crash reports
• error logs

This data is used exclusively for:

• security and fraud prevention
• troubleshooting
• service optimisation
• maintaining system integrity

Legal basis: Article 6(1)(f) GDPR (legitimate interests).

17.8 Third-Party SDKs in Mobile Applications

The mobile application may integrate selected third-party software development kits (SDKs) necessary for:

• payment processing
• secure authentication
• push notifications
• analytics
• crash monitoring
• infrastructure services

All third-party SDK providers are subject to written data processing agreements in accordance with Article 28 GDPR where applicable.

EUDoctor conducts due diligence before integrating third-party services and implements safeguards for international data transfers where required under Chapter V GDPR.

EUDoctor does not integrate advertising SDKs or behavioural profiling tools without explicit user consent.

18. Account Deletion (Mobile Application Users)

Users may request deletion of their account and associated personal data:

• directly within the mobile application (where available), or
• by contacting info@eudoctor.co

Upon verified request:

• account access will be deactivated
• personal data not subject to statutory retention requirements will be erased or anonymised
• medical records and financial documentation may be retained where required by healthcare, tax, or regulatory obligations

Identity verification may be required before processing deletion requests.

Deletion requests are handled in accordance with Section 13 of this Privacy Policy and Article 17 GDPR.

19. Third-Party Services

EUDoctor engages selected third-party service providers to support platform operations.

Such providers may include:

• Cloud hosting providers
• Payment processors
• Analytics providers
• Email and communication services
• Customer support systems

All third-party providers processing personal data are subject to written agreements containing data protection and confidentiality obligations.

EUDoctor conducts appropriate due diligence prior to engaging third-party providers and monitors compliance where necessary.

20. Children’s Data

The EUDoctor platform is intended exclusively for individuals aged 18 years and above.

EUDoctor does not knowingly collect or process personal data of minors.

Where EUDoctor becomes aware that personal data of a minor has been collected without valid legal basis, such data will be promptly reviewed and deleted in accordance with applicable law.

Parents or legal guardians who believe that a minor has provided personal data through the platform may contact info@eudoctor.co.

21. Changes to This Policy

EUDoctor reserves the right to amend this Privacy Policy from time to time in order to reflect legal, regulatory, operational, or technological developments.

Material changes will be communicated to users through appropriate channels, including platform notifications or email communication.

The updated Privacy Policy will indicate the date of last revision.

Continued use of the platform following the effective date of an updated Privacy Policy constitutes acceptance of the revised terms, unless otherwise required by applicable law.

22. Contact Information

EUDoctor has designated an internal privacy contact point responsible for coordinating data protection and compliance matters.

For all privacy-related inquiries, data subject requests, and data protection matters, users may contact EUDoctor at:

Email: info@eudoctor.co

Address: HORECA Building, 3rd Floor, Triq L-Imgarr, Xewkija, Għawdex, XWK 9012, Malta

Final Disclaimer

This Privacy Policy reflects EUDoctor’s role as a digital intermediary and technology platform facilitating access to independent licensed healthcare providers.

Nothing in this Privacy Policy shall be interpreted as establishing EUDoctor as a healthcare provider, medical institution, or clinical service provider.

All medical services are delivered exclusively by independent healthcare professionals, who retain full responsibility for clinical decisions and patient care.