Privacy Policy

VirtuMedix ("we", "us") provides online medical consultations to patients in Ireland. This draft describes arrangements requiring review under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. It is not a certification of compliance.

Data controller

The data controller is Dr Ayub Khan, trading as VirtuMedix (IMC Registration 433226). For privacy enquiries, contact info@virtumedix.net or +353 87 385 8587. Do not include medical details or documents in ordinary email.

Non-medical callback requests

The callback form collects your name, email address, mobile number, preferred callback date and time, Privacy Policy acknowledgement and submission timestamp. These administrative details are used by Dr Khan to respond to your enquiry. Do not provide symptoms, date of birth, medical history or clinical documents. This form does not collect payment details or confirm an appointment.

Callback details are stored privately in Lovable Cloud and are not available to public visitors. A generic notification is sent to info@virtumedix.net through Lovable’s managed email service; it contains no names, contact details or medical information. The practice reviews callback details through its restricted Lovable account.

Medical-information collection remains paused

The former health-information form remains disabled pending approval of processing arrangements. Existing clinical requests have not been deleted or transferred. Former notifications included patient details in email; those sends are disconnected, but previously sent messages may remain in the practice mailbox and with its delivery providers.

Information we collect

The active website form collects administrative callback details only. Previous medical requests may contain identity details, date of birth and clinical concerns. Any clinical information required for subsequent care must be handled through an appropriately approved protected arrangement, not this callback form.

Purpose and legal basis to be reviewed

Callback information is used to respond to your request and take steps at your request before a possible consultation under Article 6(1)(b) GDPR. Before health-information collection resumes, the controller must document the applicable Article 6 basis and Article 9 condition, including whether Article 9(2)(h) applies, and confirm professional confidentiality obligations. Acknowledging this policy is not consent to treatment or certification of GDPR compliance.

Sharing

The current website uses Lovable hosting and Lovable Cloud storage. Former email notifications used Lovable’s managed sending service and the practice mailbox provider. The approved processor list, hosting locations, data-processing agreements, subprocessors and any international transfer safeguards must be documented before the form resumes. No protected clinical portal has yet been approved or activated.

Initial appointment enquiries

Use the contact-only callback form or telephone for initial enquiries. Do not send sensitive documents, photographs or detailed clinical histories by ordinary email or text message.

Retention

Administrative callback details should be reviewed after the enquiry is resolved and removed when no longer necessary, unless lawful retention is required. No automatic deletion period is configured; the controller must approve a documented schedule and perform these reviews. Clinically necessary existing records must not be deleted without an approved professional record-keeping arrangement. A separate clinical retention schedule remains to be finalised.

Security

Public reading, updating and deleting callback requests are not permitted. New requests are validated on the website and server before insertion. Medical-request insertion remains disabled. The live site uses HTTPS; full hosting, backup and encryption-at-rest arrangements require contractual and configuration review. The notification sent to the practice inbox contains the name, phone number, email address and preferred callback time you provided, so that the doctor can contact you; it contains no clinical information, because none is collected. Notification emails are not sent to browser URLs or to any address other than the practice inbox.

Your rights

You have the right to access, correct, erase (where applicable), restrict or object to processing of your data, and to data portability. To exercise these rights, contact us. You may also complain to the Data Protection Commission (www.dataprotection.ie).