x.doctor x.doctor

Privacy policy

Last updated: . This version applies from . Until then, the previous version applies.

This policy explains how x.doctor OÜ uses personal data when you use the x.doctor apps: what we collect, why, who receives it, how long we keep it and what your rights are.

1. Who is responsible for your data

x.doctor OÜ, registry code 16536174, Narva mnt 5, 10117 Tallinn, Estonia ("x.doctor", "we", "us"), is the controller of the personal data this policy describes. Our privacy contact is support@x.doctor.

Words with a capital letter, such as App, Patient, Doctor, Plan, Messages, Calls, Call log and Chat, have the meaning given in our Terms of service.

Each Doctor is a separate controller of the personal data they receive from Patients and of the records they keep under their own professional rules (section 4).

The GDPR (Regulation (EU) 2016/679) and Estonian data protection law apply to our use of personal data. If you are in Moldova, Moldovan data protection law also protects you.

2. What data we collect

2.1 Everyone who uses the App

  • Account: your email address, your name if you give one, whether you use the App as a Patient or as a Doctor, and which version of our Terms of service you last accepted in the App, and when.
  • Sign-in records: the IP address and the app and device details that your phone sends each time you sign in or the App renews your sign-in.
  • Notifications: a device token for push notifications, and whether your phone is an iPhone or an Android phone.
  • Server logs and error reports: technical records of requests to our servers, which include your IP address, and reports of errors. They never contain the content of your Messages.
  • Support: what you write to support@x.doctor, and our replies.

2.2 Patients

  • Messages, call recordings and Call logs: everything you send in Messages, the audio recordings of your Calls, and the Call logs (section 5). This often includes health information (section 4).
  • Plans and payments: which Plans you have with which Doctors, their prices, when they start and end, refunds, and Stripe's references for your payments. We never receive your card details.

2.3 Doctors

  • Profile: your name, photo, specialty and subspecialties, the languages you speak, your bio, your prices and the number of Patients who have had a Plan with you. Patients can see all of this, and anyone who has the web address of your photo can open it. We also keep whether you are taking new patients.
  • Licence check: the information we use to check your licence and your identity before we first show your profile.
  • Payouts: your bank account (IBAN and account holder's name), your earnings and your payouts.
  • Messages, call recordings and Call logs with your Patients (section 5).

2.4 What you must give us

You need an email address to sign in. Your name is optional. Health information is your choice, but a Doctor can only help with what you share. Doctors must give us what we need to check their licence and to pay them. The App does not ask for your phone number or your date of birth.

The App has no analytics or advertising tools of its own and does no tracking. The Google software that delivers push notifications (Firebase) sends Google technical data about itself and about notification delivery, which is not linked to you. Our website, https://x.doctor, uses no cookies and no analytics. It only stores your choice of a light or dark theme in your browser.

3. Why we use your data and on what legal basis

The articles named below are articles of the GDPR.

  • Account and sign-in: we use your account data and sign-in records to run your account, sign you in and send you notices about it, including changes to our Terms of service and this policy. Basis: our contract with you (Article 6(1)(b)).
  • Messages and Calls: we deliver Messages and Calls between you and the Doctor you choose, and we store Messages and Call logs so that you both can see the Chat. Basis: our contract with you (Article 6(1)(b)); for health information, your explicit consent (Article 9(2)(a), section 4).
  • Plans and payments: we sell and start Plans, take payments on Doctors' behalf and make refunds. Basis: our contract with you (Article 6(1)(b)); for health information that your Plans reveal, your explicit consent (Article 9(2)(a), section 4).
  • Doctor profiles and payouts: we show each Doctor's profile to Patients so that they can choose a Doctor, and we pay Doctors their share. Basis: our contract with the Doctor (Article 6(1)(b)).
  • Notifications: we use your device token to send you push notifications. Basis: our contract with you (Article 6(1)(b)).
  • Licence checks: we check Doctors' licences and identity before we first show their profiles. Basis: our contract with the Doctor (Article 6(1)(b)) and our legitimate interest in listing only licensed professionals (Article 6(1)(f)).
  • Accounting: we keep records of Plans, payments, refunds and payouts. Basis: our legal obligation under the Estonian Accounting Act (Article 6(1)(c)); for health information that these records reveal, the establishment, exercise or defence of legal claims (Article 9(2)(f)).
  • Legal protection: we record the audio of Calls, and we keep Messages, call recordings, Call logs and records of Plans, to protect Patients, Doctors and x.doctor in complaints, disputes and legal claims. Basis: our legitimate interest in being able to show what was said and agreed if a complaint or legal claim arises (Article 6(1)(f)); for health information, the establishment, exercise or defence of legal claims (Article 9(2)(f)).
  • Reports and misuse: when someone reports content, or to investigate a specific fault, security incident or misuse, our staff open the Messages, call recordings or Call logs concerned and decide what to do (section 5). Basis: our legal obligations under the EU Digital Services Act (Article 6(1)(c)) and our legitimate interest in an App that is safe and works (Article 6(1)(f)); for health information, your explicit consent (Article 9(2)(a), section 4) or Article 9(2)(f).
  • Security and faults: we use sign-in records, server logs and error reports to keep the App secure, stop misuse and fix faults. Basis: our legitimate interest in an App that is safe and works (Article 6(1)(f)).
  • Support and complaints: we use what you write to us, and the data it concerns, to answer you. Basis: our contract with you (Article 6(1)(b)) and our legitimate interest in resolving complaints (Article 6(1)(f)).
  • Courts and authorities: we answer requests from courts and authorities that the law requires us to answer, and we report information that suggests a crime that threatens someone's life or safety. Basis: our legal obligations (Article 6(1)(c)); for health information, Article 9(2)(f) or 9(2)(g).

We do not use your data for advertising or marketing, we do not sell it, and we make no decisions about you based solely on automated processing. You can object to the uses based on our legitimate interests (section 10).

4. Health information and your consent

Health information is anything about your health, or about the health of a child or other person you legally represent: symptoms, test results, photos, documents, voice messages and what is said in Calls. The fact that you have a Plan with a Doctor of a certain specialty can also reveal something about your health, so we protect it in the same way.

We use your health information on the basis of your explicit consent (Article 9(2)(a) GDPR). Your consent covers the health information in your Messages and Calls with Doctors, whether you or the Doctor provides it, and what your Plans reveal. With it, you allow us to:

  • send it to the Doctor you choose;
  • store it so that you and the Doctor can see your Chat;
  • let our staff open it in the cases in section 5.

Separately, we record Calls and keep Messages, call recordings and Call logs to establish, exercise or defend legal claims (Article 9(2)(f) GDPR), as sections 5 and 8 describe. This does not depend on your consent.

You give this consent in one step, by tapping Agree in the App: the same tap with which you accept our Terms of service. Tap Agree only if you consent to the use of your health information that this section describes.

You can withdraw your consent at any time by writing to support@x.doctor from any address; tell us the email address of your account. Messages and Calls cannot work without this consent, so we then close your account (Terms of service, section 10): you and Doctors can no longer send each other Messages or make Calls, and we receive no new health information about you through the App. If paid Plans are running, we refund the hours left in them (Terms of service, section 6). Withdrawing does not affect what we did before. What we keep for legal claims stays for the periods in section 8.

Each Doctor is a separate controller of the health information they receive from you and of the records they keep under their own professional rules. You can ask your Doctor about those records, or ask us and we pass your request on.

5. Messages and Calls

You cannot edit or delete a Message once sent. If you sent something by mistake, write to support@x.doctor. We store Messages on our servers.

We record the audio of every Call, including Calls where video is on. We do not record video. Each Call starts with a short notice that it is recorded and why. We store recordings in the European Union. We also keep a Call log of each Call: who called whom, when, whether it was answered and how long it lasted.

We keep each Message, call recording and Call log for 10 years after it was sent or the Call took place, and longer only while a complaint, dispute, legal claim or request from a court or authority about it is open. Then we delete it.

We use Messages, call recordings and Call logs only to:

  • show you and the Doctor your Chat, with its Messages and Call logs;
  • protect Patients, Doctors and x.doctor in complaints, disputes and legal claims, which means to establish, exercise or defend them;
  • answer requests from courts and authorities;
  • handle reports, and investigate a specific fault, security incident or misuse.

We never use them for advertising or profiling, we never sell them, and we never use them to train AI models.

We do not routinely read Messages or listen to call recordings. Our staff open Messages, call recordings or Call logs only:

  • when someone reports them to us;
  • to handle a specific complaint, dispute or legal claim;
  • to answer a request from a court or authority;
  • to answer a request from the Patient or the Doctor in the Chat to use their rights under this policy (section 10);
  • to investigate a specific fault, security incident or misuse.

6. Who receives your data

  • The Doctor you choose: your name, your Plans with that Doctor, and everything you send in Messages or say in Calls with that Doctor. The Doctor never sees your email address.
  • Patients: a Doctor's profile (section 2.3).
  • Our service providers, which process data on our behalf and only to provide their service to us:
    • Amazon Web Services: hosting of our servers, database, files and call recordings in the European Union; sign-in emails through Amazon SES (your email address and the code); Calls through Amazon Chime. The call software also sends Amazon Web Services technical data about your phone's battery, charging and memory, which is not linked to you.
    • Google (Firebase Cloud Messaging) and, on iPhone, Apple (Apple Push Notification service): delivery of push notifications. They receive your device token, ids and the type of notification, never the content of your Messages. Google's Firebase software also sends Google technical data about itself and about notification delivery, which is not linked to you.
    • Sentry: error reports from our servers, without the content of Messages.
    • The provider of our email: the emails you send to support@x.doctor.
  • Stripe: card payments, on Stripe's own page. Stripe receives your card details and the email address you enter there. From us it receives the amount and the type of Plan, never your name or the Doctor's name. For its own legal duties, such as fraud prevention, Stripe acts as a separate controller.
  • Wise: payouts to Doctors. Wise receives the Doctor's bank account (IBAN and account holder's name), the amount and a payment reference. For its own legal duties, Wise acts as a separate controller.
  • Apple App Store: on iPhone, the App asks the App Store whether a newer version exists. This request carries no account data.
  • Our lawyers, insurers, accountants and auditors: when they need the data to advise us, to handle a complaint, dispute or legal claim, or to check our accounts.
  • Courts, police and other authorities, and the professional body that licensed a Doctor: when the law requires it, when needed to establish, exercise or defend legal claims, when that body handles a complaint about the Doctor, or when we learn of information that suggests a crime that threatens someone's life or safety.
  • A buyer or successor: if our business is sold or merged, the new owner takes over the data and this policy. We tell you before it happens.

7. Transfers outside the European Economic Area

Many Doctors work outside the European Economic Area (EEA), in the Republic of Moldova. Doctor profiles do not show where a Doctor works, so expect that your Messages and Calls can go to a Doctor in Moldova. The European Commission has not decided that Moldova protects personal data to the level of the EU. When you write to or call such a Doctor, we send that Doctor your Messages and Calls because you ask us to: this is necessary to perform our contract with you (Article 49(1)(b) GDPR).

Some of our service providers, or companies in their groups, are outside the EEA, mainly in the United States. For these transfers we rely on the EU-U.S. Data Privacy Framework for providers certified under it, on another adequacy decision of the European Commission, or on the European Commission's standard contractual clauses. You can ask us for a copy of these safeguards.

8. How long we keep data

  • Account data: while your account exists. After it is closed, we keep your email address and name only as long as we keep other records linked to them.
  • Messages, call recordings and Call logs: 10 years after each Message was sent or each Call took place, and longer only while a complaint, dispute, legal claim or request from a court or authority about it is open.
  • Plans, payments, refunds and payouts: 7 years from the end of the financial year in which they took place, as the Estonian Accounting Act requires, and longer only while a complaint, dispute or legal claim about them is open.
  • Sign-in records: about 60 days after each sign-in or renewal.
  • Push tokens: until you sign out, the token stops working, or the phone is used to sign in to another account.
  • Server logs and error reports: only as long as we need them to find and fix faults and to investigate security incidents.
  • Doctors' profiles and bank details: while the Doctor's account exists. Payout records follow the 7-year rule above.
  • Licence checks: while you are a Doctor in the App, and after that as long as a legal claim about your work through the App is possible, at most 10 years.
  • Emails to support: as long as we need them to handle your request. If they concern a complaint, dispute or legal claim, we keep them as long as a legal claim about the matter is possible, at most 10 years after the matter is closed.

When a period ends, we delete the data.

9. Security

  • Data travels between the App and our servers over encrypted connections (TLS).
  • Our database and file storage are encrypted at rest.
  • Only the x.doctor staff who need it can access personal data, and only for the purposes in this policy.
  • You sign in with one-time codes. We store no passwords.

Messages and Calls are not end-to-end encrypted, so our systems can access them. This is what lets us store and keep Messages and call recordings as section 5 describes.

If a personal data breach happens, we report it to the Estonian Data Protection Inspectorate without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to put anyone at risk. We also tell any other authority that the law requires us to tell. If the breach is likely to put your rights and freedoms at high risk, we also tell you without undue delay what happened, what it may mean for you, and what we and you can do about it.

10. Your rights

  • Access: get a copy of your data, including the recordings of your Calls, where the copy does not harm the rights of others, such as the other person in the Call.
  • Rectification: have wrong data corrected.
  • Erasure: have your data deleted when we no longer need it or have no legal basis for it.
  • Restriction: have the use of your data limited, for example while we check a complaint about it.
  • Objection: object to the uses based on our legitimate interests. We then stop, unless we have compelling legitimate grounds or need the data for legal claims.
  • Portability: get the data you gave us in a common, machine-readable format.
  • Withdrawing consent: withdraw your consent at any time (section 4).

To use a right, write to support@x.doctor from the email address of your account, so that we know it is you. If you have no account, or cannot use that address, write from any address, and we may ask you for information to confirm who you are. You can always withdraw your consent from any address (section 4). It is free. We answer within one month. If a request is complex, we can take up to two more months, and we tell you why within the first month.

To delete your account, write to support@x.doctor from the email address of your account. We close the account and delete the data we no longer need. We keep the data we need for legal claims and accounting, such as Messages, call recordings, Call logs and payment records, for the periods in section 8. The Doctor may also keep their own records under their professional rules.

11. Children

You must be 18 or older to use the App. Children must not use the App themselves. A parent or legal guardian can use their own account to ask a Doctor about their child. By sharing the child's information, the parent or guardian confirms that they have the right to share it and to consent for the child, and is responsible for doing so. We protect the child's information as this policy describes, and the parent or guardian can use the child's rights on the child's behalf.

12. Complaints

If you are unhappy with how we handle your data, you can write to us first, if you like. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee, which supervises us. You can also complain to the data protection authority of the country where you live or work, for example the National Supervisory Authority for Personal Data Processing (ANSPDCP) in Romania or the National Center for Personal Data Protection (NCPDP) in Moldova.

13. Changes to this policy

We tell you by email, and publish the new version here, at least 30 days before a change that matters to you takes effect: a new purpose, new kinds of recipients, transfers to new countries, longer retention, or a change in how you use your rights. If the law requires a change sooner, we tell you as soon as we can. If a change needs your consent, we ask for it. We publish small corrections here with a new "Last updated" date. Earlier versions are available on request.

14. Contact

  • Company: x.doctor OÜ, registry code 16536174
  • Address: Narva mnt 5, 10117 Tallinn, Estonia
  • Privacy contact: support@x.doctor