This is a working draft for discussion. It is not an effective policy, agreement or statement of completed compliance.
Qualified legal and privacy advisers must review and complete this draft for the relevant jurisdictions and actual service arrangements before publication or data collection.
Draft for legal review. Identify the legal entity, contact details, jurisdictions and services before this policy is adopted. Public previews do not accept real enquiries. Isolated test environments may store preset fictional records according to their stated test retention.
Define the minimum contact details and enquiry information needed, sources of data, any sensitive health information, and why each is required. Do not collect medical documents through the initial enquiry.
Document each purpose and applicable lawful basis, including any additional requirements for sensitive information and consent where required.
Identify hospitals, service providers, hosting locations, cross-border transfers and safeguards. Explain how specific authorisation will be obtained before sharing medical information.
Define retention and deletion periods, security controls, access and correction rights, complaint processes and how individuals can exercise them.
Review essential and optional technologies, fonts, analytics and chat providers; describe their use and consent mechanisms where required.