Privacy policy

Controller

The controller responsible for processing is Karim Youssef, operator of doktorly.online. Contact: kontakt@doktorly.de.

What we process

Account data for providers (name, email, password hash, optional practice and licence details); consultation bookings (patient name, email, time, duration and service type); and non-clinical attendance timestamps. We do not record audio, video or session content.

Legal basis

We process this data to perform our contract with you (Art. 6(1)(b) GDPR), to meet legal obligations (Art. 6(1)(c)) and on the basis of our legitimate interest in operating a secure service (Art. 6(1)(f)). Health-related data is only handled to the extent the provider is responsible for it, under Art. 9(2)(h).

Retention

Join links and raw tokens are stored only as one-way hashes and expire automatically. Attendance timestamps and booking records are kept only as long as needed for the provider's documentation duties, then deleted.

Sharing & sub-processors

We do not sell data and we do not share it for advertising. Payments, when enabled, are handled directly by Stripe so card data never touches our server. Infrastructure is limited to what is needed to run the service.

Your rights

You have the right to access, rectification, erasure, restriction, portability and objection, and to lodge a complaint with a supervisory authority. To exercise any right, email kontakt@doktorly.de.

kontakt@doktorly.de

HIPAA

For US-facing use we apply HIPAA-conscious safeguards: end-to-end encrypted media, no recordings by default, hashed single-session links, access control and audit logging without clinical content. A Business Associate Agreement is available on request.

Security

All traffic is encrypted in transit, media uses DTLS-SRTP between peers, passwords are stored as salted hashes, and tokens are short-lived and scoped. We collect no more than the session requires.