Privacy notice

Who is responsible

Your clinic controls its patient records. The clinic decides why patient and appointment data is recorded, how it is used, and how long professional or legal rules require it to be kept. Patients should normally contact their clinic first about those records.

Executive Precision Era operates WAdoc.online as a processor for clinics. We process clinic records only to provide, secure and support the service and according to the clinic's instructions.

Executive Precision Era is the controller for data needed to operate WAdoc.online itself, including staff accounts, authentication, subscriptions, service security, support and communications. Contact us at Rua Herminio Cunha 7, Setúbal, Portugal, or privacy@wadoc.online. Whether a data protection officer or Turkish representative must be named is under review.

For patient data, the clinic you use is the controller. Its name appears in its messages and appointment details. Ask the clinic for its full identity, contact details, applicable legal grounds and health-data condition, and the period it must keep your record. If you cannot identify or contact it, email us with the clinic name and we will route your request.

Data we collect and where it comes from

We do not buy personal data. We do not sell personal data, use it for advertising, or use advertising trackers or behavioural analytics.

How we use data and our legal grounds

• Provide clinic scheduling: create and manage patient records, appointments, availability, reminders, clinic documents and staff collaboration.
• Provide and administer accounts: authenticate staff, apply clinic roles, maintain sessions, send invitations and manage subscriptions.
• Communicate: deliver service emails, support replies and, where permitted, appointment-related WhatsApp messages.
• Protect the service: prevent unauthorised access, investigate faults or abuse, maintain audit trails, back up data and recover the service.
• Meet legal obligations: respond to privacy requests, preserve records that must be retained, and maintain billing or security records required by law.

Patient records: the clinic must identify its actual GDPR Article 6 ground and, for health data, its Article 9 condition. If Turkish law applies, it must identify the relevant conditions in KVKK Articles 5 and 6. Those grounds depend on the clinic; ask it for the grounds applicable to your record. A clinic's contract with WAdoc is not itself a legal ground for processing the patient's health data.

WAdoc operational data: staff accounts and subscriptions are processed to provide the contracted service; billing and privacy-request records are processed to meet legal duties; and security and support records are processed for the legitimate interests of protecting and operating the service. The exact ground for each activity and any consent-dependent activity is being confirmed. No optional patient-data AI assistance is enabled at present.

Patients can decline an optional email address, date of birth, preferred language or WhatsApp notifications; booking may still require a name and a way for the clinic to contact the patient or their representative. Staff need an account identity and email to use the service. A clinic may need further information under its own professional duties; ask it which fields are required and what happens if you do not provide them.

WAdoc.online does not make decisions about people based solely on automated processing that produce legal or similarly significant effects. Optional automated assistance is not currently enabled for patient data. If that changes, this policy will be updated before such processing begins.

WhatsApp and Meta data

Clinics may use the Meta WhatsApp Business Platform for appointment conversations. When you message a participating clinic, Meta sends WAdoc.online your telephone number, message content, time, provider message identifier and interaction choices. We use this data to route the message to the correct clinic, understand the requested appointment action, prevent duplicate processing, send the clinic's reply and record delivery status.

• A message you start allows the clinic to reply to that conversation. It does not by itself enrol you in ongoing notifications.
• Booking confirmations, changes and reminders are sent only after notification permission is recorded. You may grant permission by replying UPDATES or START, or through the clinic after being told what you will receive.
• Reply STOP to stop messages from that clinic's number. This cancels queued messages and keeps a minimal suppression record so the opt-out continues to work.
• WhatsApp message text is removed after 30 days. Delivery and permission records may be kept longer as described under retention.
• Meta also processes WhatsApp data under its own terms and privacy policy. Even a clinic or service choice can reveal health information. Do not send symptoms, diagnoses or other health details through WhatsApp unless your clinic asks you to.

If a telephone number is shared or changes owner, messages may reach the handset rather than the intended person. Tell the clinic when a number is shared or has changed.

Who receives data

We disclose data only where needed to provide the service, follow a clinic's instructions, comply with law, or protect the service and its users.

Service providers may use data only to provide their contracted service or as otherwise required by law. We do not share patient data with Stripe. Transactional emails contain no appointment details or clinical records; a portal sign-in code names the clinic, which can itself be sensitive.

International data transfers

Some service providers may process data outside Portugal or the European Economic Area. The actual destinations, provider roles and transfer safeguards are still being verified. The responsible controller must identify any applicable European Commission adequacy decision or GDPR transfer safeguards and explain how to obtain a copy. If data is transferred from Türkiye, KVKK Article 9 requires a separate assessment and, where appropriate, a Turkish-law transfer mechanism; GDPR Standard Contractual Clauses do not replace it. Email privacy@wadoc.online for the verified destinations and safeguards relevant to your data.

How long data is kept

The periods below are the proposed limits for each purpose. Existing automatic deletion is identified below. Other limits are targets while we finish the deletion controls; valid deletion requests are handled individually in the meantime. A clinic sets the period for its patient and clinical records under the law and professional rules that apply to it.

Data may be kept longer when required by law, a legal claim, a regulatory request or an active security investigation. When data is no longer needed, it is deleted or irreversibly anonymised.

How to request deletion

Patients: contact the clinic that holds your record. The clinic must verify your identity and decide whether professional or legal retention duties require any part of the record to remain. If you cannot reach the clinic, email privacy@wadoc.online and name the clinic so we can route the request securely.

Staff members and other WAdoc users: email privacy@wadoc.online with the subject “Data deletion request”, your account email address and the clinic or clinics concerned. Do not send identity documents unless we ask through a secure channel.

We may ask for information needed to verify identity and prevent someone else from deleting your data. The responsible controller normally responds within one calendar month under the GDPR or within 30 days under the KVKK. Where deletion applies, data is deleted or anonymised in the live service and removal flows to service providers and backups according to their deletion cycles. A deletion journal prevents erased patient data from being reintroduced during a restore. The controller will explain any data that must be retained and the legal reason.

Replying STOP on WhatsApp stops future clinic messages but is not a deletion request. Use the process above if you also want stored data deleted.

Your privacy rights

Depending on the circumstances, you may ask to access, correct, erase or restrict your personal data; object to processing; receive portable data; or withdraw consent without affecting earlier lawful processing. A parent, guardian or authorised representative may exercise rights where the law permits.

Patients should contact their clinic first. Staff members and other users can email privacy@wadoc.online. Requests are normally answered within one month; if a request is unusually complex, we will explain within that month if more time is needed.

You may complain to Portugal's supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the data-protection authority where you live or work.

If the Turkish KVKK applies, you may also ask the controller whether your data is processed, learn its purposes and domestic or foreign recipients, request correction or deletion and notification of these actions to recipients, object to an adverse result produced solely by automated analysis, and claim compensation for damage caused by unlawful processing. The controller must answer within 30 days. You must first apply to the controller before complaining to the Turkish Personal Data Protection Authority (KVKK). If its answer is refused or inadequate, you may complain within 30 days of learning of the answer and, in any case, within 60 days of your original request.

Patients of US clinics

This section applies where a clinic in the United States uses WAdoc.online. It supplements this notice; it is not your clinic's HIPAA Notice of Privacy Practices, which the clinic gives you itself.

Who provides the service. Executive Precision Era, Lda., trading as WAdoc.online, provides scheduling software to independent clinics. Your clinic provides your care and controls its patient records. Contact it first about those records; we can help route a request if you cannot identify the clinic.

What information is used. Depending on the clinic's configuration, the service handles names, contact details, language, date of birth, authorised representative relationships, appointment details and staff-entered notes, as well as portal verification and session information, permission records, support requests and security and access records. Notes and clinic affiliation may reveal sensitive health information.

Booking through a link. Where a messaging channel is enabled for a HIPAA-covered clinic, it sends a generic, single-use link to the clinic's booking portal instead of appointment details. You must verify yourself before any appointment information or action is shown. The channel provider can still receive your account or phone identifiers, the fact that you contacted the clinic, delivery information and anything you send to it, so avoid sending medical details or identity documents in messages. Available channels depend on the clinic: the portal, email and, where the clinic enables them, WhatsApp, Facebook Messenger and Instagram in link-only form. A message from a clinic can itself show that you are its patient, which matters for sensitive services such as substance use disorder programs; ask your clinic to use the portal or email only if you prefer.

Verification email. If you verify by email, we send a code to the address on your record; the message includes the clinic's name but no appointment details. The clinic may instead give you a single-use code at the desk. Tell the clinic about a safer way to reach you, especially if an address or device is shared.

Representatives and children. Online booking for US clinics is intended for adults and for verified representatives acting within their authority. A parent's or guardian's authority may not cover every record or service, and the clinic verifies it. Children should book with the clinic's help rather than on their own.

Service providers and access. AWS hosts the principal application data in the United States. Cloudflare provides the network edge and can process information in transit. Authorised WAdoc personnel in Europe may access data only for approved support or administration, and that access is logged. Enabled messaging and email providers receive what their function needs. Stripe processes clinic subscription payments and receives no patient records.

Copies and retention. Your clinic sets how long patient records are kept. A calendar export or a downloaded file creates a copy outside WAdoc.online that the clinic is responsible for. Other service records follow their retention schedules; legal holds and required compliance records may be kept longer.

Requests. Ask your clinic for access, amendment, an accounting of disclosures or confidential communications about its records. The clinic verifies your identity and authority and applies the deadline. HIPAA does not provide a general right to delete medical records. We handle requests about our own account, billing and service data at privacy@wadoc.online. Other rights depend on your data, location and applicable law.

California. Where the Confidentiality of Medical Information Act applies to us as a provider of software that makes medical information available to patients (Civil Code §56.06(b)), we keep that information confidential to the same standard as your provider and disclose it only as that law permits.

Texas. Records about Texas residents are physically stored in the United States. We do not sell protected health information.

Washington and Nevada. Information the clinic holds under HIPAA is covered by HIPAA. We do not use consumer health data for advertising, and we do not geofence health-care locations.

Substance use disorder programs. If your clinic is a federally assisted substance use disorder program, your records are also protected by 42 CFR Part 2; the clinic's own notice explains those protections.

Security

WAdoc.online uses named accounts, role-based clinic access, doctor-level patient scoping, encrypted connections, encryption at rest for databases, backups and uploaded files, hashed session tokens, anti-forgery controls, audit logging, restricted support access, backups and recovery controls. Staff access is limited to what their role requires. No internet service can promise absolute security; suspected privacy or security issues should be reported to privacy@wadoc.online.

Cookies and browser storage

WAdoc.online uses essential cookies to keep staff signed in and protect forms from forgery. The browser stores preferences such as language, theme and the last-used clinic. These technologies are not used for advertising or cross-site tracking. The public privacy page itself sets no cookies.

Changes and contact

We update the revision date when this notice changes. Material changes affecting a permission, such as WhatsApp notifications, will apply prospectively and be tied to the notice version presented when permission is recorded.

Questions, privacy requests and security reports: privacy@wadoc.online.