Compliance

    Cookies & GDPR Compliance

    We don't just comply with GDPR — we've made it a core part of how we build. Here's how we protect your data and how cookies work on our platform.

    Data Protection Principles

    Our approach to data protection is built on six core principles that go beyond minimum compliance:

    End-to-End Encryption

    All consultation data — video, audio, text, and files — is encrypted in transit and at rest using AES-256. Not even our engineers can access your session content.

    Privacy by Design

    We collect only the minimum data required to deliver your consultation. Our systems are architected so that personal data is isolated, compartmentalised, and never aggregated without consent.

    Automatic Data Deletion

    Health data and consultation recordings are permanently deleted 30 days after your session. You can request immediate deletion at any time via your dashboard or by emailing our DPO.

    Data Portability

    You can export a complete copy of your personal data in a machine-readable format (JSON/CSV) at any time. We process portability requests within 72 hours.

    Breach Notification

    In the unlikely event of a data breach, we will notify the Data Protection Commission (DPC) within 72 hours and affected individuals without undue delay, as required by Article 33 and 34 of GDPR.

    Irish Data Residency

    All patient data is stored exclusively on servers located within the European Union. We do not transfer personal data outside the EEA. Our infrastructure is hosted with ISO 27001-certified providers.

    How We Use Cookies

    Cookies are small text files stored on your device when you visit our website. Below is exactly what we use and why.

    Strictly Necessary Cookies (Always Active)

    These cookies are essential for the website to function and cannot be switched off. They are set in response to actions you take such as setting your privacy preferences, logging in, or filling in forms. They cover session management, authentication tokens, CSRF protection, and cookie consent preferences.

    Analytics Cookies (Consent Required)

    These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. We only set these with your explicit consent. They track page views, feature usage statistics, performance monitoring, and error tracking.

    Functional Cookies (Consent Required)

    These cookies enable enhanced functionality and personalisation, such as remembering your language preference or region. They may be set by us or by third-party providers whose services we use, covering language and region preferences, accessibility settings, and chat widget preferences.

    Managing Your Cookie Preferences

    You can change your cookie preferences at any time by adjusting settings in your browser, or by emailing us at admin@instantdoconline.com. Note that disabling strictly necessary cookies may affect your ability to use our platform.

    Your Rights Under GDPR

    As a data subject, you have the following rights. We are committed to honouring each one promptly:

    • Right of Access (Article 15): Request a copy of all personal data we hold about you.
    • Right to Rectification (Article 16): Correct any inaccurate or incomplete data.
    • Right to Erasure (Article 17): Request deletion of your personal data ("right to be forgotten").
    • Right to Restrict Processing (Article 18): Limit how we use your data while a concern is being resolved.
    • Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format.
    • Right to Object (Article 21): Object to processing based on legitimate interests or direct marketing.

    To exercise any of these rights, email admin@instantdoconline.com. We respond within 30 days.

    Data Protection Officer

    Our appointed Data Protection Officer oversees all data processing activities and ensures ongoing compliance. Contact: admin@instantdoconline.com or write to us at our registered office in Dublin, Ireland.

    Sub-Processors

    We use a limited number of vetted sub-processors, all of whom are contractually bound to GDPR standards:

    • Stripe — Payment processing (PCI-DSS Level 1 certified).
    • AWS Dublin Region — Infrastructure hosting (ISO 27001, SOC 2).
    • An Post / DPD Ireland — Prescription delivery (limited to name and address).

    If you have any compliance questions, please contact our DPO at admin@instantdoconline.com. You also have the right to lodge a complaint with the Data Protection Commission at dataprotection.ie.