Privacy Policy

Last updated: 13 August 2026

1. Introduction

GetYourGP Limited ("we", "us", "our") is committed to protecting your privacy and ensuring the security of your personal and health information. This Privacy Policy explains how we collect, use, store, and protect your data when you use our online healthcare services.

We are registered in Ireland and comply with the General Data Protection Regulation (GDPR), the Data Protection Acts 1988-2018, and all applicable Irish and EU data protection legislation.

2. Data Controller

GetYourGP Limited is the data controller for the personal data we process. Our contact details are:

  • Email: privacy@getyourgp.ie
  • Address: Nenagh, Co. Tipperary, Ireland

We have appointed a Data Protection Officer. You can contact them directly about how we handle your information or about exercising any of your rights:

  • Data Protection Officer: dpo@getyourgp.ie

3. Information We Collect

3.1 Personal Information

  • Full name, date of birth, and gender
  • Contact details (email address, phone number, postal address)
  • PPS Number (for prescription purposes only)
  • Payment information (processed securely via Stripe)
  • Account login credentials

3.2 Health Information

  • Medical history and current conditions
  • Medications and allergies
  • Consultation notes and clinical assessments
  • Prescriptions issued
  • Test results and referral information

3.3 Technical Information

  • IP address and browser type
  • Device information
  • Usage data and cookies
  • Audio and video consultation recordings

3.4 Analytics and Advertising Information

If you consent to analytics or advertising cookies, we and the providers named in section 11 also collect:

  • The pages you visit and the actions you take, including on the signed-in patient portal. Page addresses can themselves reveal what you are looking for — for example, the address of a prescription request page contains the name of the condition
  • The condition you select when requesting a prescription, sent as a property of the analytics event alongside the page address
  • Completed bookings and submitted prescription requests, with the amount paid and the booking or request reference
  • A recording of your screen and interactions on this site and the patient portal ("session replay") — see section 11.3
  • Your approximate location derived from your IP address, your device and browser, the site that referred you, and advertising click identifiers (such as a Google Ads gclid) carried in the web address
  • A persistent analytics identifier stored on your device, which is linked to your patient account identifier once you sign in

We do not send your name, email address, date of birth, phone number, address, PPS number, consultation notes, prescriptions or any document to analytics or advertising providers.

4. Consultation Recording (Audio & Video)

4.1 Purpose of Recording

All consultations (audio and video) are recorded. Recording is a condition of using the service: as a telemedicine platform we record every consultation to maintain a complete clinical record and to establish, exercise, or defend legal claims (GDPR Article 9(2)(f)), alongside our medical record-keeping obligations. Recordings are made for the following purposes:

  • Quality assurance: To maintain high standards of care and review consultations for training purposes
  • Clinical records: To supplement written clinical notes and provide a complete record of your consultation
  • Dispute resolution: To assist in resolving any concerns or complaints about your care
  • Regulatory compliance: To meet requirements set by the Irish Medical Council and other regulatory bodies

4.2 Your Rights Regarding Recordings

  • You are always informed: Every consultation is recorded; there is no unrecorded consultation option. If you do not wish to be recorded, please do not book a consultation and contact your own GP practice instead
  • Access recordings: You can request access to recordings of your consultations at any time
  • Request deletion: You can request deletion of recordings; because recordings form part of your medical record, deletion is subject to the legal retention period (minimum 7 years under Irish law)
  • Restricted use: Recordings are used only for the purposes listed above and are never shared for marketing or sold to third parties

4.3 Recording Security

  • Recordings are encrypted in transit and at rest
  • Access is strictly limited to authorised healthcare professionals
  • Recordings are stored securely within the EEA
  • Recordings are retained for the same period as medical records (minimum 7 years as per Irish law)
  • All access to recordings is logged for audit purposes

5. How We Use Your Information

We process your data for the following purposes:

  • Healthcare provision: To provide medical consultations, prescriptions, and healthcare services
  • Legal obligations: To comply with medical record-keeping requirements (minimum 7 years retention in Ireland)
  • Communication: To send appointment reminders, prescription updates, and important health information
  • Payment processing: To process payments for our services
  • Service improvement: To understand how the website and patient portal are used and to improve them. This data is pseudonymous, not anonymous — it is not labelled with your name or email address, but it is tied to a persistent identifier and, once you sign in, to your patient account identifier
  • Advertising measurement: With your consent, to measure which advertising campaigns lead to bookings and prescription requests, and to report those conversions to Google Ads
  • Safety: To ensure patient safety and identify potential drug interactions or contraindications
  • Asking for a review: If you have agreed to hear from us about our services, we may include an invitation to review us publicly on Trustpilot inside an email confirming that a consultation or prescription is complete. We do not send Trustpilot any information about you — see section 7

6. Legal Basis for Processing

We process your data based on:

  • Contract: Processing necessary to provide our healthcare services
  • Legal obligation: Compliance with healthcare regulations and medical record requirements
  • Vital interests: In emergency situations to protect your health
  • Consent: For marketing communications (including any invitation to review us publicly — see section 5), for analytics and session replay, and for advertising measurement. No analytics event, session replay or advertising measurement happens before you accept, and you can withdraw at any time (section 11.5). One exception we want to be straight about: the PostHog software loads with the page and contacts PostHog once to fetch its settings, so PostHog sees your IP address even if you never accept. It records nothing about you until you do
  • Legitimate interests: For fraud prevention and service improvement

7. Data Sharing

We may share your information with:

  • Healthcare professionals: GPs, specialists, and pharmacies involved in your care
  • Pharmacies: To fulfil prescriptions (with your consent)
  • Payment processors: Stripe for secure payment processing
  • Regulatory bodies: Irish Medical Council, HIQA, or other authorities as required by law
  • Emergency services: In case of medical emergencies
  • Analytics and advertising providers: PostHog and Google, and only if you consent — see sections 7.1 and 11

We do not send Trustpilot anything about you in order to collect a review. You may see an invitation to review us on Trustpilot in your account, or in an email confirming that a consultation or a prescription is complete. It is an ordinary link: we do not send Trustpilot your email address, your name or any identifier, and we never ask Trustpilot to contact you. If you follow the link and write a review, you are dealing with Trustpilot directly, under its own terms and privacy policy at legal.trustpilot.com. Anything you write there is public, so please do not include medical details. Reviewing us is entirely optional and your care is not affected either way — and we only include the invitation if you agreed to hear from us about our services, which you can change at any time in your settings.

Separately from that link, our public website can show a Trustpilot reviews widget. It loads only if you allow functional cookies, and when it loads Trustpilot receives your IP address and the address of the page you are viewing. That is described in the Cookie Policy, and it is the only circumstance in which Trustpilot receives anything about you from us.

7.1 Service Providers (Data Processors)

We use a small number of carefully selected service providers to operate the platform. Each provider is bound by a GDPR-compliant data processing agreement. All processing of your health records, consultations, documents and payments takes place within the EU/EEA. The main provider that processes data outside the EEA is Google, which we use only for analytics and advertising measurement and only with your consent (see section 12); any other non-EEA processing is noted against the provider concerned below. Our providers are:

  • Hetzner Online GmbH (Germany): Secure hosting of our platform and encrypted storage of health records, documents, and consultation recordings
  • Stripe Payments Europe Ltd (Ireland): Payment processing — we never store your card details
  • Whereby (Norway/EEA): Video consultation infrastructure
  • Telnyx (EU): Phone consultation infrastructure
  • Resend (EU — Frankfurt): Transactional email delivery (appointment confirmations, reminders)
  • PostHog (EU Cloud): Product analytics and session replay, used only with your consent. Health information is masked in replays — see section 11.3
  • New Relic (EU region): Platform performance and error monitoring
  • Google Ireland Limited and Google LLC (Google Analytics 4 and Google Ads): Advertising measurement, and analytics for the public website — used only with your consent. Google receives the pages you visit, your approximate location, your device and browser, and the fact that you completed a booking or prescription request with the amount paid. No condition is included in the conversion itself, and the condition is removed from treatment-request addresses before they are sent. The addresses of our public blog articles and of pages named after a service can name the subject they cover, and Google receives those in full. Google processes this data outside the EEA, including in the United States — see section 12

We will never sell your personal data to third parties.

8. Data Security

We implement robust security measures to protect your data:

  • Encryption in transit (TLS) for all data sent between your device and our servers
  • Encrypted storage of all personal and health data
  • Regular security audits and penetration testing
  • Strict access controls and authentication
  • Staff training on data protection
  • GDPR-compliant data processing agreements with all service providers

9. Data Retention

We retain your data for the following periods:

  • Medical records: Minimum 7 years (as required by Irish law), or 8 years for minors after they reach 18
  • Payment records: 6 years for tax purposes
  • Account information: Until you request deletion (subject to legal retention requirements)
  • Marketing consent: Until withdrawn
  • Analytics and advertising data: Held by the providers named in section 11 for the retention period configured on each account. Withdrawing consent stops any further collection

10. Your Rights

Under GDPR, you have the following rights:

  • Right of access: Request a copy of your personal data
  • Right to rectification: Correct inaccurate personal data
  • Right to erasure: Request deletion of your data (subject to legal requirements)
  • Right to restrict processing: Limit how we use your data
  • Right to data portability: Receive your data in a portable format
  • Right to object: Object to certain types of processing
  • Right to withdraw consent: Withdraw consent at any time

To exercise these rights, contact us at privacy@getyourgp.ie, or our Data Protection Officer directly at dpo@getyourgp.ie.

11. Cookies, Analytics and Advertising

11.1 Cookies

We use cookies to improve your experience on our website. For a full list of the cookies we set, including their names and how long they last, please see our Cookie Policy.

The analytics and advertising described below run on both our public website and the signed-in patient portal. None of it records anything about you until you accept — see section 11.5.

11.2 Product analytics (PostHog)

We use PostHog, hosted in the EU, to understand how the website and the patient portal are used so we can improve them. PostHog records the pages you view and the steps you take through booking, prescription requests and registration — including where you stop.

One of these details is health-adjacent: when you request a prescription we record the condition you selected. This is tied to the same persistent analytics identifier as the rest of your activity, and to your patient account identifier once you sign in.

We do not record the name of the medicine you are prescribed or the name of the pharmacy you choose. Where our analytics needs to tell one medicine or pharmacy apart from another, it uses an internal reference code that means nothing outside our own systems.

11.3 Session replay

PostHog also records a replay of your visit to the public website and the patient portal. A replay is a reconstruction of your screen built from the page structure, not a video file. It lets us see where a page confused someone or a step failed.

What a replay does and does not contain:

  • Masked: everything you type, and all text displayed on screen. Text is replaced by placeholder blocks, so your answers, medicines, conditions, messages and documents are not readable in a replay
  • Never captured: the contents of requests and responses between your browser and our servers
  • Captured: the layout of each page, your mouse movements, clicks, key presses (as events, not as the characters you typed), scrolling, and the web address of each page you visit — and a page address can itself indicate what you were doing

Session replay runs on the public website and the patient portal only. It is switched off in the portals used by our GPs, pharmacies and staff.

11.4 Google Analytics and Google Ads

With your consent we use Google Analytics 4 and Google Ads on both the public website and the patient portal, so we can see which pages and which advertising campaigns lead to bookings and prescription requests. A cookie shared across getyourgp.ie lets Google join your visit to the public website with your later activity in the portal as one journey.

Google receives:

  • Every page you view on the public website and in the patient portal, including the page address. Where an address names the condition you are requesting treatment for, that part is replaced before it is sent, so Google receives "/prescriptions/[condition]/request" rather than the condition itself. This replacement does not extend to our public information pages: the address of a blog article, or of a page named after a service, can name the subject it covers, and Google receives that address in full. Reading such a page is not a statement that it applies to you, but it is information about you that Google receives, and you can decline it by refusing analytics and advertising cookies
  • The actions you take on the public website. Google is not sent the condition you select when requesting a prescription, and is not sent any of the events we record inside the portal
  • Completed bookings and submitted prescription requests, with the amount paid in euro and the booking or request reference. Sick-certificate bookings are reported under a separate conversion, so Google can tell that a booking was for a sick certificate
  • Your IP address (from which Google derives an approximate location), your device and browser, the site or advert that referred you, and any Google Ads click identifier

We do not sell your data, and we do not ask Google to build advertising profiles from your health information. Google processes what it receives outside the EEA, including in the United States — see section 12, and Google's own privacy policy for what it does with it. If you do not accept advertising cookies, Google's measurement code is never loaded at all: no cookie is set, no page address or IP address reaches Google, and we send Google no record of your booking or prescription request. Nothing goes to Google until you accept.

11.5 Your choice, and how to withdraw it

  • Nothing described in sections 11.2 to 11.4 is recorded before you accept. Google's measurement code is not loaded at all until then, so nothing whatever reaches Google. The PostHog software does load with the page and contacts PostHog once for its settings, so PostHog sees your IP address; it captures no events and records no replay unless you accept
  • You can change or withdraw your choice at any time using the "Cookie Settings" link in the footer of www.getyourgp.ie. Your choice applies across getyourgp.ie, including the patient portal. Withdrawing stops further collection; it does not delete what was already collected, which you can request separately at privacy@getyourgp.ie
  • Declining has no effect on your care, your appointments or your prescriptions
  • We honour your browser's "Do Not Track" setting for product analytics

12. International Transfers

Your health records, consultations, recordings, documents and payments are stored within the European Economic Area (EEA).

The exception is the analytics and advertising data described in section 11.4. Google transfers and processes that data outside the EEA, including in the United States. It does not include anything about your health: the condition you are seeking treatment for is removed before it is sent. This transfer only happens if you accept analytics or advertising cookies, and you can withdraw that consent at any time (section 11.5).

Where we use service providers outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

13. Children's Privacy

Our services are available to patients of all ages. For patients under 16, parental or guardian consent is required. We take additional care to protect the privacy of minors.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through our platform. The date of the last update is shown at the top of this policy.

15. Complaints

If you have concerns about how we handle your data, please contact us first at privacy@getyourgp.ie. You also have the right to lodge a complaint with the Data Protection Commission:

16. Contact Us

For any questions about this Privacy Policy or our data practices, please contact:

GetYourGP Limited

Dublin, Ireland

Email: privacy@getyourgp.ie

General enquiries: support@getyourgp.ie