This privacy statement describes how customers' personal data is processed on the Dokport website, in the patient record system and in the digital doctor service. We are committed to protecting the privacy of our customers and users in compliance with applicable law, such as the EU General Data Protection Regulation (GDPR).
Summary
Dokport processes your personal data so that we can provide you with remote healthcare safely and handle the identification, communication, payment and statutory obligations involved in the Service.
We process, for example, your name, your personal identity code, your contact details, service usage and payment data, and the patient data concerning your health and treatment. Patient data may include, for example, symptoms, diagnoses, medication, examination results and the messages you exchange with a healthcare professional.
The data is used primarily to provide the healthcare service and to ensure patient safety. It may also be processed for invoicing, for meeting statutory obligations and for developing the Service.
We retain personal data only for as long as its purpose of use or the law requires.
1. Controllers
Dokport Suomi Oy ("Dokport") provides the Dokport online service ("Platform"), through which individuals ("Customer") can order remote healthcare services ("Service") provided by doctors or other healthcare professionals ("Service Provider").
Dokport is the controller of the personal data processed on the Platform and of its own patient records. The Service Provider with whom the Customer has a care relationship is the controller of its own patient records. Dokport may also act as the Service Provider.
2. Contact
If the Customer has questions about this privacy statement or wishes to exercise their data protection rights, the Customer can contact Dokport customer service:
Dokport Suomi Oy / data protection
Postal address: Maria Jotunin tie 11 LT, 00400 Helsinki, Finland
Email: [email protected]
3. Purposes and legal bases of processing
Processing related to the use of the Platform and the contract between Dokport and the Customer:
- Dokport processes the Customer's personal data on the basis of the contract between the Customer and Dokport to provide the Service the Customer requested, to send communications related to the Service and to bill the Customer.
- After the contract ends, Dokport retains log and billing data to meet its legal obligations.
- Dokport and its partners use Platform usage data and anonymised patient data to develop the Platform and for statistics and research, on the basis of Dokport's legitimate interest.
- With the Customer's consent, Dokport measures how the website and the Platform are used (analytics) and which campaign brought the Customer to the service. Analytics data contains no health data.
- If the Customer has accepted marketing cookies and came to the service from an ad, Dokport reports the purchased consultation to Google Ads to measure advertising effectiveness (consent). No information about the Customer's health or the service bought is disclosed.
- Dokport processes partner referral codes to pay partner commissions, on the basis of legitimate interest.
- Electronic direct marketing sent by Dokport to the Customer is based on the legitimate interest arising from the customer relationship or on the Customer's explicit consent.
- Dokport processes the Customer's personal data to handle feedback, official requests for information and adverse events, on the basis of law or legitimate interest.
Processing related to the care relationship and the contract between the Customer and the Service Provider:
- The Service Provider processes the Customer's personal data to examine and treat the Customer's health, illnesses and injuries. The processing is based on the contract and care relationship between the Customer and the Service Provider and on statutory obligations.
- The Service Provider processes the Customer's personal data to handle feedback, official requests for information and adverse events, on the basis of law or legitimate interest.
Where processing is based on legitimate interest, the controllers have assessed that it does not override the Customer's fundamental rights and freedoms.
We do not carry out profiling or automated decision-making that has legal or similarly significant effects on the Customer.
4. Data processed
Data related to the use of the Platform and the contract between Dokport and the Customer:
- Customer identification data
- Customer contact details
- Customer contract data and consents
- Data arising from communication between the user and Dokport
- Log data generated by use of the Platform
- Receipts, invoices and other payment data provided to the Customer
- Analytics data collected with consent (a random identifier, pages viewed, device and browser type)
- Campaign and referral data (for example campaign tags, ad click identifier, partner code)
Data related to the care relationship between the Customer and the Service Provider or Dokport:
- Customer's name, personal identity code and contact details (e.g. address, phone number, email)
- The guardian of a minor Customer, or another close relative named by the Customer, with their contact details and, where necessary, personal identity code
- Consents to the processing and disclosure of data
- Patient records required by law, including treatment and examination data, the author and their position, and the time of each entry
- Messages between the Customer and the Service Provider, including any attachments
- Data related to the Kela direct reimbursement procedure
5. Sources of data
Personal data is collected mainly from the Customer when they contact us or use the services. For a minor, data may also be obtained from their guardian. Patient record data is created during treatment and examinations. For login with strong electronic identification, the identification data comes from Telia Finland Oyj. When the Customer acts on behalf of another person, the authorisation is checked from the Suomi.fi e-Authorizations service of the Digital and Population Data Services Agency. Earlier patient data may be viewed in the Kanta services to the extent necessary for care.
The dokport.com website and the Platform use cookies and similar technologies. Optional cookies are set only with consent, and no Google, Meta or other advertising tags are loaded in the browser. More information is in our cookie policy. Data collected with cookies contains no health data and is not used for care.
6. Retention period
To perform the contract, personal data is collected from the moment the Customer identifies with strong authentication on the Platform and is processed for as long as the health service is provided. Dokport may retain data related to use of the Platform for a reasonable period after the contract ends to communicate about or develop the Service.
Dokport and the Service Providers comply with legal retention requirements. For example, the Act on the Processing of Client Data in Healthcare and Social Welfare (703/2023) sets long retention periods for patient records: 12 years from the patient's death or, if this is not known, 120 years from the patient's birth. Accounting records are retained for six years from the end of the financial year in which they were created.
Data may be retained beyond these periods in exceptional situations, such as when required by law or an authority, or because of a legal claim.
Data collected with cookies is retained for the period described in the consent tool and the cookie policy.
7. Disclosure of data
The Customer's personal data is disclosed in the following cases:
- Kanta: patient record entries are saved in the national health data archive (Kanta), where the Customer can read them in the MyKanta service. More information at www.kanta.fi.
- Consent: personal data is disclosed to another healthcare provider to enable the Customer's care, based on the Customer's written consent or consent recorded in the patient records, oral consent, or consent evident from the context. Anonymised and/or statistical data may be processed and disclosed for research and statistics without consent.
- Authorities: data is disclosed to courts and other authorities or bodies with a statutory right to it, based on a written and specific request, in the form and scope the matter requires.
- Business transfers: if we sell or otherwise reorganise our business, the Customer's personal data may be disclosed to buyers and their advisers.
- Debt collection and legal claims: the Customer's data may be disclosed to selected partners to collect our receivables and to establish and defend legal claims.
- Kela: for Kela-reimbursed consultations, the data required by the direct reimbursement procedure.
- Google Ads: only with consent to marketing cookies, the ad click identifier, purchase amount, order identifier and email address in hashed form (SHA-256), as described in section 3.
We also use the following processors, which process data only on our behalf:
- Google Cloud (servers and databases in Finland) and Google Firebase (notifications)
- Stripe (card payments; card details are entered directly with Stripe)
- Telia Finland Oyj (strong electronic identification)
- PostHog (analytics, data stored in the EU)
- CookieYes (cookie consent management)
- Resend (email) and GatewayAPI (text messages)
8. International transfers
Patient data and other service data are stored in the EU (Google Cloud, Finland). Some processors, such as Google, Stripe and Resend, are US companies, so data may be transferred outside the EU and EEA. Such transfers rely on the EU-U.S. Data Privacy Framework or on standard contractual clauses approved by the European Commission.
9. Security
The register is protected by technical and organisational measures. We use measures under Article 32 of the GDPR, such as pseudonymisation and encryption, to keep processing secure. Everyone who processes personal data is bound by confidentiality. We follow industry best practices and standards for information security.
10. Your rights
The Customer has the right to:
- Be informed about the processing of their data
- Access their data
- Request rectification of their data
- Request erasure of their data ("right to be forgotten")
- Restrict processing
- Object to processing
- Data portability
- Withdraw consent
- Lodge a complaint with the Data Protection Ombudsman, tietosuoja.fi
These rights apply within the limits permitted and required by data protection and other law. To exercise them, please contact us at the address in section 2. We will ask the Customer to verify their identity so that data is not disclosed to anyone other than the data subject.
11. Changes
We continuously develop the Service and our practices and may change this privacy statement, also because of changes in law or regulatory guidance. We recommend reviewing this privacy statement regularly.