Privacy policy

1. Who is responsible for your data

The data controller is SIA “Cyber Security” (reg. No. 40203470171, registered address: Silmaļu iela 17–47, Salaspils, Salaspils nov., LV-2121), which operates the E-Medicīna platform. Contact: atbalsts@emd.lv. Data protection contact: Sergejs Ponomarjovs, atbalsts@emd.lv.

The doctor, as a separate controller, is responsible for the medical content of the consultation and for any records the doctor makes in their own system or in the national E-health system.

2. What data we process

Patients: first name, surname, email address, phone number (if given), visit time, chosen doctor, payment status and the files you send during the visit. Card details are processed by Stripe – we do not see or store them.

Doctors: first name, surname, contact details, certificate number, specialty, profile information, schedule, bank details and earnings. For unconfirmed doctor profiles we use publicly available information (name, specialty, place of practice).

Everyone: technical data for security (IP address, browser) and necessary cookies – see the “Cookies” page.

3. Why and on what legal basis

Providing the booking, the video call and the payment – performance of a contract (GDPR Article 6(1)(b)). Accounting and tax – legal obligation (point (c)). Security, fraud prevention and public doctor profiles – our legitimate interests (point (f)).

4. Who can access the data

The doctor you booked with and our service providers (data processors): Daily (video call), Lovable Cloud (database and file storage), Stripe (payments), Cloudflare (website security), Lovable (website hosting and visit statistics – page views, clicks, page loading speed and technical errors; this uses the “session-id” cookie, see the “Cookies” page), an email delivery provider (confirmations and reminders), and Google and Apple (only if a doctor chooses to sign in with that account). We do not sell data or use it for advertising.

5. Transfers outside the EU

Some of our service providers (for example, Stripe and Daily) are US companies. Where data is transferred outside the European Union, this is done with the safeguards required by the GDPR – the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

6. How long we keep data

Booking and contact information – 3 years after the last visit. Payment and accounting documents – 5 years, as required by the Accounting Law. Files sent during a visit – 7 days after the visit ends; they are then automatically deleted together with their metadata, and during that time only the patient and the doctor for that visit can open them. Doctor account – until it is deleted.

We do not record video calls and we do not keep medical records.

7. Your rights

You can ask for access to your data, for its correction or deletion, for restriction of processing and for data portability, and you can object to processing. Write to atbalsts@emd.lv – we will reply within one month. You can lodge a complaint with the Data State Inspectorate (www.dvi.gov.lv).

8. Children

Children under 18 are booked by a parent or legal guardian, who takes part in the video call.

9. Changes

The current version of this policy is always published on this page.