Privacy Policy
How Maybrook handles your information
I am the Data Controller for the information described here. That means I decide what is held, why, and I am accountable for it.
“GDPR” means the General Data Protection Regulation (EU) 2016/679.
“Data Controller” has the meaning detailed in GDPR.
In short, and subject to any obligations at law:
- I hold a medical record about you because I am or have been your doctor.
- I do not sell your information, share it for marketing, or allow anyone to use it to train artificial intelligence.
- The only people who see your medical records are me, the doctor covering when I am away, and anyone you are referred to.
- I sometimes use a transcription tool during consultations to facilitate a more engaged and attentive consultation (whereby I am not typing on the computer while we are talking). I tell you when it’s on, and you can ask me to turn it off. It is entirely to support documentation, and no clinical decision is made by artificial intelligence or this transcription tool.
- You can see everything I hold about you, at any time, free of charge.
- We may provide access to certain information to third-party suppliers for them to perform certain functions for us as necessitated by your use of any of the services we provide — for example, your mobile telephone number and email addresses and the contents of SMS messages and emails may be given to mobile network operators for the purposes of providing you messages in connection with the services as requested by you. These suppliers are not authorised to release this information to other third parties.
- Any personal data that you provide to Maybrook and which we retain will be held on secure servers. The nature of the Internet is such that we cannot guarantee or warrant the security of any information you transmit to us via the Internet. No data transmission over the Internet can be guaranteed to be 100% secure. However, we take all required steps (including appropriate technical and organisational measures) to protect your personal data. This Policy will be continuously assessed against new technologies, business practices, regulatory changes and the evolving needs of the business and the services we provide.
- We reserve the right to change this Policy from time to time in our sole discretion. Any changes to this Policy will be printed in an updated policy and posted on our website so you are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. If I change this notice, the updated version will be posted at maybrook.ie/privacy with the date. If a change is significant, I will tell members directly.
1. What I hold
About you: name, date of birth, address, PPS number, phone number, email, next of kin, and, where applicable, your own GP or a former GP’s details.
About your health: the notes of our consultations, your history, examination findings, test results, letters to and from other clinicians, prescriptions, and anything you tell or share with me.
About the arrangement between us: your membership or appointment record, dates of contact, and the fact and amount of payments. (Maybrook does not hold your full card or bank details. Card payments are processed by Stripe and Direct Debits by GoCardless, who hold that information securely — see section 6.)
When you contact me: emails, text messages and voicemails, and the record of calls made and received.
When you use the website: see section 10.
We only collect the minimum amount of personal information necessary.
2. Where it comes from
Any information which I hold about you will have come directly from you during our consultations and correspondence, or where I have, with your authority, requested information from third parties. These third parties may include, but are not limited to, other clinicians, hospitals, specialists, your previous GP — and from laboratories reporting results I have requested, or occasionally from a family member (where you have asked me to speak with them).
3. Why I hold it, and what allows me to hold it
I hold your health information to provide your medical care. Under data protection law this is permitted because processing is necessary for medical diagnosis and the provision of healthcare and continuity of your healthcare, carried out by a health professional bound by professional secrecy — Article 9(2)(h) of the GDPR, together with the Data Protection Act 2018.
I hold your contact and payment information to run the practice — to arrange appointments and follow-up or recall notices and reminders, to take payment, and to correspond with you. That is on the basis of our agreement.
Certain information I hold because the law requires it: certain notifiable diseases, statutory certification, and record retention.
4. The transcription tool, and what it does not do
During consultations, I sometimes, with your permission, use a secure clinical transcription tool. It listens, produces a transcript of our conversation, and produces a draft clinical note of our encounter. I then check, adjust, correct and approve that note myself. I will ask you before I turn it on. You can decline without giving a reason. While it is running, you can ask me to turn it off, without giving a reason. The audio is not kept once the note is written, and all of the data is automatically deleted from the transcription tool in the days after our encounter. No decision about your care is made by the tool. It assists with documentation, but every clinical judgement is mine. Your consultation is not used to train artificial intelligence. This tool allows us to step away from the computer more easily during the consultation.
5. Who else may see your medical data
- The doctor covering when I am away, so that you are not starting from nothing if you need care while I am on leave.
- Clinicians you are referred to, and the hospital or service treating you, and pharmacists (for the purpose of filling your prescriptions), with your knowledge.
- Laboratories processing your samples.
- Your health insurer, if you require me to fill out a claim form.
- For guest consultation/episodic review patients, with your permission, your own GP (where you have come for a one-off appointment, or limited arrangement), so that your record stays in one place. I will ask you.
Unless the law requires disclosure, or there is a serious risk to your safety or the safety of someone else, no other parties outside of sections 5 and 6 herein are privy to your information. If that ever arose I would tell you, unless telling you would itself create the risk or breach any law.
6. The services I use
Running a practice means using suppliers. Each holds a limited part of the picture, each is bound by a written data protection agreement, and none may use your information for their own purposes.
| The Service | The Provider | The Data they hold |
|---|---|---|
| Clinical records system | Semble | Your medical record |
| Consultation transcription | Heidi | Audio during the consultation only; then transcription and draft note for a few days, then deleted |
| Email and office software | Google Workspace | Correspondence |
| Laboratory testing | HSE laboratories, Eurofins Biomnis | Samples and results |
| Membership payments | GoCardless | Bank mandate, payment record. No medical data |
| Appointment payments | Stripe, SumUp | Payment record. No medical data |
| Telephone and voicemail | IP Telecom | Call records and voicemail messages |
| Messaging | WhatsApp Business (Meta) | Encrypted messages |
| Website hosting | Blacknight, Cloudflare | Website only. No patient data |
| Accounting | Garvey Moran Chartered Certified Accountants | Financial records. No medical data |
7. What I will not do
- Sell your information, to anyone, for any amount.
- Use your medical record to market anything to you.
- Share your information with an employer, an insurer, or a family member without your authorisation.
- Allow it to be used to train an artificial intelligence system.
- Move it outside the European Economic Area without a lawful basis for doing so.
Semble may host data in the UK, which is outside the EEA. The European Commission recognises UK data protection law as providing an adequate level of protection (an ‘adequacy decision’), which permits this. This position is kept under review.
8. How long I keep it
Medical records are kept for a minimum of 8 years after our last contact, and notes for patients who were children will be kept until at least the date of that patient’s 25th birthday.
I keep records this long because I am professionally required to, and because a medical history is only useful if it is complete. This is also why the right to erasure at section 9 works differently for health records than for most other data.
Financial records are kept for six years, as tax law requires. Voicemails and routine correspondence are routinely deleted after being dealt with, unless they form part of your clinical record.
9. Your rights
- See your record. Ask, and I will give you a copy within one month. There is no charge or explanation required.
- Correct your record. If something is factually wrong, tell me and I will update the record. Where a clinical opinion is disputed rather than objectively incorrect, I will record your view alongside mine.
- Have your record transferred to another doctor. There is no charge for this.
- Restrict or object to certain processing.
- Erasure, with a limit. You can request erasure of your record. Although a request can be made, it is not permissible to delete a medical record, because I am legally and professionally required to retain it. I will explain what can and cannot be removed, added or adjusted rather than simply refusing.
- Withdraw agreement to anything that you had previously agreed to, at any time (subject to any obligations I may have at law).
To exercise any of these rights, please contact me. If I need to verify who you are, I will ask.
Children and young people
A parent or guardian can usually see and act on their child’s information. As young people become able to decide for themselves, usually around 16, their information is theirs to control, and I will not share it with a parent without their consent, unless there is a serious risk to their safety.
10. The website
I set no cookies beyond those strictly necessary to serve the basic functions of the page, which is why there is no consent banner. There are no advertising trackers, social media pixels or anything that follows you elsewhere installed on the website. We do not use cookies to gather personal information such as a person’s name or email address.
The booking page is operated by Semble, who also provide the medical record and appointment scheduling service for Maybrook (semble.io). When you use it, their privacy notice applies.
11. External links
The website may contain links to other websites. Please take note that Maybrook is not responsible for the privacy policies or practices of such other websites. You are advised that when you leave the Maybrook website, you should read the privacy statements of each website that collects personally identifiable information.
This privacy statement applies solely to information collected by Maybrook as part of any health service we may deliver.
12. If you are unhappy
Tell me, by phone, by email, or in person. You can also lodge a grievance or complaint to the Data Protection Commission at any time: Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland, dataprotection.ie. That right exists independently of anything here.
13. Changes
If this notice changes, the current version will always be available at maybrook.ie/privacy, with the date it was last updated. We recommend that you revisit this policy on occasion to learn of any new privacy practices or changes to our policy.