Legal
Privacy notice
What is held about you, why, who else can see it, and what you can make us do about it.
Last updated, 26 October 2026
The clinic is responsible for your health information, not us
This is the most important sentence on the page. Your clinic is the data controller for your medical record: they decide what is held and why, and they answer for it. We are their processor, acting on their instructions. So a request about your record goes to the clinic. We help them answer it; we do not answer it over their head. For the little we hold in our own right, your sign-in account and the fact that it exists, we are the controller and you can come to us directly.
What is held
Your account: an email address or a phone number, the language you read in, and when you last signed in. Held by the clinic, through us: your name, contact details, date of birth, your appointments, what you paid, messages between you and them, and whatever clinical information they record. Technical: the requests your browser makes, recorded with an account identifier and never your name, kept for security and for finding faults.
Why
To let you sign in and prove it is you. To show your appointments and take a booking. To take a payment and give the clinic a record of it. To carry a message between you and the practice. To send a reminder. The clinical part is processed because a clinic needs it to provide care, and because keeping a record is a legal obligation on them.
What is never done
Your information is never sold, and you are never advertised to on the strength of it. There is no advertising network, no session recording and no third-party analytics on any page you reach after signing in. Nothing about your health goes in a web address, an email subject line or a phone notification. A reminder says you have an appointment; it does not say what for. That rule is why a notification on your lock screen tells the person next to you nothing.
Who else sees it
Staff at the clinics you are registered with, and only those. A practice you have never been to cannot see that you exist. The services we depend on: the company hosting the servers, the one sending email, the provider taking the payment. Each is bound by contract, handles only what it needs, and may not use it for anything of its own. A very small number of our own staff, when a clinic asks for help with a fault. That access is time limited, asked for in advance, and recorded. Anybody else only where the law requires it, and we tell the clinic when that happens unless we are forbidden to.
Every read is recorded
Opening a chart is logged: who, when, and which record. Not only changes. Reads. That log is not decoration. It is what lets a clinic answer "who looked at my file?" with a list rather than with reassurance, and you are entitled to ask them for it.
What you can make us do
You can ask for a copy of what is held about you, ask for a mistake to be corrected, ask for it to be deleted, object to a particular use, or ask for your data in a form you can take elsewhere. Ask the clinic about your medical record and us about your account. Either way you get an answer within a month. Deletion has a real limit, and we would rather say it than bury it: a clinic must keep a medical record for a period the law sets where they practise, and that outlives your account here. Closing the account removes your access; it does not erase the chart. If you are not satisfied, you can complain to the data protection authority in your country.
How long
Your account: while you use it, and two years after you last sign in, then it is deleted. Your medical record: the clinic decides, within what the law where they practise requires. Usually years rather than months. Payment records: as long as tax law requires, typically several years, and not ours to shorten. Technical logs: weeks rather than years, carrying identifiers rather than names.
How it is protected
Everything travels encrypted and is encrypted where it is stored. The separation between clinics is enforced by the database itself rather than by a line of code somebody could forget: a request scoped to one practice cannot read another's rows even if the software asked it to. Backups are encrypted before they leave the server, and restoring one is rehearsed rather than assumed.
Cookies
Only the ones the site cannot work without: one that keeps you signed in, and one that remembers the language you chose. No advertising cookies, no tracking pixels, and no consent banner, because there is nothing here to consent to.
Children
An account here is for adults. A child's care is booked and managed by a parent or guardian through the clinic, and the record belongs to the child. If you believe a child has made an account on their own, tell us and we will close it.
Asking us something
About your medical record, ask the clinic. Their number and address are on their page here. About your account, this site, or this notice, write to [email protected]. Tell us what you want rather than which right you are invoking; working out which one it is is our job.
The phone apps, and where you are
Tobb (for patients) and Tobb Clinic (for practice staff) hold the same information as this website, and every rule on this page applies to them. Location. The patient app asks for your position only when you tap: to find doctors near you, or to place a home visit. For a home visit, the address and the point you choose go to that clinic, so the doctor can find your door. Neither app reads your location in the background, ever. A doctor on the way. When a doctor taps "On my way" for a home visit, Tobb Clinic sends their position to that one patient, then again every few minutes while that visit is open on the doctor's screen, until they stop sharing or the visit ends. The patient sees it only while the visit is open, and never once it is six hours old. Notifications. If you allow them, the apps receive notifications through Google's and Apple's push services. A notification never says what an appointment is for. Camera and photos. Used only when you choose to upload a photo or a document. Maps are drawn by a free map service, which learns the area shown and not who is looking. Directions open in the maps app already on your phone.