Who is responsible for your information
Two parties handle your information, for different things.
- Dr Navindi Fernandopulle, registered medical practitioner, SLMC Reg. No. [SLMC No.], Colombo, is responsible for your health information: the form you fill in, the results you upload, the notes of your consultation and your written summary. She is the "controller" of that information under Sri Lankan law.
- [Company name] Ltd, company no. [Company number], [Registered office address], United Kingdom, is responsible for your booking and payment information: your name, mobile number, email, the type of consultation, the time, and the payment record. It is the controller of that information under Sri Lankan law and under UK data protection law.
What we collect and why
- Information
- Name, mobile, email
- Collected by
- Booking tool, at booking
- Used for
- Confirmation, reminders, video link, summary
- Legal basis
- Needed to carry out your booking (contract)
- Information
- Consultation type, time, amount, payment record
- Collected by
- Booking tool and Stripe
- Used for
- Taking payment, refunds, accounts
- Legal basis
- Needed to carry out your booking; legal duty to keep accounts
- Information
- Language preference and the one-line note you add when booking
- Collected by
- Booking tool
- Used for
- Preparing for the call
- Legal basis
- Your consent, given when you book
- Information
- Your health form, uploaded results, consultation notes, written summary
- Collected by
- Dr Navindi Fernandopulle's secure form and records
- Used for
- The consultation itself
- Legal basis
- Provision of care by a licensed health professional (PDPA Schedule II(g)); your explicit consent
| Information | Collected by | Used for | Legal basis |
|---|---|---|---|
| Name, mobile, email | Booking tool, at booking | Confirmation, reminders, video link, summary | Needed to carry out your booking (contract) |
| Consultation type, time, amount, payment record | Booking tool and Stripe | Taking payment, refunds, accounts | Needed to carry out your booking; legal duty to keep accounts |
| Language preference and the one-line note you add when booking | Booking tool | Preparing for the call | Your consent, given when you book |
| Your health form, uploaded results, consultation notes, written summary | Dr Navindi Fernandopulle's secure form and records | The consultation itself | Provision of care by a licensed health professional (PDPA Schedule II(g)); your explicit consent |
We do not use your information for marketing. We do not sell it. There is no advertising on this site.
Who else sees it
- Stripe (Stripe Payments Europe Ltd and Stripe, LLC, United States) processes your card, Apple Pay or Google Pay payment. Stripe never passes your full card details to us. Stripe's own notice is at stripe.com/privacy.
- [Booking tool] holds your booking details and sends your emails and SMS.
- [Video platform] carries the video call. The call is not recorded.
- [Secure form] holds your health form and uploads.
- No one else, unless the law requires it or you ask us to send something to another doctor.
Where it is kept
Your booking and payment records are processed in the United Kingdom and the United States (Stripe). Your health information is kept by Dr Navindi Fernandopulle in [Secure form]. Some of this is a transfer outside Sri Lanka. By booking you agree to that transfer, having read this notice.
How long
Consultation records: [n] years. Booking and payment records: [n] years for accounts.
Your rights
You can ask to see the information we hold about you, ask us to correct it, withdraw your consent, or ask us to delete it where the law allows. Email [email]. We will reply within one month. If you are not satisfied you may complain to the Data Protection Authority of Sri Lanka (dpa.gov.lk). For the UK company's processing you may also contact the Information Commissioner's Office (ico.org.uk).
Security
The site itself stores no health information. Card details go directly to Stripe. Access to your health form is limited to Dr Navindi Fernandopulle. If there is ever a breach that puts you at risk, we will tell you and the authority.
Cookies and analytics
This site sets no advertising cookies. Analytics are switched off. If they are switched on in future, this notice will say so and the tool will be one that does not identify you.
Children
Consultations are for adults. A parent may book for a child aged [n] and over, and must join the call.
Changes
Last updated [launch date]. Changes will be shown here.