Privacy & GDPR
Your medical record belongs to you
Built to Irish and EU GDPR standards, with encryption and audit logging on every clinical record.
Who we are
NOVAGP.IE is an Irish online general practice service and is the data controller for the personal and health data you provide through this platform. Queries: admin@novagp.ie.
What we collect
Identity and contact details, your past medical history, current medications and drug allergies, consultation notes and outcomes, prescriptions, certificates and referral letters, uploaded documents and images, and payment records held by our payment processor.
Why we hold it
To provide medical care, to keep the clinical record the law requires of a general practice, to process payments, and to meet our regulatory obligations. We do not sell your data, and your health data is never used for advertising.
How it is protected
Data is encrypted in transit (TLS 1.2+) and at rest on EU-hosted managed infrastructure, and files such as documents and data exports are held in private storage reachable only through short-lived signed links. Access is restricted by role — a GP sees only the patients assigned to them — and every access to a record is logged in an audit trail.
Where it lives
Your data is hosted within the European Union. Where a processor operates outside the EU, transfers are governed by Standard Contractual Clauses.
How long we keep it
Clinical records are retained in line with Irish medical record retention guidance. Payment records are retained as required by Revenue. Data no longer needed for either purpose is deleted.
Cookies, analytics and advertising
Strictly necessary cookies keep your session secure. Only if you accept them on our cookie banner do we also use Google Analytics (which pages are useful) and Google Ads measurement (which advert led to a booking or Smart Script request). Those tools receive the page, the type of service and its price — never your name, contact details, symptoms or any clinical information — and we do not use them for personalised advertising. Google acts as a recipient of that data; see business.safety.google/privacy. You can change or withdraw your choice at any time from “Cookie preferences” in the footer, and we ask again every 6 months.
Anonymous statistics
We count how often the Instagram, Facebook and TikTok links on this website are clicked, so we know which channels are worth our time. The count records only the platform, whether the link was in the footer or on the contact page, and the calendar day — no name, account, IP address, device, location, cookie or precise time, and nothing that could be linked back to you or to any clinical information. Because the counts are anonymous statistics rather than personal data, no cookie banner choice is needed, they are stored inside the EU on the same infrastructure as the rest of the site, they are visible only to our own staff, and they are deleted automatically after 13 months.
Your rights
You may request access to, correction of, or deletion of your data, object to processing, or ask for your record to be exported. Most of this is available directly from your patient portal; anything else, email admin@novagp.ie. Approved copies of your record are released as a secure link that expires after 14 days, after which the file is deleted from storage. Where you ask for erasure, we must keep the clinical record itself for the retention period Irish medical-record rules require, so we instead restrict its processing: your contact details are pseudonymised, your consents are withdrawn and portal access is closed. You may also complain to the Data Protection Commission (dataprotection.ie).