Datenschutz / Privacy Policy

Effective date: 30 August 2026

Dr. Dost Health takes the confidentiality and security of personal information seriously. This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal information when you visit our website, communicate with us, use our services, make an appointment, use our AI-assisted features or interact with healthcare professionals or other services available through Dr. Dost Health.

1. Data Controller

For purposes of the EU General Data Protection Regulation (“GDPR”) and other applicable data-protection laws, the controller is:

Dr. Dost Mohammad – Dr. Dost Health
Landshut
Germany

Email: info@drdosthealth.com
Telephone: +49 00000000000

Data Protection Officer, if appointed:

[DPO NAME/CONTACT OR “Not legally required/applicable”]

2. Scope

This Privacy Policy applies to personal information processed through:

• drdosthealth.com;
• appointment and consultation services;
• patient and user accounts;
• contact forms;
• healthcare-provider and hospital discovery;
• online and, where relevant, in-person service coordination;
• our AI Health Assistant/chatbot;
• purchases and payment-related processes;
• newsletters and marketing communications;
• customer support; and
• other Dr. Dost Health digital services that link to this Policy.

3. Information We May Collect

Depending on how you use Dr. Dost Health, we may process:

Identification and contact information: name, email address, telephone number, postal address, date of birth and account information.

Appointment information: selected physician/provider, requested service, appointment date and time, booking status and relevant communications.

Health information: symptoms, health concerns, medical history, medications, allergies, treatment information, information submitted during consultations and other health-related information that you voluntarily provide or that is lawfully recorded as part of healthcare services.

AI Assistant information: questions, symptoms and other information submitted to the AI assistant, together with technical information necessary to provide and secure the service.

Transaction information: purchases, invoices, order information, payment status and related billing information. Payment-card information may be processed directly by an authorized payment service provider rather than stored by Dr. Dost Health.

Technical information: IP address, browser, operating system, device information, referring URL, timestamps, security logs and similar technical information.

Cookie and analytics information: subject to your choices and applicable consent requirements.

Communications: emails, contact requests, support conversations, feedback and other communications with us.

Health information is particularly sensitive and may constitute a special category of personal data under Article 9 GDPR. We therefore apply additional legal and technical safeguards where required.

4. Why We Process Your Information

We may process personal information to:

• operate and secure the website;
• create and administer accounts;
• arrange appointments and consultations;
• facilitate healthcare services;
• respond to enquiries;
• enable communication with healthcare professionals;
• provide requested AI-assisted functionality;
• suggest relevant services or providers;
• process purchases and payments;
• meet accounting, tax and regulatory obligations;
• prevent fraud, abuse and security incidents;
• improve our services where lawfully permitted;
• manage consent and privacy preferences; and
• send marketing communications where permitted.

5. Legal Bases under the GDPR

Where the GDPR applies, processing may be based on:

Article 6(1)(a) GDPR – Consent
For processing where we specifically request your consent.

Article 6(1)(b) GDPR – Contract
Where processing is necessary to provide a service you requested or to take steps before entering into a contract.

Article 6(1)(c) GDPR – Legal obligation
Where processing is required to comply with applicable legal obligations.

Article 6(1)(f) GDPR – Legitimate interests
Where processing is necessary for legitimate interests such as website security, fraud prevention, administration and appropriate service improvement, provided your rights and interests do not override those interests.

For special-category information, including health information, we rely on an appropriate Article 9 GDPR condition where required, including explicit consent where applicable and/or processing necessary for medical diagnosis, provision of health treatment or management of healthcare services by or under the responsibility of professionals subject to appropriate confidentiality obligations.

6. AI Health Assistant

Dr. Dost Health may provide an AI-powered health assistant.

When using it, you are interacting with an AI system, not directly with a physician unless the interface expressly states otherwise.

Information entered into the AI assistant may be processed to:

• respond to your questions;
• provide general health information;
• help identify potentially relevant healthcare categories;
• recommend relevant services, physicians or facilities available through the platform; and
• maintain safety, security and technical operation.

AI-generated responses may be inaccurate, incomplete or inappropriate for your individual medical circumstances.

Do not use the AI assistant for emergencies.

Where legally required, we will obtain appropriate consent before processing health information through AI functionality.

We also clearly identify AI interaction because EU AI Act transparency requirements for relevant AI interactions apply from 2 August 2026.

7. Automated Decision-Making

Unless expressly disclosed otherwise, Dr. Dost Health does not intend to make decisions producing legal or similarly significant effects concerning you solely through automated processing.

AI-generated health information should not independently determine medical treatment. Appropriate professional medical assessment should be obtained where required.

8. Healthcare Professionals

Healthcare professionals using or appearing on Dr. Dost Health may, depending on the service structure, process patient information either on behalf of Dr. Dost Health or as separate/independent data controllers.

Where a healthcare professional acts as an independent controller, their own professional and privacy obligations may apply in addition to this Policy.

9. Service Providers

We may use trusted service providers for functions such as:

• hosting and infrastructure;
• website operation;
• appointment management;
• email;
• security;
• payment processing;
• analytics;
• consent management;
• customer communication;
• video consultation;
• AI technology; and
• other technical services.

Such providers receive personal information only as appropriate for their role and are subject to contractual and legal safeguards where required.

Important: Before publication, this section should be updated to name important actual providers where legally required—for example your hosting provider, payment processor, analytics service, AI provider and video-consultation provider.

10. International Data Transfers

Because Dr. Dost Health may use international technology providers and serve users internationally, personal information may in certain circumstances be processed outside your country of residence.

Where GDPR-protected information is transferred outside the European Economic Area, we use an appropriate transfer mechanism where required, such as:

• an adequacy decision;
• EU Standard Contractual Clauses;
• another legally recognized transfer mechanism; and
• supplementary safeguards where appropriate.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and as required by applicable medical, professional, tax, accounting and other legal retention requirements.

Medical documentation may be subject to specific statutory/professional retention periods that differ from ordinary website information.

12. Security

We use appropriate technical and organizational measures intended to protect personal information against unauthorized access, alteration, disclosure, loss or destruction.

However, no internet-based service can guarantee absolute security.

13. Your Privacy Rights

Where the GDPR applies, you may have rights including:

• access to your personal data;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• objection to certain processing;
• withdrawal of consent at any time for future processing; and
• the right to lodge a complaint with a competent supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Other jurisdictions may provide additional privacy rights. Where applicable, we will process valid requests in accordance with the law governing your request.

Contact: info@drdosthealth.com

14. Children’s Privacy

Dr. Dost Health services intended for minors may require involvement or authorization of a parent or legal guardian depending on the child’s age, the service involved and applicable law.

The AI Health Assistant should not be used by children independently where parental/guardian authorization is legally required.

15. Changes

We may update this Privacy Policy to reflect legal, technological or operational changes. The current version will be published on this page together with its effective or last-updated date.