Privacy policy
What personal data we process, why, who receives it, how long we keep it and how you can exercise your rights under the GDPR.
Last updated: 24 October 2026
- Name
- Prague K. Onur Ozman
- info@doktorio.cz
- Website
- doktorio.cz
1. Who we are
Doktorio (doktorio.cz) is a directory of doctors, dentists, clinics and hospitals in Czechia, with patient reviews and online appointment requests. It is operated by Prague K. Onur Ozman, the controller of your personal data under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Czech Act No. 110/2019 Coll. on personal data processing.
For any question about your data, write to info@doktorio.cz.
2. Who this policy covers and our role
This policy applies to visitors of the site, patients who send appointment requests or write reviews, and people who manage a practice profile (owners, managers and assistants).
- We are the controller for the directory, user accounts, appointment requests while we forward them, reviews, messages to us, the newsletter and billing.
- The practice is the controller once it receives your appointment request, and for anything it records about you in its dashboard (for example patient notes, treatment history, files or emails it sends you). For this data we act only as the practice's processor and follow its instructions. Questions about it should go to the practice first; we will help where we can.
3. What data we process
| Category | Data | Where it comes from |
|---|---|---|
| Practice accounts | Name, email address, password (stored only in hashed form by our authentication provider), your role at the practice, and basic profile data from Google if you choose "Sign in with Google". | You |
| Claims and applications | Your role at the practice, contact details, the practice's address and specialty, and any documents you send to show that you represent the practice. | You |
| Practice profiles | Practice name, address, phone, email, website, opening hours, specialties, photos, videos, 360° tours, and the names and professional details of doctors. | The practice, or publicly available sources |
| Appointment requests | Your name, phone number, email address (optional), the practice, your preferred time or the slot you chose, and any note you add. | You |
| Reviews | The name you enter (or "Anonymous"), your rating, the review text and date. For a verified review, the link to your completed appointment request. | You |
| Messages to us | Name, email, phone, the practice concerned and your message (contact form, cancellation requests, applications for our services). | You |
| Newsletter | Email address and name — only if you tick the consent box. | You |
| Pro billing | Billing name and email, the practice, subscription status, Stripe customer and subscription IDs, and invoices. Card details go directly to Stripe and never reach us. | You and Stripe |
| Technical data | IP address, browser and device type, pages requested and error logs. Visit statistics are collected only with your consent (see the Cookie policy). | Your browser |
| Chat and AI assistant | The messages you type, only if you use the chat widget or an AI assistant offered on the site. | You |
4. Health-related information
An appointment request shows which practice you contacted, and a note may reveal something about your health. Health data is a special category of personal data under Art. 9 GDPR, so we keep this to a minimum:
- The form asks only for what the practice needs to contact you. Please do not include more health detail in the note than necessary — you can discuss it with the practice directly.
- If you choose to include health information, we process it only to pass your request to the practice you selected, based on your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.
- Appointment requests are visible only to the practice and to the people who run the service for technical support and abuse prevention. They are never published and never used for marketing.
5. Why we use your data and on what legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Running the public directory and practice profiles | Legitimate interest in giving patients information about healthcare providers (Art. 6(1)(f)); for practices with an account, the contract with them (Art. 6(1)(b)) |
| Practice accounts, the dashboard and Doktorio Pro | Contract (Art. 6(1)(b)) |
| Forwarding appointment requests, confirmations, reminders and the invitation to leave a verified review | Steps taken at your request (Art. 6(1)(b)); for health information in a note, explicit consent (Art. 9(2)(a)) |
| Publishing and moderating reviews | Legitimate interest in reliable, fair reviews for other patients (Art. 6(1)(f)) |
| Answering your messages and applications | Steps taken at your request (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
| Newsletter | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Payments, invoicing and accounting | Contract (Art. 6(1)(b)) and legal obligations under Czech accounting and tax law (Art. 6(1)(c)) |
| Security, spam and abuse prevention, error logs | Legitimate interest in a secure, working service (Art. 6(1)(f)) |
| Visit statistics | Your consent (Art. 6(1)(a)), given in the cookie banner |
| Establishing or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, you can object at any time (see section 10).
6. Doctors and practices listed without an account
Some profiles are created from publicly available information about healthcare providers (such as name, specialty, workplace and contact details) so that patients can find them. We do this on the basis of legitimate interest (Art. 6(1)(f)).
If you are listed, you can claim your profile to manage it, ask us to correct it, or object to the listing by writing to info@doktorio.cz.
7. Who receives your data
We do not sell personal data. We share it only with:
- The practice you contact — it receives your appointment request.
- The public — practice profiles and published reviews (with the name you chose) are visible to everyone.
- Service providers (processors) who help us run the site, listed below and bound by data processing terms.
- Authorities — only where the law requires it.
| Provider | What for | Location |
|---|---|---|
| Supabase | Database, file storage and sign-in | EU (Ireland) |
| Vercel Inc. | Hosting and server logs; visit statistics only with your consent | USA, global network |
| Resend | Sending emails (notifications, confirmations, reminders, newsletter) | USA |
| Stripe | Payments for Doktorio Pro | Ireland / USA |
| Monetra.cz | Issuing and emailing invoices for Doktorio Pro | Czech Republic |
| Sign-in with Google — only if you choose it | Ireland / USA | |
| Ozvelo (ozvelo.com) | Chat widget on the site — only if you use it | See ozvelo.com |
| Anthropic PBC | AI assistant — only if one is offered and you use it | USA |
| Cloudflare (cdnjs) | Delivering icon files; receives your IP address | Global network |
| Embedded content (e.g. YouTube, Vimeo, Instagram, Matterport) | Videos and 360° tours that a practice adds to its profile | Provider's own locations |
Fonts are served from our own domain, so no request is sent to Google Fonts. Links to Google Maps open on Google's own site.
8. Transfers outside the EU
Some providers above are based in, or may access data from, the USA. In those cases transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for more information about these safeguards.
9. How long we keep data
- Practice accounts: for as long as the account exists. When you ask us to close it, we delete or anonymise the data unless we must keep it by law.
- Practice profiles: for as long as the practice is listed.
- Appointment requests: for as long as the practice needs them to handle your appointment and keep its records. Practices can permanently delete a patient's records from their dashboard, and you can ask us or the practice to delete your request.
- Verified review links: expire 60 days after they are sent.
- Reviews: for as long as they are published, until you or we remove them.
- Messages and applications: for as long as needed to deal with them and any follow-up.
- Newsletter: until you withdraw your consent.
- Invoices and accounting records: for the periods required by Czech accounting and tax law (up to 10 years).
- Server logs: for the short periods set by our hosting provider.
10. Your rights
Under the GDPR you have the right to:
- Access — get a copy of the personal data we hold about you (Art. 15).
- Rectification — have inaccurate data corrected (Art. 16).
- Erasure — have your data deleted where there is no reason to keep it (Art. 17).
- Restriction — ask us to limit how we use your data (Art. 18).
- Portability — receive the data you gave us in a machine-readable format (Art. 20).
- Objection — object to processing based on legitimate interest (Art. 21).
- Withdraw consent — at any time, without affecting processing done before (Art. 7(3)).
To use any of these rights, email info@doktorio.cz. We will reply within one month, as the GDPR requires. We may ask you to confirm your identity first.
You also have the right to lodge a complaint with the Czech supervisory authority: Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz — or with the authority in the EU country where you live or work.
11. Security
All connections to the site use TLS encryption. Access to personal data is limited to the people and services that need it, practice dashboards are protected by sign-in and role-based access, and patient files that practices upload are kept in private storage.
12. Children
The site is not intended for children. A parent or legal guardian should send appointment requests on a child's behalf. If you believe a child has given us personal data, please let us know and we will delete it.
13. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
14. Changes to this policy
We may update this policy when our services or the law change. The "Last updated" date at the top of the page shows when it last changed.