1. Why this assessment is needed

Consult Your Doctor processes health data on a large scale, uses artificial intelligence to check prescriptions and follow up patients, and moves data between Germany and India. This type of processing is likely to involve a high risk to the rights of individuals, so the General Data Protection Regulation requires an assessment before it begins, and the company applies the same standard to its work in India.

2. Description of the processing

Patients give their details and symptoms to a licensed doctor through the platform. The doctor records a consultation and issues a prescription, which is checked by automated tools, and the patient may be referred to a diagnostic centre. After the consultation Zebrold AI contacts the patient for twelve days. Records are stored securely and may be accessed by the treating doctor, the diagnostic centre, authorised staff and processors, from Germany and from India. The data processing record (CYD-DP-01) lists the detail.

3. Necessity and proportionality

• Only data needed for care and follow-up is collected; optional data is marked as optional.
• The legal basis for each activity is recorded in CYD-DP-01, and explicit consent is obtained for health data and for AI-assisted checking and follow-up.
• Access is limited by role (CYD-SEC-01) and every access to a record is logged.
• Patients are informed through the privacy notice and can exercise their rights through the grievance officer (CYD-DP-03).
• Processors are bound by written agreements, and transfers between the EU and India use the safeguards in CYD-DP-06.

4. Risk assessment

5. Consultation

The company consults its data protection lead, its medical lead, its security lead, and where appropriate patients or patient representatives. Where residual risk remains high after measures are applied, the competent supervisory authority is consulted before processing starts.

6. Conclusion and sign-off

7. Data flows

Data moves through the platform in five stages: (1) the patient's account and identity data is created in the app and stored in the platform database; (2) during a consultation the doctor sees the record and adds notes and the prescription; (3) the prescription is sent to the automated checking service and returned to the doctor; (4) test referrals and results move between the platform and the diagnostic centre; (5) after the consultation Zebrold AI sends follow-up messages through the messaging provider and the replies return to the record. At each stage data is encrypted in transit. Staff and doctors in Germany and in India may access records according to their role.

8. Lawful basis

The data protection lead and counsel confirm the bases for each country before launch.

9. Measures that show compliance

• The record of processing (CYD-DP-01), the privacy notice and consent forms (CYD-DP-03), the retention policy (CYD-DP-04), the breach plan (CYD-DP-05) and the transfer policy (CYD-DP-06).
• Role-based access, encryption and logging under CYD-SEC-01.
• Training of all staff and doctors on data protection.
• Agreements with every processor, and regular reviews of vendors.
• A named data protection lead and, if required, a data protection officer.

10. Monitoring and review

The data protection lead reviews this assessment every year, and whenever the purpose, the technology, the places where the data is handled or the vendors change. Incidents and complaints are also used to test whether the assessment was right. If the review finds that a risk has grown, the directors decide on further measures before processing continues.

11. Views of those affected

The company seeks the views of patients and doctors on the design of the consent screens, the follow-up messages and the privacy notice, through short surveys and interviews with a sample of users, and records the results. Concerns about the use of AI, about messages being seen by others and about the sharing of results are considered in the design.

12. Residual risk and decision

After the measures in this assessment are in place, the main remaining risk is the possibility that an AI flag is wrong or missing. This risk is accepted because a doctor reviews every prescription, because the protocol sends red flags to a human at once and because performance is monitored every month. If monitoring shows a rise in errors, the directors will pause the function and review the assessment.

13. Action plan

14. Conclusion

With the measures described, the company concludes that the processing is necessary and proportionate for the purpose of delivering and following up health care, and that the remaining risks are acceptable and are controlled. The conclusion is subject to the completion of the actions in the action plan.

1. Why this assessment is needed

Consult Your Doctor processes health data on a large scale, uses artificial intelligence to check prescriptions and follow up patients, and moves data between Germany and India. This type of processing is likely to involve a high risk to the rights of individuals, so the General Data Protection Regulation requires an assessment before it begins, and the company applies the same standard to its work in India.

2. Description of the processing

Patients give their details and symptoms to a licensed doctor through the platform. The doctor records a consultation and issues a prescription, which is checked by automated tools, and the patient may be referred to a diagnostic centre. After the consultation Zebrold AI contacts the patient for twelve days. Records are stored securely and may be accessed by the treating doctor, the diagnostic centre, authorised staff and processors, from Germany and from India. The data processing record (CYD-DP-01) lists the detail.

3. Necessity and proportionality

• Only data needed for care and follow-up is collected; optional data is marked as optional.
• The legal basis for each activity is recorded in CYD-DP-01, and explicit consent is obtained for health data and for AI-assisted checking and follow-up.
• Access is limited by role (CYD-SEC-01) and every access to a record is logged.
• Patients are informed through the privacy notice and can exercise their rights through the grievance officer (CYD-DP-03).
• Processors are bound by written agreements, and transfers between the EU and India use the safeguards in CYD-DP-06.

4. Risk assessment

5. Consultation

The company consults its data protection lead, its medical lead, its security lead, and where appropriate patients or patient representatives. Where residual risk remains high after measures are applied, the competent supervisory authority is consulted before processing starts.

6. Conclusion and sign-off

7. Data flows

Data moves through the platform in five stages: (1) the patient's account and identity data is created in the app and stored in the platform database; (2) during a consultation the doctor sees the record and adds notes and the prescription; (3) the prescription is sent to the automated checking service and returned to the doctor; (4) test referrals and results move between the platform and the diagnostic centre; (5) after the consultation Zebrold AI sends follow-up messages through the messaging provider and the replies return to the record. At each stage data is encrypted in transit. Staff and doctors in Germany and in India may access records according to their role.

8. Lawful basis

The data protection lead and counsel confirm the bases for each country before launch.

9. Measures that show compliance

• The record of processing (CYD-DP-01), the privacy notice and consent forms (CYD-DP-03), the retention policy (CYD-DP-04), the breach plan (CYD-DP-05) and the transfer policy (CYD-DP-06).
• Role-based access, encryption and logging under CYD-SEC-01.
• Training of all staff and doctors on data protection.
• Agreements with every processor, and regular reviews of vendors.
• A named data protection lead and, if required, a data protection officer.

10. Monitoring and review

The data protection lead reviews this assessment every year, and whenever the purpose, the technology, the places where the data is handled or the vendors change. Incidents and complaints are also used to test whether the assessment was right. If the review finds that a risk has grown, the directors decide on further measures before processing continues.

11. Views of those affected

The company seeks the views of patients and doctors on the design of the consent screens, the follow-up messages and the privacy notice, through short surveys and interviews with a sample of users, and records the results. Concerns about the use of AI, about messages being seen by others and about the sharing of results are considered in the design.

12. Residual risk and decision

After the measures in this assessment are in place, the main remaining risk is the possibility that an AI flag is wrong or missing. This risk is accepted because a doctor reviews every prescription, because the protocol sends red flags to a human at once and because performance is monitored every month. If monitoring shows a rise in errors, the directors will pause the function and review the assessment.

13. Action plan

14. Conclusion

With the measures described, the company concludes that the processing is necessary and proportionate for the purpose of delivering and following up health care, and that the remaining risks are acceptable and are controlled. The conclusion is subject to the completion of the actions in the action plan.