Privacy Policy

1. Introduction

Welcome to the Privacy Policy of Olive Health Ireland Ltd (“Company”, “Olive”, “we”, “us”, or “our”). We are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, and protect your personal data — including sensitive health data — when you use our website and mobile application (the “Platform”) to access online video consultations, home phlebotomy services, and related healthcare services in Ireland.

This Privacy Policy should be read together with our Terms & Conditions and our Cookie Policy.

1.1 Who We Are

• Data Controller (non-clinical data): Olive Health Ireland Ltd is the Data Controller for your account registration, billing, technical, and administrative data.
• Data Processor (clinical data): when we store your medical notes, prescriptions, consultation recordings, or laboratory results, we act as a Data Processor on behalf of the independent healthcare professional (the “Clinician”) who treats you. The Clinician is the Data Controller of your medical record and is responsible for its clinical content.

1.2 Contact Details

Data Protection Officer (DPO), Olive Health Ireland Ltd

Company Registration Number: 796058

47 The Green, Elsmore, Jigginstown, Naas, Co. Kildare, W91 X47D, Ireland

Email: dpo@olivesofthealth.com | Phone: +353 1 699 4590

2. Data We Collect

2.1 Standard Personal Data

• Identity Data: first name, last name, date of birth, gender
• Contact Data: email address, telephone number, postal address
• Financial Data: payment card details (processed by Bank of Ireland (BOI); we do not store full card numbers), billing address
• Technical Data: IP address, browser type and version, device and operating system information, time zone
• Usage Data: information about how you use our Platform, including pages viewed, features used, and appointment booking activity

2.2 Special Category Data (Health Data — GDPR Article 9)

Processed on behalf of your Clinician:

• Medical history: symptoms, diagnoses, prescriptions, allergies, and chronic conditions
• Consultation records: clinical notes from your appointments
• Audio/video data: recordings of teleconsultation sessions, made only with your separate, session-specific consent (see Section 4)
• Pathology data: blood test and other laboratory results, processed with our laboratory partner Eurofins
• Imaging data: radiology and diagnostic scan results, where a Clinician refers you for one, processed with our radiology partner Alliance Medical

2.3 Dependant Data

Where you register a dependant (for example, a child) on your account under Section 7, we also collect the dependant’s Identity, Contact (where applicable), and Special Category Data, provided and consented to by you as their parent or legal guardian.

3. How We Use Your Data and Our Legal Basis

We only use your personal data when the law allows us to. The table below sets out our main processing activities and the legal basis for each.

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects concerning you without human involvement. Any symptom-intake or triage questionnaires are used only to help your Clinician prepare for your consultation; they do not determine diagnosis or treatment automatically, and a qualified Clinician reviews your care in every case.

4. Consultation Recordings

4.1 Consent Is Separate and Session-Specific

Recording a consultation requires your explicit, informed consent given at the time of that specific appointment, through an in-app prompt immediately before the session begins. Your consent (or refusal) at registration, or for any past appointment, does not carry over to future appointments — you decide, session by session. Declining to be recorded will never affect your ability to receive care.

4.2 Retention of Recordings

Where a recording is made and the Clinician determines it forms part of your clinical record (for example, to support continuity of care), it is retained for the same period as your other medical records — ordinarily 8 years from the date of your last consultation for an adult patient, and until a dependant's 25th birthday (or 26th birthday, where their last record entry was made at age 17) — in line with Irish Medical Council and HSE clinical record retention guidance. Where the Clinician determines a recording is not clinically necessary to retain, it is permanently deleted within 30 days of the appointment. You may ask your Clinician, at any time, whether a specific recording has been retained and why.

Where a recording is retained, it is stored within our organisation's Google Workspace environment (Google Drive) rather than on our general AWS/GCP hosting infrastructure, and is subject to the same retention and deletion rules set out above, enforced through Workspace administrator controls.

4.3 Access to Recordings

Recordings are accessible only to you, the treating Clinician, and, where strictly necessary for technical support or safeguarding, authorised Olive personnel bound by confidentiality obligations.

5. Video Consultation Security

Our teleconsultation sessions are provided using Google Meet (via our organisation's Google Workspace account) and include:

• Encryption of video and audio in transit
• A unique, single-use secure link generated for each booked appointment, rather than a shared or recurring link
• Clinician approval required before any participant is admitted to the session from the virtual waiting room
• The ability for your Clinician to remove any unauthorised participant from a session

6. Joining a Consultation with a Companion

You may invite one additional person of your choosing (for example, a partner, parent, or carer) to join your consultation. By doing so, you confirm you are content for that person to see and hear the content of your appointment, including any health information discussed. Your Clinician may ask a companion to confirm their name and relationship to you before the session proceeds.

7. Registering and Booking for a Dependant (Minors)

7.1 Under Irish law and the GDPR, the age at which a person may independently consent to the processing of their personal data online is 16. A parent or legal guardian may create a linked dependant profile to book and manage consultations on behalf of a child under 16, and will exercise that child’s data protection rights (including access, correction, and erasure requests) on their behalf.

7.2 Where a Clinician judges that a patient between 16 and 18 has sufficient maturity and understanding to consent to their own treatment and to the related processing of their health data, the Clinician may proceed on that basis and will explain this to the accompanying parent or guardian where appropriate.

8. Disclosure of Your Personal Data

8.1 Healthcare Providers (Core Service)

• Independent Clinicians who treat you (they remain the Data Controller of your medical records)
• Eurofins — our laboratory partner, for analysis of blood and other pathology samples
• Alliance Medical — our radiology partner, for imaging and diagnostic scans, where a Clinician refers you for one

Eurofins and Alliance Medical are connected to the Platform through secure system-to-system integrations; ordering an investigation and receiving your result happens through those integrations rather than through any page or feature that sets a cookie on your device.

8.2 Third-Party Service Providers

• Bank of Ireland (BOI) — payment processing
• Google Meet (Google Workspace) — teleconsultation
• Google Workspace (Google Drive) — storage of consultation recordings, where a recording is retained
• Sinch — SMS appointment reminders
• Amazon Web Services (AWS) / Google Cloud Platform (GCP) — data hosting and storage
• SendGrid / Mailgun — transactional emails

All third-party processors are bound by Data Processing Agreements compliant with GDPR Article 28. A current register of our sub-processors is maintained by our DPO and is reviewed at least every 6 months. Where we appoint a new sub-processor that will process your health data, we will update this Privacy Policy and, where the change is material, notify you by email in advance.

Sub-processor register last reviewed: 2 August 2026

8.3 Legal Requirements

We may disclose personal data where required by Irish law, or in response to a valid request from a public authority (for example, a court order, the Health Service Executive, or An Garda Síochána).

9. International Transfers

We primarily store your data within the European Economic Area (EEA), with servers located in Ireland. Where data is transferred outside the EEA (for example, to certain cloud provider regions), we ensure this only occurs where:

• the recipient country has been deemed by the EU Commission to provide an adequate level of data protection; or
• we rely on Standard Contractual Clauses approved by the EU Commission; or
• the recipient is certified under an approved transfer framework (e.g., the EU-U.S. Data Privacy Framework).

10. Data Security

• Encryption: data encrypted in transit (TLS/SSL) and at rest (AES-256)
• Access control: strict role-based access, on a need-to-know basis
• Breach procedures: we have procedures to detect, investigate, and respond to any suspected data security breach, and will notify affected patients and the Irish Data Protection Commission where legally required

11. Data Retention

• Medical records (including retained consultation recordings): ordinarily 8 years from the date of your last consultation for an adult patient, and until a dependant's 25th birthday (or 26th birthday, where their last record entry was made at age 17)
• Non-clinical account data: up to 6 years after account closure, for tax and financial record-keeping
• You may request deletion of your account by contacting dpo@olivesofthealth.com. Medical records will nonetheless be retained for the periods above where required by law or our professional obligations.

12. Your Rights

Under the GDPR and the Irish Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure of your data, subject to our legal obligation to retain medical records for the periods set out in Section 11
• Restrict processing of your data in certain circumstances
• Object to processing based on our legitimate interests
• Data portability, to receive your data in a structured, commonly used, machine-readable format
• Withdraw consent at any time — for example, for a specific consultation recording, or for marketing communications — without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, contact dpo@olivesofthealth.com. We will respond within one month, as required by the GDPR.

You also have the right to lodge a complaint with the Data Protection Commission:

• Address: 6 Pembroke Row, Dublin 2, D02 X963, Ireland
• Website: www.dataprotection.ie
• Email: info@dataprotection.ie
• Phone: +353 57 868 4800

13. Cookies

Our use of cookies is described in our separate Cookie Policy. We do not use Performance, Functionality, or Marketing cookies on any page or screen that could reveal a health context — including booking, symptom, consultation, radiology or laboratory ordering, or results screens. You can manage your cookie preferences at any time via the cookie settings control on our website.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes affecting how we handle your health data will be notified to you by email or an in-app notice before they take effect.

15. Contact Us

Olive Health Ireland Ltd

Company Registration Number: 796058

47 The Green, Elsmore, Jigginstown, Naas, Co. Kildare, W91 X47D

Email: info@olivesofthealth.com | Phone: +353 1 699 4590