Privacy Policy

Western Rheumatology

Introduction

At Western Rheumatology, we are committed to protecting the privacy and personal data of our patients. This Privacy Policy outlines how we collect, use, and share information in compliance with the General Data Protection Regulation (GDPR) and other relevant data protection laws. This Privacy Policy explains how we collect and use personal data.

Data We Collect

We collect and process personal data necessary for providing high-quality healthcare services. This may include:

  • Personal Identification Information: Name, address, date of birth, contact details, and PPS number (where required).
  • Medical Information: Health history, treatment plans, laboratory results, and imaging data.

Payment and Insurance Information: Billing details, payment history, and health insurance information.

How We Use Your Data

Your personal data is used to provide and manage your healthcare services effectively, including:

  • Diagnosing and treating rheumatologic conditions.
  • Managing appointments, treatment schedules, and follow-ups.
  • Communicating with you regarding your care.
  • Processing payments and handling insurance claims.
  • Receiving and processing repeat prescription requests submitted through our website chat.

Data Sharing

To provide efficient and secure healthcare services, we share necessary data with trusted third parties. These include:

  • iMedDoc (Clanwilliam Health): For secure electronic medical record (EMR) management.
  • Billink (billinkpayments.com): For processing payments and managing billing services.
  • HSE PCRS High Tech Hub: For prescription approvals and reimbursement of high-tech medications.
  • Relevant Health Insurers: To process claims and ensure coverage of your treatments.
  • Private Hospitals: Such as Blackrock Health Galway Clinic and Bon Secours Hospital Galway, to facilitate treatment and continuity of care.
  • Heidi AI: For AI-assisted healthcare management and operational efficiency.
  • Mistral AI: An EU-based AI provider used to power our website chat assistant. Message content is processed within the European Union to generate replies.
  • Mailgun: Used to deliver transactional emails, such as repeat prescription requests, to our reception team. Configured to process data within the EU region.
  • Microdoc: an AI tool that we use to help us improve the efficiency of our practice. It is configured to process information within the EU.
  • Whatsapp: we use Whatsapp as an alternative to SMS messaging for appointment reminders and confirmation.

Additionally, when communicating with other healthcare professionals, we use the HSE-run Healthmail Net, which ensures secure, encrypted communication to protect your data.

We ensure that all data shared with these third parties is done so securely and strictly for the purposes outlined.

Website Chat and Repeat Prescription Requests

Our website includes a chat assistant that can answer general questions about the clinic and allows you to submit a repeat prescription request. This section explains how that feature handles your data.

What the chat collects

When you use the chat to ask a general question, your typed messages are processed to generate a reply. The assistant is not able to give medical advice and is intended only for general clinic information.

The chat assistant does not make clinical decisions, diagnose, triage, or access medical records.

If you choose to request a repeat prescription, you will be asked to complete a short form providing: your name, date of birth, phone number, email address, your treating consultant, the medication(s) you are requesting, and your pharmacy details. You must give explicit consent before the request is submitted. Please only provide the information requested in the form, and avoid typing sensitive personal or medical details into the general chat.

How chat data is used and shared

General chat messages are sent to Mistral AI, an EU-based artificial intelligence provider, solely to generate replies. Mistral processes this data within the European Union.

Repeat prescription requests are stored securely in our website database and sent by email to our reception team so they can be actioned. Outbound email is delivered through Mailgun (configured in the EU region). We may generate internal, aggregated reports on chat usage to improve the service. Where these reports use AI assistance, message content may be processed by Mistral AI for that purpose.

Service provider

Our website and chat assistant are operated and maintained on our behalf by Doghouse Media (doghousemedia.ie), who act as our data processor. Mistral AI and Mailgun act as sub-processors. All processing is governed by data processing agreements and carried out within the European Union.

Retention

General chat conversation logs are retained for up to 60 days, after which they are automatically and permanently deleted.

Repeat prescription requests submitted through the chat are retained for up to 60 days, after which they are automatically and permanently deleted from the website system. Where your request results in a prescription being issued, the relevant clinical record is held separately in our medical records system in line with the retention periods described elsewhere in this policy.

Privacy

We do not store your IP address with chat or prescription data. Visitor and conversation identifiers used for rate limiting and reporting are stored only in an irreversible, hashed form. The chat assistant cannot access your medical records.

Your choice

Use of the chat assistant is optional. You can contact the clinic directly by phone or email (details below) instead of using the chat at any time.

Legal Basis for Data Processing

We process your personal data based on the following legal grounds:

  • Consent: You have provided explicit consent for the processing of your data.
  • Contractual Necessity: Data processing is necessary for the delivery of healthcare services.
  • Legal Obligations: To comply with regulatory requirements, including those of the HSE and relevant health insurers.

Some information submitted through the repeat prescription form, and any health details you choose to include in chat messages, may be health data under GDPR. Health data is treated as special category data. Western Rheumatology processes this information only where necessary for healthcare administration, repeat prescription handling, and patient care. We process health data where permitted under GDPR Article 9, including where you have given explicit consent and where processing is necessary for healthcare-related purposes by or under the responsibility of healthcare professionals.
<

Purposes of Processing and Disclosure

Where we rely on legitimate interests, we do so to improve our services, maintain website functionality, support service administration, and ensure operational efficiency.

We process personal data for the following purposes:

  • Providing healthcare services and patient administration
  • Processing repeat prescription requests
  • Communicating with patients about appointments, care, and administrative matters
  • Conducting statistical analysis and service reporting
  • Improving website functionality and user experience
  • Meeting legal, regulatory, insurance, and professional obligations

We may disclose personal data to recipients where necessary for the purposes listed above, including:

  • Healthcare professionals and clinical service providers involved in your care
  • IT, website, email, hosting, and administrative service providers
  • Professional advisers, auditors, insurers, and regulatory bodies
  • Third parties where disclosure is required by law or necessary to protect patient safety or legal rights

Cookies

This website uses cookies to distinguish you from other users of our website. This helps us to provide you with a positive and relevant experience when you browse our website and also allows us to improve our site and its functionality.

Web browser place cookies on user's hard drive for record-keeping purposes and sometimes to track information about them. A user may choose to set their web browser to refuse cookies. If they do so, note that some parts of the website may not function as intended.

For detailed information on the cookies we use and the purposes for which we use them please see our Cookie Policy.

Your Rights

Under GDPR, you have the following rights regarding your personal data:

  • Access: Request access to the personal data we hold about you.
  • Rectification: Request corrections to inaccurate or incomplete data.
  • Erasure: Request the deletion of your personal data, subject to legal and regulatory obligations.
  • Restriction: Request the limitation of data processing under certain conditions.
  • Data Portability: Request your data in a structured, machine-readable format.
  • Objection: Object to the processing of your data under specific circumstances.

To exercise these rights, please contact us using the details provided below.

Data Security

We retain personal data only as long as necessary to provide our services and comply with legal obligations. When data is no longer required, it is securely deleted or anonymized. Personal data submitted through our website chat is retained only for the limited periods set out above and is then automatically deleted.

Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. The latest version will always be available on our website.

Last updated August 7th, 2026

Contact Us

If you have any questions or concerns about this Privacy Policy or how your personal data is handled, please contact us at:

Western Rheumatology
Suite 19, Blackrock Health Galway Clinic
 Phone: +353 (91) 342508
 Email: reception@wrh.ie