Privacy Policy

DundalkGP

Version 1.0 · Last updated 23 October 2026

The key points in plain English

We collect personal and medical information so we can care for you safely, run the practice and manage memberships.
Your medical information is confidential. It is shared only with people involved in your care, where the law requires it, or with your consent.
We never see or store your full card details. Card payments are handled by Stripe, a regulated payment provider.
For members, we look at how often appointments are used so we can apply our fair use policy. A person always makes any decision, never a computer.
We don’t sell your information, and we don’t use it for advertising.
You have rights over your information, including the right to see a copy of your records. You can complain to the Data Protection Commission.

1. Who we are
2. Information we collect
3. Why we use it and our legal basis
4. Medical information and confidentiality
5. Card and payment details
6. Membership and fair use
7. Who we share information with
8. Transfers outside the EEA
9. How long we keep information
10. How we keep information safe
11. Children and family memberships
12. Your rights
13. Our website, emails and texts
14. Complaints and contact

1. Who we are

DundalkGP provides general practice services on behalf of Basgaith Limited, a company registered in Ireland (CRO number 790680), registered office Co. Louth, A91 NN29. Basgaith Limited is the data controller for the personal information described in this policy (“we”, “us”, “the practice”).
Practice address: Floor 2, Church Street Medical Centre, Church Street, Dundalk, Co. Louth. Phone (042) 933 4205.
For any question about your personal information, contact our data protection lead, the Practice Manager, at mail@dundalkgp.com or on (042) 933 4205.
This policy applies to patients (including private, GMS and DVC patients), members of the DundalkGP Membership Scheme, and visitors to our website. We follow the General Data Protection Regulation (GDPR), the Data Protection Act 2018, the ePrivacy Regulations 2011 and the Medical Council’s Guide to Professional Conduct and Ethics.

2. Information we collect

Identity and contact details: name, date of birth, gender, address, Eircode, phone numbers, email address, PPS number where needed for State schemes, and next of kin or emergency contact.
Medical information: your medical history, consultation notes, diagnoses, medications and prescriptions, allergies, test results, scans, immunisations, referral letters, hospital correspondence, and health MoT results. This is “special category” data under GDPR and receives extra protection.
Scheme and entitlement details: whether you hold a medical card or GP visit card and which practice it’s registered with, private health insurance details where relevant, and (for members aged 18 to 22) confirmation of full-time education.
Membership details: your plan, the members on it, the account lead (the person paying), relationships between members, start and renewal dates, declarations made when joining, and membership status.
Payment details: payment amounts and dates, payment status, a Stripe customer reference, and limited card information returned by Stripe (card type, last four digits and expiry date). See section 5.
Appointment and usage records: appointments booked, attended, cancelled or missed, and the type of service used. See section 6.
Communications: emails, messages, letters and notes of phone calls with us.
Website information: information you enter into our forms, and limited technical data such as cookies (see section 13).
Most information comes directly from you. We also receive it from other healthcare providers (such as hospitals, consultants, laboratories, out-of-hours services and your previous GP), the HSE, and Stripe.

3. Why we use it and our legal basis

GDPR requires us to have a legal basis for each use of your information. For medical information, we also need an additional condition under Article 9.

What we use it for	Legal basis
Providing your medical care, including diagnosis, treatment, prescriptions, referrals, screening and health MoTs	Art. 6(1)(b) contract (private patients and members) or Art. 6(1)(c) legal obligation / 6(1)(e) public task (State schemes); and Art. 9(2)(h) health care, with section 52 of the Data Protection Act 2018. Information is handled by health professionals bound by confidentiality.
Protecting your life in an emergency	Art. 6(1)(d) and Art. 9(2)(c) vital interests
Reporting required by law, e.g. notifiable diseases, national screening programmes, GMS and DVC claims	Art. 6(1)(c) legal obligation; Art. 9(2)(h) and 9(2)(i) public health
Setting up and running your membership, including eligibility checks, plan changes and renewal reminders	Art. 6(1)(b) contract; Art. 9(2)(h) where health information is involved (e.g. chronic disease status for MoT frequency)
Taking membership payments, chasing failed payments and keeping financial records	Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (tax and accounting records)
Applying our fair use policy and managing missed appointments	Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interests (fair access to appointments for all patients); Art. 9(2)(h) management of health services
Running the practice safely: audit, clinical governance, training, complaints, and legal claims	Art. 6(1)(c) and 6(1)(f); Art. 9(2)(h) and 9(2)(f) legal claims
Appointment reminders and practice updates by text or email	Art. 6(1)(b) or 6(1)(f) for service messages; consent or the “soft opt-in” for news about our services (you can opt out at any time)
Reports for insurers, employers or solicitors	Only with your explicit written consent (Art. 9(2)(a))

When you join the Membership Scheme, we ask you to confirm you understand how we’ll use your details. We don’t rely on consent as the legal basis for your medical care, because care must continue even if consent to something else is withdrawn.
We don’t use your information for advertising, we don’t sell it, and we don’t make decisions about you using only automated processing or profiling.

4. Medical information and confidentiality

Your medical record is kept in our secure practice management system. Only practice staff who need it for their role can access it, and every member of staff is bound by a duty of confidentiality.
We share medical information only:
- with people directly involved in your care (see section 7);
- where the law requires it; or
- with your consent, for example a report for an insurer.
In rare cases, we may share information without consent where there is a serious risk of harm to you or others, in line with Medical Council guidance.
Membership does not change who can see your medical information. The account lead on a Membership for 2 or Family plan does not get access to other adult members’ medical information because they pay for the membership.
If you’re new to the practice, we’ll ask your previous GP to transfer your records to us once you’ve registered.

5. Card and payment details

Membership payments are processed by Stripe. For customers in Ireland, this is Stripe Payments Europe, Limited, which is regulated by the Central Bank of Ireland. Stripe is certified to PCI DSS Level 1, the highest security standard in the card payments industry.
You enter your card details directly on Stripe’s secure payment page. Your full card number and security code (CVC) are never seen by, sent to or stored by DundalkGP.
We receive from Stripe only what we need to manage your membership: your name and email, the plan, payment amounts, dates and status, a customer reference, and the card type, last four digits and expiry date (so we can tell you if a card needs updating).
Stripe never receives your medical information. We share with Stripe only your name, email address and a membership reference.
Stripe also uses payment information for its own purposes, such as fraud prevention and meeting its legal obligations as a regulated financial institution. For that use, Stripe is a separate data controller. See Stripe’s privacy policy at stripe.com/ie/privacy.
Card payments made in person at the practice are processed by our card terminal provider. We don’t keep any record of the card number.

6. Membership and fair use

To apply our Membership fair use policy, practice staff may review a member’s appointment history, including:
- how often appointments are booked;
- missed or late appointments;
- repeated or duplicate requests; and
- use of urgent appointments.
This review is carried out by people, not automated systems. A clinician is always involved in any judgement about whether use is clinically appropriate. Before we take any action, we’ll contact you in writing and give you the chance to respond, as described in our Membership Terms.
We record missed appointments, and charges for them, against the member’s account. We also keep a record of any fair use correspondence.
To check eligibility, we may check whether a member holds a medical card or GP visit card registered with DundalkGP, and ask members aged 18 to 22 to show educational ID. We note that the ID was seen, but we don’t keep a copy unless you ask us to.
When you sign up online, your details are first saved securely on our website, then emailed to our membership team at membership@dundalkgp.com once payment is confirmed. Website copies are deleted after 90 days, once the details have been added to your patient record.

7. Who we share information with

We share only what is necessary for the purpose. Depending on your care, recipients may include:

Other healthcare providers: hospitals, consultants, out-of-hours GP services (the weekday rota and Delgean Doc at weekends), community and allied health services, laboratories, radiology services, and pharmacies (for prescriptions). These are often reached through secure systems such as Healthlink and Healthmail.
The HSE and State bodies: for GMS and DVC schemes (through PCRS), national screening programmes such as CervicalCheck and BreastCheck, immunisation programmes, and notification of infectious diseases as required by law.
Service providers acting on our behalf: our practice management software supplier; Pippo (online booking and repeat prescriptions); Stripe (payments); our email and IT support providers; and our website host (WordPress.com). They process information only on our instructions, under written data processing agreements.
Professional and regulatory bodies: our indemnity provider and legal advisers (for claims and complaints), the Medical Council, and auditors.
Others, with your consent: insurers, employers or solicitors, if you ask us to send a report.
Where required by law: for example, a court order, or a lawful request from An Garda Síochána.

8. Transfers outside the EEA

We aim to keep your information within the European Economic Area. Some service providers, such as Stripe or email providers, may transfer limited data (not your medical record) outside the EEA, for example to the United States.
Where this happens, the transfer is protected by an approved safeguard, such as the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

9. How long we keep information

Information	How long
Adult medical records	At least 8 years after your last contact with the practice, or 8 years after death
Children’s medical records	Until the patient’s 25th birthday (26th if they were 17 when treatment ended), or 8 years after death, whichever is longer
Membership records (plan, members, declarations, fair use correspondence)	For the length of the membership, then 6 years
Payment and financial records	6 years from the end of the financial year they relate to, as required by Revenue
Online sign-up form copies on our website	90 days
General emails and enquiries	Up to 2 years, unless added to your medical record

Some records may be kept longer where needed for a legal claim or required by law. When information is no longer needed, it is securely deleted or destroyed.

10. How we keep information safe

Access to records is limited by role and password-protected, and access is logged.
Information is encrypted when sent online. We use secure health systems such as Healthmail for clinical communication.
Our membership forms and payment pages use secure (HTTPS) connections.
Staff are trained in data protection and confidentiality.
Paper records are stored securely and destroyed confidentially.
If a data breach is likely to put your rights at risk, we’ll report it to the Data Protection Commission within 72 hours. If the risk to you is high, we’ll tell you directly.

11. Children and family memberships

For children under 16, we usually deal with a parent or legal guardian, who can generally access their child’s records where that is in the child’s best interests.
Young people aged 16 and over can consent to their own medical treatment under Irish law. We respect their confidentiality in line with Medical Council guidance, including from their parents. This applies even when a parent is the account lead.
A member aged 18 or over has the same confidentiality as any adult patient. Their medical information isn’t shared with the account lead or other family members without their agreement.

12. Your rights

Under GDPR, you have the right to:

Access: get a copy of the information we hold about you, including your medical records. This is free of charge, and we’ll respond within one month. Occasionally, information may be withheld where releasing it would cause serious harm to your health, in line with the law.
Rectification: ask us to correct inaccurate information. Clinical opinions can’t be deleted, but we can add your comments to the record.
Erasure: ask us to delete information. We can’t delete medical records we’re required to keep, but we will delete other information where we no longer need it.
Restriction or objection: ask us to limit or stop certain uses, including any use based on legitimate interests and all direct marketing.
Portability: get information you provided to us in a commonly used electronic format, where processing is based on contract or consent.
Withdraw consent at any time, where we rely on it. This doesn’t affect anything done before.

To use any of these rights, contact our data protection lead (section 1.3). We may ask for proof of identity. To transfer your records to another GP, please ask your new practice to request them from us.

13. Our website, emails and texts

Our website uses essential cookies so the site, member pages and sign-up forms work. We use analytics or other non-essential cookies only with your consent.
The member area of our website is password protected. Please don’t share the password outside your household.
If you contact us by ordinary email, please be aware that it isn’t fully secure. Please don’t send detailed medical information by email unless we ask you to.
We send appointment reminders and membership notices (such as renewal reminders and payment issues) by text or email. We send practice news only if you haven’t opted out, and every message tells you how to opt out.
Our online booking and prescription services are provided by Pippo, which has its own privacy policy.

14. Complaints and contact

If you have a concern about how we handle your information, please contact our data protection lead first (section 1.3). We’ll deal with it under our complaints policy.
You also have the right to complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, or online at www.dataprotection.ie.
We may update this policy from time to time. The current version is always on our website, and we’ll tell members about any significant changes.