WupDoc Logo

Privacy Policy

Last Updated:

August 23,2026

WUPDOC PRIVACY POLICY

1. INTRODUCTION & DATA CONTROLLER We, as Wupdoc B.V. ("Wupdoc", "Us", "We"), deeply value your privacy and commit to protecting the personal data we collect when you use our website at https://www.wupdoc.com and associated mobile applications (collectively, the "Platform"). Wupdoc operates as an online software technology intermediation platform connecting Users (Patients) with independent Clinics and Healthcare Providers via an anonymous Offer Model.

Data Controller Information:

  • Company Name: Wupdoc B.V.
  • Address: Sloterweg 303, 1171 VC Badhoevedorp, Amsterdam, Netherlands
  • Tax Identification Number: 865127761
  • Contact Email: support@wupdoc.com

By accessing Wupdoc, creating an account, submitting Offer Requests, or utilizing our services, you acknowledge the data collection, processing, and protection practices described in this Privacy Policy.

2. CORE PRINCIPLES OF DATA PROCESSING Your Personal Data is processed in strict compliance with the European Union General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable national data protection legislation. Adhering to Article 5 of the GDPR, we ensure that your personal data is:

  • Processed lawfully, fairly, and in a transparent manner (Lawfulness, Fairness, Transparency);
  • Collected for specified, explicit, and legitimate purposes (Purpose Limitation);
  • Adequate, relevant, and limited to what is necessary in relation to the purposes (Data Minimization);
  • Accurate and kept up to date (Accuracy);
  • Kept in a form which permits identification of data subjects for no longer than necessary (Storage Limitation);
  • Processed in a manner that ensures appropriate security, confidentiality, and integrity (Integrity and Confidentiality).
     

3. ITEMIZED PERSONAL DATA CATEGORIES, PURPOSES & LEGAL BASES

3.1. Identity & Profile Information (Full Name, User Credentials)

  • Processed Data: Full name, surname, user profile configuration, account password.
  • Processing Purpose: Account creation, identity verification, password reset links, platform access management, and contract performance.
  • Strict Anonymity Rule: Your Full Name is NOT disclosed to Clinics or third parties when you submit an Offer Request. Clinics receive only anonymous request IDs. Your identity is released to the Clinic strictly after a booking Deposit payment is confirmed.
  • Legal Basis: Performance of a contract (GDPR Art. 6(1)(b)).
     

3.2. Contact Information (Email Address, Mobile Phone Number)

  • Processed Data: Email address, mobile phone number (including country code).
  • Processing Purpose: Account verification (via SMS/email codes), operational updates, booking confirmations, password reminders, customer support, and—where explicit consent is granted—commercial marketing communications, newsletters, and promotional offers.
  • Strict Non-Disclosure Prior to Deposit: Your email address and phone number are NEVER shared with Clinics during the Offer Request or In-App Chat stages. All pre-booking communications must occur strictly inside Wupdoc In-App Chat. Contact details are released to the Clinic solely upon successful payment of the treatment Deposit.
  • Legal Basis: Performance of a contract (GDPR Art. 6(1)(b)), Explicit Consent for marketing (GDPR Art. 6(1)(a)), and Legitimate Interest in customer communication (GDPR Art. 6(1)(f)).
     

3.3. Location & Address Data (Country, Province, Postal Code, Address Header)

  • Processed Data: Country of residence, city, state/province, postal code, full postal address.
  • Processing Purpose: To route Offer Requests to geographically relevant Clinics, enable local treatment matching, and facilitate distance service agreements between the User and the Clinic.
  • Legal Basis: Performance of a contract (GDPR Art. 6(1)(b)) and Legitimate Interest (GDPR Art. 6(1)(f)).
     

3.4. Demographic & Preference Data (Gender, Age/DOB, Preferred Language)

  • Processed Data: Gender, preferred language, basic age indicators.
  • Processing Purpose: To personalize treatment recommendations, tailor clinical offer requests to gender-specific medical specialties, and enhance platform user experience.
  • Legal Basis: Legitimate Interest in service optimization (GDPR Art. 6(1)(f)).
     

3.5. Health & Special Category Data (Medical Photos, History Notes, Treatment Preferences)

  • Processed Data: Diagnostic photos (cosmetic, dental, hair transplant, surgical areas), medical history notes, treatment goals, dietary/physical requirements.
  • Processing Purpose: To enable prospective Clinics to evaluate your medical case, assess treatment feasibility, and issue customized price quotes.
  • Strict Photo Privacy Guarantee: Medical photos and diagnostic media uploaded inside Offer Requests or In-App Chat are collected strictly for clinical evaluation by Clinics. Wupdoc explicitly guarantees that patient health photos shall NEVER be used, published, displayed, or distributed for marketing, advertising, social media promotion, or commercial publicity without obtaining separate, express, written consent from the User.
  • Legal Basis: Explicit Consent of the data subject pursuant to GDPR Article 9(2)(a). You may withdraw your consent at any time by deleting your Offer Request, without affecting processing conducted prior to withdrawal.
     

3.6. Communication & In-App Chat Records

  • Processed Data: Text messages, voice notes, video proposals, photo attachments, and documents exchanged inside Wupdoc In-App Chat.
  • Processing Purpose: Facilitating treatment discussions, enforcing platform safety, preventing off-platform fraud/circumvention, and preserving legal evidence for disputes or chargebacks.
  • Legal Basis: Performance of a contract (GDPR Art. 6(1)(b)), Legitimate Interest in platform security (GDPR Art. 6(1)(f)), and establishment/defense of legal claims (GDPR Art. 9(2)(f)).
     

3.7. User-Generated Content (Comments, Ratings, Testimonials)

  • Processed Data: Post-treatment reviews, clinic star ratings, written feedback, display names.
  • Processing Purpose: Publishing authentic patient experiences on clinic profiles to inform other platform users.
  • Legal Basis: Data publicly disclosed by the data subject and Explicit Consent (GDPR Art. 6(1)(a)).
     

3.8. Financial & Payment Data (Deposit Transactions)

  • Processed Data: Transaction reference IDs, deposit amounts, timestamps, payment status, cardholder name.
  • Payment Processor Integration: All credit/debit card transactions are processed securely by our PCI-DSS compliant partner (Stripe, Inc.). Wupdoc does NOT store full credit card numbers or CVV security codes on its servers.
  • Legal Basis: Performance of a contract (GDPR Art. 6(1)(b)) and Compliance with tax/legal obligations (GDPR Art. 6(1)(c)).
     

3.9. Technical, Security & Cookie Data (IP Address, User Agent, Hashed Identifiers)

  • Processed Data: IP address, browser type, operating system, traffic logs, session duration, device indicators, hashed (pseudonymized) contact data.
  • Processing Purpose: System security, fraud detection, server log compliance, traffic analytics, and digital advertising targeting. Hashed data may be processed via platforms such as Meta Ads and Google Ads to deliver custom advertising audiences based on user consent.
  • Legal Basis: Compliance with legal obligations (GDPR Art. 6(1)(c)), Consent for advertising cookies (GDPR Art. 6(1)(a)), and Legitimate Interest in fraud prevention (GDPR Art. 6(1)(f)).
     

4. DATA SHARING AND THIRD-PARTY TRANSFERS Wupdoc does not sell, rent, or trade your personal data. Data is shared strictly under the following controlled circumstances:

  1. Clinics / Healthcare Providers: Anonymous treatment requests and health photos are shared with verified Clinics to generate offers. Full identity and contact details are released ONLY AFTER a reservation Deposit is paid.
  2. Cloud Hosting Infrastructure: All personal data is hosted securely within encrypted servers operated by Microsoft Azure (located within the EU/EEA).
  3. Payment Gateways: Financial transaction data is processed directly by Stripe, Inc. in compliance with PCI-DSS security standards.
  4. Digital Marketing & Analytics Suppliers: Pseudonymized/hashed identifiers and cookie tokens may be processed via Meta, Google, and cookie analytical suppliers, subject to user consent settings.
  5. Legal & Judicial Authorities: Data may be disclosed to law enforcement bodies, courts, or legal counsel where mandated by applicable law, court order, or to defend Wupdoc against chargebacks and legal claims.
     

5. DATA RETENTION & ANONYMIZATION We retain personal data only as long as necessary to fulfill the processing purposes outlined herein, maintain active user accounts, comply with statutory tax/legal retention mandates (e.g., 7-10 years for accounting records), and defend against legal claims or chargeback disputes. Upon expiration of applicable retention periods, data is securely erased, destroyed, or irreversibly anonymized for statistical research purposes.

6. YOUR RIGHTS UNDER THE GDPR Under Articles 15-22 of the GDPR, you possess the following rights regarding your personal data:

  • Right of Access: Request copies of your processed personal data.
  • Right to Rectification: Request correction of inaccurate or incomplete data.
  • Right to Erasure ("Right to be Forgotten"): Request deletion of data where processing grounds no longer exist.
  • Right to Restriction of Processing: Request temporary suspension of data processing under specific statutory conditions.
  • Right to Data Portability: Request structured, machine-readable export of data provided to us.
  • Right to Object: Object to processing based on legitimate interests or direct commercial marketing.
  • Right to Withdraw Consent: Withdraw consent given for health data processing, marketing, or cookies at any time.
     

Exercising Your Rights & Response Commitment: You may exercise your rights by sending a written request with proof of identity to support@wupdoc.com or via physical mail to our headquarters: Wupdoc B.V., Sloterweg 303, 1171 VC Badhoevedorp, Amsterdam, Netherlands.

We commit to evaluating and responding to your request free of charge as soon as possible and within a maximum of 30 (thirty) days from receipt. You also have the right to lodge a formal complaint with a data protection supervisory authority, such as the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7. AMENDMENTS TO THIS POLICY Wupdoc reserves the right to update or modify this Privacy Policy at any time to reflect platform enhancements or legislative changes. Revised versions will be published on https://www.wupdoc.com with an updated effective date.