DrToye
Health Management System
Effective date: 1 April 2026 | Last updated: 13 April 2026
DrToye HMS is operated by Neural Signal Corporation Limited ("we", "us", "our"), registered in England and Wales. We act as a data processor on behalf of healthcare providers (Hospitals) that use our platform, and as a data controller for account and platform-related data.
Data Protection Officer contact: support@drtoye.com
| Category | Examples | Lawful Basis |
|---|---|---|
| Identity Data | Full name, date of birth, gender, profile photo | Contract performance |
| Contact Data | Email address, phone number, home address | Contract performance, consent (SMS/calls) |
| Health Data | Medical history, diagnoses, lab results, prescriptions, vital signs, allergies | Provision of healthcare (Article 9(2)(h) UK GDPR) |
| Appointment Data | Booking details, doctor assignments, scheduling history | Contract performance |
| Financial Data | Billing records, payment method (via Stripe — we do not store full card numbers) | Contract performance, legal obligation |
| Technical Data | IP address, device type, app version, push notification tokens | Legitimate interest (security & service improvement) |
| Communication Data | In-app chat messages, email correspondence | Contract performance |
We use the following third-party services to deliver the Platform. All are bound by data processing agreements:
| Service | Purpose | Data Shared |
|---|---|---|
| Twilio | SMS text messages & automated voice calls | Phone number, message content |
| Stripe | Payment processing | Payment details (tokenised) |
| MongoDB Atlas | Database hosting | All platform data (encrypted) |
| ElevenLabs | AI voice synthesis for automated calls | Patient name, appointment details (in call script) |
| SMTP provider | Email delivery | Email address, message content |
| Firebase (FCM) | Push notifications | Device token, notification content |
| Agora | Video call infrastructure | Audio/video stream (not recorded) |
We do not sell, rent, or share your personal data with any third party for marketing purposes.
By providing your phone number during registration, you consent to receive transactional SMS and automated voice calls related to your healthcare. These include:
Opt out: Reply STOP to any SMS, update preferences in the app, or contact support@drtoye.com.
No marketing or promotional messages are sent. Standard carrier message and data rates may apply.
Under UK data protection law, you have the right to:
To exercise any of these rights, contact support@drtoye.com. We will respond within 30 days.
The DrToye web portal may use essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies. The mobile app does not use cookies.
The Service is not intended for children under 16. We do not knowingly collect data from children under 16 without parental consent. Minors' accounts are created and managed by a parent, guardian, or Healthcare Provider.
Your data is primarily stored in the UK/EEA. Where data is processed by third-party services outside the UK (e.g., MongoDB Atlas, Twilio), appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTAs).
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. The "Last updated" date at the top of this page indicates when the latest revision was made.
If you have questions or complaints about this Privacy Policy or how we handle your data:
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk