Is Doctiplus HIPAA compliant?
The honest answer depends on where you and your doctor are — and anyone who answers with a badge is not being straight with you.
There is no such thing as HIPAA certification. The US Department of Health and Human Services does not certify, approve or endorse any company as HIPAA compliant, so a "HIPAA certified" seal on a website means nothing.
HIPAA is a United States law that applies to particular healthcare organisations and the companies handling records on their behalf. Whether it covers your records depends on who your doctor is. Section 5 sets out exactly when it applies here. What does not depend on where you are is how we protect your data, which is the rest of this page.
What we store, and for how long
Every kind of data Doctiplus holds is in this table. If something is not listed, we do not keep it.
Data we hold about patients
| Data | Why we hold it | Kept for |
|---|
| Account detailsName, email, phone, date of birth, country |
To run your account and confirm bookings |
Until you close your account; deleted within 30 days after |
| Booking recordsDoctor, date, time, specialty, consultation type |
To arrange, confirm and change appointments |
While your account is open, plus any period tax law requires for the matching invoice |
| Clinical recordsIntake forms, consultation notes, diagnoses, prescriptions, referrals, sick notes, files you upload |
To provide your care and continue it at later appointments |
The minimum period medical-records law requires where your doctor practises |
| Payment recordsAmount, date, last four card digits, transaction reference |
To take payment and issue refunds and receipts |
As long as tax and accounting law requires |
| Support messagesEmails and messages with our team |
To answer you and keep a record of what was agreed |
24 months after the conversation closes |
| Reviews you publishRating and written review |
To help other patients choose a doctor |
Until you delete the review or close your account |
| Browsing dataCookies and similar technologies |
To keep the site working and, with your consent, to measure it |
As set out in our cookie policy |
Why clinical records outlast your account
This is the part most people do not expect. Almost every country requires doctors to keep medical records for years after treatment, and closing your Doctiplus account does not override that law. When you close your account, everything else is deleted on the schedule above; clinical records are kept only for as long as the law requires, then deleted. If you ask us to delete something we are legally required to keep, we will tell you which law applies and when the record will go.
What we do not store at all
- Full card numbers or security codes. They go directly to our payment processor. We only ever see the last four digits.
- Recordings of your video consultations. Calls are streamed live and not recorded, unless you give explicit consent for a specific call.
- Your password in readable form. We store a one-way hash, so nobody at Doctiplus can see your password — including us.
- Your clinical records in any advertising or analytics platform. They never leave the clinical system for marketing purposes.
Who can see what
Encryption keeps outsiders out. Access controls decide who inside the system may read what — and that is the part that matters more. A perfectly encrypted record is still exposed if the wrong person can open it.
Who can access each type of data
| Data |
You |
Your doctor |
Other doctors |
Support staff |
Engineers |
Advertisers |
| Clinical records |
Yes |
Yes |
On referral |
No |
Logged only |
Never |
| Booking records |
Yes |
Yes |
No |
Yes |
Logged only |
Never |
| Account details |
Yes |
Contact only |
No |
Yes |
Logged only |
Never |
| Payment records |
Yes |
No |
No |
Last 4 only |
No |
Never |
Other doctors on the platform cannot browse your records. If your doctor refers you to a specialist on Doctiplus, the specialist sees what is relevant to the referral, and you are told before it happens. "Logged only" means an engineer can reach the data only to fix a technical fault, and every such access is recorded and reviewed. "Contact only" means your doctor sees your name and how to reach you, not your account settings.
How it is protected
In transit
Everything between your device and our servers travels over an encrypted TLS connection — the padlock in your browser bar. That includes video calls.
At rest
Stored data is encrypted on disk, so a copied drive or backup is unreadable without the keys, which are held separately from the data.
Access
Staff access follows their role, uses two-factor sign-in, and every opening of a clinical record is logged with who, when and why.
We apply these safeguards to every record on the platform, whether or not a particular law requires them. A patient in Lagos or Manila gets the same protection as a patient in Houston.
Where HIPAA applies
HIPAA — the Health Insurance Portability and Accountability Act — is a United States law. It applies to three kinds of organisation, called covered entities: health plans, healthcare clearinghouses, and healthcare providers who handle certain transactions electronically. It also applies to their business associates, meaning companies that handle protected health information on a covered entity's behalf.
Doctiplus connects patients with independent doctors in more than 90 countries, which produces three different situations.
Case 1Your doctor is a US covered entity
Your records are protected health information under HIPAA. Your doctor is responsible for them under that law, and Doctiplus, as the platform holding them on the doctor's behalf, acts as a business associate under a written agreement with that doctor.
Case 2Your doctor is outside the United States
HIPAA does not apply. The privacy law of your country and your doctor's country does. For patients in the European Union and the United Kingdom, that is the GDPR, covered in the next section.
Case 3You are reading, not booking
Nothing you read on this site creates a health record. Browsing is covered by our cookie policy, not by health privacy law.
A company that tells every visitor worldwide it is "HIPAA compliant" is either not reading the law or hoping you won't.
Your rights under GDPR
If you are in the European Union or the United Kingdom, the GDPR and the UK GDPR govern how we handle your data. Health data is a special category under Article 9, which means we need a specific legal basis to process it at all. Ours are:
- Providing healthcare. Consultations, prescriptions and records, handled by or under the responsibility of a health professional bound by confidentiality — Article 9(2)(h).
- Your explicit consent. For anything beyond direct care, such as optional features. You can withdraw it at any time, and withdrawing does not affect your care.
AccessGet a copy of everything we hold about you.
CorrectionHave anything inaccurate fixed.
DeletionHave your data erased, except records the law requires us to keep.
RestrictionLimit how we use your data while a dispute is resolved.
PortabilityReceive your data in a format another provider can use.
ObjectionObject to processing based on our legitimate interests.
Withdraw consentAt any time, for anything that relies on consent.
ComplainTo your national data protection authority, without contacting us first.
We respond within one month. If a request is genuinely complex we may extend that by up to two further months, and we will tell you within the first month if we need to.
Your data may be processed in the United States. Where it leaves the EU or UK, we rely on the European Commission's standard contractual clauses or an equivalent recognised safeguard.
If something goes wrong
No system is immune to a breach. What matters is how fast you hear about it and how much you are told.
- Immediately
We contain the breach, preserve the evidence and establish whose data was involved.
- Within 72 hours
We notify the relevant data protection authority, as the GDPR requires where a breach risks your rights.
- Without undue delay
We tell you directly, by email, if your data is affected and the risk to you is high — not in a blog post you might never see.
- Within 60 days
For records covered by HIPAA, affected individuals are notified no later than 60 days after discovery, as the law requires.
Every notice says what happened, what data was involved, what we have done about it, and what you should do next.
What we will never do
- Sell your personal or health data, to anyone, in any form.
- Use your clinical records for advertising, or pass them to an advertising platform.
- Use your consultations or records to train AI models without your explicit, separate consent.
- Share your records with your employer or insurer without your consent, except where the law compels it.
- Hand data to law enforcement without a valid legal order, or without telling you where the law allows us to.
- Call ourselves "HIPAA certified". The certification does not exist.
Making a request
To use any of the rights above, email us. You do not need a lawyer, a form, or a reason.
What to include
- Your full name and the email address on your Doctiplus account.
- What you want — a copy of your data, a correction, deletion, or something else.
- For corrections, what is wrong and what it should say.
We will confirm your identity before releasing anything. That step can feel slow, but if we sent your records to anyone who emailed asking for them, that would be the breach.
The data controller is Doctiplus, 1401 St Joseph Pkwy, Houston, TX 77002, United States. The full legal terms are in our privacy policy.
Cardiologist