Privacy Policy

1. Controller

2. What is dCare Locum?

dCare Locum is a digital platform for arranging and coordinating temporary physician coverage. Physicians can manage a profile, provide professional information, record availability, and handle booking requests. Medical institutions and other authorised organisations can manage coverage needs, search suitable availability, and submit booking requests.

dCare Locum is not intended for patient data or medical treatment records. Such data must not be entered in free-text fields, messages, or other areas of the platform.

3. ID Austria in the mobile physician app

3.1 Purpose and process

The native dCare Locum app uses ID Austria as an external identity provider for the secure identification and authentication of physicians. The web portal does not use ID Austria as a sign-in method. When you choose “Sign in with ID Austria” in the mobile app, you are redirected to the ID Austria system. After successful authentication, ID Austria transmits the identity attributes approved for dCare Locum. dCare Locum then creates its own revocable app session. We do not receive your ID Austria password or biometric characteristics used for confirmation.

3.2 Data processed and purposes

3.3 Source, necessity, and consequences of non-provision

We receive identity attributes through ID Austria. Healthcare-provider information originates from the Austrian eHealth directory (eHVD). Further information is available in the ID Austria privacy notice.

Attributes required for authentication and account association must be provided if you wish to use ID Austria. Without suitable GDA information, a physician profile may not be verified immediately; a manual review may be offered. Where use without a postal code is available, it may instead be added to the profile.

3.4 No solely automated final rejection

eHVD information supports physician-profile verification. Missing or inconclusive information does not result in a solely automated final rejection. Individuals may request manual review and correction. We otherwise do not make solely automated decisions, including profiling, that produce legal effects or similarly significantly affect you.

4. Other processing activities

4.1 User and organisation profiles

Depending on your role, we process contact and profile data, medical disciplines and qualifications, organisation and location information, and voluntary information such as a form of address, profile picture, or additional profile details. Processing required to provide and manage the platform is based on Article 6(1)(b) GDPR. Voluntary profile details are processed on the basis of your consent under Article 6(1)(a) GDPR and may be removed or withdrawn with future effect at any time.

4.2 Availability, coverage needs, and bookings

We process availability periods, assignment locations, medical disciplines, fee information, coverage needs, booking requests, confirmations, rejections, and processing statuses. This is necessary to provide matching, scheduling, and booking functions under Article 6(1)(b) GDPR. Data subject to statutory retention obligations is additionally processed under Article 6(1)(c) GDPR.

4.3 Communication and support

When you contact us, we process your contact details, the content of your request, and related communication. The legal basis is Article 6(1)(b) GDPR where your request concerns the user or contractual relationship, and otherwise Article 6(1)(f) GDPR based on our interest in responding to requests and operating the platform securely.

4.4 Server logs and security

Access may cause us to record the IP address, time, requested address, HTTP status, transferred data volume, browser or operating system, and technical error and security information. This serves delivery, stability, troubleshooting, and prevention of misuse and is based on Article 6(1)(f) GDPR.

4.5 Cookies and local storage

The web application uses technically necessary cookies or comparable local storage for session management, authentication, security, and required user settings. The legal basis is Article 6(1)(b) and Article 6(1)(f) GDPR and, where applicable, section 165(3) of the Austrian Telecommunications Act 2021. Analytics or marketing cookies are not used without prior information and any consent required.

5. Recipients and processors

Personal data is disclosed only where necessary for the purposes described. Potential recipients or categories of recipients include:

• authorised physicians and organisation users within the intended platform functions;
• World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Austria, as hosting and technical infrastructure provider for the application and database;
• helloly GmbH, Rainerstraße 25, 4020 Linz, Austria, for domain, DNS, and email services;
• other contracted technical maintenance and support providers;
• ID Austria and participating technical bodies for an authentication process initiated by you;
• public authorities, courts, or other bodies where legally required or necessary for legal claims.

Processors are contractually bound and may process personal data only in accordance with our instructions and applicable data-protection law. Further information: World4You and helloly.

6. International transfers

No transfer of dCare Locum application data outside the EU or EEA is intended for the production hosting configuration or ID Austria authentication. The processing agreements with World4You and helloly permit third-country processing only in accordance with Articles 44 et seq. GDPR. If a provider with a third-country connection is used in the future, processing will occur only with the required safeguards and this policy will be updated beforehand.

7. Retention

We retain personal data only for as long as necessary for its purpose or to comply with legal obligations. The following criteria apply in particular:

• Accounts and their technical identity association are generally retained for the active user relationship.
• GDA information is processed for verification. Where possible, we retain only the result, relevant role, source, and verification time and update these periodically.
• Profile and location data is retained until it is changed or deleted or the account ends.
• Booking and billing data is retained for statutory retention periods and necessary limitation and evidence periods.
• Technical security and server logs are generally retained for no more than six months unless an incident requires longer purpose-limited retention.
• Completed support communication is generally retained for no more than three years unless longer retention is required.

When the purpose no longer applies and applicable periods expire, data is deleted or effectively anonymised.

8. Data security

We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, and disclosure. These include encrypted transmission, role- and organisation-based access controls, secure secret management, logging of security-relevant events, backups, and regular system updates.

9. Your data-protection rights

Subject to the statutory conditions, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), objection (Article 21 GDPR), and withdrawal of consent with future effect.

To exercise your rights, contact administrator@dcare.at. We may request additional information to confirm your identity and prevent unauthorised disclosure.

Right to lodge a complaint

10. Changes to this Privacy Policy

We update this policy when dCare Locum, its service providers, or legal requirements change. The current version is available at /policy. We will notify registered users appropriately of material changes.