Privacy Notice
Last updated 2 August 2026 · Dr. Ordo
A short statement of what personal data Dr. Ordo holds, in which role, for how long, and the rights you have over it. The full privacy policy carries the detail; this notice is the summary of your rights.
1. Who is responsible
Dr. Ordo operates drordo.com and the practice management application behind sign-in. For staff account data and site visitors, Dr. Ordo is the controller. For patient records — including health data — the practice that entered them is the controller and Dr. Ordo is its processor. Questions and requests go via the support page at /support.
2. Data categories
Staff account data: email, name, role, and sign-in records. Passwords are handled by the sign-in provider and never stored by Dr. Ordo.
Subscription billing data: a subscription identifier and status from the payment processor; card numbers never reach the service.
Patient records, entered by the practice: identity and contact details, appointments, clinical notes and billing — health data, treated as a special category and handled with corresponding care.
Access logs: who viewed or changed which record, and when.
3. Purposes
Staff and billing data are used to run and bill the service. Patient data is processed only on the practice's instructions, to provide the service to that practice — never for cross-practice analytics, model training, advertising or sale. Data is encrypted in transit and at rest.
4. Retention
Patient records are kept for the periods the practice instructs, which follow the medical record-keeping rules that bind the practice. When a subscription ends the practice can export its records; after the export window they are deleted. Staff accounts are deleted when the practice removes them. Billing records are kept as long as tax law requires.
5. Your rights
Under the UK GDPR and the EU GDPR, practice staff can ask for access to their own account data, for correction, for erasure, for restriction of processing, for a portable copy, and can object to processing based on legitimate interests. Requests are answered within one month, and you can complain to a supervisory authority.
Patients: your records are controlled by your practice. Address access, correction and erasure requests to the practice; Dr. Ordo assists it in answering, as its processor.
6. Contact
To exercise any of these rights, use the support page at /support. Identity is confirmed only to the extent needed to be sure the request comes from the person concerned.