DPOs and patients' rights teams checking legal basis and consent flows
Privacy and consent
What is collected, on what legal basis, for how long, and how a person exercises a right over their own data.
Legal basis
Consent
Collected explicitly before any non-essential processing.
Contract performance
Processing necessary to deliver the service a customer signed up for.
Legitimate interest
Limited to security, fraud prevention and service improvement.
Your rights
Access, rectification, deletion, portability and objection requests go to the data protection officer at dpo@on-kare.org.
The six questions
- What is it?
- The legal basis for each category of processing, and the mechanism to exercise a data-protection right.
- Who is it for?
- Data protection officers, legal reviewers and patients or users asserting a right.
- Which problem does it solve?
- A privacy policy that lists rights without a route to exercise them is not usable during an actual request.
- How does it work?
- Processing rests on consent, contract performance or legitimate interest depending on the purpose. Retention periods are set per data category. A named DPO handles access, rectification, deletion, portability and objection requests.
- How is it different?
- Each right on this page links to the same contact used to exercise it, not a generic support address.
- What is the proof?
- The full retention table and sub-processor list are published on the privacy policy.
This page is part of a platform of 2,156 clinical and operational capabilities across 8 business domains.
Explore the catalogueContinue
Security contact
Coordinated disclosure and documentation requests: security@on-kare.org.
security@on-kare.orgLegal review: 2026-08-24