Legal
Data Protection Impact Assessment (DPIA)
Last updated: 14 September 2026
Processing of Clinical Data — Myrto Care
1. Overview of Processing
Myrto Care processes clinical data voluntarily submitted by users, including symptoms, health-related descriptions, or other sensitive information.
This qualifies as special category data under GDPR.
2. Purpose of Processing
- To respond to enquiries involving clinical context
- To provide information or guidance consistent with user requests
- To safely determine suitability for services or onward support
Clinical data is not used for marketing, not shared without consent, and not repurposed.
3. Lawful Basis for Processing
- Article 6(1)(a) – Consent
- Article 9(2)(a) – Explicit Consent for special category (health) data
Consent is given when users voluntarily submit clinical data via forms or messages. Users may withdraw consent at any time via info@myrto.care.
4. Assessment of Necessity and Proportionality
Processing is:
- necessary to respond to clinical-information-based enquiries
- minimal, collecting only what users voluntarily provide
- proportionate to the service offered
A Privacy Notice informs users clearly about this processing.
5. Risks to Individuals
| Risk | Likelihood | Impact | Notes |
|---|---|---|---|
| Unauthorised access to clinical data | Low | High | mitigated by access controls |
| Data breach of sensitive information | Low | High | Google Cloud + SSL encryption |
| Users unaware of how data is used | Medium | Medium | mitigated by Privacy Notice |
| Misuse or repurposing of data | Low | High | strict internal policies |
6. Mitigation Measures
- SSL encryption across entire website
- Data stored securely in Google Cloud within EEA/UK
- Access limited to essential personnel only
- Clinical data encrypted at rest
- Data retention limited (default 7 years unless user requests deletion)
- Users provided with explicit consent information
- Logging and monitoring of system activity
- Processes for handling withdrawal of consent and data deletion
7. Residual Risks
Residual risks are low after mitigation. Further reduction includes periodic review every 12 months.
8. Approval
Data Protection Lead: Myrto Care
Contact: info@myrto.care
Approved on: 14 September 2026