Privacy

DocMap Limited is the data controller. Contact admin@docmap.co.uk about your information. Search for yourself or someone else using general terms. Do not enter names, contact details, medical records or other details that could identify anyone. A search can still reveal health information even when it has no name.

Temporary search storage

Submitted messages, interpreted criteria and result pages are stored in the application database so you can return to the search. A submitted town, city or postcode is part of that saved search. A location chosen in the picker is not submitted until you search. The conversation becomes unavailable after 30 minutes without activity or 24 hours after starting, whichever comes first. Reading it does not extend its life. Start again deletes the active conversation, turns and saved result pages.

Unsent drafts and pending locations stay in this tab's memory during navigation and clear on reload or tab close. An essential first-party HttpOnly cookie holds a random conversation identifier, not the search text. On HTTPS it is Secure and SameSite Strict; it expires in the browser after at most 24 hours. After deletion, an unusable cookie may remain until expiry or replacement. Browser session storage may hold scroll position and a yes/no reset or expiry marker, neither of which contains search text or a session identifier. Search text is not placed in page URLs or used for advertising.

Before your first search, DocMap asks you to agree to a short statement about using the health details you type. Agreeing once covers new searches in the same browser tab until you reload it or withdraw below. A short-lived receipt records the session hash, a non-secret session reference, the statement version and digest, whether you agreed on screen or by a new search in the same tab, and the time, without search text. Its configured lifetime is 30 days; cleanup may remove it later. The optional search-improvement setting is off unless you turn it on, and no counts are collected by this version. Each approved version of the statement is kept word for word, so a receipt shows exactly what you agreed to. After you agree, “How we store searches” shows a consent reference such as DM-1A2B-3C4D; quote it if you contact us and we can find your receipt while it is kept. You can withdraw and delete the active search below, even after the statement changes.

Search and sources

Search uses reviewed catalogue evidence. Embeddings are calculated locally in the application. Public profiles link to their supporting sources; historical information may have changed.

Location lookup

Location lookup is enabled. When enabled, DocMap may send the location text you enter, intended to be a town or postcode, to postcodes.io to obtain an approximate search centre. Do not enter names or other identifying details there. It does not send the clinical message or saved conversation to that service. A radius is measured in a straight line from that centre and can only match practices with stored coordinates. The provider’s handling of lookup requests requires separate review.

AI query interpretation

AI query interpretation is enabled. When enabled, some new clinical search text is sent to a third-party AI service to interpret body-area wording. Recognised location instructions are handled separately, but personal details left in the clinical text may be included. This interpretation step does not include previous conversation messages, catalogue records or private review information. The application requests zero data retention and no model training on that route; actual service handling requires separate verification.

AI relevance assessment

You can choose an AI relevance check after seeing sourced results. When offered, the check shows the exact clinical concern before you choose to send it with selected current profile source facts for up to 12 results to a third-party AI service. Those facts may include consultant or place names. The response is a relevance judgment, not proof of clinical suitability, insurance acceptance or availability. The current first-search agreement is required, and you must choose Check AI relevance after results before this additional transfer; no second agreement dialog is shown. The archived, route-bound receipt contains no clinical text.

Corrections

Correction reports contain a profile identifier, category, submitted text and hashed conversation identifier used for rate limiting. They remain separate if you delete your search. Reports are available to authorised reviewers for 30 days, then hidden from ordinary reviewer access and removed by cleanup. Include only the factual correction and a public source.

Retention

Expired conversations cannot be read or updated. Application cleanup removes expired conversations and correction reports from the active database; physical deletion can occur later if cleanup has not run or fails. Database backups may retain earlier copies. Backup recovery and provider deletion windows require confirmation. Restored data must pass expiry and withdrawal checks before the service reopens.

The application is hosted on Railway and stores catalogue and search conversation data in Supabase. These providers also process technical information needed to deliver the service. Current routing and provider retention details require verification before the new notice is activated.