Privacy Policy
Last updated: 19 October 2026
1. About Gold Star Doc
Gold Star Doc provides a patient feedback service for doctors in the United Arab Emirates.
Gold Star Doc is currently operated by an individual founder in Dubai pending licensing.
In this Privacy Policy, “Gold Star Doc”, “we”, “us” and “our” mean the operator of the service.
You can contact us about this Privacy Policy or the handling of information at hello@goldstardoc.com.
2. What the service does
A patient can scan a Gold Star Doc QR code at a doctor’s clinic. The QR code opens a short feedback page for that doctor.
The patient may:
- submit private feedback about their visit; and
- choose to follow a link to Google’s separate public review page.
Leaving a Google review is always optional. A patient can submit feedback to Gold Star Doc without leaving a Google review.
Feedback submitted through Gold Star Doc is made available privately to the treating doctor through the doctor’s dashboard. It is not published by Gold Star Doc.
3. Information we collect
Gold Star Doc is designed to collect anonymous feedback without asking patients to identify themselves.
3.1 Patient feedback
The feedback form collects:
- anonymous star ratings for three questions;
- one yes/no answer; and
- an optional free-text comment limited to 500 characters.
The free-text comment is optional. Patients are instructed not to include names, medical details or other information that could identify them or another person.
3.2 Usage events
Gold Star Doc records the following first-party, non-identifying usage events:
- a QR code was scanned;
- a feedback form was started;
- a feedback form was completed; and
- an outbound link to Google was selected.
These events are tagged with the clinic location associated with the QR code that was scanned. They are not linked to the content of a patient’s feedback.
3.3 Hashed IP address for abuse prevention
For rate-limiting and abuse prevention only, Gold Star Doc processes a hashed version of the device’s IP address.
The hashed IP address:
- is retained for no more than 24 hours;
- is used only to limit repeated or abusive submissions; and
- is never linked to feedback content.
3.4 Doctor account information
Separately from patient feedback, Gold Star Doc collects information from each doctor who uses the service. This is account information about the doctor, not about patients.
It includes the doctor’s name and professional details, a login email address and account credentials, and records of the doctor’s use of the dashboard. The doctor is a data subject in respect of this information, which Gold Star Doc uses to create and operate the account, authenticate access and provide the service.
4. Information we do not request or use
Gold Star Doc does not request or require a patient’s:
- name;
- email address;
- telephone number;
- account; or
- login details.
Gold Star Doc does not use:
- cookies;
- analytics software development kits, or analytics SDKs; or
- advertising trackers.
Gold Star Doc feedback is not used for advertising or marketing.
5. Personal or health information included by accident
Gold Star Doc is designed not to collect patient identity information or health information. Patients are instructed not to include medical details or other identifying information in the optional comment.
However, because the comment is written by the patient, a patient may voluntarily include information that Gold Star Doc did not request. This could include:
- the patient’s name or other identifying details;
- another person’s identifying details;
- information about symptoms, diagnoses, treatment or other health matters; or
- details that could indirectly identify somebody.
Any such information is provided voluntarily. Gold Star Doc does not request it and does not use it to identify the patient or anyone else.
Gold Star Doc may redact or delete identifying or medical information included in a comment, including where this is necessary to protect privacy, comply with applicable law or keep the service focused on general feedback.
If you believe you included personal or health information by mistake, contact hello@goldstardoc.com. Please provide only the information reasonably needed to help us locate the relevant feedback.
6. How information is used
Gold Star Doc uses the information described in this Privacy Policy only to:
- collect and deliver private patient feedback to the treating doctor;
- help the doctor with care development and improvement;
- allow the doctor to use feedback in summary or export form as part of professional appraisal or revalidation evidence;
- record the limited usage events listed in section 3.2;
- prevent repeated or abusive submissions through short-term rate-limiting; and
- operate, protect and maintain the feedback service.
Gold Star Doc feedback is:
- never published by Gold Star Doc;
- never sold;
- never used for marketing; and
- never shared with third parties except as described in this Privacy Policy.
7. Who sees the feedback
7.1 The treating doctor
Feedback is made available privately to the treating doctor through the doctor’s Gold Star Doc dashboard.
The doctor may use the feedback for care development and improvement. The doctor may also include feedback in summary or export form in evidence prepared for professional appraisal or revalidation.
An appraisal or revalidation export may be handled by the doctor outside the Gold Star Doc service. The doctor is responsible for using and disclosing that export in accordance with applicable professional, confidentiality and data protection requirements.
7.2 Microsoft Azure hosting
Gold Star Doc uses Microsoft Azure to host and store the service and its data. The service is hosted in the UAE North region in Dubai, and data at rest remains in the UAE.
Microsoft Azure provides the technical infrastructure on which the information is stored. This does not mean that Microsoft receives the feedback for its own marketing or independent use.
Gold Star Doc does not disclose patient feedback to any other third party except as described in this Privacy Policy.
8. Google reviews and external links
Google reviews are separate from Gold Star Doc feedback.
After submitting feedback, a patient may be invited to follow a link to the relevant Google review page. Following that link and leaving a review are entirely optional.
If a patient chooses to leave a Google review:
- the review is submitted directly to Google, not to Gold Star Doc;
- Google’s own terms and privacy policy apply;
- the review may be public;
- the review may be associated with the patient’s Google profile in accordance with Google’s practices; and
- Gold Star Doc does not receive, control or moderate the Google review.
Gold Star Doc records only its own non-identifying outbound-click event when the Google link is selected. Gold Star Doc may also track publicly visible Google review counts. It does not receive the contents of a patient’s Google review through the Gold Star Doc feedback service.
Patients should review Google’s own information before submitting a public review.
9. Hosting and location of stored information
Gold Star Doc information is hosted and stored using Microsoft Azure’s UAE North region in Dubai.
Data at rest remains in the UAE. This statement concerns the location in which stored data is held. It should not be read as a promise that every form of technical processing, support or access is necessarily confined to the UAE.
Where personal data is accessed from outside the UAE (for example, for technical support by the hosting provider), Gold Star Doc will ensure that any such cross-border transfer is made in accordance with the cross-border transfer provisions of the UAE Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data.
10. Data protection framework
Gold Star Doc’s primary data protection framework is UAE Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, commonly referred to as the PDPL. The PDPL came into force on 2 January 2022.
The service is designed not to request patient identity information or health information. Nevertheless, personal data may still be processed in limited circumstances, including:
- when a patient voluntarily includes identifying or health information in a comment; or
- if the short-lived hashed IP address is treated as personal data under applicable law.
The PDPL and other applicable requirements may therefore apply depending on the information involved and the circumstances of the processing.
11. Legal bases for processing
Where consent is relied upon, the patient may withdraw that consent, subject to applicable law. Withdrawal does not affect processing that was lawful before consent was withdrawn.
| Processing activity | Proposed legal basis |
|---|---|
| Providing private feedback to the treating doctor | Article 4(10) PDPL: necessary to perform the contract with the doctor, who receives the feedback. Feedback identifying a doctor is the doctor’s personal data; anonymous patient input is not patient personal data and is outside the PDPL. |
| Handling identifying information voluntarily included in a comment | Not relied upon. Where volunteered information is personal data it is minimised and redacted or deleted, not processed on a legal basis. |
| Handling health information voluntarily included in a comment | Health information is Sensitive Personal Data (Article 1). None of the PDPL health gateways (Article 4(4) to (6)) fit patient feedback, so there is no basis to use it and it is removed. |
| Responding to a privacy request or complying with a legal obligation | Article 4(10) (acting at the data subject’s request) for enquiries and rights requests; Article 4(11) (obligations under other UAE laws) and Article 4(3) (legal claims or procedures) where a legal obligation applies. |
| Operating the doctor’s account and providing the service to the doctor (name, professional details, login email, credentials, dashboard use) | Article 4(10): necessary to perform the service agreement with the doctor. Gold Star Doc is the controller of this account information. |
| Non-identifying usage events and monitoring public Google review counts | Outside the PDPL: no identifiable personal data is processed. A Google review a patient chooses to leave is processed by Google as controller under Google’s own terms. |
12. Your rights and requests
Subject to the PDPL and any other applicable law, a person may have rights concerning their personal data, including the right to:
- receive information about how their personal data is processed;
- request access to personal data held about them;
- request correction of inaccurate personal data;
- request deletion or erasure;
- request restriction of, or an end to, processing;
- object to processing where an objection right applies;
- request data portability where applicable;
- withdraw consent where processing relies on consent;
- receive information about automated processing where applicable; and
- make a complaint or raise a concern about the handling of personal data.
These rights are not absolute. They apply only where the relevant right is available under applicable law and its conditions have been met.
Requests involving anonymous feedback
Gold Star Doc intentionally does not request a patient’s name, contact details, account or login. As a result, we may not be able to identify which anonymous feedback belongs to a particular person.
To act on a request, we may need enough information to locate the relevant feedback, such as:
- the doctor or clinic concerned;
- the approximate date and time of submission; and
- part of the comment or other details that distinguish the submission.
We will not ask for unnecessary identity information. If we cannot locate the feedback with reasonable confidence, we may be unable to access, correct or delete it without risking action against somebody else’s submission.
To make a request or raise a concern, email hello@goldstardoc.com.
You may also complain to the data protection regulator. Under the PDPL the regulator is the UAE Data Office, now part of the federal Artificial Intelligence and Data Authority. The detailed complaints procedure is expected to be set out in the PDPL’s Executive Regulations, which had not been issued at the date of this Policy.
13. Security
Gold Star Doc uses proportionate organisational and technical safeguards intended to protect information against unauthorised access, disclosure, alteration, loss or destruction.
These safeguards include:
- encryption in transit;
- encryption at rest;
- access controls; and
- measures designed to limit access to people who require it to operate or use the service appropriately.
No website, storage system or transmission method can be guaranteed to be completely secure. Gold Star Doc therefore cannot promise absolute security.
If a personal data breach occurs, Gold Star Doc will assess it and, where the PDPL requires, report it to the regulator and notify affected individuals, in accordance with Article 9 of the PDPL and its Executive Regulations.
14. Children
Children and their parents or guardians should not include a child’s name, medical details or other identifying information in the optional comment.
15. Changes to this Privacy Policy
Gold Star Doc may update this Privacy Policy where the service, its data practices or applicable legal requirements change.
The updated Policy will be published on goldstardoc.com with a revised effective date or “last updated” date. Where a change materially affects how personal data is processed, Gold Star Doc will provide any additional notice or obtain any consent required by applicable law.
The current version will be identified by the date shown at the beginning of the Policy.
16. Contact us
For questions, privacy requests or concerns about this Privacy Policy, contact hello@goldstardoc.com.
Please do not send medical information by email. Gold Star Doc is not a medical communication channel. Medical concerns should be directed to the relevant doctor or clinic.