Air Doctor Privacy Policy for Pomodoc
August 2026
Introduction
Welcome to Pomodoc, an online platform that enables users to request and receive proposals for video consultations with English-speaking General Practitioners and to schedule and pay for an Appointment (the “Service”).
This Privacy Policy (“Policy”) explains how information about you is collected and used when you use the Service, and when you visit or contact us through our website (the “Website”).
The Service and the Website are developed and operated by Air Doctor Ltd. (“Air Doctor”, “we”, “us”, “our”).
In this Policy, “Practitioner(s)” means English-speaking General Practitioners.
You have the right to review the personal information we collect and use about you and the right to request correction of your personal information. You also have a right to request that we delete your personal information, subject to the limitations specified in the law.
This Policy may be amended from time to time. We will post any change to this Policy on our Service and Website at a reasonable time in advance of the effective date of the change, and we will also make efforts to proactively notify you by email of the changes if we have your email address.
Contact us
Our Data Privacy Officer is Dana Ben Zvi.
If you have any questions, comments or concerns regarding this Policy or our processing of your personal information, or if you would like to exercise any of your data subject rights, please contact us at privacy@air-dr.com.
What we collect and why
| Scenario | Purposes | Categories of information processed |
|---|---|---|
When you use our Service, directly or through a third party provider | Providing you with the functionality of the Service, sending service-related updates and operational communications, contacting you regarding administrative issues related to the Service or the Website following your appointment, responding to support requests, and maintaining and improving the Service. | Email address, full name and mobile phone number, as applicable, and your selected communication method; If you register using a third-party provider such as Google, Facebook or Apple, we may also collect your user profile photo. When using the Service: date of birth, gender that you provide. |
Processing your health information relating to your request to receive Services | Providing you with the functionality of the Service you request. | Health Information you choose to provide, or that the Practitioner provides to us about you, including photos, documents, receipts, and health information you provide verbally by phone. |
When you book an appointment or make a payment via the Service | Providing you with the functionality of the Service you requested. | Full name, financial or payment information, country, mobile phone number, email address. We do not receive or store your full credit card number; payment processing is handled by our payment service providers. We typically receive confirmation of payment status and limited payment details, such as the last 4 digits of a payment card. |
Contacting us with an inquiry or feedback, the Website or via phone. | Responding to your inquiry or feedback, our business development. | Your full name, email address, the subject of your inquiry, and the content of your message. If you choose to include additional information, we will process it only for purposes of responding to you. When contacted by phone, we will record your call with us, and if you are outside of Israel, subject to your consent. |
Use of cookies on the Service and the Website | Facilitating a Service or Website feature that the user specifically requested, Analyzing the Service or Website usage to evaluate and improve its performance, improving user experience on the Service or Website, informing and serving personalized advertisements more relevant to user interests (where permitted). | IP address from which you access the Service and Website, time and date of access, type of device and browser used, language used, links clicked via a mouse or a touch screen, and actions taken while using the Service and the Website. |
Processing your device information | Providing you with the functionality of the Service, subject to your permissions. Usage data and diagnostics may be collected. Where collected, they are not intended to be linked to you directly. | Location data, Unique device ID, limited storage access, usage data and diagnostics. |
Practitioners' entry of details, and their use of the Service | Providing the Practitioner with the functionality they requested, such access to the Service, sending them operational or transactional communications. | Business address and details of Practitioner (such as doctors and/or clinics) education background. We will also collect the Practitioner's payment information, such as bank details. |
You do not have a legal obligation to provide the information that we request. However, if you choose not to provide this information to us, we will not be able to process your feedback, respond to your inquiry, and you will not be able to use our Service or Website functionalities.
If you will not provide or share your health information relating to your inquiry through the Service, we will not be able to able to handle your medical inquiry.
Methods and sources for collecting your personal information
We collect the personal information from several sources:
- Directly from you when you use our Service and through a third-party provider, such as Google, Facebook and Apple, when you contact us via email, WhatsApp, or phone;
- From our service providers helping us to operate the Service and the Website.
- From Practitioner(s) you visit.
- Through the device you use to access our Service and Website, including through third party cookies and analytics tools, such as our Internal analytics services and Google Analytics, Hubspot, Microsoft, Outbrain, TikTok, Meta, Google AdSense and others.
Sharing your personal information
We do not share your personal information with third parties, except as described below, or where you provide explicit and informed consent.
| Scenario | Purposes | Examples of Third parties involved |
|---|---|---|
We will share your information with our service providers who assist us with the internal operations of the Service and the Website. These companies are authorized to use your personal information in this context only as necessary to provide these services to us and not for their own promotional purposes | Operating the Service and the Website, and managing our business operations | Stripe, Link, Business Process Outsourcing (BPOs), Datadog, Aircall, Twilio, Microsoft (365), and AWS, subject to additional Policies such as: https://www.datadoghq.com/legal/privacy/ https://www.twilio.com/en-us/privacy |
Sharing health information with Practitioners | Providing you with the functionality of the Service, based on your choices and preferences. | Practitioners |
Sharing Practitioners' information with other users of the Service | Providing functionality of the Service, including presenting Practitioner proposals | Practitioner information included in Practitioner proposals is shared with End-Users requesting medical assistance. |
If you misused your rights to use the Service or the Website or violated any applicable law in the course of doing business with us | Responding to, handling, and mitigating suspected violations of law in connection with our business. | Competent authorities, legal counsels, and advisors. |
If a judicial, governmental, or regulatory authority requires us to disclose your information | Complying with a binding request from a competent authority. | Competent authorities. |
If the operation of the Service or the Website, or our business, is organized within a different framework, or through another legal structure or entity | Enabling a structural change in the operation of the Service and the Website, and our business. | The target entity of the merger or acquisition, legal counsels, and advisors. |
Data retention and security
We retain your personal information for as long as necessary for the purposes described in this Policy, including operating the Service and the Website, and thereafter as necessary for record-keeping and compliance purposes.
We will retain your information for as long as needed to operate the Service or the Website. Thereafter, we will still retain your personal information as necessary to comply with our legal obligations, resolve disputes, establish, and defend legal claims and enforce our agreements. Unless a longer retention period is required or permitted under applicable law, our general retention period is up to 7 years.
We implement measures to secure your information
We implement measures to reduce the risks of damage, loss of information and unauthorized access or use of information, such as TLS 1.2+ encryption, secure authentication and session controls. However, these measures do not provide absolute information security. Therefore, although efforts are made to secure your personal information, there is no guarantee that it will be immune from information security risks.
Additional information for individuals in the EU or UK
Controller, GDPR representatives
Air Doctor is the data controller for:
- Personal information collected via the Website;
- Processing aggregated and analytic information and feedback;
- Providing the Service to users who use the Service, subject Pomodoc service Terms of Use and this Policy;
- Processing is required to administer the direct business or contractual relationship between Air Doctor and Practitioner.
| Name | Address | GDPR Representative |
|---|---|---|
Air Doctor Ltd. | Israel: Hashaked 1, Bet Nekofa, Israel, 9083000 | Juliana Kyriakides - Juliana.kyriakides@americanoslaw.com +357 22 46 55 00 12, Demostheni Severi Av. Office 601, 6th Floor 1080 Nicosia, Cyprus |
International data transfers
To facilitate processing your information through the Service and Website and by our service providers, we will transfer your information to countries outside the EU or the UK. We do so to countries which are recognized by the European Commission as having adequate protection for personal data, or under the terms of a data transfer agreement which contains standard data protection contract clauses with adequate safeguards determined by the EU Commission and UK Information Commissioner’s Office.
Legal basis for processing your personal data
| Purpose or Scenario | Legal Basis |
|---|---|
Using the Service (including facilitating appointment booking) | Performance of a contract (where applicable) and our legitimate interests in operating and improving the Service. Where we process health information as special category data, such processing is performed on the basis of your explicit consent, expressed by your act of providing us the health information. |
Providing or sharing health information relating to your inquiry through the Service or by phone | Your explicit consent, expressed by your act of providing us the health information. |
When you consent to call recording as part of your phone inquiry | Consent. |
When you provide us with access to your device components | Our legitimate interest in facilitating your request and our legitimate interest in the operation of the Service and the Website. |
When you order or make a payment on our Service | Performance of a contract. |
When you request to or pay the fees to access our Service | Providing you with the functionality of the service you requested, performance of our contract with you. |
Responding to your Website inquiry or feedback | Our legitimate interest in responding to your Website inquiry or feedback, developing and enhancing our business and the Website. |
Use of strictly necessary cookies on the Service or Website | Our legitimate interests in the proper operation of the Website or Service. |
Use of non-essential cookies on the Service or Website | Consent. |
Processing Practitioner details, remittance of fees | Performance of our contract with the Practitioner. |
Responding to, handling, and mitigating suspected violations of law in connection with our business | Our legitimate interests in defending and enforcing against violations and breaches that are harmful to our business. |
Complying with a binding request from a competent authority | Our legitimate interests in complying with mandatory legal requirements imposed on us. |
Enabling a structural change in the operation of the Service or Website and our business | Our legitimate interests in our business continuity. |
Data subject rights
If you are in the EU or the UK, you have the following rights under the GDPR:
Right to Access and receive a copy of your personal information that we process.
Right to Rectify inaccurate personal information we have concerning you and to have incomplete personal information completed.
Right to easily and at any time withdraw your consent for
- the use of non-essential cookies on our Service or Website.
- the processing and sharing of your health information.
The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
Right to Data Portability, that is, to receive the personal information that you provided to us, in a structured, commonly used, and machine-readable format. You have the right to transmit this data to another person or entity. Where technically feasible, you have the right to have your personal information transmitted directly from us to the person or entity you designate.
Right to Object to our processing of your personal information based on our legitimate interest. However, we may override the objection if we demonstrate compelling legitimate grounds, or if we need to process such personal information for the establishment, exercise, or defense of legal claims.
Right to Restrict us from processing your personal information (except for storing it): (a) if you contest the accuracy of the personal information (in which case the restriction applies only for a period enabling us to determine the accuracy of the personal information); (b) if the processing is unlawful and you prefer to restrict the processing of the personal information rather than requiring the deletion of such data by us; (c) if we no longer need the personal information for the purposes outlined in this Policy, but you require the personal information to establish, exercise or defend legal claims; or (d) if you object to our processing based on our legitimate interest (in which case the restriction applies only for the period enabling us to determine whether our legitimate grounds for processing override yours).
Right to be Forgotten. Under certain circumstances, such as when you object to our processing of your personal information based on our legitimate interest and there are no overriding legitimate grounds for the processing, you have the right to ask us to erase your personal information. However, notwithstanding such request, we may still process your personal information if it is necessary to comply with our legal obligations, or for the establishment, exercise, or defense of legal claims. If you wish to exercise any of these rights, please contact us through the channels listed in this Policy.
When you contact us, we reserve the right to ask for reasonable evidence to verify your identity before we provide you with information. Where we are not able to provide you with information that you have asked for, we will explain the reason.
Subject to applicable law, you have the right to lodge a complaint with your local data protection authority. If you are in the EU, then according to Article 77 of the GDPR, you can lodge a complaint to the supervisory authority, in the Member State of your residence, place of work or place of alleged infringement of the GDPR. For a list of supervisory authorities in the EU, click here. If you are in the EU, you can find the list of supervisory authorities at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
If you are in the UK, you can lodge a complaint to the Information Commissioner’s Office (ICO) pursuant to the instructions provided here. See: https://ico.org.uk/make-a-complaint/.
Additional information for individuals in the United States
If you are an individual residing in the United States, we provide you with the following information pursuant to state privacy laws, such as the California Consumer Privacy Act of 2018, as amended (CCPA) and the Texas Data Privacy And Security Act (TDPSA). This is also the information we have collected in the past 12 months when we operate as a “business” under certain state privacy laws.
Personal Information We Collect
| Categories of personal information | Specific types of personal information collected | Source of Information |
|---|---|---|
Identifiers | Real name, IP address, email address. | The consumers themselves. Practitioners. |
Other personal information that identifies, relates to, describes, or is capable of being associated with, a particular individual | Telephone number, financial information, health information. Health information is sensitive personal information | The consumers themselves. Practitioners. |
Characteristics of Protected Classifications | Health information, gender, age. Health information is sensitive personal information. | The consumers themselves. Practitioners. |
Consumer Commercial information | Services paid for. | The consumers themselves. Practitioners. |
Internet or other electronic network activity information | Internet or other electronic network activity information. | The consumers’ devices. |
Geolocation data | Device location data. Precise location data is sensitive personal information. | The consumers’ devices. |
Audio, electronic, visual, thermal, olfactory, or similar information | Health Information such as medical imaging information or audio call. Health information is sensitive personal information. | Medical imaging information - The consumers themselves. The consumers’ Practitioners. Audio call - The consumers themselves. |
Customer records (of Practitioner) | Bank account number. | The consumers themselves. |
Professional or job-related information (of Practitioner) | Employment history. | The consumers themselves. |
Educational information (of Practitioner) | Educational degrees & background. | The consumers themselves. |
Business Purposes for which the Personal Information is used
The following are the business or commercial purposes for which we use each category of personal information. Details about the information we collect for each category are provided in the table above. More details about the business or commercial purposes are provided in the privacy policy’s section titled ‘What we collect and why‘
| Categories of personal information | Categories of third parties to whom we disclose your information and the specific business or commercial purpose for the disclosure |
|---|---|
Identifiers Other personal information that identifies, relates to, describes, or is capable of being associated with, a particular individual Internet or other electronic network activity information Geolocation data Customer records (of Practitioner) Professional or job-related information (of Practitioner) Educational information (of Practitioner) | Helping to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for these purposes Debugging to identify and repair errors that impair existing intended functionality Performing services on behalf of a businessproviding customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of a business Undertaking internal research for technological development and demonstration Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standard Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of the current interaction with the Service or Website, provided that personal information is not disclosed to another third party and is not used to build a profile or otherwise alter the experience outside the current interaction with the Air Doctor. |
Characteristics of Protected Classifications Consumer Commercial information Audio, electronic, visual, thermal, olfactory, or similar information | For the limited purposes as authorized in the state privacy laws. |
Sharing, Selling and Disclosing to third parties
We use data collected via cookies, such as analytics and performance data to provide you with our Website or Service functionality and to customize your experience. We also share personal information in ways that may be considered as a “sale” or “share” under state privacy laws, with the third party cookie providers we use on our Website and Service.
We only use your sensitive personal information for the limited purposes as authorized in state privacy laws.
The chart below explains what is the personal information we disclosed for a business purpose to third parties in the preceding 12 months. Other than this, we have not disclosed your personal information for a business purpose in the preceding 12 months
| Categories of personal information | Categories of third parties to whom we disclose your information and the specific business or commercial purpose for the disclosure |
|---|---|
Identifiers Other personal information that identifies, relates to, describes, or is capable of being associated with, a particular individual Internet or other electronic network activity information Geolocation data Customer records (of Practitioner) Professional or job-related information (of Practitioner) Educational information (of Practitioner) | Our service providers, who will use it only as necessary to assist us in the internal operations of our business and the Service or the Website, and not for their own promotional purposes. Competent authorities, legal counsels, and advisors if you abused your rights to use the Service or the Website or violated any applicable law in the course of doing business with us. Judicial, governmental, or regulatory authority if they require us to disclose your information Target entity of the merger or acquisition, legal counsels, and advisors If the operation of the Service or the Website or our business is organized within a different framework, or through another legal structure or entity. Practitioners. |
Characteristics of Protected Classifications Consumer Commercial information Audio, electronic, visual, thermal, olfactory, or similar information | Our service providers, who will use it only as necessary to assist us in the internal operations of our business and the Service, and not for their own promotional purposes. Competent authorities, legal counsels, and advisors if you abused your rights to use the Service or violated any applicable law in the course of doing business with us. Judicial, governmental, or regulatory authority if they require us to disclose your information Target entity of the merger or acquisition, legal counsels, and advisors If the operation of the Service or our business is organized within a different framework, or through another legal structure or entity. Practitioners |
Your rights if you reside in the United States
Notice of the Right to Opt-Out Using the Opt-Out Preference Signal
You have a right to opt out of sharing your personal information for behavioral-targeted ads. You can exercise this right by using the opt-out preference signal as explained here.
We process the opt-out preference signal if it is sent by your browser in accordance with the "Global Privacy Control." For more information on how to install and implement the Global Privacy Control, please visit globalprivacycontrol.org/#download.
If you turn on this Global Privacy Control in your browser, we will receive the signal, process it in a frictionless manner, and treat it as a request to opt out of the use of your personal information for behavioral-targeted ads. The opt-out request is specific to the browser in which you have it turned on. It is effective as an opt-out request only while you use that browser to surf the web.
Knowing the personal information we collect about you and to obtain the personal data in a readable format
You have the right to know:
- The categories of personal information we have collected about you.
- The categories of sources from which the personal information is collected.
- Our business or commercial purpose is for collecting personal information.
- The categories of third parties with whom we share personal information, if any.
- The specific pieces of personal information we have collected about you.
Right to delete personal data provided by or obtained about you
Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:
- Delete your personal information from our records; and
- Direct any service providers to delete your personal information from their records.
Please note that we may not delete your personal information if it is necessary to:
- Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us.
- Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes.
- Debug to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
- Comply with the applicable privacy act.
- Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the ability to complete such research, provided we have obtained your informed consent.
- Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us and compatible with the context in which you provided the information.
or
- Comply with an existing legal obligation.
We also will deny your request to delete if it proves impossible or involves disproportionate effort, or if another exception to state privacy laws applies. We will provide you with a detailed explanation that includes enough facts to give you a meaningful understanding as to why we cannot comply with the request to delete your information.
Right to correct inaccurate personal information, taking into account the nature of the data and the purposes for processing the data
If we receive a verifiable request from you to correct your information and we determine the accuracy of the corrected information you provide, we will correct inaccurate personal information that we maintain about you.
In determining the accuracy of the personal information that is the subject of your request to correct, we will consider the totality of the circumstances relating to the contested personal information.
We also may require that you provide documentation if we believe it is necessary to rebut our own documentation so that the personal information is accurate.
We may deny your request to correct in the following cases:
- We have a good-faith, reasonable, and documented belief that your request to correct is fraudulent or abusive.
- We determine that the contested personal information is more likely than not accurate based on the totality of the circumstances.
- Conflict with federal or state law.
- Other exception to state privacy laws.
- Inadequacy in the required documentation
- Compliance proves impossible or involves disproportionate effort.
We will provide you with a detailed explanation that includes enough facts to give you a meaningful understanding as to why we cannot comply with the request to correct your information
Protection against discrimination for exercising these rights
You have the right not to be discriminated against by us because you exercised any of your rights under state privacy laws.
Exercising your rights by yourself or through an authorized agent
If you would like to exercise any of your rights as described in this Policy, please contact us by e-mail at: privacy@air-dr.com
We will ask you for additional information to confirm your identity and for security purposes, before disclosing the personal data requested to you, by using a two or three points of data verification process, depending on the type of information you require and the nature of your request.
We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal data requested to you, by using a two or three points of data verification process, depending on the type of information you require.
You may also designate an authorized agent to make a request on your behalf. To do so, you need to provide the authorized agent with written permission to do so, and the agent will need to submit proof to us that they have been authorized by you. We will also require that you verify your own identity, as explained below.
Do Not Track
Our Do Not Track Notice. We do not currently respond or take any action with respect to web browser “do not track” signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of Personal Data about a User’s online activities over time and across third-party web sites or online services.
See also the Terms of Use.