Privacy Policy & Data Protection Notice
Get Doctor Second Opinion (GDSO)
Operated by NEXTPEAK SRLS
Last updated: August 2026
- Introduction
Get Doctor Second Opinion (“GDSO”, “we”, “us” or “our”) is a digital platform operated by NEXTPEAK SRLS, an Italian company, that facilitates access to medical second-opinion services.
GDSO enables individuals to submit information relating to their medical case and, where appropriate, facilitates the secure transmission of relevant information to qualified medical specialists, hospitals, university hospitals, specialist centres and other healthcare institutions participating in the GDSO network.
The purpose of this Privacy Policy is to explain how NEXTPEAK SRLS processes personal data when you visit the GDSO website, contact us, request a second opinion, or use services associated with the GDSO platform.
Because medical information is particularly sensitive, we apply enhanced safeguards to the processing of health data.
This Privacy Policy applies specifically to the GDSO website and second-opinion service.
GDSO does not provide medical treatment. GDSO facilitates access to medical expertise and the transmission of information necessary for the requested second-opinion service. Medical assessments, opinions, diagnoses and recommendations are provided by the relevant qualified medical professionals or participating healthcare institutions.
Any services outside the GDSO second-opinion process are subject to separate arrangements and are not covered by this Privacy Policy.
- Who We Are
The entity responsible for the processing of personal data in connection with the GDSO website and second-opinion service is:
NEXTPEAK SRLS
Trading as Get Doctor Second Opinion (GDSO)
Via Celso 35
73048 Nardò (LE)
Italy
VAT No.: IT 05477050750
Email: [email protected]
Website: www.getdoctorsecondopinion.com
For privacy and data-protection enquiries:
NEXTPEAK SRLS acts as the data controller for the personal data processed through the GDSO website and in connection with the GDSO second-opinion service, except where another entity independently determines the purposes and means of processing its own data processing activities.
- What GDSO Does
GDSO is a platform for facilitating access to medical second opinions.
Depending on the service requested, GDSO may:
● receive and process a patient’s request for a second opinion;
● collect information necessary to understand and coordinate the case;
● facilitate the submission of medical records and diagnostic information;
● coordinate the identification of an appropriate medical specialist or participating medical institution;
● securely transmit relevant information to the authorised specialist or institution;
● coordinate communications relating to the second-opinion process;
● facilitate a remote consultation where this forms part of the agreed service;
● facilitate delivery of the resulting medical second-opinion report.
GDSO does not itself diagnose medical conditions, prescribe treatment or provide medical treatment.
The medical assessment itself is carried out by the relevant qualified medical professional or healthcare institution.
- Personal Data We May Collect
Depending on how you interact with GDSO, we may process the following categories of personal data.
4.1 Identification and contact information
This may include:
● full name;
● date of birth;
● nationality, where relevant;
● residential or correspondence address;
● telephone number;
● email address;
● preferred language;
● other information necessary to establish and manage your service relationship.
4.2 Medical and health information
Where you request a medical second opinion, we may process information necessary for the specialist to understand and assess your case, including:
● medical history;
● diagnoses and suspected diagnoses;
● symptoms;
● treatment history;
● laboratory results;
● medical reports;
● pathology reports;
● radiology reports;
● medical images and diagnostic imaging;
● prescriptions and medication information;
● operative reports;
● other relevant clinical documentation.
Health information constitutes special category personal data under Article 9 GDPR.
We process such information only where an appropriate legal basis under applicable data-protection law exists and, where required, with your explicit consent.
4.3 Payment information
Where you purchase a GDSO service, payment information may be processed through our payment service provider, Stripe.
GDSO does not generally need to receive or retain your complete payment-card details.
Payment-card processing is handled through the applicable payment infrastructure and according to the relevant provider’s security and privacy framework.
4.4 Communications
We may process information contained in:
● emails;
● messages;
● enquiries;
● contact-form submissions;
● communications relating to your case;
● communications concerning appointments and service administration.
4.5 Technical information
When you visit our website, certain technical information may be collected automatically, including:
● IP address;
● browser type and version;
● device type;
● operating system;
● time zone;
● language settings;
● technical identifiers;
● information concerning website interaction.
The precise use of cookies and similar technologies is addressed in our separate Cookie Policy.
4.6 Information received from third parties
Where appropriate and lawful, GDSO may receive limited personal information from:
● healthcare professionals;
● hospitals or medical institutions;
● authorised referral partners;
● professional representatives;
● other persons or organisations referring a patient to GDSO.
Such information is processed only for legitimate and relevant purposes connected with the GDSO service.
- How We Use Personal Data
We process personal data only for defined and legitimate purposes.
These purposes may include:
Providing and coordinating the requested second-opinion service
This includes receiving your request, understanding the nature of your case, coordinating the relevant specialist pathway, transmitting relevant medical information and facilitating delivery of the second opinion.
Facilitating communication
We may use your contact information to communicate with you regarding:
● your request;
● case status;
● required documentation;
● appointments;
● consultations;
● delivery of the second opinion;
● administrative matters relating to the service.
Processing payments
We process information necessary to administer payments and billing for GDSO services, including through Stripe.
Responding to enquiries
We process information submitted through our website or other communication channels to respond to your questions and requests.
Operating and maintaining our website and digital infrastructure
We process technical information as necessary to maintain security, functionality, performance and reliability.
Improving our services
Where legally permitted, we may analyse appropriate technical and usage information to improve the functionality, accessibility and quality of GDSO.
Legal and regulatory compliance
We may process information where necessary to comply with applicable legal, regulatory, accounting, tax or other statutory obligations.
Protecting our rights and interests
We may process information where necessary to establish, exercise or defend legal claims, prevent misuse of our services, investigate security incidents or protect our legitimate business interests.
- Legal Bases for Processing
Depending on the circumstances, processing may be based on one or more of the following legal grounds under the GDPR.
Performance of a contract — Article 6(1)(b) GDPR
Where processing is necessary to provide the service you have requested, administer your relationship with GDSO or take steps at your request before entering into a service relationship.
Consent — Article 6(1)(a) GDPR
Where you have provided consent for a specific processing activity.
Explicit consent concerning health data — Article 9(2)(a) GDPR
Medical information is special category data. Where required, we obtain your explicit consent before processing and transferring relevant health information for the purpose of obtaining the requested second opinion.
You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. However, withdrawal may make it impossible for GDSO to continue providing a service that requires the relevant health information.
Legal obligation — Article 6(1)(c) GDPR
Where processing is necessary to comply with a legal obligation applicable to NEXTPEAK SRLS.
Legitimate interests — Article 6(1)(f) GDPR
Where processing is necessary for our legitimate interests, or those of a third party, provided that these interests are not overridden by your fundamental rights and freedoms.
Such interests may include website security, fraud prevention, service administration, legal claims and improvement of our services.
Where special category data is involved, an additional legal basis under Article 9 GDPR will be required.
- Processing of Medical Information
Medical information is central to the GDSO second-opinion service and is therefore treated with particular care.
We process health information only to the extent reasonably necessary to facilitate the requested medical second opinion.
Where you submit medical records, you should provide only information that is relevant to the requested medical assessment.
Your medical information may include information concerning your medical history, diagnosis, treatment, laboratory findings, imaging and other clinical information necessary for specialist review.
Before relevant medical information is transferred to a medical specialist or participating healthcare institution, GDSO will ensure that the applicable legal requirements for such processing and transfer have been satisfied.
Where explicit consent is required, the relevant consent will be obtained before the transfer takes place.
- Medical Specialists and Healthcare Institutions
To provide the requested second-opinion service, GDSO may facilitate the transfer of relevant information to qualified medical specialists and participating healthcare institutions.
These may include:
● individual medical specialists;
● specialist medical centres;
● hospitals;
● university hospitals;
● multidisciplinary medical teams;
● other appropriately qualified healthcare institutions.
The recipient will receive only information that is relevant and reasonably necessary for the requested medical review, subject to applicable legal requirements.
The medical specialist or healthcare institution is responsible for its own professional medical activities and for complying with the legal and professional obligations applicable to it.
GDSO does not assume responsibility for the clinical judgment, diagnosis or medical recommendations issued by an independent medical specialist or healthcare institution.
- Service Providers and Data Processors
To operate GDSO effectively and securely, NEXTPEAK SRLS may use specialised third-party service providers.
These may include providers supporting:
● website hosting and infrastructure;
● CRM and case management;
● secure medical-document transmission;
● electronic communications;
● payment processing;
● video consultation;
● cybersecurity;
● technical maintenance;
● data storage and related IT services.
We select service providers appropriate to the nature of the services they provide and require them, where applicable, to process personal data only on our documented instructions and subject to appropriate confidentiality and security obligations.
The specific technology providers used by GDSO may change over time as our systems and security requirements evolve. We therefore avoid defining the GDSO privacy framework by reference to a particular medical-data technology provider.
Where a provider processes personal data on our behalf, appropriate contractual arrangements and safeguards will be implemented as required by applicable law.
- Payment Processing
Payments for GDSO services may be processed through Stripe.
Where payment is made through Stripe, relevant payment information is processed by Stripe in accordance with its own applicable privacy and security terms.
GDSO processes the payment information necessary to confirm and administer the transaction, maintain billing records and comply with applicable accounting and tax obligations.
- International Data Transfers
GDSO may facilitate medical second opinions from specialists and healthcare institutions located in different countries.
As a result, personal data, including health information, may in appropriate circumstances be transferred outside the European Economic Area.
Where personal data is transferred to a country outside the EEA, NEXTPEAK SRLS will ensure that the transfer is carried out in accordance with Chapter V of the GDPR.
Depending on the circumstances, an international transfer may rely on:
● an applicable European Commission adequacy decision;
● Standard Contractual Clauses;
● another legally recognised transfer mechanism;
● or another applicable safeguard permitted under the GDPR.
Where required, additional measures will be implemented to ensure an appropriate level of protection for personal data.
Where explicit consent is the applicable legal basis for the transfer of health information, the relevant consent will be obtained before the transfer.
- Data Security
Because GDSO processes highly sensitive medical information, NEXTPEAK SRLS applies appropriate technical and organisational measures designed to protect personal data against:
● unauthorised access;
● accidental loss;
● destruction;
● alteration;
● unauthorised disclosure;
● unlawful processing.
Depending on the relevant system and service, security measures may include:
● encrypted transmission;
● secure document-transfer mechanisms;
● access controls;
● authentication mechanisms;
● restricted access to case information;
● confidentiality obligations;
● secure hosting and storage;
● appropriate technical monitoring;
● regular review of security measures.
Access to medical case information is restricted to persons and organisations authorised and required to access it for the relevant purpose.
No method of transmission or electronic storage can be guaranteed to be completely secure. Nevertheless, we continuously seek to maintain security measures appropriate to the sensitivity and risks associated with the data we process.
Where a personal-data breach occurs that is subject to notification requirements under applicable law, NEXTPEAK SRLS will comply with the relevant GDPR obligations, including Articles 33 and 34 where applicable.
- Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, taking into account:
● the nature of the information;
● the purpose of processing;
● the duration of the service relationship;
● legal and regulatory obligations;
● accounting and tax requirements;
● contractual requirements;
● applicable limitation periods;
● the need to establish, exercise or defend legal claims;
● legitimate business and operational requirements.
Medical records and information relating to a completed second-opinion case will be retained for the period necessary to fulfil the relevant legal, contractual, regulatory and professional requirements applicable to NEXTPEAK SRLS and the service.
Payment and accounting information will be retained for the periods required under applicable accounting and tax legislation.
Information relating to enquiries that do not result in a service relationship will generally be retained only for as long as reasonably necessary to respond to the enquiry and maintain appropriate records.
Where personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with applicable requirements.
- Cookies and Similar Technologies
The GDSO website uses cookies and similar technologies.
Information about the categories of cookies used, their purposes, the relevant providers and how you can manage your preferences is provided separately in our:
Cookie Policy
The Cookie Policy forms part of GDSO’s broader privacy framework but is maintained separately so that information concerning website technologies can be kept current as the website and its technical environment evolve.
- Your Data Protection Rights
Subject to the conditions and limitations provided by applicable law, you may have the following rights under the GDPR:
Right of access
You may request information about whether we process your personal data and obtain a copy of the personal data we hold about you.
Right to rectification
You may request correction of inaccurate or incomplete personal data.
Right to erasure
You may request deletion of your personal data in circumstances provided by law.
This right is subject to applicable exceptions, including legal obligations requiring us to retain certain information.
Right to restriction
You may request restriction of processing in circumstances provided by Article 18 GDPR.
Right to data portability
Where the applicable legal conditions are met, you may request your personal data in a structured, commonly used and machine-readable format.
Right to object
You may object to certain processing based on legitimate interests and to direct marketing where applicable.
Right to withdraw consent
Where processing is based on your consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Rights relating to automated decision-making
Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.
GDSO does not intend to make significant medical decisions about patients through solely automated decision-making.
- How to Exercise Your Rights
To exercise your rights or ask questions about the processing of your personal data, please contact:
NEXTPEAK SRLS / GDSO
Email: [email protected]
Please provide sufficient information for us to understand your request.
For security reasons, we may need to verify your identity before responding to a request concerning personal data.
We aim to respond to valid data-protection requests within the time limits required by applicable law.
- Children and Minors
GDSO’s services are not primarily directed at children.
Where a second opinion is requested for a person under the age of 18, the request and submission of personal and medical information must be made by a parent or legally authorised representative, unless applicable law provides otherwise.
Where necessary, we may request evidence of the authority of the person acting on behalf of the minor.
If you believe that personal data concerning a minor has been submitted to GDSO without appropriate authorisation, please contact us promptly.
- Third-Party Websites and Services
The GDSO website may contain links to websites, platforms or services operated by third parties.
This Privacy Policy applies to the processing activities carried out by NEXTPEAK SRLS in connection with GDSO.
It does not govern the privacy practices of independent third-party websites or services.
We encourage you to review the applicable privacy information before providing personal information directly to a third-party provider.
- Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
● changes in our services;
● changes to our technology;
● changes in our organisational structure;
● changes in applicable law;
● changes in our data-processing activities;
● changes in the medical specialist or institutional network.
The current version will always be made available on the GDSO website and will contain the applicable “Last updated” date.
Where required by applicable law, we will provide additional notice of material changes.
- Supervisory Authority and Right to Complain
If you believe that your personal data has been processed unlawfully or that your data-protection rights have not been adequately respected, you have the right to lodge a complaint with a competent data-protection supervisory authority.
For NEXTPEAK SRLS, the relevant Italian supervisory authority is:
Garante per la Protezione dei Dati Personali
You may also contact the data-protection supervisory authority in the EU/EEA country where you reside, work or believe that an infringement has occurred, subject to the applicable rules.
- Contact Us
For questions concerning this Privacy Policy, the processing of your personal data, or the exercise of your data-protection rights, please contact:
NEXTPEAK SRLS
Trading as Get Doctor Second Opinion (GDSO)
Via Celso 35
73048 Nardò (LE)
Italy
Email: [email protected]
Website: www.getdoctorsecondopinion.com
Telephone: +39 334 890 6466
Last updated: August 2026