Subject: Guidance Request for GDPR Compliance – New Telemedicine Platform
From: "Juliane Stall" <[email-masked]>
To: "info - AKI" <[email-masked]>
Date: Thu, 17 Jul 2025 16:45:39 +0300

Tähelepanu! Tegemist on välisvõrgust saabunud kirjaga.
Tundmatu saatja korral palume linke ja faile mitte avada.

Dear Sir or Madam,

I hope this message finds you well.

We are reaching out as the developers of a new telemedicine platform 
established in Estonia. As we expand our operations within the European 
Union, we are committed to ensuring full compliance with the General Data 
Protection Regulation (GDPR) and related Estonian data protection laws.

Our platform does not store electronic health records or medical charts. We 
only collect limited personal data directly from patients, such as:

*
Full name

*
Email address

*
Date of birth

*
Physical address

*
Brief description of symptoms (provided voluntarily by the user)

Given the nature of our service, we would appreciate your guidance on the 
key compliance measures we should implement. Specifically, we are looking 
for recommendations or official documentation regarding:

*
The necessity of appointing a Data Protection Officer (DPO)

*
Requirements for a Data Protection Impact Assessment (DPIA)

*
Recommended safeguards for storing and processing basic patient data

*
Any Estonian-specific obligations that may apply to telemedicine platforms

We are grateful for any advice or resources you can share to help us align 
fully with EU and national requirements.

Thank you very much for your time and support.

Kind regards,