GDPR Data Subject Rights Request
Exercise Your Rights Under GDPR
Your Privacy Rights: Under the General Data Protection Regulation (GDPR), you have specific rights regarding your personal data. Use this form to submit a request to exercise your rights. We will respond within 30 days of receiving your verified request.
YOUR RIGHTS UNDER GDPR
Right of Access
Request a copy of your personal data we process
Right to Rectification
Correct inaccurate or incomplete personal data
Right to Erasure
Request deletion of your personal data ("right to be forgotten")
Right to Restriction
Limit how we process your personal data
Right to Data Portability
Receive your data in a portable format
Right to Object
Object to processing based on legitimate interests
SUBMIT YOUR REQUEST
To submit a GDPR rights request, please complete the following steps:
- Identify Yourself: Provide information to verify your identity
- Select Your Rights: Choose which rights you wish to exercise
- Provide Details: Give specific information about your request
- Submit Request: Send your request through one of our channels
REQUEST CHANNELS
Recommended: Online Form
Submit your request through our secure online portal for fastest processing
Go to Support PortalSend your request via email with the subject line "GDPR Rights Request"
Email:support@getbirch.com
Postal Mail
Send written requests to our privacy team
28labs Inc.Attn: Privacy Team - GDPR Request
[Address to be provided]
INFORMATION REQUIRED FOR YOUR REQUEST
Important: Identity Verification Required
To protect your privacy and ensure security, we must verify your identity before processing any request. Please include the following information:
1. Personal Identification
- Full name
- Email address associated with your Birch account
- Professional license number (if applicable)
- Date of account creation (approximate)
- Country of residence
2. Request Details
- Which right(s) you are exercising
- Specific data or processing activities concerned
- Time period relevant to your request (if applicable)
- Reason for your request (optional but helpful)
- Preferred response format
3. Additional Information (if applicable)
- Representative information (if request made on behalf of someone)
- Previous correspondence reference numbers
- Specific departments or services involved
- Any deadlines or urgency factors
REQUEST PROCESSING TIMELINE
Day 1-3: Receipt & Acknowledgment
We acknowledge receipt of your request and begin verification
Day 4-7: Identity Verification
We verify your identity and may request additional information
Day 8-25: Processing
We process your request and gather relevant data
Day 26-30: Response
We provide our full response to your request
Complex Requests: In exceptional circumstances involving complex requests, we may extend the response time by up to 60 additional days. We will notify you within the initial 30-day period if an extension is necessary, explaining the reasons for the delay.
IDENTITY VERIFICATION PROCEDURES
Enhanced Security Verification
To protect against fraudulent requests and ensure the security of personal data, we employ a multi-step verification process:
- Initial Verification:
- Email verification to registered account address
- Security questions based on account activity
- Verification code sent to registered phone number
- Enhanced Verification (if required):
- Government-issued ID (with sensitive information redacted)
- Professional license verification for healthcare providers
- Video verification call for high-risk requests
- Notarized statement for certain jurisdictions
- Failed Verification:
- Maximum 3 attempts allowed
- 24-hour lockout after failed attempts
- Alternative verification methods available
- Right to appeal verification decisions
AGENT/REPRESENTATIVE AUTHORIZATION
You may authorize an agent or representative to make a request on your behalf. Requirements for authorized representatives:
For Individual Representatives:
- Written authorization signed by the data subject
- Power of attorney (if applicable)
- Proof of representative's identity
- Declaration of authority to act
For Legal Representatives:
- Court order or legal documentation
- Bar membership verification
- Client authorization letter
- Confidentiality agreement
For Parental/Guardian Requests:
- Proof of legal guardianship
- Birth certificate or adoption papers
- Court-appointed guardianship documents
- Verification of minor's identity
FEE SCHEDULE FOR EXCESSIVE REQUESTS
| Request Type | First Request | Additional Requests (within 12 months) | Manifestly Unfounded/Excessive |
|---|---|---|---|
| Access Request | Free | €10 / $12 | €50 / $60 or refusal |
| Rectification | Free | Free | €25 / $30 |
| Erasure | Free | Free | €25 / $30 |
| Data Portability | Free | €15 / $18 | €75 / $90 |
| Complex Requests | Free (may extend timeline) | Hourly rate: €50 / $60 | Actual costs + admin fee |
Note: Fees are waived for corrections of errors made by Birch or where required by law. Payment must be received before processing paid requests.
PARTIAL FULFILLMENT PROCEDURES
In some cases, we may only be able to partially fulfill your request. This may occur when:
- Legal Restrictions: Certain data must be retained for legal compliance
- Third-Party Rights: Request affects others' privacy rights
- Technical Limitations: Some data is technically impossible to retrieve or delete
- Ongoing Services: Data necessary for continued service provision
When Partial Fulfillment Occurs:
- We will fulfill as much of your request as legally and technically possible
- Provide detailed explanation of what couldn't be fulfilled and why
- Offer alternative solutions where available
- Document the partial fulfillment for compliance records
- Inform you of your right to appeal or complain about the decision
CROSS-BORDER REQUEST HANDLING
Special procedures apply for requests involving multiple jurisdictions:
EU/EEA Requests:
- Processed under GDPR regardless of data location
- Response in language of request (where possible)
- Coordination with EU representative
- Currency options for any applicable fees
UK Requests:
- Processed under UK GDPR
- Coordination with UK representative
- ICO complaint rights preserved
International Requests:
- Local law compliance where applicable
- Extended timelines for translation needs
- Coordination with local counsel if required
- Currency conversion at current exchange rates
IMPORTANT INFORMATION
Free of Charge
In most cases, we will not charge a fee for processing your request. However, we may charge a reasonable fee or refuse to act on a request if it is manifestly unfounded, excessive, or repetitive.
Legal Limitations
Some rights may be limited by law. For example, we may need to retain certain data for legal compliance, or we may not be able to delete data that is necessary for ongoing healthcare provision.
Third-Party Data
If your request involves data about other individuals, we may need to balance your rights against theirs and may redact or withhold certain information.
APPEAL PROCESS
If you are not satisfied with our response to your request, you have the right to:
- Request Review: Ask us to reconsider our decision by contacting our Data Protection Officer at support@getbirch.com
- Lodge a Complaint: File a complaint with your local data protection supervisory authority
- Seek Legal Remedy: Pursue judicial remedies through the courts
SUPERVISORY AUTHORITIES
You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. Key authorities include:
CONTACT OUR PRIVACY TEAM
For questions about this process or assistance with your request:
Data Protection Officer:support@getbirch.com
Privacy Team:support@getbirch.com
Support Portal:/support
EU Representative:support@getbirch.com
Privacy Notice: When you submit a GDPR rights request, we process your personal data under Article 6(1)(c) of the GDPR (legal obligation) and Article 6(1)(f) (legitimate interests in verifying identity). We retain request records for 3 years for compliance purposes. For more information, see our GDPR Privacy Policy.