MedTour

1. What this policy covers

This policy explains how we collect, use, share, and protect personal information through TravelNTreat.com and related services. Because our service involves health information and transfers between countries, please read it carefully.

2. Information we collect

Information you give us:

Name, email, phone, date of birth, country, passport/travel details where needed for travel bookings, payment details (processed by our payment provider; we do not store full card numbers), messages, and reviews.

Health information you choose to share (Sensitive Data):

Medical history, diagnoses, medications, allergies, images, test results, treatment interests, and records you upload. This is sensitive data.

Information collected automatically:

IP address, device and browser type, pages viewed, referral source, approximate location, and cookie and similar-technology data (see Cookie Policy).

Information from others:

Providers (appointment status, quotes, treatment summaries you authorize), travel suppliers, payment processors, and identity or fraud-prevention services.

3. How we use information and our legal bases (GDPR/UK GDPR)

To create your account and provide the service: match you with providers, transmit your inquiries, and arrange bookings (legal basis: contract performance).
To process and share your health information: with providers you select (legal basis: your explicit consent).
To process payments, prevent fraud, and meet obligations: legal, tax, and accounting obligations (legal basis: legal obligation and legitimate interests).
To provide customer support: handle complaints, and improve the Platform (legal basis: legitimate interests).
To send marketing communications: consent or, where lawful, legitimate interests, with easy opt-out (legal basis: consent / legitimate interests).
To enforce our Terms: and protect rights, safety, and security (legal basis: legitimate interests).

4. How we share information

We share information only as needed: (a) with providers and travel suppliers you choose or are matched with; (b) with service providers acting on our behalf (hosting, payment processing, communications, analytics, customer support, translation), bound by contracts; (c) where required by law, court order, or to protect rights and safety; (d) in a merger, acquisition, or sale of assets, with notice; and (e) with your consent. We do not sell your personal information, and we do not sell or share your health information for advertising.

5. International transfers

Your information, including health information, will be transferred to and processed in countries outside your own, including the United States and the countries where your chosen providers are located. These countries may not offer the same level of protection as your home country. Where required, we rely on safeguards such as Standard Contractual Clauses, adequacy decisions, and your explicit consent for specific transfers. You can request details of the safeguards by contacting us.

6. Retention

We keep information only as long as necessary for the purposes described, to comply with law (for example tax and record-keeping), and to resolve disputes. Account data is retained for the life of the account plus 3 years; booking and payment records for 3 years; health records you upload for 12 months after your last booking unless you ask for earlier deletion.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your information; to data portability; to withdraw consent at any time; to opt out of targeted advertising or the sale or sharing of personal data; to limit use of sensitive information; and to lodge a complaint with your data protection authority. To exercise rights, email info@thipaksllc.com. We will verify your identity and respond within the legally required period (generally 30 to 45 days). We will not discriminate against you for exercising your rights.

8. Security

We use administrative, technical, and physical safeguards such as encryption in transit and at rest, access controls, and staff confidentiality obligations. No system is perfectly secure. If a breach affects you, we will notify you and regulators as required by law.

9. Providers' own handling

Once a provider receives your information, the provider processes it under its own privacy practices and local law as an independent controller. We are not responsible for providers' handling. Ask providers about their practices.

10. Children

The Platform is not directed to anyone under 18, and we do not knowingly collect information from minors. If you believe a minor has provided information, contact us and we will delete it.

11. Cookies and tracking

We use essential cookies and, with consent where required, analytics and marketing cookies. See our Cookie Policy for the list and how to change settings. We honor opt-out preference signals such as Global Privacy Control where required.

12. HIPAA note

Thipak’s LLC is not a healthcare provider and, depending on how we operate, may not be a HIPAA covered entity. Where we handle protected health information on behalf of a HIPAA-covered US provider, we do so under a Business Associate Agreement.

13. Changes to this policy

We will post updates here with a new effective date and, for material changes, notify you directly or request new consent where required.