Privacy policy

Who we are

Controller: Travel2Doctor

Privacy contact: panos@travel2doctor.com

If our legal entity name, registered address, or data protection officer details change, we will update this page.

What this policy covers

• Visiting our website
• Sending an enquiry (name, email, phone, message, interest)
• Using our concierge or similar chat tools when they are live
• Emails we send you in reply to an enquiry

It does not cover independent clinics, insurers, payment providers, or other third-party sites you may visit via links.

Personal data we collect

Information you give us

When you use the enquiry form (or similar contact routes), we typically collect:

• Name
• Email address
• Phone number (optional)
• Procedure or interest (if you provide it)
• Free-text message
• Which page you sent the form from (source)

Please don’t send medical records through the website form — test results, clinical photos, or full histories — unless we have expressly asked for a specific item and explained how it will be handled. Health information is special category data under UK GDPR; we minimise what we collect.

Information collected automatically

When you load our pages, our hosting environment and server logs may process:

• IP address
• Date and time of request
• Browser type and basic device information
• Pages requested and referrer URL

We keep the public site privacy-light: fonts are self-hosted, and we do not rely on third-party advertising trackers on the main static pages. Logs are for security, debugging, and basic traffic understanding.

Cookies

The main public site is mostly static HTML and does not need advertising cookies. Essential cookies or similar storage may be used by:

• Hosting / security features
• Session or preference needs if we add interactive tools later

If we introduce non-essential cookies (for example analytics), we will update this policy and, where required, provide a choice mechanism.

Concierge / AI chat (when enabled)

If you use an on-site concierge:

• Conversation text you type may be processed to answer general questions and to help us follow up
• We design the service to avoid soliciting detailed health data — please do not paste clinical notes or full medical histories into chat
• Messages may be processed by a carefully chosen AI provider under a contract that restricts use of your data for their own training where we can obtain that commitment
• Structured lead details (name, contact preference, procedure interest) may be emailed to our team the same way form enquiries are

Why we use your data

• Respond to enquiries — reply by email or phone. Lawful basis: legitimate interests and/or steps prior to a contract.
• Introduce you to a clinic — only with your involvement. Lawful basis: legitimate interests and/or consent where we ask for it.
• Operate and secure the website — logs, abuse prevention, rate limits. Lawful basis: legitimate interests.
• Improve content and service — aggregated patterns, not ad profiling. Lawful basis: legitimate interests.
• Legal compliance — tax, dispute, or regulatory requests. Lawful basis: legal obligation.
• Health data you volunteer — only if you include it. Lawful basis: explicit consent (and we prefer you not to send it via the form).

You can object to processing based on legitimate interests — email us and we will consider your request.

Who we share data with

We do not sell your personal data.

We may share data with:

• Email and hosting providers — to deliver mail and run the site (processors on our instructions)
• AI infrastructure providers — only if you use the concierge, and only as needed for that feature
• Clinics or partners — only when you have asked us to make an introduction
• Professional advisers or authorities — where required by law or to protect rights and safety

Transfers outside the UK/EEA use an appropriate safeguard (for example the UK International Data Transfer Agreement / Addendum, or adequacy regulations).

How long we keep data

• Enquiry records and related emails — typically up to 24 months, longer if a conversation, complaint, or legal reason needs it
• Server logs — a short operational period set by the host (often weeks to a few months)
• Concierge transcripts — only as long as needed to provide the service and handle follow-up, then deleted or anonymised

Backups may persist slightly longer until rotated.

Security

We use measures appropriate to a small service handling enquiry data: access control to mail and backup stores, HTTPS on the live site, rate limiting on the form, and enquiry backups outside the public web root. No method of transmission or storage is perfectly secure.

Your rights

Under UK data protection law you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase data in certain circumstances
• Restrict or object to certain processing
• Data portability (where applicable)
• Withdraw consent where processing is based on consent
• Complain to the Information Commissioner’s Office (ico.org.uk)

To exercise rights, email panos@travel2doctor.com. We may need to verify your identity. We aim to respond within one month.

Children

Our services are aimed at adults considering treatment. We do not knowingly collect data from children. If you believe a child has submitted data, contact us and we will delete it where appropriate.

Third-party links

Guides and pages may link to NHS, clinic, regulator, or other external sites. Those sites are responsible for their own privacy practices.

Changes to this policy

We may update this page when our practices or the law change. The “Updated” date on this page will change. Material changes may also be highlighted on the site where practical.