Privacy Policy

1. Our approach

The public Medical Travel Cost registry is designed to be privacy-light: you can browse prices, hospitals and rankings without an account, and we keep the data we hold about visitors to a minimum.

If you contact us, submit a price estimate request, or use our separate signed-in Case Desk to reach a hospital, you may choose to give us details about the treatment you are researching — which can include information about your health. We use that information only to handle the request you have asked us to make. This Policy explains how, and what choices you have.

2. Who is responsible

The data controller is [Operator legal name], [registered address]. For any privacy question or request, contact privacy@medicaltravelcost.com.

3. What we collect

Preferences (functional cookie): a first-party cookie stores your chosen display currency and home country so figures are shown in a relevant form. It holds a preference, not your identity.

Privacy-first analytics: we use Umami, a cookieless, privacy-focused analytics service, to understand aggregate usage — such as which pages are viewed and rough traffic sources. Umami does not use cookies, does not collect information that identifies you personally, and does not track you across other websites. We do not use Google Analytics, advertising pixels, or profiling.

Server logs: our hosting and infrastructure providers process standard technical logs (such as IP address and request metadata) to deliver, secure and troubleshoot the Service.

Enquiries and price estimates: when you use our contact or estimate forms, we process the details you provide — such as your name, email, the procedure or hospital you are interested in, and any message — to respond to you and, where you ask us to, to help connect you with a hospital. These details may include information about your health where you choose to provide it.

Case Desk (separate signed-in service): our Case Desk lets you send an enquiry to a hospital. To do this we process your email address (used to sign you in with a one-time link — there is no password) and the enquiry details you enter: the procedure, the hospital, your intended travel month and any notes, which may include health information. Your free-text notes are encrypted. When an enquiry is forwarded to a hospital we send the treatment details you entered but not your identity or contact details, and a member of our team may access those details to deliver your enquiry. The Case Desk is governed by its own notice, in addition to this Policy.

4. Why we process it (legal bases)

Where the EU/UK GDPR applies: preferences and security rest on our legitimate interest and on what is necessary to provide the site you request; our cookieless analytics rests on our legitimate interest in understanding aggregate usage, and is chosen specifically because it stores no cookies and no personal data; enquiries are processed to take steps at your request and on our legitimate interest in responding.

Health information: where an enquiry, estimate request or Case Desk inquiry includes information about your health (a specially protected category of data), we rely on your explicit consent, which you give by ticking the box on the form before you submit it. We record that consent and when it was given, and you can withdraw it at any time by contacting us or, for the Case Desk, by deleting your account — this does not affect anything done lawfully beforehand.

5. Cookies

We set one first-party cookie, to remember your display currency and home country. Our analytics (Umami) is cookieless, and we use no advertising cookies. You can block or delete cookies in your browser at any time.

6. Who we share with

We do not sell your personal data and do not share it for third-party advertising. We share data only with: our cookieless analytics provider (Umami); our hosting and infrastructure providers; our email delivery provider, used to send you replies and to forward an enquiry when you ask us to; a hospital you explicitly ask us to contact on your behalf (which receives the treatment details you entered, but not your identity or contact details); and public authorities where we are legally required to do so.

7. International transfers

Our analytics provider (Umami), our hosting and infrastructure providers, and our email delivery provider may process data in locations outside your country. Our analytics is cookieless and collects no personal data. Where you send us enquiry or Case Desk details — which may include personal and health information — those details may also be processed by our hosting and email providers outside your country; where required by law we rely on appropriate safeguards.

8. Retention

Preference cookies last until they expire or you clear them. Enquiry and estimate details are kept for as long as needed to handle your request and for a reasonable period afterwards. If you use the Case Desk, deleting your account removes your data. (A detailed, per-field retention schedule is being finalised.)

9. Your rights

Depending on where you live (for example, under the EU/UK GDPR or the California CCPA/CPRA), you may have rights to access, correct, delete, port, restrict or object to the processing of your personal data, and to withdraw consent where processing is based on it. To exercise any right, contact privacy@medicaltravelcost.com. You also have the right to complain to your local data-protection authority.

10. Children

The Service is intended for adults researching medical-travel decisions and is not directed to children under 18. We do not knowingly collect personal data from children.

11. Security

We use reasonable technical and organisational measures to protect the limited data we handle. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes

We may update this Policy from time to time. The "last updated" date at the top shows the current version.