Your privacy, and your medical records
You send us medical reports so we can get you hospital quotes. We use them for that, share them only with the specific hospitals you approve, store them encrypted, and delete them when you ask. This page says exactly how.
What we collect
- Contact details: name, country, WhatsApp number, email
- Medical information: the reports, scans, prescriptions and history you send us, and what you tell your case manager
- Case details: the treatment you are considering, your timeline, and what you have been quoted
- Website data: standard analytics, and which page an enquiry came from
Why we ask for medical reports
A hospital cannot price your treatment without knowing your clinical situation. Any quote given without your reports is a guess. This is the only reason we ask.
Who we share them with
Only the hospitals you approve, and only the hospitals you approve. We name them before we send anything, and we send only what the hospital needs to price your case.
We do not sell your data. We do not share it with other facilitators, insurers, advertisers or data brokers. We do not use your reports for marketing.
Your consent, separately
We ask you to agree separately, in plain language, to each of these. Never bundled into one tick box, never pre-ticked.
- We may process your reports in order to obtain hospital quotes
- We may send your reports to the specific hospitals we name to you
- We may contact you about your enquiry
- We may send you general information later. Entirely optional, and refusing it changes nothing about your case
You can withdraw any of these at any time.
How reports are stored
Encrypted, on servers that are not publicly reachable, with every access logged. Files are never stored where the web can serve them directly. Access is limited to the case manager handling your case.
How long we keep them
Medical reports are deleted 12 months after your case closes, or sooner if you ask. Case records are kept longer for tax and legal purposes, but medical documents are removed from them.
Your rights
Ask us what we hold about you, correct it, or have it deleted. Withdraw consent. Ask us to stop contacting you. Complain to us, or to the Data Protection Board of India.
To delete your data, write to care@healthaford.com with the subject "Delete my data". We will confirm within seven days.
Grievance Officer: grievance officer pending
If you are in the UK or EU
The GDPR applies to you in addition to Indian law. Your medical information is special-category data and we process it on the basis of your explicit consent. Transfers to India are covered by standard contractual clauses. You may complain to your national data protection authority.