Privacy Policy

1. Who we are, and what we are not

Global Healing Tourist LLP ("Healing Tourist", "we", "us") is a limited liability partnership registered in the State of Karnataka, India, operating the platform at healingtourist.com.

We are a medical facilitation service. We do not employ doctors, own hospitals, hold medical licences, or practise medicine. Specialists and hospitals accessible through our platform are independent, separately registered practitioners and institutions.

2. The laws that apply to you

If you are	Primary framework	Our role
In India	Digital Personal Data Protection Act, 2023; NMC Telemedicine Practice Guidelines for teleconsultation records	Data Fiduciary
In the EU or EEA	GDPR we process your data in India, a country without an EU adequacy decision	Controller, relying on Standard Contractual Clauses and supplementary measures
In the UK	UK GDPR and Data Protection Act 2018 India is not the subject of a UK adequacy regulation	Controller, relying on the UK International Data Transfer Addendum
In California	CCPA/CPRA, to the extent applicable to a foreign business	Business (we do not sell or share personal information)
Elsewhere	Indian law applies as the place of processing; local law may grant you further rights we will honour where practicable	Data Fiduciary

3. What we collect

3.1 Identity and contact data

• Name, date of birth, sex
• Email, mobile or WhatsApp number, country and city of residence
• Passport number and nationality only where you engage medical travel services requiring a visa invitation letter
• Nominated family contact, where you provide one

3.2 Health data

Under the DPDP Act this is personal data; under GDPR Article 9 and UK GDPR it is special category data requiring explicit consent. We collect:

• Diagnostic imaging, including DICOM studies
• Pathology, histopathology and laboratory reports
• Discharge summaries, operative notes and consultation letters
• Medication lists, allergies and clinical history
• The questions you ask, and the written opinion produced in response
• For domestic teleconsultation: the consultation record required under the NMC Telemedicine Practice Guidelines

3.3 Transaction data

Amount, date, service purchased, and a payment reference. We never receive or store your card number, UPI PIN, CVV or bank credentials. Payments are handled by an RBI-authorised payment aggregator under its own terms.

3.4 Technical data

IP address, browser and device type, pages visited, and referring source. See our Cookie Policy.

3.5 What we do not collect

We do not collect Aadhaar numbers, PAN, biometric identifiers, or data purchased from data brokers. We do not buy patient leads.

4. Why we process it, and on what basis

Purpose	Data used	Basis (DPDP / GDPR)
Checking whether your records are sufficient for review	Health data	Consent / Art. 9(2)(a) explicit consent
Providing your records to the reviewing specialist	Health data, first name	Consent, given per named specialist
Conducting a teleconsultation (India only)	Health data, identity	Consent; NMC TPG obligations
Coordinating treatment and travel	Identity, passport, health data	Consent; performance of contract
Issuing a visa invitation letter	Name, nationality, passport, hospital assignment	Consent; legal requirement of the receiving hospital
Taking payment	Transaction data	Performance of contract
Publishing aggregate statistics, including our rate of advising against travel	Non-identifiable aggregates only	Legitimate use / legitimate interests
Statutory record-keeping, tax, audit	Transaction data	Legal obligation
Service updates you asked for	Email, name never health data	Consent, withdrawable at any time

5. Who your records are shared with

5.1 The reviewing specialist

Your records go to the specific clinician you have authorised, and to nobody else on the panel. Each panellist is bound by a written confidentiality and data processing agreement requiring them to use your records solely to produce your opinion, to delete local copies within {{X}} days of delivery, and to report any unauthorised access within 24 hours.

5.2 Hospitals only in medical travel

If, and only if, you proceed to treatment in India, the relevant clinical records go to the treating hospital. They are provided to the clinical team. They are not provided to hospital marketing or business-development departments, and this restriction is written into our partnership agreements.

For second opinion services international or domestic your records are not shared with any hospital.

5.3 Processors

Encrypted storage, the video platform used for domestic teleconsultation, the payment aggregator, and medical translation where required. Each operates under a data processing agreement. A current list of categories and jurisdictions is available on request from our Data Protection Officer.

5.4 Legal disclosure

We may disclose data where compelled by a court, tribunal or authority of competent jurisdiction, or where required by Indian law. Where we are legally permitted to tell you, we will before disclosure if possible.

6. Cross-border transfers

Data is processed and stored in India. Where a panellist or partner sits outside India, transfer occurs only under a written agreement imposing equivalent protection.

For patients in the EU, EEA or UK, transfers into India rely on Standard Contractual Clauses (or the UK IDTA), a transfer impact assessment, encryption in transit and at rest, and your explicit consent. You may withdraw that consent, and we will stop processing and delete, subject only to retention we are legally required to observe.

7. How long we keep it

Category	Retention	Reason
International second opinion case file	{{X}} years from delivery	Clinical and legal continuity
Domestic teleconsultation record	As required by NMC Telemedicine Practice Guidelines and applicable medical record rules	Regulatory obligation on the consulting practitioner
Enquiry that did not proceed	{{12}} months, then deleted	Your ability to resume; no longer needed after
Medical travel case file	{{X}} years from repatriation	Continuity programme and dispute window
Financial and tax records	8 years	Income Tax Act and LLP Act requirements
Consent records	Life of the relationship plus {{X}} years	Demonstrating lawful basis

The DPDP Act requires erasure once the purpose is served and retention is no longer legally required. We delete on that basis, using irreversible methods.

8. Security

• AES-256 encryption at rest; TLS 1.3 in transit
• Role-based access, coordinators cannot open clinical files without a logged case reason
• Multi-factor authentication for all staff and panellist access
• Full audit log of every access to a health record
• {{Frequency}} third-party security assessment
• Medical documents accepted only through the encrypted portal never by email or WhatsApp. If anyone claiming to represent us asks for records by those channels, they are not us.

Breach notification. The DPDP Act requires notification to the Data Protection Board of India and to affected individuals. We will notify you without undue delay, telling you what was affected, what we are doing, and what you should do. For EU and UK patients we will additionally notify the relevant supervisory authority within 72 hours where the threshold is met.

9. Your rights

To exercise any right, write to our Data Protection Officer with the subject line "Data Rights Request". We verify identity before acting this protects you.

10. Children

Under the DPDP Act, a child is anyone under 18. We do not process a child's data without verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children in any circumstances.

Where a parent or guardian seeks a second opinion or treatment for a child, the guardian is our contact and gives all consents. The child's records receive the same protections as an adult's.

11. Grievance officer and contact

Role	Contact
Data Protection Officer	privacy@healingtourist.com
Grievance Officer (DPDP Act 2023; IT Rules 2021)	grievance@healingtourist.com Acknowledgement within 24 hours; resolution within 15 days
Postal	Global Healing Tourist LLP, Attn: Data Protection Officer, MIG 3/423, Satya Sai Enclave, Aiginia , Bhubaneswar,Odisha, 751030 India, India
Escalation India	Data Protection Board of India
Escalation EU/UK	Your national supervisory authority; in the UK, the Information Commissioner's Office

12. Changes

Material changes are notified to registered users by email at least 30 days before they take effect, with the version number and date updated here. Where a change alters how we use data you have already given us, we obtain fresh consent rather than relying on continued use.