Privacy Policy

IndiHeals is a medical travel facilitator. We are the data controller for the information you give us through this website.

Registered entity: [[ENTITY NAME — pending incorporation]]. Registered address: [[REGISTERED ADDRESS]]. For any privacy question or request, email [email protected].

Only what you type into our contact form. Specifically:

• Your name
• Your email address
• Your phone or WhatsApp number (optional)
• Your country
• The treatment you are considering
• Anything you write in the message box — which often includes your diagnosis, symptoms or medical history
• Which page you were on when you submitted the form

The last two are health data. Under UK/EU law that is “special category” data and gets extra protection. We treat all of it that way regardless of where you live.

We do not currently run analytics, advertising trackers or non-essential cookies on this site. If that changes, this page will be updated before any tracking goes live and you will be asked to consent where the law requires it.

Your consent — you choose to send us an enquiry, and you tick the consent box on the form. For health data specifically, this is explicit consent under Article 9(2)(a) UK/EU GDPR, and consent under India’s Digital Personal Data Protection Act 2023.

You can withdraw that consent at any time (see below). Withdrawing does not make our earlier use of the data unlawful, but it stops all future use.

• Replying to your enquiry
• Asking partner hospitals in India for a treatment opinion and a price quote for your case
• Coordinating your treatment, travel and aftercare if you choose to proceed

We do not sell your data. We do not use it for advertising. We do not share it with anyone outside the list below.

Partner hospitals and doctors in India. This is the important one. To get you a real medical opinion and price, we must send your case details — including your medical information — to hospitals we work with. We only do this once you have asked us to, and we tell you which hospitals.

Service providers who run our tools. Our contact form is delivered by a third-party form service, and our site is hosted by a third-party host. They process data on our instructions only. [[NAME THE FORM PROCESSOR + HOST, AND CONFIRM A DPA IS SIGNED WITH EACH]]

Nobody else — unless we are legally required to, which we would tell you about unless the law forbids it.

We are coordinating treatment in India, so your information will be transferred there and processed by hospitals there.

If you are in the UK or EU, this is a transfer outside your jurisdiction. India does not currently hold a UK or EU adequacy decision, which means the transfer needs a specific legal safeguard. [[CONFIRM SAFEGUARD WITH COUNSEL — likely Standard Contractual Clauses in each hospital MOU, plus a transfer risk assessment. This must be settled before taking UK/EU enquiries.]]

If you enquire and do not proceed: [[RETENTION PERIOD — suggest 12 months]], then deleted.

If you become a patient: longer, because coordination and aftercare records need to exist. [[RETENTION PERIOD FOR PATIENT RECORDS — needs counsel; medical-adjacent records often carry statutory minimums]]

You can ask us to delete it sooner at any time.

You can ask us to:

• Show you what we hold about you
• Correct anything wrong
• Delete it
• Stop using it, or restrict how we use it
• Send it to you or someone else in a portable format
• Withdraw your consent — entirely, at any time

Email [email protected] and we will action it. We aim to respond within 30 days.

If you think we have handled your data badly, you can complain to your data protection regulator — the ICO in the UK, your national authority in the EU, or the Data Protection Board in India.

This site is not directed at children. If a patient is under 18, we deal with a parent or legal guardian, and we need their consent — not the child’s.

If we change how we handle your data, we will update this page and change the date at the top. If the change is significant and we hold your data, we will tell you directly.

Related: Terms of Service and our Medical Disclaimer.