Privacy Policy
Last updated: [TO BE COMPLETED: date this version goes live]
This notice explains what personal data WorldClinics collects about you, why we use it, who we share it with, and what rights you have. It applies to www.worldclinics.net and the services offered through it.
Please read section 3 carefully. When you send an enquiry you tell us about a treatment you are looking for. Under data protection law that is health data, which receives the strongest legal protection, and we only process it with your explicit consent.
1. Who is responsible for your data
The data controller is [TO BE COMPLETED: full legal entity name], registered at [TO BE COMPLETED: registered address], company number [TO BE COMPLETED: company registration number] (“WorldClinics”, “we”, “us”).
For any question about this notice or your data, contact us at info@worldclinics.net [TO BE COMPLETED: add a dedicated privacy address, e.g. privacy@worldclinics.net, if you have one].
[TO BE COMPLETED: If WorldClinics is not established in the EU/EEA, GDPR Article 27 requires you to appoint a representative in the EU and name them here with their contact details. If you have appointed a Data Protection Officer, name them here too.]
2. Data we collect
When you send an enquiry or create an account
- Your name, email address, phone number and country
- The language you use the site in
- Your password, stored only as a cryptographic hash — we never see or store it in readable form
If you send an enquiry without an account, we create one for you so you can follow your enquiry and message clinics. We tell you this on the enquiry form before you submit it.
When you use the service
- The treatment and destination you are looking for, and anything you write in your enquiry (see section 3)
- Messages you send to clinics through the site
- Reviews you write, and clinics you save as favourites
- Your email preferences
Automatically
- Your IP address. We use it to limit how often forms can be submitted and to run a bot check (Cloudflare Turnstile) that keeps automated spam out. We do not use it to build a profile of you.
- Cookies and similar technologies — see section 8.
3. Health data
The treatment you search for and the description you write in your enquiry say something about your health. This is a special category of personal data under Article 9 of the GDPR.
We process it, and pass it to the clinics you select, only on the basis of your explicit consent (Article 9(2)(a)), which you give with a separate tick box on the enquiry form. You do not have to give it — but without it we cannot pass your enquiry to a clinic, which is the whole purpose of the service.
Please do not send us more health information than is needed for a clinic to answer your question. We do not ask for medical records, diagnoses or test results through this website.
4. Why we use your data, and our legal basis
| What we do | Legal basis |
|---|---|
| Pass your enquiry to the clinics you choose and let them reply to you | Your explicit consent for the health data (Art. 9(2)(a)); performance of our service to you (Art. 6(1)(b)) |
| Create and run your account, let you message clinics and track your enquiry | Performance of our service to you (Art. 6(1)(b)) |
| Contact you about your enquiry, including by phone, to help you find a suitable clinic | Performance of our service to you (Art. 6(1)(b)) |
| Send you treatment guides, offers and news by email | Your consent (Art. 6(1)(a)) — optional, and you can withdraw it at any time |
| Keep the site secure, stop spam and abuse, and keep it working | Our legitimate interest in protecting the service (Art. 6(1)(f)) |
| Understand how the site is used, and measure our advertising | Your consent, given through the cookie banner (Art. 6(1)(a)) |
| Meet legal and accounting obligations | Legal obligation (Art. 6(1)(c)) |
5. Who we share your data with
Clinics and hospitals
This is the core of what we do. When you send an enquiry, we pass your name, contact details and the treatment information in your enquiry to the clinic or clinics you selected, so they can reply to you directly.
Those clinics decide for themselves how they use your data once they receive it, which makes them separate data controllers. Their own privacy policies apply to what they do with it. If you want a clinic to delete your data, you need to ask that clinic — although we can help you get in touch.
Service providers acting on our instructions
- Microsoft Azure — hosting, database and file storage
- Cloudflare — bot protection on our forms
- Google — website analytics and advertising measurement, only if you consent (section 8); and machine translation of clinic descriptions
- Telegram — our team receives a notification containing your enquiry so we can review it quickly. Telegram is based outside the EEA and ordinary Telegram chats are not end-to-end encrypted, which means your enquiry is stored on Telegram’s servers.
- [TO BE COMPLETED: name your email delivery provider, and any payment provider you use]
These providers act only on our instructions and are not allowed to use your data for their own purposes.
Others
We may disclose data where the law requires it, or to establish or defend legal claims. We do not sell your personal data.
6. Sending your data outside the European Economic Area
Many of the clinics on WorldClinics are outside the EEA — for example in Türkiye, the United Arab Emirates, India or Thailand. If you choose a clinic in one of those countries, your enquiry goes there. Some of these countries have not been recognised by the European Commission as offering a level of data protection equivalent to the EEA, and your rights may be harder to enforce there than at home.
You are told which country your enquiry is going to on the enquiry form before you submit it, and this transfer happens on the basis of your explicit consent (Article 49(1)(a)).
[TO BE COMPLETED: Article 49 consent is intended for occasional transfers. If you transfer enquiries to the same clinics routinely — which you do — you should also put Standard Contractual Clauses in place with those clinics under Article 46 and describe them here. This needs legal input and a contract rollout to the clinics.]
Our own service providers may also process data outside the EEA. Where they do, the transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.
7. How long we keep your data
[TO BE COMPLETED — and note: the retention periods below are not yet enforced by the system. Deleting an account currently only flags it as deleted and leaves the underlying data in place. Confirm the periods you want, and make sure the deletion and clean-up work is finished before publishing this section, otherwise this notice will describe something that does not happen.]
- Enquiries and the health data in them — [suggested: 24 months after your last activity]
- Account details — for as long as your account is open, then [suggested: 6 months]
- Marketing consent records — until you withdraw consent, then kept as proof for [suggested: 3 years]
- Records we must keep by law — for the period the law requires
When a period ends we delete the data or anonymise it so it can no longer be linked to you.
8. Cookies
We use cookies that are necessary to make the site work — keeping you signed in, keeping the site secure, and remembering your cookie choice. These do not need your permission.
We only use analytics and advertising cookies if you agree. Nothing is loaded and no such cookie is set until you make a choice, and you can change or withdraw that choice at any time:
9. Automated decision-making
We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you in that way.
10. Your rights
If you are in the EEA or the UK, you have the right to:
- Access the personal data we hold about you, and get a copy
- Correct data that is wrong or incomplete
- Erase your data (“right to be forgotten”)
- Restrict how we use it while a concern is being resolved
- Portability — receive the data you gave us in a machine-readable format, or have it sent to another provider
- Object to processing based on our legitimate interests
- Withdraw consent at any time, including consent for health data and for marketing. Withdrawing consent does not affect processing that already happened, and it cannot pull back an enquiry a clinic has already received
You can change your email preferences and delete your account from your profile settings, and change your cookie choice from the link in section 8. For anything else, email info@worldclinics.net. We will reply within one month.
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to a data protection supervisory authority — in the EEA, the authority in the country where you live or work. [TO BE COMPLETED: name your own lead supervisory authority and link to it]
11. Children
WorldClinics is not intended for anyone under 18 and we do not knowingly collect data about children. If you believe a child has given us personal data, contact us and we will delete it.
12. Security
We protect your data with encryption in transit, hashed passwords, access controls on our systems, and bot and rate-limiting protection on our forms. No service can promise perfect security, but we take this seriously — particularly because of the health information involved.
13. Changes to this notice
If we change how we use your data we will update this page and change the date at the top. Where the change is significant, or where the law requires it, we will ask for your consent again.
14. Contact
[TO BE COMPLETED: full legal entity name]
[TO BE COMPLETED: registered address]
info@worldclinics.net
Our Terms and Conditions cover the rules for using the site. This notice covers your data.