Health Data and Consent Notice

Why this notice exists

Information about your health is a special category of personal data under Article 9 of the GDPR and the UK GDPR. It may only be processed with your explicit consent or on another narrow legal ground. On this site, health data reaches us in two ways: through the message field of the consultation form, and through the live chat. Both ask for your consent before anything is stored. This notice is the long form of what that consent means.

What counts as health data here

Anything that says something about your physical or mental health, including:

• the procedure you are considering and why;
• previous operations, treatments or complications;
• medications, allergies and existing conditions;
• photographs of yourself that you send to us or to a clinic;
• your weight, measurements or any description of your body.

You do not have to give us any of this to use the site. The procedure pages, price comparisons and clinic profiles work without it. It is needed only if you want an answer that is specific to you.

What you are consenting to

When you tick the consent box on the consultation form, or start a chat after reading the consent text, you agree that:

1. we store what you write, including health information, so that we can answer you;
2. named staff of the operator can read it for that purpose;
3. if you ask us to forward your enquiry to a clinic, we send that clinic your name, contact details and your message, including its health content, and that clinic becomes a separate controller of that copy.

The exact wording you agreed to is stored with your request, together with the date, time and the network address it came from, so that we can show what was agreed if we are ever asked.

What we do not do with it

• We do not use your health information for advertising, profiling or automated decisions.
• We do not share it with any clinic you have not asked us to contact.
• We do not share it with analytics or marketing providers.
• We do not train any automated system on it.

Withdrawing consent

You can withdraw consent at any time by contacting us with the details on the Legal Notice page. We will stop processing and delete the health information you gave us, unless we are legally required to keep a record. Withdrawal does not undo processing that already took place, and it does not reach a copy that a clinic already holds; you would need to contact that clinic as well, and we will tell you how.

Clinics and their obligations

Clinics we forward enquiries to are healthcare providers regulated in their own country. They have their own legal duties of confidentiality and their own privacy notices. Before your enquiry is forwarded we tell you which clinic will receive it. We only forward to clinics that hold the authorisations described on the page about how we verify clinics.

Photographs

If you send photographs, they are health data and this notice applies to them. Send only what a clinic has asked for, never include other people, and remove anything in the image that identifies you if you can. We keep photographs for the same period as the rest of your request and delete them on the same schedule.

Children

We do not accept health information from anyone under 18, and the form and chat must not be used to describe a child's health.

Your rights

All the rights set out in the Privacy Policy apply to health data. Because of its sensitivity we will always verify identity before disclosing it, and we will not send health information to an email address other than the one it came from unless you have proved that the new address is yours.