Privacy Policy

1. Who we are

MediCurage is a medical travel facilitator based in Hyderabad, India. We help patients from any country get a medical opinion, compare treatment quotes from partner hospitals and clinics in India, Turkey, Thailand, Malaysia and Mexico, and arrange the travel, stay and support around their treatment. We are not a hospital and we do not provide medical care.

When you send us your details or medical reports, MediCurage decides why and how that information is used. Under India's Digital Personal Data Protection Act, 2023, this makes us the "Data Fiduciary" for your information, and you are the "Data Principal".

Our contact details:

• MediCurage, 6th Floor, JVR Tower, beside Orchid Hospital Road, Prabhat Nagar, Laxmi Nagar Colony, Kothapet, Hyderabad, Telangana 500035, India
• Email: info@medicurage.com
• Phone and WhatsApp: +91 88868 87123

2. What this policy covers

This policy covers the information you give us through medicurage.com, through our enquiry form, and through email, phone calls and WhatsApp messages with our team.

It does not cover how hospitals, doctors, airlines, hotels or WhatsApp handle your information once they have it. Each of them has its own privacy policy, and hospitals outside India also follow the law of their own country (see section 7). We suggest you read their policies, and we can ask a hospital for its policy for you.

We follow the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Parts of this law are coming into force in stages until May 2027, and we apply its principles now. We also follow the Information Technology Act, 2000 and the rules made under it, which treat medical records as sensitive personal data.

3. The information we collect

Information you give us

1. Contact details. Your name, your country of residence, your phone number, whether we may contact you on WhatsApp, and your email address.
2. Your enquiry. The treatment you need, your preferred country for treatment (India, Turkey, Thailand, Malaysia, Mexico, or no preference), and the message you write to us.
3. Medical reports and health information. Files you upload with the form (PDF, JPG, PNG or DOC, up to 5 files, 7 MB in total) or send us later. These can include test results, scans, prescriptions, discharge summaries and details of a diagnosis. This is sensitive information and we handle it with extra care.
4. Travel details, if you go ahead. To request a visa invitation letter from the hospital where the country you choose asks for one, and to book travel and a place to stay, we may ask for a copy of your passport, your travel dates, and the names and passport details of the family members travelling with you.

If you write to us for someone else, for example as a family member or as a partner agent, please make sure the patient (or their parent or lawful guardian) has agreed to you sharing their information with us. If you give us details of attendants travelling with the patient, please tell them about this policy.

Information collected automatically

At launch, our website does not use cookies, analytics tools or advertising pixels.

Our website host, Netlify, automatically records basic technical information when you visit, such as your IP address, browser type, and the pages requested. This is kept in server logs to keep the website secure and working, and to block spam on the enquiry form. We do not use it to build a profile of you.

4. Why we use your information

We use your information only for these purposes:

1. To reply to your enquiry. We reply to every enquiry within 24 hours.
2. To have doctors review your medical reports and give a medical opinion.
3. To ask partner hospitals in the country or countries you choose for treatment quotes for your case, so you can compare them and choose.
4. To arrange the services you ask for, such as the hospital's visa invitation letter, flights, airport pickup, a stay near the hospital, an interpreter, and an online consultation with the doctor before you travel.
5. To stay in touch after you go home, for follow up questions.
6. To keep the records Indian law requires, to deal with complaints or legal claims, and to keep our website and systems secure.

We do not sell or rent your information to anyone. We do not use your medical information for advertising. We will not send you marketing messages unless you separately agree to receive them, and you can stop them at any time. We do not make decisions about you by automated means alone.

5. Your consent

We process your information on the basis of your consent. When you send the enquiry form, you tick a box to confirm that you have read this policy and agree to us using your information, including your medical reports, for the purposes in section 4. This includes sending your reports to partner hospitals in the country or countries you choose, which may be outside India (see section 7).

You can withdraw your consent at any time by emailing info@medicurage.com. Withdrawing is as easy as giving consent. Please keep in mind:

1. Withdrawal does not affect what we did with your information before you withdrew.
2. After you withdraw, we will stop using your information and delete it within a reasonable time, unless Indian law requires us to keep part of it (see section 9). We will also stop sending your reports to hospitals and ask the hospitals that received them to delete them (see section 11).
3. Without your information and reports, we may not be able to keep helping you. For example, hospitals cannot quote without seeing your reports.

In a small number of cases Indian law allows us to use information without consent, for example to comply with a court order, or to respond to a medical emergency that threatens someone's life or health.

6. Who we share your information with

Partner hospitals and doctors in the countries you choose

To get a medical opinion and treatment quotes, we share your medical reports and the details doctors need (such as your age, country of residence and the treatment question) with partner hospitals and their doctors. We do this only with your consent and only for your case.

You decide which countries' hospitals receive your reports:

1. If you choose a preferred country on the form, we send your reports only to partner hospitals in that country.
2. If you choose "No preference", or ask for quotes from more than one country, we will tell you which countries we suggest for your treatment and confirm with you before we send your reports to hospitals there.
3. You can tell us at any time to add a country, leave one out, or stop sending your reports.

You can ask us at any time which hospitals, and in which countries, have received your reports.

Once you choose a hospital and are treated there, that hospital keeps its own medical records about you. It does so under its own privacy policy and the laws of its country, and it is responsible for them.

Service providers who help us work

We share only what each provider needs:

1. Netlify, Inc. hosts our website and stores the enquiry form submissions, including uploaded reports.
2. Our email provider stores the copy of your enquiry that is emailed to info@medicurage.com, and our later emails with you.
3. WhatsApp (Meta) carries our messages with you if you choose to talk to us on WhatsApp.
4. Airlines, hotels, guest houses, interpreters and local transport providers receive the names and travel details needed to make the bookings and arrangements you ask for. Many of them are in the country where you are treated.

Authorities

We share information with government bodies when it is needed for a service you asked for, or when the law requires it, for example under a court order. If the country where you are treated needs a visa invitation letter, the hospital uses your passport details to write it, and you send your visa application to that country's embassy or visa portal yourself.

7. Where your information goes outside India

Your information may be stored, processed and used outside India.

1. Website and form. Netlify is a company based in the United States. Form submissions and uploaded files are stored on Netlify's servers, which may be in the United States or other countries.
2. Email. Each enquiry is also emailed to info@medicurage.com and stored by our email provider.
3. WhatsApp. If you tap "Continue on WhatsApp" after sending the form, WhatsApp opens with a summary of your enquiry already typed in. From that point, WhatsApp's own terms and privacy policy apply to the messages you send.
4. Hospitals. Partner hospitals and clinics are in India, Turkey, Thailand, Malaysia and Mexico. Your reports go only to hospitals in the countries you choose, as explained in section 6.
5. Travel and local services. Airlines, hotels, interpreters and transport providers may be in the country where you are treated or in the countries you travel through.

Hospitals abroad follow the law of their own country

Once a hospital or doctor in another country receives your reports, they hold and use them under the data protection and medical records laws of that country and under their own privacy policy. Each of the five countries has its own law, and the protection it gives may be different from the protection Indian law gives you. From that point, the hospital is responsible for how it handles your information.

Before we share, we ask each partner hospital in writing to use your reports only to review your case and prepare an opinion and a quote, to keep them confidential, to let only the staff working on your case see them, and to delete them if you do not go ahead with treatment there, where its law allows. We choose partner hospitals with care, but we cannot control what a hospital in another country does with your information, and we cannot promise that its law gives you the same rights as Indian law. If you want to know how a hospital handles personal data, ask us and we will request its privacy policy for you.

The legal basis for these transfers

Today, Indian law (the Information Technology Act, 2000 and its 2011 rules on sensitive personal data) allows us to send sensitive information such as medical reports to an organisation in another country when you have consented to the transfer, or when the transfer is needed to provide the service you asked for, and the organisation keeps the same level of data protection that we follow. We rely on your consent and on the written terms we agree with each hospital.

When the cross-border part of the Digital Personal Data Protection Act, 2023 comes into force (expected in May 2027), personal data may be sent to any country unless the Government of India restricts transfers to it, and subject to any conditions the Government sets about making data available to a foreign government. We will check for any such restriction before sending your information to a country, and tell you if it affects your case.

8. How we protect your information

We take reasonable steps to protect your information, including:

1. Our website uses an encrypted connection (HTTPS), so the form and your files travel to us encrypted.
2. Only the team members working on your case can see your reports.
3. Our email, hosting and WhatsApp accounts are protected by strong passwords and two step login.
4. We send reports only to the contact we have agreed with each partner hospital, and we ask every partner hospital, in India and abroad, to use your reports only to review your case and to keep them confidential.
5. We keep a record of who accessed and shared your information, including which hospitals in which countries received it, so we can find and fix problems.

No system can be made completely secure, but we work to keep the risk low and to act quickly if something goes wrong.

9. How long we keep your information

1. Enquiries and reports. If you do not travel for treatment with us, we delete your enquiry, your reports and our messages with you 24 months after our last contact with you. You can ask us to delete them sooner at any time.
2. If you travel with us. We keep the records of the services we arranged for as long as Indian tax, accounting and other laws require, and delete your medical reports 24 months after our last contact with you, unless you ask us to keep them for follow up.
3. Notice before deletion. When we are about to delete your information because the time above has passed, we will write to you at least 48 hours before, so you can ask us to keep it if you are still in touch with us.
4. Basic records. Indian rules require us to keep basic records of how information was processed (for example, when a form was received and who it was shared with) for at least one year. We keep these records only for that purpose.

Hospitals that received your reports or treated you keep their own records under the laws of their country. We cannot delete those records, but we will pass your request to them.

10. Your rights

Under Indian law you have these rights over your information:

1. Access. Ask for a summary of the information we hold about you, how we use it, and the names and countries of the hospitals and service providers we have shared it with.
2. Correction. Ask us to correct information that is wrong, complete information that is missing, or update information that has changed. If we have sent the information to hospitals, we will pass the correction to them.
3. Erasure. Ask us to delete your information (see section 11).
4. Withdraw consent. Stop us using your information at any time (see section 5).
5. Grievance redressal. Make a complaint to us and get a reply (see section 15).
6. Nominate someone. Name a person who can use these rights for you if you die or are unable to act yourself, for example because of illness.

To use any of these rights, email info@medicurage.com from the email address you used to contact us, with the subject "Data request", and tell us what you would like. If you write from a different address, we may ask you to confirm who you are before we act, so we do not give your information to the wrong person. We aim to complete requests within 30 days.

You may also have rights under the law of the country where a hospital that holds your information is based. You can contact that hospital directly, or ask us to help you contact it.

The law also asks you to give accurate information, not to pretend to be someone else, and not to make complaints that you know are false.

11. How to ask us to delete your information

Email info@medicurage.com with the subject "Delete my data". Include your name and the phone number or email you used in your enquiry. We will then:

1. Delete your form submission and uploaded reports from our website storage.
2. Delete your enquiry and reports from our mailbox, and our WhatsApp chat with you.
3. Ask every partner hospital, in India or abroad, and every service provider that received your information from us to delete it too. A hospital that has treated you, or that must keep consultation records under the law of its country, may keep them as that law requires.
4. Write to you to confirm when it is done, and tell you if a hospital has said it must keep any records.

We may keep the basic records described in section 9, point 4, and anything the law requires us to keep.

12. Children and people who need a guardian

Some patients are children, for example those who need heart surgery. If the patient is under 18, their parent or lawful guardian must make the enquiry and give consent for them. The same applies to an adult who cannot make decisions for themselves, whose lawful guardian must act for them.

We may ask the person writing to us to confirm that they are the patient's parent or lawful guardian. We use a child's information only to arrange their medical opinion, quotes, treatment travel and follow up. We never use it for advertising, and we never track or monitor a child's behaviour online.

13. If there is a data breach

If your information is lost, stolen or seen by someone who should not see it, we will tell you without delay. We will explain what happened, what it may mean for you, what we are doing about it, what you can do to protect yourself, and who to contact.

We will also report the breach to the Data Protection Board of India, within 72 hours of becoming aware of it as the rules require, and to any other authority the law requires.

We ask partner hospitals to tell us promptly if information we sent them is affected by a breach. If a hospital tells us, we will tell you what we know and help you contact the hospital.

14. Cookies and analytics

Our website does not set cookies and does not use analytics or advertising tools at launch.

We may add tools such as Google Analytics or Meta Pixel later, to understand how visitors use the website. Before we do, we will update this policy, and the website will show a banner asking for your consent before any of these tools run. You will be able to change your choice at any time.

15. Grievance Officer and complaints

If you have a concern about how we handle your information, please contact our Grievance Officer:

• Email: info@medicurage.com, with the subject "Grievance"
• Phone: +91 88868 87123
• Post: Grievance Officer, MediCurage, 6th Floor, JVR Tower, beside Orchid Hospital Road, Prabhat Nagar, Laxmi Nagar Colony, Kothapet, Hyderabad, Telangana 500035, India

We will add the name of our Grievance Officer to this page. We will acknowledge your complaint and aim to resolve it within 30 days. In every case we will respond within 90 days, the longest period Indian rules allow.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India once you have used our complaint process. A complaint about how a hospital abroad handles your information can also go to that hospital and to the data protection authority of its country.

16. If you live outside India

Patients contact us from many countries. We are based in India and handle your information under Indian law. The data protection laws of your own country may also give you rights. If you believe they apply, write to us and we will consider your request in good faith and respond as those laws require where they apply to us.

17. Changes to this policy

We may update this policy when our services, our tools, the countries we work in or the law change. The date of the latest review is shown on this page. If we make an important change, such as adding analytics, a new destination country or a new type of service provider, we will tell people we are in contact with by email or WhatsApp before the change takes effect.

18. Contact us

For any question about this policy or your information, email info@medicurage.com or call +91 88868 87123.