Privacy Policy

India Care Bridge Medical Value Travel ("India Care Bridge", "we", "us") is an independent medical travel facilitation platform based inHisar, Haryana, India. We help international patients send their medical reports to hospitals and doctors in India, receive treatment estimates, and plan their trip. This policy explains what personal data we collect, why, who we share it with, and the rights you have.

We act as the data fiduciary (under India's Digital Personal Data Protection Act, 2023) and the data controller (under the EU General Data Protection Regulation) for the data you give us. Hospitals and doctors who review your case are responsible for how they use your data once they receive it.

What we collect

• Identity and contact details: your name, age, gender, nationality, email address and WhatsApp number, and your passport number if you choose to give it.
• Health information: your diagnosis, symptoms, previous treatments, the treatment or specialty you are interested in, and the medical reports, scans and images you upload.
• Travel details: preferred hospital, travel window, number of attendants, preferred language and whether you need an interpreter.
• Your consent: the date and time you agreed to share your medical information.
• Technical data: your IP address, used briefly to prevent abuse and spam (see "Security" below). We do not use advertising or tracking cookies.

Health information is sensitive. We only collect it because you send it to us to get your case reviewed, and we only use it for that purpose.

Why we use it

• To review your enquiry and share your case with the hospitals and doctors best placed to assess it.
• To send you treatment estimates and quotes, and to contact you about your case by email or WhatsApp.
• To help with travel arrangements you ask for, such as a visa invitation letter, airport transfer or interpreter.
• To let you check your case status with the case tracker.
• To keep the service secure, prevent abuse and meet our legal obligations.

Our legal basis is your consent, which you give when you submit the enquiry form. For EU patients, health data is processed on the basis of your explicit consent (GDPR Article 9(2)(a)). We do not sell your data, use it for advertising, or make automated decisions about you.

Who we share it with

• Hospitals and doctors in India that we ask to review your case. They see your case details and reports so they can give a medical opinion and an estimate. Each hospital sees only the cases shared with it.
• Service providers that host and run the platform for us: Supabase (database and file storage) and Cloudflare (website hosting and security). They process data only on our instructions.
• WhatsApp (Meta), when you choose to message us on WhatsApp.
• Authorities, only when the law requires it.

Your data is stored and processed in India and may be accessed by our service providers in other countries. Where data leaves the EU, we rely on your explicit consent and on our providers' contractual safeguards.

How long we keep it

We keep your case for as long as we are helping you and for a reasonable period afterwards, so we can answer follow-up questions and meet legal and accounting obligations. You can ask us to delete it sooner. Files uploaded to an enquiry form that is never submitted are deleted automatically within about a day.

Security

• Data is encrypted in transit and at rest.
• Medical files are kept in private storage. Staff can open them only through short-lived links, and every access is logged.
• Access is limited by role: coordinators see the cases they handle, and each hospital sees only the cases shared with it.
• To stop spam and abuse, we count requests per connection using a one-way hash of the IP address, and delete those counters within a day or two.

Your rights

Depending on where you live, you can:

• ask for a summary of the personal data we hold about you and who we have shared it with;
• ask us to correct, complete or update it;
• ask us to delete it;
• withdraw your consent at any time (this does not affect sharing that already happened, and we may then be unable to continue with your case);
• for EU patients: restrict or object to processing, receive your data in a portable format, and complain to your local data protection authority;
• for patients covered by Indian law: nominate someone to exercise your rights if you die or become unable to, and complain to the Data Protection Board of India if we do not resolve your grievance.

Children

If the patient is under 18, the enquiry must be submitted by a parent or legal guardian, who gives consent on the patient's behalf.

Contact and grievances

To use any of these rights or raise a concern, contact us at care@indiacarebridge.com. Please include your case number if you have one. We will respond within 30 days.

Changes to this policy

We will update this page if our practices change, and change the date at the top.