Privacy policy

Summary in plain English. We collect the details you give us so we can arrange treatment abroad for you. Health information is only used with your explicit consent and shared only with the hospital you choose. We do not sell data or use advertising trackers. You can ask us to delete your data at any time, subject to legal record-keeping. Questions: care@medcoabroad.com.

1. Who we are

This policy is issued by Advargo Limited (trading as "MedCo Abroad"), a company registered in England and Wales, registered office 27 Old Gloucester Street, London, England, WC1N 3AX, with a branch office at Plot no 105, Prashanthi Nagar, Kukatpally, Hyderabad 500072, Telangana, India ("MedCo", "we", "us"). We are the data controller for personal data collected through medcoabroad.com, portal.medcoabroad.com, our AI assistant, email, telephone and messaging. Company number: [COMPANY NUMBER]. ICO registration: [ICO REFERENCE].

2. Scope

This policy applies to patients and prospective patients, companions, website visitors, and staff of partner hospitals who use our portals. Partner hospitals act as independent controllers for the clinical records they create; their own privacy notices apply to treatment.

3. What we collect

4. Why we use it and our lawful bases

• Providing our facilitation service (obtaining opinions and quotes, arranging visas, travel and accommodation, coordinating your case): performance of a contract (UK GDPR Art. 6(1)(b)); for health data, your explicit consent (Art. 9(2)(a)), which you give when you submit reports or accept a quote and which you may withdraw at any time.
• Responding to enquiries before any contract: our legitimate interest in answering you (Art. 6(1)(f)), and explicit consent for any health details you volunteer.
• Legal and accounting obligations (invoicing, tax, fraud prevention, responding to lawful requests): Art. 6(1)(c).
• Improving our website and services (analytics, quality monitoring): consent for cookies (PECR); legitimate interests for aggregated, non-identifying statistics.
• Marketing: only with your consent; you can opt out from any message.

For individuals in India, we process personal data in accordance with the Digital Personal Data Protection Act 2023 on the basis of your consent for the specified purposes above.

5. AI assistant

Our website assistant ("Maya") is powered by a third-party large language model (OpenAI, L.L.C., United States). Messages you type or speak are transmitted to that provider to generate replies. Under our agreement the provider does not use your messages to train its models. The conversation is stored with your enquiry so a human planner can read it, and is retained under section 9. The assistant does not give medical advice and its answers are informational only. If you prefer not to use it, you can contact us by form, email or phone.

6. Who we share data with

• Partner hospitals and doctors you ask us to approach, so they can review your case and quote. They receive only what is needed for that purpose, under written agreements requiring confidentiality and security.
• Travel, accommodation, transfer and insurance providers needed for your trip.
• Service providers that host our systems, send email and process payments, acting on our instructions under data processing agreements.
• Professional advisers, regulators and authorities where required by law or to protect legal rights.

We never sell personal data and never share health information with advertisers.

7. International transfers

Partner hospitals may be located outside the UK and EEA (for example India, Turkey, Thailand, the UAE). We transfer your data to them on the basis of your explicit consent to the specific transfer (UK GDPR Art. 49(1)(a)), having informed you that the destination country may not provide equivalent protection, and under written contractual safeguards. Our hosting and email providers are in [HOSTING LOCATION]; where they process data outside the UK we rely on the UK International Data Transfer Agreement or adequacy regulations.

8. Security

Health records are stored encrypted at rest and in transit, access is limited to the planner assigned to your case and the hospital users assigned to it, every access is logged, and portal accounts use strong passwords with lockout protection. No system is perfectly secure; if a breach affects you we will notify you and the ICO as required by law.

9. Retention

• Enquiries that do not proceed: 12 months from last contact, then deleted.
• Cases where treatment is arranged: 7 years after completion, for legal, insurance and accounting purposes.
• AI assistant conversations not linked to an enquiry: 90 days.
• Analytics data: 26 months, aggregated thereafter.
• Accounting records: 6 years as required by UK law.

10. Your rights

You may ask us to: access your data; correct it; delete it; restrict or object to processing; export it in a portable format; and withdraw consent (which does not affect processing already carried out). We respond within one month. Contact care@medcoabroad.com or write to the registered office. You may complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in India, to the Data Protection Board of India.

11. Cookies

Strictly necessary cookies keep you signed in to the portals and protect forms. One first-party analytics cookie is set only if you click "Accept" on the banner; you can change your choice by clearing site data. We do not use advertising or third-party tracking cookies. See our Cookie policy.

12. Children

Our services are for adults. Where treatment is for a person under 18, a parent or legal guardian must make the enquiry and provide consent on their behalf.

13. Changes

We will post updates here with a new version number and date, and notify active patients of material changes by email.