This Notice explains what personal data we collect when you use Bookimed, why we need it, who we share it with, and how you can access or delete it.
The Notice explains what data is collected in connection with the Website.
It also explains how we use that data, where we store it, and how we protect it.
Finally, it explains your rights in relation to your personal data.
You may generally browse our Website without providing us with your information. However, if you want to use the full functionality of our Website and services, you will need to provide some of your data.
If you do not agree with the whole Agreement or with a part of it, please stop using our Website and the Services presented on it.
| Controller | Bookimed Limited |
|---|---|
| Address of registration | 14/F Golden Centre, 188 Des Voeux Road Central, Hong Kong |
| Email for general questions and personal data requests | care@bookimed.com |
As for privacy roles:
Please note. Our Partners act as separate controllers when providing services. To contact the Data Protection Officer of Bookimed Limited, please email care@bookimed.com.
We also act as a business associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") regulations and use your personal health information ("PHI") to provide support functions, activities, and services for a healthcare entity.
For your convenience, we divided our users into 4 categories:
Regardless of who you are to us (Visitor, Client, Partner, or Representative), we have only three categories of data about you:
Important: We process medical and health data that is sensitive data. We understand the importance of keeping this data secure. We need you to understand that processing of sensitive personal data (medical and health) is necessary to provide you with the Service (legal basis: performance of the contract).
When you access our Website, some data is collected automatically. We need technical data to operate, maintain, and improve our Website. Such data includes:
| Category of actions | Description of the category | Legal basis |
|---|---|---|
| Your interaction with a Website | We may collect data about your interaction with our Website. Such data includes: your interaction with the Website, the features you use, the pages you view, the way you use our Website, and the actions you take, if any. | Legitimate interest |
| Device and connection data | We collect information about your computer, phone, tablet, or other devices you use to access the Services. Namely, we collect: connection type and settings when you access, update, or use our Services. Also, the operating system, browser type, IP address, URLs of referring/exit pages, device identifiers, and crash data. Geolocation: for instance, we use your IP address and/or country preference to approximate your location and provide you with a better Service experience. The amount of this information we collect depends on the type and settings of the device you use to access the Services. | Legitimate interest |
| Cookies and similar technologies | We use cookies for analytical purposes. You may disable cookies in your browser settings at any time. Find out more about our use of cookies further in this Privacy Notice and in our Cookie Policy. | Legitimate interest and/or Consent |
Please note that not all of the data listed here is necessarily collected. This only means that we may collect it from you.
During the use of our website, you may want to clarify details about our services or get a recommendation for your case.
| Category of actions | Description of the category | Legal basis |
|---|---|---|
| Customer support | Name; surname; email; phone number; country; request type; case details (if applicable); documents (if applicable). | Performance of the contract |
When you become our Client, we begin to process more data about you. All the data we collect and process is needed for the following reasons: User Account registration, request submission, rating formation, consulting in the form of conversation.
| Category of actions | Description of the category | List of data | Legal basis |
|---|---|---|---|
| User Account registration | To use our service you need to create an account. For User Account registration you will need to provide data and agree to our Terms of Service. | Contact data: name; email address; phone number. | Performance of the contract |
| Account customization | In account settings, you may choose the preferred messenger (Viber, Telegram, WhatsApp) to communicate with us. Also, you choose to link your account to your social media profile (Facebook, Google+). | Account data: profile picture; name; age; country; email address; social media profile; messenger; phone number. | Performance of the contract |
| Commenting of the content / rating | On our Website, you may also leave comments. Note: your comments will be publicly available. That is why we kindly ask you to be cautious when leaving a comment. However, you may choose to leave an anonymous comment. Also, you may delete your comment at any time by writing to us from the email address linked to your account. | name; email address; comment context; user ID. | Performance of the contract. Find out more details in the Review & Comment Policy. |
| Submitting a request | Through your User Account, you may submit a request to us. You may upload certain data to your request. | Trip data: bank statement; passport data, etc. Guardian data: ID; authorization to represent your ward; contact data; medical data of your ward; trip data, etc. Please note: guardian data is collected when you are authorized to represent and to disclose data of another person. If you decide to provide data of another person, we will ask you to provide additional data. Medical data: description of diagnosis; medical history; MRI scans; X-ray scans, etc. | Performance of the contract. Please note: some of the data may be kept longer due to legal obligations. Consent |
| Consultation | You may also provide your data via phone conversation. Please note: we will let you know if your call is being recorded before we do so. If you would prefer that your call not be recorded, you can opt out by stating this or by hanging up. | Call Records Data: name; age; location; medical data, etc. | Performance of the contract |
If you are a representative of the clinic and/or the hospital and you want to register an account, we need to process data about you and your company.
| Category of actions | Description of the category | List of data | Legal basis |
|---|---|---|---|
| Partner Account registration | To use our service, you need to create an account. For User Account registration, you will need to provide data and agree to our Terms of Service. | Contact data: Company type; website; the full name of a contact person; phone number; the email address. | Performance of the contract |
Due to the agreements between us (Bookimed) and our Partners, we receive the data that is needed for our Clients and Visitors to make a decision about the most suitable clinic and professional.
| Category of actions | Description of the category | List of data | Legal basis |
|---|---|---|---|
| Account registration | Partner registers its doctors and specialists to create a database for users' convenience in choosing the appropriate one. | Contact data: name; profile picture; location; email address. | Performance of the contract |
| Detailed description | In order to provide a high-quality service when choosing a specialist, we request qualification data, as this gives our Client a more complete understanding. | Qualification data: education and special training programs; work experience; availability of licenses and certificates; membership in professional associations and international communities (ISAPS, ASPS, EURAPS, EORTC and others); internships and advanced training in clinics abroad; awards and grants. Scientific activity information: research; publications; participation in specialized events. | Performance of the contract |
We may also get the information from other sources and combine it with the information which we are gathering through the Website. Such sources include:
| Category of actions | Description of the category | List of data | Legal basis |
|---|---|---|---|
| Social media Data | To use our service, you need to create an account. For User Account registration, you will need to provide data and agree to our Terms of Service. | Contact data: name; email address; phone number. | Performance of the contract |
| Data from medical providers | We may receive certain personal data from medical partners. | the medical course; details on trip to medical provider; information about flights; invoices; other relevant information. | Performance of the contract |
We process your data for seven basic purposes:
| Category of data processing purpose | Description | Legal Basis | Categories of personal data |
|---|---|---|---|
| To provide the features of the Website. | We collect the data to provide you with access to our Website and Services. Also, to maintain and improve our services. This includes using the data to: create and update your Account; enable you to use our Website; enable you to request our Service. | Performance of a contract | Contact data, Account data. |
| To provide our Service. | You may provide us with additional data so that we can tailor our Service to your needs. This includes using data to: provide a range of medical facilities for a particular case; verify your identity; arrange a trip to the designated place. | Performance of a contract | Contact data, Account data, Social media data, Medical data, Trip data, Guardian data, Consultation data. |
| To communicate information about our Services. | We use the data we collect to communicate with you about the Services you have requested. This includes using data to: answer your questions; help resolve issues in relation to our services. | Performance of a contract | Contact data, Social media data, Medical data, Trip data, Guardian data, Consultation data. |
| To communicate information about our Services. | We use the data we collect to communicate with you about the Services. This includes using data to: inform you about the new features; inform you about updates and changes. | Legitimate interest | Contact data, Account data. |
| To conduct research and for analysis purposes. | We may use data we collect for the purpose of testing, analysis, research and overall development of the product and services. This also allows us to enhance safety and security, develop new features, and monitor and improve customer support. | Legitimate interest | Automatically collected data, Device and connection data, Cookies and similar technologies, Account Data. |
| To create a safe environment. | We may also use data about how you use our Website to prevent, detect, or investigate fraud, abuse, illegal use, violations of our Terms of Service, and to comply with court orders, governmental requests or applicable law. | Legitimate interest | Automatically collected data, Device and connection data, Cookies and similar technologies, Data from our partners, Contact data, Social media data, Account data, Trip data, certain Guardian data. |
| To operate our business and to comply with our legal obligations. | We use the personal data you give us to run our business and to comply with our legal obligations. | Compliance with legal obligations | Automatically collected data, Device and connection data, Cookies and similar technologies, Data from our partners, Contact data, Social media data, Account data, Trip data, certain Guardian data. |
| To send marketing communications. | If you are our Representative and you gave us your consent, we may use the contact details you provided to send you our marketing communications, where permitted by applicable law (unless you have opted out). You may opt out of receiving such communications at any time. | Consent | Contact data, Social media data. |
| Other Purposes. | We will ask for your consent to further process your personal data if we use it for other purposes. During data collection, we will send you individual messages and get your consent. | Consent | — |
If we need to process your data for other purposes, we will ask for your consent to do so.
Important. If we use consent as a legal basis for processing, you will have a choice to opt in or to opt out of any processing activity. You may withdraw your consent at any time by sending us an email to care@bookimed.com.
The only legal basis for processing of Medical data is the performance of a contract. We don't use this data for any reason other than providing you with a Service.
Some steps in our service are automated. We use automation to take routine work off our team so that you get an answer sooner — not to decide anything about you on its own.
Where we use it:
What automation does not do. It does not make final decisions about your treatment, your eligibility for a service, or the price you are offered. It does not replace the coordinator assigned to you. Every request is reviewed and acted on by a person, and that person can override anything the system suggests.
Review moderation is the one exception: reviews are screened automatically, and a moderator reads those that need a closer look.
Your rights. Depending on where you live, you may have the right not to be subject to a decision made solely by automated means, and to ask for a person to review it. Because our systems are not used to make such decisions on their own, this should not arise — but if you believe a decision affecting you was made without a person involved, write to care@bookimed.com, and we will look into it.
Where our systems shape what you see on the Website, we explain that separately in our Clinic Ranking Policy.
A cookie is a piece of data stored on the user's device containing information about the user.
We use both session cookies, which expire when you close your browser, and persistent cookies, which stay on your device for a set period. Some cookies are necessary for the Website to work. Others are used for statistics and for marketing, including cookies set by third parties. The full list, with what each cookie does and how long it lasts, is in our Cookie Policy.
Data collected by cookies may include the following:
We also collect information using web beacons (also known as "tracking pixels").
Manage cookies in Chrome, Safari, Firefox, or Microsoft Edge.
You can also opt out by visiting the Network Advertising Initiative Opt Out page or by using the Google Analytics Opt Out Browser add-on.
We store your data on our servers in Germany. To handle it in a secure and GDPR-compliant way, we use: encryption, contractual obligations, retention controls, levels of access, and vendor security checks.
We provide industry-standard physical, electronic, and procedural safeguards to protect personal data we process and maintain. For example, we take reasonable operational and technical measures to limit access to your data. Data that we receive is available only to authorized employees and contractors. We also use encryption and other safeguards to make sure your data is safe. Such measures are reasonably designed to help protect your personal data from loss, unauthorized access, disclosure, alteration or destruction.
Despite our efforts, no website, mobile application, database or system is completely secure or "hacker proof." As a result, we cannot guarantee or warrant the security of any information you transmit on or through the Website, and you do so at your own risk. You can help keep your data safe by taking reasonable steps to protect your personal data against unauthorized disclosure or misuse. If you have a reason to believe that your interaction with our Website and/or Service is no longer secure, please immediately notify us by contacting us in writing at care@bookimed.com.
We use the Standard Contractual Clauses approved by the European Commission to ensure adequate protection in the mutual processing of data with our Partners.
Note: while providing you with the medical care services, our Partner acts as an independent controller.
We retain your personal data for as long as necessary to fulfill the purposes described in this Notice unless otherwise required by law. However, we may keep some of your personal data for as long as reasonably necessary for our legitimate business interests, including fraud detection and prevention, and to comply with our legal obligations, including tax, legal reporting, and auditing obligations.
Before disclosing your personal data to any third party, we conduct a vendor security check to see if appropriate safeguards are in place.
We do not and will not knowingly collect personal data directly from any child under 16. We may process data of a child under 16 only upon a parent or guardian's request and only after the verification of parent/guardian identity and authority to represent a child. However, if you are a parent or guardian and are concerned about the personal data of your child, please contact care@bookimed.com.
If you provide us with your personal data, you may exercise any of the rights described in this section. If you have any additional questions, you can always send an email to care@bookimed.com, and we will do our best to help you.
| Right | Description |
|---|---|
| Right to access | You can request information on whether personal data are being processed, and, where that is the case, access to this personal data and the information required by law. |
| Right to rectification | You can change the data if it is inaccurate or incomplete. |
| Right to erasure | You can send us a request to delete your personal data from our systems. We will remove them unless otherwise provided by law. |
| Right to restrict the processing | You may partially or completely prohibit us from processing your personal data in cases provided by law. |
| Right to data portability | You can request all the data you provided to us and request to transfer data to another controller. |
| Right to object | You may object to the processing of your personal data that is collected on the basis of legitimate interest. |
| Right to withdraw consent | You can withdraw your consent at any time. |
| Right to file a complaint | If your request was not satisfied, you could file a complaint to the regulatory body. |
For EEA residents: we will answer your request within one month. If your request is not satisfied, you can submit a complaint to your local Data Protection Authority.
For UK residents: we will answer your request within one month. If your request is not satisfied, you can submit a complaint to the Information Commissioner's Office by phone at 0303-123-1113 or online at www.ico.org.uk/concerns.
Your rights vary depending on the state of your residency, as indicated below.
| Right | Description | Area |
|---|---|---|
| Right to access | You can request an explanation of how your personal data is processed. | California; Colorado; Connecticut; Delaware; Indiana; Iowa; Montana; New Hampshire; New Jersey; Oregon; Tennessee; Texas; Utah; Virginia. |
| Right to correct | You can change the data if it is inaccurate or incomplete. | California; Colorado; Connecticut; Delaware; Indiana; Montana; New Hampshire; New Jersey; Oregon; Tennessee; Texas; Virginia. |
| Right to delete | You can send us a request to delete your personal data from our systems. | California; Colorado; Connecticut; Delaware; Indiana; Iowa; Montana; New Hampshire; New Jersey; Oregon; Tennessee; Texas; Utah; Virginia. |
| Right to portability | You can request all the data you provided to us and request to transfer data to another controller. | California; Colorado; Connecticut; Delaware; Indiana; Iowa; Montana; New Hampshire; New Jersey; Oregon; Tennessee; Texas; Utah; Virginia. |
| Right to opt out of sales | The right to opt out of the sale of personal data to third parties. | California; Colorado; Connecticut; Delaware; Indiana; Iowa; Montana; New Hampshire; New Jersey; Oregon; Tennessee; Texas; Utah; Virginia. |
| Right to opt out of certain purposes | The right to opt out of processing for profiling/targeted advertising purposes. | Colorado; Connecticut; Delaware; Indiana; Montana; New Hampshire; New Jersey; Oregon; Tennessee; Texas; Utah; Virginia. |
| Right to opt out of the processing of sensitive data | The right to opt out of the processing of sensitive data. | California. |
| Right to opt in for sensitive data processing | The right to opt in before processing sensitive data. | Colorado; Connecticut; Delaware; Indiana; Montana; New Hampshire; New Jersey; Oregon; Tennessee; Texas; Virginia. |
| Right against automated decision-making | A prohibition against a business making decisions about a consumer based solely on an automated process without human input. | California; Colorado; Connecticut; Delaware; Indiana; Iowa; Montana; New Hampshire; New Jersey; Oregon; Tennessee; Texas; Virginia. |
| Private right of action | The right to seek civil damages from a controller for violations of a statute. | California. |
We will answer your request within 30 to 60 days, depending on the state and legislative requirements. If your complaint is not satisfied, you can submit a complaint to the Federal Trade Commission.
Please note! Some states do not have privacy laws. The rights of residents of such states are governed by U.S. federal law. If your state is not on the list, please contact us.
California residents have the right under the California Consumer Privacy Act ("CCPA") to opt out of the "sale" of their personal information by a company governed by CCPA.
We do not sell your personal information to anyone nor use your data as a business model.
However, we support CCPA by allowing California residents to opt out of any future sale of their personal information. If you would like to record your preference that we will not sell your data in the future, please contact us.
California residents visiting the Website may request that we do not automatically gather and track information about their online browsing movements across the Internet.
Such requests are typically made through web browser settings that control signals or other mechanisms that allow consumers to exercise choice regarding collecting personal data about an individual consumer's online activities over time and across third-party websites or online services.
We currently do not have the ability to honor these requests. We may modify this Privacy Notice as our abilities change.
As a business associate under HIPAA regulations, we are committed to safeguarding your privacy and protecting the confidentiality of your PHI. This includes using and disclosing PHI for treatment, payment, and healthcare operations.
| Right | Description |
|---|---|
| Right to request privacy protection | You can request restrictions on certain uses and disclosures of PHI. |
| Right to access | You can ask for an inspection and receive a copy of your PHI. |
| Right to amend | You have the right to request corrections to your medical records if, on obtaining a copy of your PHI, it is found to be inaccurate or incomplete. |
| Right to access an accounting of disclosures | You have the right to access an accounting of disclosures, which explains who your PHI has been disclosed to and why over the past six years. Please note that this right has some exclusions. For instance, if the information is requested by a law enforcement officer or public health official. |
| Right to be notified of a breach | You have the right to be notified of any breach of unsecured PHI when there is reason to believe the PHI has been accessed, acquired, used, or disclosed without authorization. |
| Right to file a complaint | If you believe your rights are being denied or your health information isn't being protected, you can file a complaint with your provider or health insurer, or file a complaint with Health and Human Services. |
We have 30 days to exercise your request from the moment it is received.
Applicable law and our practices change over time. If we decide to update the Privacy Notice, we will post the changes on our Website. If we materially change the way in which we process your personal data, we will provide you with prior notice, or where legally required, request your consent prior to implementing such changes. We strongly encourage you to read the Privacy Notice and keep yourself informed of our practices.