Privacy Policy

What we collect

Details about your health are sensitive. We only ask for what we need to respond, and we don't ask for scans or reports in the first form.

• Contact details: name, email, phone or WhatsApp number, country and preferred contact method.
• Your enquiry: the treatment you're interested in, your travel timeline, whether you have reports, and anything you choose to write about your condition.
• Consent records: what you agreed to, the wording you saw and when.
• How you found us: the page you started on, the referring site and campaign tags. We don't use advertising trackers on the quote form.

Why we use it

• To reply to your enquiry and understand whether we can help.
• To request opinions and quotes from hospitals, but only after we've told you which hospital and you've agreed.
• To coordinate visas, travel and accommodation if you go ahead.
• To keep records needed for security, fraud prevention and the law (including Form C reporting for foreign patients).
• To send updates about treatments and prices, only if you ticked the optional box. You can stop these at any time.

Who we share it with

We never sell your information. We share medical details with a hospital only after we've named it to you and you've given specific consent for that hospital. You can say no, and you can choose a different hospital.

We use a small number of service providers to run our systems, including our cloud database (Supabase) and hosting (Vercel). They process data on our instructions and may store it outside India, under contractual safeguards. We may disclose information if the law requires it.

How long we keep it

Enquiries that don't go ahead are deleted automatically 12 months after you submit them. If you become a patient, we keep your case file for as long as needed to support your follow-up care and meet legal and accounting obligations, then delete it.

Security

Information is encrypted in transit (HTTPS) and at rest in our database. Access is limited to named staff who need it for your case, and access is logged. Reports and scans are exchanged through private, access-controlled links, never through public storage. No online service is perfectly secure; if we ever have a breach that affects you, we'll tell you and the relevant authority as the law requires.

Your rights

To use any of these rights, email care@krinavcare.com with the subject "Privacy request". We'll confirm receipt and reply in writing.

• Ask what we hold about you and get a copy.
• Correct anything that's wrong.
• Ask us to delete your information, where we don't need to keep it by law.
• Withdraw consent, including for marketing or for sharing with a hospital. This doesn't undo sharing that already happened with your consent.
• Nominate someone to exercise your rights if you can't.
• Complain to us, and if you're not satisfied, to the Data Protection Board of India (or the UK ICO or your EU supervisory authority).