Privacy Policy

Contact form and sharing links

The contact form sends your name, email and message to contact@medical2china.com through our email provider. We use these details to respond. Do not send medical records or identifying health information.

A registered sharing link can set a first-party source cookie. It contains a signed random link identifier, not your name or email. A registered sharer and the source link are included with your enquiry when the signature is valid. Deleting the cookie removes browser attribution. The source cookie lasts 30 days from the most recent valid sharing link. Ordinary visits do not extend it. Expired links cannot establish a new source; an already verified source remains until the cookie expires or the link is revoked.

A one-hour secure form cookie prevents cross-site submissions. Hashed request and quota identifiers help prevent abuse and duplicates. No message text is stored in the website submission ledger. Request markers expire after one day; expired markers are removed on the next submission. Email correspondence follows our retention policy. Delivery acceptance does not guarantee inbox delivery.

Member access and account information

When member access is available, our sign-in provider handles registration, email verification and sign-in credentials. This is the narrow exception to the general instruction not to submit identifying information: provide only the email and authentication information required by the sign-in provider. Do not provide patient information or medical records. The sign-in screen identifies that provider and links its privacy information before you enter credentials.

Medical2China retains an opaque account identifier, verification and access status, assigned roles, consent timestamps, necessary security events and numeric usage counts. Our application does not retain your email, name, password, directory search terms, or the identities of profiles viewed. Staff access requires additional authentication. Separate permissions govern imports and publishing; membership grants read access only.

Member and authentication pages are excluded from our Google Analytics events. Directory results are private responses and are not included in public search indexes, page metadata or public caches. Numeric quotas are shared across website and authorized client access. Repeated reads count toward the allowance; we do not build a clinical browsing history to identify repeated views.

Necessary secure cookies support sign-in and abuse prevention. A login transaction expires after 10 minutes, a member session after one hour, and a chat abuse-prevention cookie after one day. A new login or security action may invalidate a session sooner. Expired records cannot authorize access; physical removal and encrypted backup expiry follow the deployed storage retention schedule. Account settings allow sign-out and revocation of sessions. Account deletion removes application access and profile settings; a minimal opaque revocation marker prevents old credentials from restoring access. Deleting an identity-provider account is a separate action with that provider.

1. Scope and who we are

This Privacy Policy applies to medical2china.com, its chat feature, and messages sent to Medical2China about the Website. Medical2China is the operator responsible for the processing described here. Our privacy contact is contact@medical2china.com.

Medical2China provides referrals to independent healthcare providers, arranges travel, and assists with logistics for clients seeking medical care in China. We also provide general educational and logistics information. We are not a licensed medical provider, hospital, insurer, or medical-record custodian, and we do not provide medical advice or examine medical records. Unless we expressly agree otherwise in a separate written instrument, we are not acting as a HIPAA covered entity or business associate in connection with the Website. The Website is not designed to receive protected health information or identifiable medical records.

2. Information you must not submit

We do not ask for and do not need information that identifies, relates to, describes, or could reasonably be linked with a particular person in order to provide general Website information. Do not submit such information through chat or a URL, and do not include it in an email's subject, message body, or attachments. If you voluntarily email us, the email systems involved necessarily receive your email address and message metadata as described below.

• Names, dates of birth, precise ages combined with other details, photographs, faces, voice recordings, signatures, addresses, precise locations, email addresses, phone numbers, social-media identifiers, or employer information.
• Passport, visa, national ID, tax, insurance, bank, payment, booking, appointment, patient, or medical-record numbers.
• Medical records, prescriptions, referral letters, diagnoses, laboratory results, imaging, pathology, genetic data, discharge summaries, screenshots, report text, or other documents.
• Information about a family member, patient, child, or any other person that could identify or be linked to them.

If limited context is genuinely necessary, use only a short, general symptom description with no names, dates, locations, provider names, identifiers, document text, or distinctive facts. Removing a name alone may not make information non-identifying when other details can point to a person.

3. Information we process

We process only the categories reasonably needed to operate the Website, respond to a request, protect the service, and understand general page use. The categories below describe current Website operation. A separately agreed referral or travel engagement may require additional administrative arrangements; the required information, purpose, recipients, and appropriate channel must be explained before it is requested. Do not submit passport details, medical records, or other sensitive documents through this Website or chat.

• Chat content: the text you enter and the preceding user and assistant messages needed to maintain the current conversation. You should keep this content non-identifying.
• Contact content: if you choose to email us, we necessarily receive your email address and the content and metadata of the message. Do not include health records, identification documents, report contents, or sensitive personal information.
• Basic technical data: network and request information needed to deliver and protect the Website, such as IP address, browser or device type, timestamps, requested route, response status, and security events. Our application does not intentionally add chat text to access logs.
• Cookie choice: a first-party cookie records whether you allowed or declined analytics. It lasts up to 12 months unless you delete it or change your choice.
• Consent-based analytics: if you affirmatively allow analytics, Google Analytics may process a pseudonymous cookie identifier, page path, general referrer information, browser or device information, coarse location derived from the connection, and interaction measurements. We configure page locations to exclude URL query details and do not send chat questions or form entries to Google Analytics.

4. How chat content is processed

When you send a chat message, your browser transmits the current conversation to our server hosted on Amazon Web Services (AWS). Our server adds a safety instruction and sends the conversation to the DeepSeek API so that DeepSeek can generate and stream a response.

Using chat does not create a member account. We save only the final submitted question after automated identity masking for internal service review, separately from the conversation sent to DeepSeek. Full conversations are processed in memory and in transit; infrastructure and AI-provider copies follow their own schedules, which we cannot guarantee.

Chat is not confidential and must not be used for medical records or identifying information. We do not use chat content to diagnose, treat, clinically profile, determine eligibility for care or insurance, or make an automated medical decision about you.

We save questions in their original wording and language to improve our service. Local rules mask recognised names, contact details and identifiers; they can miss identifying information. We do not classify, summarise or translate questions. Questions are encrypted in private website storage and reviewed by weekly email at contact@medical2china.com. Please do not include identifying information.

5. Why we process information

Depending on the information and applicable law, we process information for the following limited purposes:

• To load, operate, maintain, and secure the Website and chat feature.
• To generate the general educational or logistics response you request.
• To respond to a contact message and keep necessary correspondence records.
• To detect abuse, troubleshoot errors, protect users and systems, and enforce our Terms of Use.
• With your consent, to count visits and understand which general pages are useful without sending chat or form content to analytics.
• To comply with law, preserve legal claims, respond to valid legal process, or protect vital safety interests where permitted.

6. Legal bases where required

Where the GDPR, UK GDPR, or a similar law requires a legal basis, we rely on your request to provide the feature you selected, our legitimate interests in operating and securing a minimal informational Website, compliance with legal obligations, and your consent for optional analytics. You may withdraw analytics consent at any time through Cookie settings without affecting earlier lawful processing.

We do not seek consent to process identifiable health information through the Website because you are prohibited from submitting it. If you send such information despite this notice, that submission does not transform the Website into a medical service or authorise unrelated use. We will limit handling to what is reasonably necessary to secure, reject, minimise, delete, respond to, or comply with law concerning the submission.

7. Service providers and disclosures

We disclose information only as reasonably necessary for the purposes described in this Policy, subject to appropriate terms and applicable law.

• AWS processes network and Website data to host and deliver the service.
• DeepSeek processes chat conversations to generate AI responses.
• Google Analytics processes limited measurement data only after you allow analytics. Advertising storage, ad personalisation, Google signals, and automatic page views are disabled in our Website configuration.
• Professional advisers, auditors, insurers, or authorities may receive limited information when reasonably necessary to protect rights, investigate an incident, comply with law, or respond to valid process.
• A successor may receive information as part of a merger, reorganisation, financing, or transfer of the Website, subject to this Policy and applicable notice requirements.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not send chat questions or symptom descriptions to advertisers, data brokers, Google Analytics, hospitals, clinicians, insurers, employers, or travel suppliers. If you later ask us through a separate, clearly identified process to transmit information to a third party, that process must have its own notice and any consent required by law.

8. Cookies and analytics choices

When you choose a website language, a first-party preference cookie (m2c_language) remembers that choice for up to 12 months. It contains only the language code and is not used for analytics or advertising.

The Website uses a necessary first-party cookie to remember whether you allowed or declined analytics. Google Analytics is not loaded for measurement unless you choose Allow analytics. If you decline or later withdraw, we set analytics storage to denied and attempt to remove analytics cookies associated with the Website.

You can reopen Cookie settings from the Website and change your choice. You can also delete or block cookies in your browser. Blocking the preference cookie may cause the consent choice to be requested again. Our Cookie Policy provides additional operational detail; if it conflicts with this Privacy Policy about personal-information handling, this Privacy Policy controls.

9. Retention

We retain information only for the shortest period reasonably necessary for the stated purpose, security, dispute resolution, and legal compliance. Retention depends on the category and system rather than a single period.

• The analytics-consent cookie lasts up to 12 months unless you delete it or change your preference.
• Website copies are kept for the current and previous Shanghai calendar weeks, expire after 13 calendar days, and are removed by daily cleanup (within 14 days while cleanup operates). Outages can delay deletion. Website deletion does not delete email or mailbox backups; those copies follow a separately reviewed retention policy.
• Consent-based analytics data follows the retention settings in the dedicated Medical2China analytics property and Google's processing terms. We periodically review those settings and seek to retain only aggregate usefulness data.
• Contact correspondence is retained for as long as reasonably needed to answer the request, document the interaction, protect rights, and meet legal obligations, then deleted or de-identified when practicable.
• Security and diagnostic records are retained only as long as reasonably needed to investigate incidents, prevent abuse, maintain service reliability, and comply with law.

10. Security and incident response

We use reasonable administrative, technical, and organisational safeguards appropriate to the limited Website, including HTTPS, server-side API credentials, restricted production access, request-size limits, access controls, and separation of server modules from public files. No Internet transmission, AI service, or storage system can be guaranteed completely secure.

The safest protection is not to submit identifying or sensitive information. If an incident triggers a legal notification duty, we will provide notice to affected people and regulators as required by applicable law. Nothing in this Policy limits a mandatory breach-notification obligation.

11. International processing

Medical2China is intended for an international audience, and its service providers operate across borders. Information may be processed in Australia, China, the United States, or other countries where our providers maintain infrastructure or personnel. Those countries may have privacy laws different from those where you live.

Where applicable law requires safeguards, notices, assessments, contractual measures, or separate consent for a cross-border transfer, we will use the required mechanism before making that transfer. Because chat is routed to international service providers, do not use chat if you do not want the limited text you enter processed internationally.

12. Your privacy rights

Depending on where you live and whether a law applies to Medical2China, you may have rights to request access, confirmation, correction, deletion, restriction, objection, portability, withdrawal of consent, or an explanation of processing. You may also have a right to appeal a decision or complain to a privacy regulator.

To make a request, email contact@medical2china.com with the subject Privacy Request and describe the right you want to exercise. Do not send identity documents, medical records, or additional sensitive information unless we specifically request a minimal verification method after reviewing the request. We may need to verify that a request relates to you, and may deny or limit a request where permitted or required by law. We will not discriminate against you for exercising an applicable privacy right.

13. Region-specific disclosures

California and other U.S. states: if an applicable state privacy law covers our processing, residents may have rights to know, access, correct, delete, or obtain a copy of covered information and to opt out of certain sales, sharing, profiling, or targeted advertising. Medical2China does not sell personal information, share it for cross-context behavioural advertising, or use identifiable health information for targeted advertising. We do not use sensitive personal information to infer characteristics beyond the limited purposes described here.

European Economic Area and United Kingdom: health information can be special-category data. The Website does not request it. Where these laws apply, you may contact the relevant supervisory authority and exercise the rights described above. Optional analytics relies on consent; essential operation and security rely on the applicable lawful bases described in this Policy.

People's Republic of China: medical and health information may be sensitive personal information under the Personal Information Protection Law. The Website does not request identifiable medical or health information. Where the law applies, processing will be limited to a clear purpose and the minimum necessary scope, and separate consent or other required measures will be obtained before sensitive or cross-border processing when required.

These disclosures do not concede that every regional law applies to every Website interaction and do not reduce any mandatory right you have under applicable law.

14. Children

The Website is intended for adults and is not directed to children under 18. We do not knowingly collect a child's personal or health information. A parent or guardian must not submit a child's identifying information, records, or medical details through the Website. If you believe a child has submitted personal information, contact us without repeating the information so we can assess and take appropriate action.

15. Third-party sites

The Website may link to independent websites. Their privacy practices are governed by their own notices, not this Policy. Review those notices before providing information. A link does not mean Medical2China controls or endorses a third party's privacy or security practices.

16. Changes to this Policy

We may update this Policy to reflect changes in the Website, providers, law, or our practices. We will post the revised version and effective date. If a change materially expands how previously collected personal information is used, we will provide additional notice or obtain consent when required rather than relying only on a silent or retroactive policy change.

17. Contact and complaints

Email privacy questions, requests, or complaints to contact@medical2china.com with the subject Privacy Request. Do not include medical records, identity documents, report contents, or a detailed health history. We will respond within the period required by applicable law. You may also contact the privacy or consumer-protection regulator available in your jurisdiction.