Privacy Policy

1. Who we are

Hainan Medical Tour ("we", "us") is an independent medical travel consultation and on-ground concierge service operating in Qionghai, Hainan, China. We are not a hospital, clinic or medical provider. All diagnosis and treatment are delivered by licensed hospitals inside the Boao Lecheng International Medical Tourism Pilot Zone.

2. What information we collect

• Contact details you submit through either of our forms (the contact form, the first-screen matcher send panel, or a treatment page form): name, email, country, phone or WhatsApp number.
• Health information you voluntarily describe in your enquiry, such as condition, treatment sought and timeline. The wording you type is kept in full, as written, so your coordinator can read, classify and organise it. Do not paste identity numbers into the form.
• The first-screen matcher: text you type into the box on our home page is compared with our programme list inside your own browser only. Nothing leaves your device while matching, and no external AI or model service processes it. If you then choose "Send this to me", the exact words you wrote — unchanged — plus the programme it matched and the match confidence are sent through the same private form relay. If you do not press that button, nothing is sent.
• Medical documents you choose to attach (entirely optional): reports, imaging or test results in PDF / image / Word format. A form can be sent with no attachments at all. Files are limited to 5 per submission and 10 MB each, are stored as attachments on the same private record as your message, and are accessible only to the coordinator handling your case. Please attach only what is needed and redact identity numbers where you can. Your explicit consent at the time of submission covers these files as sensitive health information.
• Browser-local submission history: a copy of what you sent, kept in your own browser storage so you can review it on the "My account" page. For visitors without an account this never leaves the device, is not shared with us or any third party, and can be cleared by you at any time on that page.
• Optional account data: if you choose to create an account, we store your email address, a salted one-way hash of your password (never the password itself), a one-way hash of a one-time recovery code, a random session token and a private copy of the enquiries you send while signed in. To confirm that the address belongs to you, we send a 6-digit code by email at sign-up and when you reset a forgotten password; only a one-way hash of that code is held in the private key-value store, for 15 minutes, with a five-attempt limit. The code itself is never stored in readable form and is deleted as soon as it is used. The recovery code is shown to you once at registration and is not retained in readable form. Creating an account is entirely optional — every form works without one.
• Claim tokens: for enquiries sent without an account, the relay issues a random token that stays in your browser. If you later create an account, that token plus a matching email address lets you move those enquiries into your account. The relay keeps only the token, the reference number, the email and the list of attachment identifiers — not the words you wrote — until the claim happens.
• Technical data: IP address, browser type, pages visited, collected via analytics cookies if you accept them; the account relay also keeps short-lived abuse counters keyed to an IP address.

3. Why we use it

• To respond to your enquiry and prepare a personalised proposal.
• To coordinate appointments with hospitals and arrange travel logistics you request.
• To send you updates about your own case (never unrelated marketing without consent).
• To give you, if you choose to create an account, a private permanent record of what you sent and the documents you attached.
• To meet legal, accounting and safety obligations.

4. Legal basis (GDPR)

Where the EU or UK GDPR applies, we rely on: consent (for health information and marketing), performance of a contract (services you request), and legitimate interests (responding to enquiries, preventing fraud). You may withdraw consent at any time.

5. Who we share it with

We share only what is necessary with: the hospital or specialist you choose to be referred to; translation or transport providers you ask us to arrange; our email and form-processing providers (including the transactional email service that delivers account verification and password-reset codes — it receives your email address and the code, never your medical information); our serverless form relay and its private key-value store (which holds the optional account data and the customer-facing copy of your enquiries); and the private cloud collaboration workspace (a Feishu / Lark multi-dimensional table) where the original text of your enquiry, any attached medical documents, the entry point used and — for the first-screen matcher — the suggested programme and its confidence score are stored for review, classification and follow-up. The table and its attachments are private: no public link, shared form or guest access is enabled, and visitors cannot see or reach them. Access is limited to the coordinator handling your case. Your account view reads only rows tagged to your own account; it can never read another customer's records. We never sell your data.

6. International transfers

Our services are delivered in China, so your information — including the original wording of your enquiry — will be transferred to and processed in China, which may have different data protection laws from your country. The serverless relay and its account store run on a global edge network before the data reaches the private working table in China, so a copy may also be processed outside your country in transit. If you are in the EU or UK this is a transfer outside your country, made on the basis of your consent. We limit transfers to what is needed to deliver the service you requested and require recipients to keep it confidential.

7. How long we keep it

Enquiries that do not proceed are deleted within 12 months. Active client records are kept for the duration of the service plus 24 months, or longer where required by law. The original text and any attached files in the working table follow the same schedule and are removed on request sooner. Your account's own copy is different by design: it has no automatic expiry, so you can keep looking at what you sent from any device for as long as you keep the account. You may remove a record from your account at any time on the "My account" page; that removes the account copy only and does not delete the original enquiry I received, which continues to follow the schedule above. You may also ask me to delete the account and all of its copies entirely. A session token expires after a year of inactivity, but signing in again restores access — expiry never deletes your records. Guest claim metadata is discarded as soon as a claim succeeds. An unverified sign-up and its code hash are discarded after 24 hours and 15 minutes respectively. Logs kept by the form relay contain only a reference id, timestamp and delivery status — never the content of your message, your email or your files. The browser-local history stays on your device until you clear it or clear your browser data.

8. Your rights

You may request access, correction, deletion, restriction, portability, or object to processing, and you may lodge a complaint with your local data protection authority. Signed-in customers can view the full text of their own submissions, re-download the documents they uploaded through an authenticated link, and remove individual records from the account copy directly on the "My account" page. Registration and password resets use a 6-digit code sent to your email address; the one-time recovery code shown at sign-up remains a second, offline way back in. If you lose access to both your email and the recovery code, contact me and I will verify your identity out of band before restoring access. Contact us to exercise any right.

9. Cookies

We use essential cookies for language preference and, if you consent, analytics cookies to understand which pages help visitors. The optional account uses browser local storage (not a cookie) for its session token and language choice, and for the device-only submission history. You can clear local storage in your browser at any time; that signs you out on that device but does not delete your account records. You can block cookies in your browser at any time.

10. Medical disclaimer

Information on this website is general and educational. It is not medical advice and must not replace consultation with a qualified physician. Always seek professional advice before making treatment decisions.

11. Contact

Email: hello@hainanmedicaltour.com
We aim to reply to privacy requests within 30 days.