MED TRAVEL CONNECT LTD · 15728624
Privacy notice
Effective 11 September 2026
Who controls your information
MED TRAVEL CONNECT LTD (company number 15728624), Office 3800, 182-184 High Street North, East Ham, London E6 2JA, is the controller. Contact: officemedtravelconnect@gmail.com.
What we collect
When you book or contact us, we may collect your name, email, telephone number, preferred appointment, treatment area, messages, consent record and technical security information. Do not upload or send medical records through the booking form.
Why we use it and our lawful bases
We use your contact and appointment details to respond to your enquiry, arrange the consultation and take steps you request before a possible contract under Article 6(1)(b) UK GDPR. We use limited technical and anti-abuse records to protect the booking service under our legitimate interests in operating a secure service under Article 6(1)(f). We retain information needed to meet applicable legal duties under Article 6(1)(c), and may keep limited records needed to establish, exercise or defend legal claims under Article 6(1)(f).
A selected treatment area may reveal health information. We process that field only after a separate, explicit opt-in and rely on explicit consent under Article 9(2)(a). The form records the wording, version and time of consent. You can withdraw that consent through your private booking link or by contacting us. Withdrawal does not affect processing that was lawful before it, and the selected treatment area is removed from the booking record when withdrawal is recorded.
Sharing and international transfers
We use website hosting, database and transactional email providers and, when you choose to contact us there, WhatsApp operated by Meta. The email provider is used for booking confirmations, booking changes and administrator password recovery. Booking emails deliberately exclude your telephone number and selected treatment area; those details remain in the restricted administrator panel. We share information with a clinic or specialist only after explaining the proposed recipient and obtaining the authority required for that step. Information may be processed in the UK, EEA or another country with an applicable adequacy decision or contractual safeguards. We do not sell personal information.
Retention and security
The current booking-system retention periods are shown below this notice and are controlled by the authorised administrator. The booking lookup stores only a SHA-256 hash of its private-link token; while a customer email is queued, the link is held in an AES-GCM encrypted outbox payload and that payload is erased after successful delivery or removal of the delivery record. Booking anti-abuse records are normally removed within 30 minutes; administrator authentication rate-limit records may be retained for up to 24 hours, and password-recovery tokens expire after 30 minutes. A longer period applies only where required by law or reasonably needed to resolve a complaint or legal claim. Access to booking information is restricted to the authorised administrator.
Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction, portability or object to processing. You may withdraw consent and complain to the UK Information Commissioner's Office at ico.org.uk. Contact us first at officemedtravelconnect@gmail.com. We do not make solely automated decisions about your eligibility for treatment.
Current booking-system retention periods
- Active and completed booking records: up to 365 days after the appointment.
- Cancelled booking records: up to 90 days after cancellation.
- Transactional email delivery records: up to 90 days.
- Private booking-management link: expires 30 days after the appointment.
Last rendered from the live administrator-controlled settings. These periods may be shortened by deletion or extended only where the law or a live complaint or legal claim requires it.