Privacy Policy

1. Introduction

Aurevon Health ("we", "us", "our") is committed to protecting your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and all applicable Maltese and EU data protection legislation. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights in relation to it.

Our Data Controller is Aurevon Health Ltd, contactable at info@aurevonhealth.com.

2. What Data We Collect

We collect the following categories of personal data:

For patients and enquirers: Full name, email address, phone number; preferred medical treatment and destination; any additional details you voluntarily provide in your message, including health notes and treatment interests.

For clinic partners (healthcare providers): Clinic name, website, treatment types, and accreditation details; contact name, email address, and phone number; listing tier selection and subscription preferences; payment and billing information (processed via our payment provider); clinic profile content submitted for public directory display (descriptions, images, treatment lists, pricing indicators).

For website visitors: IP address, browser type, and pages visited (via analytics cookies, subject to consent); cookie consent preferences.

3. Special Category Data (Article 9 GDPR)

When you submit a medical tourism enquiry, you may voluntarily provide health-related information such as your treatment interests and health notes. This constitutes special category personal data under GDPR Article 9. We process this data on the basis of your explicit consent (Article 9(2)(a)). You are under no obligation to provide health-related information, and doing so is entirely voluntary. If you do provide it, we use it solely to coordinate your enquiry with relevant clinics in our network.

4. Legal Basis for Processing (Article 6 GDPR)

We process your data on the following legal bases: contractual necessity (Article 6(1)(b)) to respond to your enquiry, coordinate with clinics, and manage listing subscriptions; consent (Article 6(1)(a)) for marketing communications and analytics cookies; legitimate interests (Article 6(1)(f)) for website security, fraud prevention, and service improvement; legal obligation (Article 6(1)(c)) for record retention as required by applicable law.

5. How We Use Your Data

For patients and enquirers: To respond to your enquiry and coordinate with our vetted network on your behalf; to manage your patient journey from initial contact through to clinic introduction.

For clinic partners: To manage listing subscriptions and billing; to display clinic profile information in our public directory; to manage our relationship with clinic partners.

For all users: To improve our website and services; to comply with legal and regulatory obligations.

6. Public Directory Display

When a healthcare provider subscribes to a listing tier and submits clinic profile information, that information (clinic name, location, treatment types, accreditation details, description, and images) is displayed publicly in our Healthcare Providers directory. By submitting listing content, clinic partners consent to the public display of this information. Clinic partners may request removal or modification of their listing at any time by contacting info@aurevonhealth.com.

Listing tiers (Crown Diamond, Corporate Diamond, Platinum, Gold, Silver, Regular) determine the visibility and prominence of a clinic's listing. Higher tiers appear more prominently. This is a paid placement and does not constitute an endorsement of the clinic's services by Aurevon Health.

7. Data Sharing

We do not sell your personal data. We share data with the following categories of recipients: Healthcare providers in our network, for the purpose of coordinating patient enquiries; our payment processor, for clinic subscription billing (payment card data is handled directly by the processor; we do not store full card numbers); HubSpot, our CRM provider, for managing enquiries and clinic contacts; Base44, our platform provider, for data storage and application hosting; IT and cloud service providers, for website hosting and analytics. All processors are engaged under GDPR Article 28 Data Processing Agreements.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

9. Your Rights

You have comprehensive rights under the GDPR, including access, rectification, erasure, restriction, portability, and the right to object. Please see our Your Rights page for full details.

10. Your Right to Erasure (GDPR Article 17)

You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where it has been unlawfully processed.

How we handle account deletion: When you delete your account, your personal profile and login access are removed. Your personal identifiers (name, email, phone, address) will be anonymised within 30 days of your deletion request.

In accordance with GDPR Article 17(3) and applicable Maltese law, certain records relating to enquiries, referrals, or transactions you have made through Aurevon Health may be retained in a secure, restricted archive for up to 5 years. These records will only be accessed where required for legal, regulatory, or dispute resolution purposes and will not be used for any commercial purpose.

Special category health data (health notes, treatment interests) will be deleted within 30 days of account deletion unless directly tied to an active legal or dispute record.

For clinic partners: subscription and billing records are retained for 5 years post-cancellation for tax and accounting compliance. Public directory listings are removed within 30 days of subscription cancellation.

11. Data Retention Schedule

Data Category	Retention Period	Basis
Personal profile data (name, email, phone, address)	While account is active; anonymised within 30 days of deletion	GDPR Art. 6(1)(b) — contract performance
Transaction and enquiry records	5 years post-account deletion	GDPR Art. 17(3) — legal obligation
Health notes and treatment interest data	Deleted within 30 days of account deletion (unless legal hold)	GDPR Art. 9 — special category data
Marketing communications	Immediately removed upon deletion or withdrawal of consent	GDPR Art. 6(1)(a) — consent
Clinic listing subscription and billing records	5 years post-cancellation	Tax and accounting legal obligation
Public directory listing content	Removed within 30 days of subscription cancellation	Subscription terms

12. Why We Require Certain Information (Mandatory Fields)

Under GDPR Article 6(1)(b), we are permitted to process personal data where it is necessary for the performance of a contract or to take steps at your request prior to entering a contract.

Your email address is required to coordinate your enquiry, deliver service communications, and verify your identity. Your phone number is required to coordinate your care journey and ensure we can reach you. These fields cannot be left blank as they are essential to the delivery of our service. Changes to your email address require verification before taking effect.

For clinic partners: clinic name, contact details, and treatment types are mandatory to create a directory listing. Listing tier selection is required to activate a subscription.

13. Age Threshold

Our services are available to individuals aged 18 or over only. We do not knowingly collect or process personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at info@aurevonhealth.com and we will delete it promptly.

14. Children

Our services are intended for individuals aged 18 and over only. We do not knowingly collect personal data from anyone under the age of 18. If you believe a person under 18 has provided us with personal data, please contact us immediately at info@aurevonhealth.com.

15. Your Rights if You Are Outside the EU/EEA

If you are located outside the European Union or EEA, you may not have the same statutory rights under GDPR. However, as a Malta-registered data controller, Aurevon Health applies the same data protection standards to all users regardless of location. We will, as a matter of policy, honour requests to access, correct, or delete your personal data, subject to applicable legal obligations.

16. Supervisory Authority

If you believe your data protection rights have been violated, you may lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC), Malta's national data protection supervisory authority:

Website: idpc.org.mt
Address: Level 2, Airways House, High Street, Sliema SLM 1549, Malta
Email: idpc.info@idpc.org.mt