Your Rights

Your Rights Under the GDPR

As a resident of the European Union or the European Economic Area (EEA), you have specific rights regarding your personal data under Regulation (EU) 2016/679 (GDPR). Aurevon Health is committed to upholding these rights in full.

1. Right of Access (Article 15 GDPR)

You have the right to request a copy of the personal data we hold about you. We will respond to verified access requests within 30 days.

2. Right to Rectification (Article 16 GDPR)

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it.

3. Right to Erasure — "Right to Be Forgotten" (Article 17 GDPR)

You may request the deletion of your personal data where it is no longer necessary, you withdraw consent, or it has been unlawfully processed.

How we handle account deletion: When you delete your account, your personal profile and login access are removed immediately. Your personal identifiers (name, email address, phone number, and address) will be anonymised within 30 days of your deletion request.

In accordance with GDPR Article 17(3) and applicable Maltese law, certain records relating to enquiries, referrals, or transactions you have made through Aurevon Health may be retained in a secure, restricted archive for up to 5 years. These records will only be accessed where required for legal, regulatory, or dispute resolution purposes and will not be used for any commercial purpose. Deleted and anonymised accounts will not appear in any active user lists or marketing communications.

Special category health data (health notes, treatment interests) will be deleted within 30 days of account deletion unless directly tied to an active legal or dispute record.

4. Data Retention Summary

• Personal profile data (name, email, phone, address): held while your account is active; anonymised within 30 days of account deletion.
• Transaction and enquiry records: retained for 5 years post-account deletion for legal and regulatory compliance.
• Health notes and treatment interest data: deleted within 30 days of account deletion unless subject to a legal hold.
• Marketing communications: immediately removed upon account deletion or withdrawal of consent.

5. Why We Require Certain Information (Mandatory Fields)

Under GDPR Article 6(1)(b), we are permitted to process personal data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract.

Your email address is required to coordinate your enquiry, deliver service communications, and verify your identity. Your phone number is required to coordinate your care journey and ensure we can reach you regarding your enquiry. These fields cannot be left blank as they are essential to the delivery of our service.

6. Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

7. Right to Object (Article 21 GDPR)

You have the right to object at any time to the processing of your personal data for direct marketing purposes.

8. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you may lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta: idpc.org.mt

Your Rights as a Cross-Border Healthcare Patient

Under EU Directive 2011/24/EU — Patients' Rights in Cross-Border Healthcare

If you are an EU or EEA resident seeking medical treatment in another EU or EEA country through Aurevon Health, you have specific rights under EU Directive 2011/24/EU. These are separate from and in addition to your GDPR data protection rights above.

The Right to Seek Treatment Abroad

As an EU or EEA resident, you have the right to seek and receive healthcare in another EU or EEA Member State and to be reimbursed for the cost of that treatment, subject to the conditions of your home country's healthcare system.

The Right to Reimbursement Information

Before you travel, you have the right to receive clear information about whether and to what extent the costs of your intended treatment may be reimbursed by your home country's national health system or insurance provider. Aurevon Health does not make reimbursement claims on your behalf. Contact your home country's national health authority or insurer directly to establish your entitlement before committing to treatment abroad.

The Right to Safe and High-Quality Treatment

You have the right to receive treatment from a licensed, authorised healthcare provider. All clinics and medical facilities within the Aurevon Health network hold valid operating licences issued by the relevant national health authority in their country of operation.

The Right to a Medical Record

You have the right to receive a written medical record, in a comprehensible format, of any treatment you receive abroad. Request this directly from your treating clinic at the time of treatment.

The Right to a Second Opinion

You retain the right to seek a second medical opinion at any point — from a clinician in your home country or elsewhere — before proceeding with any treatment abroad. Aurevon Health supports and encourages this right.

The Right to Continuity of Care

Upon return to your home country, you have the right to receive any necessary follow-up treatment from your domestic health system, in accordance with applicable national law.

National Contact Points

Each EU Member State operates a National Contact Point (NCP) for cross-border healthcare. To find your country's NCP, visit: ec.europa.eu/health/cross_border_care/national_contact_points_en

How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at: legal@aurevonhealth.com

We will respond within 30 days, and in complex cases, within a maximum of 90 days with prior notice.

For Users Outside the European Union or EEA

If you are located outside the European Union or EEA, you may not have the same statutory rights under GDPR. However, as a Malta-registered data controller, Aurevon Health applies the same data protection standards to all users regardless of location. We will, as a matter of policy, honour requests to access, correct, or delete your personal data submitted to our platform, subject to applicable legal obligations. For data protection enquiries, contact legal@aurevonhealth.com.