Privacy policy
Version
Medicalacross is an independent guide to planned treatment abroad. We collect as little personal data as possible, never ask for medical details (the treatment you consider is kept only with your explicit consent), never sell data, and show no advertising. This policy explains what we process, why, on which legal basis (EU General Data Protection Regulation, "GDPR"), and your rights.
1. Who is responsible
Data controller: Medicalacross (medicalacross.com). Contact for any privacy question or request: contact@medicalacross.com.
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Visiting the site without an account: IP address, browser, pages requested (server logs) | Deliver the site, security, preventing abuse | Legitimate interest (Art. 6(1)(f)) | About 14 days (log rotation) |
| Tools (true cost, clinic check, which destination, recovery planner) | Calculations run in your browser; nothing is sent to or stored by us | — | Not stored |
| Account: email address, password (stored only as a strong one-way hash), or a Google account identifier and name if you use Google sign-in; dates of creation and last login | Provide your account | Contract (Art. 6(1)(b)) | Until you delete the account; inactive accounts are deleted after 24 months without login |
| What you save in an account, when accounts open: where you live, the clinics you check (name, country, checklist ticks, the quote and what it includes, the clinic's written answers), your trip dates and your own dates. Never medical details (no photos, weight, BMI, medical history or medicines) | Keep your treatment file between visits | Consent (Art. 6(1)(a)), given when you create the account; withdrawable at any time in "My account" | Until you withdraw consent or delete the account (withdrawal deletes this data) |
| The treatment you are considering (for example dental implants or weight-loss surgery) and, in your trip plan, the procedure. Because it says something about your health, it is a special category of data | Set your clinic checklists, the costs and the dates of your plan | Explicit consent (Art. 9(2)(a)), asked separately when you save your treatment; withdrawable at any time in "My account" (withdrawal removes the treatment and the procedure from your file) | Until you withdraw this consent or delete the account |
| Email address, for updates about your treatment file (not sent yet) | Optional updates when a rule or a source changes for your treatment or your clinics' countries | Consent (Art. 6(1)(a)) | Until you withdraw consent |
| A trip you share with a travel companion (only if you make a link): the link's label (for example a first name), its end date, when it was last opened, and the short notes your companion sends back with the name they choose to give | Let the person travelling with you see the dates, the place and the clinic's name. Your treatment is hidden unless you show it for that link; quotes, checklists, the clinic's answers and your preparation steps are never shared | Consent (Art. 6(1)(a)) for each link, and explicit consent (Art. 9(2)(a)) if you choose to show the treatment; you can switch a link off at any time | Until the link ends or you switch it off, then 30 days; we keep only a fingerprint of the link, never the link itself |
| Record of your consents (what, when, policy version, hashed IP) | Demonstrating consent (Art. 7(1)) | Legal obligation / legitimate interest | As long as the account exists |
| Audience measurement (Google Analytics 4) if you accept analytics cookies | Understand which pages help, improve the site | Consent (Art. 6(1)(a)); not loaded at all without it | Google Analytics retention set to 14 months |
| Hashed IP address and email in a short-lived log of login attempts | Protect accounts against password guessing | Legitimate interest (Art. 6(1)(f)) | 24 hours |
Please do not enter other sensitive data (religion, ethnic origin, detailed medical information, etc.) in free-text fields: we don't need it.
3. What we never ask for
Accounts are for adults. We only ask for what is useful for planning: no date of birth, no passport or tax number, no photo, no medical records, no weight, conditions or medicines. If you share your trip with a travel companion, they see only what the link shows.
4. Who receives data
- Hosting: Hetzner Online GmbH, servers in Germany (EU), acting as our processor.
- Google (Google Ireland Ltd / Google LLC): only if you choose "Continue with Google" (we receive your name, email and an identifier), and only if you accept analytics cookies (Google Analytics). Transfers to the US rely on the EU-US Data Privacy Framework and standard contractual clauses.
- Email delivery provider (when emails start: Brevo, Sendinblue SAS, France, EU data hosting), to send confirmation and password reset emails, bound by a data processing agreement. This policy will be updated before any email is sent.
We never sell or rent personal data and never share it with partners, agents or advertisers. When you follow a link to a partner (for example an insurer), nothing about you is passed on by us.
5. Estimates, not decisions
Our tools help you plan and check; they give no medical opinion and involve no automated decision with legal or similarly significant effects on you. Treatment decisions belong to you and the doctors who examine you.
6. Your rights
You can at any time: access your data and receive it in a portable format (download it from "My account"), correct it, delete it (delete your account from "My account"), restrict or object to processing, and withdraw any consent (without affecting processing before withdrawal). Write to contact@medicalacross.com. We answer within one month. You can also lodge a complaint with the data protection authority of your EU country of residence.
7. Security
Encrypted connections (HTTPS), passwords hashed with Argon2id, protection against cross-site request forgery, rate limiting of login attempts, data stored in a dedicated database on servers in the EU, and least-privilege access.
8. Cookies
See our cookie policy. You can change your choice at any time via "Cookie settings" at the bottom of each page.
9. Changes
We will update this policy when our processing changes, change its version number, and, for important changes, inform account holders by email or when they log in.