Privacy Policy

Qalyup Ltd (company number 15936794), registered in England and Wales, trading as "Qalyup" ("we", "us", "our"). We are registered with the Information Commissioner's Office (ICO), registration number ZC144444.

Qalyup is a UK-based platform that connects patients with healthcare providers in other countries. We act as an intermediary – this means we help you find and book appointments with partner clinics abroad and can store your medical records for you. We are not a healthcare provider ourselves, but we facilitate your access to medical care internationally.

Your privacy is very important to us. This Privacy Policy explains what personal and health-related information we collect through our public website, how we use and share that information, and how we keep it safe. We handle all personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, which ensure strong privacy protections.

This Privacy Policy, and the rights it describes, are governed by UK data protection law and apply to how Qalyup handles your data as the data controller, wherever in the world you are based. Where your data is transferred to a partner clinic or provider outside the UK, the level of protection it receives may differ once it is in that provider's hands, as explained further in "International Data Transfers" below. We take steps to protect your data appropriately in all cases, but we cannot guarantee that every partner or jurisdiction will apply identical standards to those required in the UK.

Please read this policy carefully to understand our practices. By using the Qalyup website or services, you agree to the collection and use of your information as described here. If you have any questions, you can contact us using the details in the “Contact Us” section below.

We only collect information that is necessary to provide you with our services. This includes:

• Personal Identification Information: Your name, date of birth, and any identification details you provide when registering or filling in forms on our site.
• Contact Information: Contact details such as email address, telephone number, and mailing address. We use these to communicate with you about appointments or respond to your inquiries.
• Health and Medical Information: Any health-related details you choose to give us, such as medical history, current conditions, test results, or medical records. For example, you might provide information about your condition or upload medical documents so that we can help find a suitable healthcare provider. This is “special category data” under UK GDPR and we treat it with particular care. We only collect it where you have given your explicit consent, and we rely on the health or social care purposes condition in Schedule 1 of the Data Protection Act 2018 as our additional condition for processing it. See “Our Lawful Basis” below for more detail.
• Appointment and Service Details: Information related to the services you request through Qalyup – for instance, the type of treatment you’re seeking, preferred dates, and the clinic or doctor you’re interested in. We also keep records of appointments or arrangements we book for you, including follow-up notes or correspondence related to your care.
• Communications: Copies of communications you have with us. If you email us, call us, or use a contact form or chat feature on our website, we may keep those communications. They might include personal and medical details you share while asking questions or getting support.
• Website Usage Data: Basic technical information collected automatically when you use our site. For example, we might log your IP address, browser type, and cookies that are necessary for the site to work (see “Cookies” below). This information helps us ensure the website functions properly and secure your account. We do not use this data to track your behaviour across other sites, and we do not collect any unnecessary usage analytics without your knowledge.

We do not collect any financial information (such as credit card details) through our site, unless it becomes necessary to facilitate a payment that you initiate. In such cases, payments will be processed securely through a third-party provider, such as Stripe, and their own terms and conditions will apply. Should we begin to handle payments directly through the site in the future, we will update this policy accordingly to reflect those changes.

We use your personal and health information only for legitimate purposes connected to our services. Specifically, Qalyup may use the data we collect to:

• Provide Our Services: We use your information to connect you with healthcare providers and arrange medical services as you request. For example, if you ask us to find a specialist in another country or book an appointment, we will use your provided details (like your name, contact, and relevant medical information) to facilitate that service. This may include matching you with a suitable clinic or doctor and scheduling your appointment.
• Store and Manage Your Medical Records: With your consent, we may store copies of your medical records or health information on our platform. This is to help you easily share those records with partner clinics at your request and to assist in coordinating your care. We maintain these records so you have a centralised place for your information, accessible to you and (with your permission) to healthcare providers involved in your care.
• Communicate With You: We use your contact information to communicate with you about the services. This includes sending confirmations of appointments, updates from clinics, responding to your questions, and providing customer support. For example, we might email you to give you medical travel instructions or to follow up on your consultation. All communications about sensitive information are handled securely.
• Share with Partner Clinics (at Your Direction): When you decide to proceed with a consultation or treatment with a specific healthcare provider, we will (with your approval) share the necessary personal and medical information with that clinic or doctor. This is so they understand your case and can provide care. We only do this at your explicit request, such as when you ask us to book an appointment or send your medical records to that provider.
• Operate and Improve Our Website: We use data like website usage information and essential cookies to run the technical aspects of Qalyup. This helps keep the site secure, load faster, and remember your preferences (for example, keeping you logged in during a session). We may also use aggregated, anonymous information to improve our platform’s usability and services. This does not include any of your identifiable personal or health details – it’s only general data to help us understand what features are useful to users in general.
• Legal and Regulatory Compliance: In certain cases, we may need to use or keep your information to comply with applicable laws and regulations. For example, UK data protection law may require us to retain records of transactions or communications for a certain period. We may also use our data to fulfil our duties in responding to lawful requests (such as a court order) or to establish, exercise, or defend legal claims if that situation arises.

We will only use your personal data when we have a valid legal reason under data protection law. Most often, this will be because the data use is necessary to perform the services you request (for instance, using your information to schedule an appointment, which is essentially part of our contract with you), or because you have given consent (for example, you provide and consent to our use of your health information for the purpose of finding you medical care). In some situations, we might have a legal obligation to process data (such as retaining invoices or records for regulatory reasons), or we might rely on our legitimate interests (such as improving our services or ensuring IT security) – but if we do so, we will always consider and respect your rights and interests. If we ever need to use your personal data for a new purpose that isn’t covered here, we will seek your consent or inform you of the new purpose, as required by law.

Because health information is special category data, we need an additional legal basis before we can use it, on top of the reasons above. We rely on your explicit consent (Article 9(2)(a) UK GDPR) as our primary basis for processing your health data, together with the health or social care purposes condition under Schedule 1, Part 1 of the Data Protection Act 2018, which permits processing of health data that is necessary for the provision of health or social care or treatment. You can withdraw this consent at any time – see “Right to Withdraw Consent” below.

Importantly, we do not use your personal data for any kind of marketing without your permission. Every use of your data is tied to delivering our service to you or fulfilling our legal responsibilities, nothing else.

Cookies are small text files placed on your device to make websites work or work more efficiently. Qalyup uses only essential cookies on our website. This means:

• Necessary Cookies: These cookies are required for the basic functioning of our site. For example, when you log into your account, an essential cookie keeps you logged in as you navigate between pages. Other essential cookies may be used to remember your preferences (like language or region selection) or to provide basic security and network management. Without these, the site may not function properly.
• No Tracking or Advertising Cookies: We do not use any cookies for advertising, marketing, or tracking your behaviour outside of our interaction. We do not use third-party analytics cookies (such as Google Analytics) or social media trackers on our site. This means we’re not collecting data about your browsing for advertising or sharing your browsing habits with advertisers. Your activity on Qalyup is not profiled or tracked for marketing purposes.

Because we only use essential cookies, we typically will not display the kind of cookie consent banner you might see on other sites for advertising cookies. However, we still want you to know about our cookie use. By using our site, you understand that essential cookies will be set on your device to enable the service to work. You can set your browser to block cookies, but if you do, some parts of our site might not function correctly (for example, you might not be able to log in or book an appointment). For more details about our minimal use of cookies or if you have any specific questions, feel free to contact us.

We treat your personal information with care and confidentiality. We do not sell your data to third parties or share it for random marketing purposes. We will only share your data in the following circumstances:

• With Partner Healthcare Providers (Clinics/Doctors) – Only at Your Request: This is a core part of Qalyup’s service. If, and only if, you ask us to get a personalised quote or arrange a consultation or treatment with a specific clinic or doctor, we will share the necessary personal and medical information with that partner provider. For example, if you request a personalised quote or an appointment with a specialist overseas, we will forward details like your name, contact information, and relevant medical history to that clinic so they can elaborate a bespoke quote or prepare for your visit and treat you effectively. We will never send your health information to any clinic or doctor without your knowledge and request. You are in control: we act as a messenger, passing along your information to the people you’ve chosen to involve in your healthcare.
• Sharing with Third-Party Clinical Services: To provide you with clinical care, your healthcare provider may share your personal data with third-party organisations, such as diagnostic laboratories. Once your information is transferred, the clinic and the third-party organisation are solely responsible for its protection and lawful processing. Qalyup accepts no liability for any data handling or processing carried out by these external parties. For further details on how your data is used by our clinical partners, please contact the clinic directly.
• With Service Providers and Third-Party Tools (for Secure Processing): We use trusted third-party services to help us run Qalyup’s platform and deliver our services to you. These third parties act on our behalf (we refer to them as “data processors”) and they only process your data under our instructions and in compliance with this policy. We ensure they are also compliant with data protection laws. We use third-party tools or services, such as secure cloud hosting providers (to store data on protected servers), IT support services, or secure messaging systems for appointments. In all cases, we choose providers that implement strong security measures and we only share the minimum necessary information with them for the task.
• With Legal or Regulatory Entities: We might be required to disclose information about you if we are compelled by law or governmental authority. For instance, if a court order, subpoena, or other legal process mandates us to share certain data, or if the Information Commissioner’s Office (ICO) requests information as part of an investigation, we are legally bound to comply. In such cases, we will only provide the information that is required and will, if law allows, inform you of such disclosure.

Aside from the situations above, no one else receives your personal data. We do not share your information with advertisers, social media companies, or any unrelated third parties. If in the future we consider partnering with any new type of third party that would need access to personal data, we will update this Privacy Policy and, if required, seek your consent.

When we do share data (for example, with a clinic or a service provider), we always transfer it securely. We also ensure that the recipient understands the confidential nature of the information.

Because Qalyup connects you with healthcare providers around the world, it’s important to address how your data might travel internationally. When you ask us to send your personal information or medical records to a partner clinic outside the United Kingdom, that inherently means your data will be transferred to another country’s jurisdiction.

• Your Consent and Request: By requesting a quote, an appointment or consultation with an overseas provider, you are effectively consenting to and requesting that we transfer your relevant personal data to that provider in their country. We will only transfer the information necessary for that purpose, and we will inform you what is being sent.
• Protection Measures: Regardless of the destination country, we send your data through secure channels (for example, encrypted email or secure servers) to keep it safe in transit. We also have agreements or assurances in place with our partner clinics that they will treat your information confidentially and use it only for your care. If the clinic is in a country that the UK deems as having adequate data protection laws (for example, countries in the European Economic Area, or others officially recognised), your data will be protected similarly to how it’s protected in the UK. If the clinic is in a country without the same level of data protection laws, we take additional steps – such as using encryption, appropriate contractual safeguards, and only sharing data with your explicit instruction – to protect your privacy. Even with these steps, the protection your data receives once it reaches an overseas provider will reflect that country’s own laws and that provider’s own practices, and may not be identical to UK protections in every respect.
• Clinic’s Own Privacy Practices: Once your information is transferred to a healthcare provider abroad at your request, that clinic will handle your data according to their own privacy policies and the laws of their country. While we require our partners to respect patient confidentiality and privacy, please note that their handling of your data is outside of Qalyup’s direct control. We recommend that you review any clinic’s privacy notice if you want a clear picture of how they manage your data. However, if you need assistance or have concerns about the information we shared with a clinic, you can contact us and we will do our best to help.

In summary, international data sharing will occur only when you choose to use our service to see an overseas provider, and we will always take reasonable steps to protect your information during such transfers.

We understand that your personal and health information is sensitive, and we take appropriate security measures to protect it. Qalyup has implemented a variety of technical and organisational safeguards to keep your data safe from unauthorised access, loss, or misuse. These measures include:

• Encryption: Our website is protected by HTTPS, which means that any data you enter on our site (such as filling out forms or uploading documents) is encrypted in transit. We also use encryption where possible for data at rest, especially for sensitive health records. For example, medical documents you store with us may be encrypted or stored in a secure, access-controlled environment to prevent unauthorised access.
• Secure Email and Communication: When we send or receive emails containing personal or medical information, the content is encrypted such that only the intended recipients can read it.
• Access Controls: Within Qalyup, access to personal data is restricted to only those employees or team members who need to see it in order to perform their duties. We ensure that anyone handling sensitive information is aware of their responsibilities and is bound by confidentiality agreements.
• Secure Infrastructure: We host our platform and data with Wix, which provides secure, reliable infrastructure. Further information can be found on their website: https://www.wix.com/website-security
• Data Minimisation: We collect and keep only the information that is necessary for the purpose at hand. If certain data is no longer needed, we ensure it is safely deleted or anonymised.

While we strive to protect your information with strong measures, it’s important to note that no method of data transmission or storage can be guaranteed 100% secure. If there is ever a security breach that affects your personal data, we will follow all applicable laws in notifying you and the authorities, and we will take immediate steps to mitigate the impact.

We will keep your personal information only for as long as it is necessary to fulfil the purposes we collected it for, including to provide you services or to meet any legal, accounting, or reporting requirements.

• Active Use of Your Data: If you are using Qalyup’s services (for example, you have an ongoing inquiry or upcoming appointment, or you maintain an account with us), we will retain your information so that we can continue to serve you.
• Account Holders: If you register an account on Qalyup, we will retain your data until you decide to close your account or until it’s clear you will no longer use our services. You always have the option to ask us to delete your account and personal data (see “Your Rights” below), and we will honour such requests, provided we don’t have a legal obligation to keep the data.
• Medical Records Storage: If we are storing medical records or health information on your behalf, we will keep those records as long as you want us to. You can request deletion of specific medical documents or all of them at any time.
• After Service Completion or Account Closure: If you have completed the use of our service or close your account, we will generally either delete or anonymise your personal data. We might retain anonymised data for statistics or service improvement, but that data will not identify you.
• Legal Retention Requirements: In some cases, we might be required by law to keep certain data for a specified time, for example financial records or records of consent. If there’s a dispute or legal matter, we might need to keep relevant information until it is resolved.

Once the retention period has expired, or if you request deletion (and no legal requirement prevents it), we will ensure your data is promptly and securely removed from our systems. If complete deletion is not immediately feasible (for example, if backups are involved), we will put your information beyond use until deletion is possible.

Under UK data protection law, you have several important rights regarding your personal data. We are committed to upholding these rights. Below is a summary of your key rights and how you can exercise them:

• Right to Be Informed: You have the right to be informed about the collection and use of your personal data. This Privacy Policy is part of fulfilling that right.
• Right of Access: You can request a copy of the personal data we hold about you (a “Subject Access Request”). We will provide this free of charge (unless the request is excessive or repetitive) and within the legally required time frame (normally within one month).
• Right to Rectification: If any of your information held by Qalyup is inaccurate or incomplete, you have the right to have it corrected.
• Right to Erasure: Commonly known as the “right to be forgotten”. You can ask us to delete or remove your personal data in certain circumstances. We will do so unless we have a specific legal reason to keep it, and we will explain if that is the case.
• Right to Restrict Processing: You have the right to request that we limit the way we use your data in certain situations, for example while we verify accuracy or consider an objection.
• Right to Data Portability: You have the right to obtain your personal data from us in an accessible, machine-readable format (for example CSV or PDF), so you can reuse it or transfer it to another service or provider.
• Right to Object: You have the right to object to certain types of processing of your data, for example where we rely on legitimate interests.
• Right to Withdraw Consent: Where we rely on your consent to process your personal data, including your health information, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the legality of any processing we carried out before you withdrew, but it means we will stop that processing going forward. If the consent relates to information necessary to provide our service, we may not be able to continue providing that service, and we will advise you if that is the case.
• Right to Complain: If you have any concerns or complaints about how we are handling your personal data, please contact us first at hello@qalyup.com so we can try to resolve the issue. When you raise a complaint with us, please describe the issue in as much detail as you can, including your name and the email address associated with your Qalyup account. We will acknowledge your complaint and aim to investigate and respond within one month. If your complaint is complex, we will let you know and may need up to a further two months to respond in full. You also have the right to lodge a complaint directly with the Information Commissioner’s Office (ICO) at any time, whether or not you have raised it with us first, via ico.org.uk or by telephone. If you are located in another country, you may also have the right to complain to your local data protection authority.

To exercise any of these rights, you can contact us using the contact information provided in the next section. We will need to verify your identity before fulfilling certain requests to ensure that we don’t disclose your information to someone else. We will respond to all legitimate requests as quickly as possible, and at least within the timeframe required by law (usually one month, with the possibility to extend that by two further months for complex requests – but we’ll inform you if an extension is needed).

Please note that some rights are not absolute. For example, there may be legal or legitimate reasons we cannot fully comply with a request. If that is the case, we will explain to you why we cannot meet the request in full and discuss what we can do instead.

Qalyup Ltd (company number 15936794) is the “data controller” responsible for your personal data (in other words, Qalyup decides how your data is processed and for what purposes, in line with this policy). We are registered with the ICO under registration number ZC144444.

If you have any questions, concerns, complaints, or requests regarding your personal data or this Privacy Policy, please contact us at: hello@qalyup.com

When you contact us, please describe your question, complaint, or request in detail, including the email address or other contact information you used to sign up with Qalyup (if applicable), so we can verify your identity and assist you more efficiently.

If you’re not satisfied with our response or believe we are processing your data unfairly or unlawfully, you have the right to contact the ICO as mentioned above. However, we truly appreciate the opportunity to address your concerns first and will do our utmost to resolve any issues.

We may update or change this Privacy Policy from time to time to reflect changes in our practices, accommodate new services, or ensure compliance with updates in laws and regulations. When we make changes, we will post the updated policy on our website and update the “last updated” date at the bottom of this document. If the changes are significant, we may also notify you directly via email or a notice on our website.

We encourage you to review this Privacy Policy periodically to stay informed about how Qalyup is protecting your information. Continuing to use our website or services after a new privacy policy has been posted will indicate that you have read and understood the changes.

If we ever were to use your personal data in a materially different way than we’ve described here, we would seek your permission first, where required by law.