Privacy Policy

1. Information We Collect

We collect information you provide directly to us, including:

• check_circleContact information (name, email address, phone number)
• check_circleMedical records, imaging files, pathology reports, and other health documents you share with us through the secure Google Drive folder we email you after your enquiry
• check_circlePayment information (processed securely through Stripe; we do not store card numbers)
• check_circleEnquiry form details: the patient's name and age, your contact name if you are enquiring for someone else, your WhatsApp number and email address, the specialty you selected, and what you told us about the condition and your question
• check_circleA note of how you found us, stored alongside your enquiry: the website or search engine you arrived from, whether the visit came from an advertisement or an ordinary search, and the campaign name where there was one
• check_circleOther communications you send us by email or WhatsApp

2. How We Use Your Information

We use your information to:

• check_circleDeliver your requested medical second opinion by matching you with the appropriate U.S. specialist
• check_circleCommunicate with you about your case, reports, and follow-up questions
• check_circleProcess your payment securely through Stripe
• check_circleImprove our platform and services
• check_circleComply with applicable legal and regulatory obligations

3. Medical Information

Medical records and health documents you submit are treated with the highest level of confidentiality. They are shared only with the U.S. specialist assigned to your case and are never sold or shared with third parties for marketing purposes. We use secure, encrypted storage and transmission for all medical data. Records submitted by patients outside the United States are transferred to HIPAA-compliant servers located in the United States for review by our U.S.-based specialists. This cross-border transfer is necessary to deliver the service and is conducted using encrypted, secure channels. By submitting your records, you consent to this transfer.

3a. Applicable Privacy Laws

Your records are stored and transmitted on HIPAA-compliant infrastructure, and the U.S. physicians who review your case handle your information under U.S. federal health privacy standards. HIPAA is the U.S. federal law governing the privacy and security of health information. If you are in India, the Digital Personal Data Protection Act, 2023 applies to your personal data. We rely on your consent to transfer, process and store your information in the United States for the purpose of preparing your educational review. You may withdraw that consent at any time by contacting us, though we may then be unable to complete a review already in progress. Your data will be processed under U.S. law while it is held there. You may exercise your data rights as described in Section 7.

4. Sharing of Information

We do not sell your personal information. We may share your information with:

• check_circleU.S. board-certified specialists who review your case on our platform
• check_circleStripe, our payment processor, for secure transaction processing
• check_circleGoogle, whose Workspace and Drive services hold your enquiry details and any records you share with us, under a signed business associate agreement
• check_circleOther service providers who help us operate our platform (under confidentiality agreements)
• check_circleLegal authorities when required by law

5. Cookies and Analytics

We use Google Analytics to understand how visitors use our website. It records pages viewed, how long a visit lasted, the general region a visit came from, and it sets an identifier that recognises the same browser on a later visit. That identifier is not your name, but it is not anonymous either, so we describe it here rather than calling it anonymous. This property is connected to Google Ads. We deliberately do not send it the medical specialty you selected or anything you wrote about a condition, so no health detail about you reaches an advertising platform. Analytics data is processed on Google's servers in the United States and is governed by Google's Privacy Policy.

6. Data Retention

We keep enquiry form details for twelve months from the date you send them, then delete them. If your enquiry becomes a case, we retain the records for that case for as long as necessary to deliver the service and to comply with applicable laws. You may request deletion of your data at any time by emailing us at info@tidbithealth.in, and we will action it whether or not the twelve months have passed.

7. Your Rights

You have the right to:

• check_circleAccess the personal information we hold about you
• check_circleRequest correction of inaccurate information
• check_circleRequest deletion of your data
• check_circleWithdraw consent for processing at any time
• check_circleLodge a complaint with a relevant data protection authority

8. Security

We implement industry-standard security measures including TLS encryption, secure file transfer protocols, and access controls to protect your information. No method of transmission over the internet is 100% secure; however, we strive to use commercially acceptable means to protect your data.

9. Contact Us