Privacy Policy

Effective date: 21 October 2026

1. Who we are

MedTourism operates an independent online reference that displays provider-published prices together with source links and check dates. MedTourism is the organization responsible for the personal information described in this policy.

Privacy contact: the contact form at https://medtourism.guide/contact/

2. Scope

This policy applies to the contact form, to the optional price-update subscription when it is offered, and to the limited technical information used to operate and secure this website. Reading the catalogue does not require an account. The website does not provide booking, payment or treatment-enquiry functionality.

3. Information we collect

When you use the contact form, we collect the email address you enter so that we can reply, the address of the page you are writing about if you give it, and the text of your message. Please do not include information about your health or anyone else's in the message; we do not need it and will delete it if received.

For a price-update subscription, when it is offered, we collect:

• the email address submitted by the subscriber;
• the codes for the topics selected from our closed list;
• confirmation status and the dates and times of subscription confirmation, topic changes and unsubscribe actions;
• the version of the consent wording accepted; and
• minimal delivery and security events needed to send, protect and troubleshoot the service.

We do not ask for a name, age, residence, account password, free-text description or the identity of any other person. We do not create inferred labels, scores or advertising profiles from the selected codes.

4. Why we use this information

We use contact-form messages only to answer them and, where a message reports an error in our data, to check the provider's page and record a correction. We use subscription information only to:

• confirm the subscription request;
• send updates for the selected topic codes;
• provide a secure link for viewing and changing the selection;
• process a per-topic or complete unsubscribe;
• record consent and suppression events;
• maintain delivery, security and incident-response functions; and
• meet legal obligations.

The subscription is based on express consent. The consent box is separate and is not selected in advance. Subscription is not required to read the website. Consent may be withdrawn at any time by using the links in an email or contacting us. We will seek new consent before using the information for a materially different purpose unless law permits or requires the use.

5. Email rules

Each price-update email identifies MedTourism, provides valid contact information and includes links to manage selected topics and unsubscribe from all updates. We aim to stop messages immediately after a complete unsubscribe and will always give effect to it within 10 business days. The unsubscribe link remains available without charge and is kept valid for at least 60 days after the email was sent.

6. Sharing and service providers

We do not sell subscriber information. We do not give subscriber addresses or selected codes to providers listed in the catalogue.

We use service providers for website hosting and security (Cloudflare, Inc., USA), for receiving contact-form messages (Formspree, USA), and for email delivery and operational support. They may process only the information needed to perform those functions and must be bound by contractual confidentiality, security, purpose-limitation, incident-notification, deletion and subprocessor controls. We may disclose information where law requires it or where permitted for an incident response or legal process.

7. Storage location

Contact-form messages are received and stored by our service provider Formspree in the United States. The website is served through Cloudflare's global network, which processes technical request data in the countries where its servers are located. Information handled by these providers may therefore be stored or processed outside Canada, and may be accessible to courts, law-enforcement and national-security authorities of those countries under their laws. We will update this policy before adding a provider or a storage location that is not described here.

8. Security

Contact-form messages are protected by the security measures of our service providers and are accessible only to the people who answer them. For the subscription, when it is offered, we treat the linked email-and-code set as sensitive personal information. The email-address mapping and topic-code store are logically separated and joined through a random subscription identifier only for confirmation, delivery and subscriber-directed changes. We use encryption in transit and at rest, restricted role-based access, expiring high-entropy management links, administrative logging, tested deletion procedures and incident-response controls. No internet service can guarantee absolute security.

9. Retention

• A contact-form message and the reply address are deleted within 12 months after the matter it raises is closed (project policy; the law sets no fixed period).
• An unconfirmed subscription request is deleted after 7 calendar days.
• An active subscription is retained for 24 months after the latest confirmation or subscriber-directed topic change. We request reconfirmation before expiry. Without confirmation during the following 30 calendar days, the subscription is deactivated.
• After unsubscribe, updates stop immediately where technically possible and always within 10 business days. The plain-text address and linked topic codes are deleted from active systems within 30 calendar days.
• A keyed one-way suppression token and a minimal consent/unsubscribe receipt are kept for 3 years after unsubscribe. The receipt does not contain the topic-code set.
• Routine security and delivery logs are kept for 30 calendar days.
• Rolling backups expire within 30 calendar days after active-system deletion. A restored backup is reconciled against deletion and suppression records before use.
• Records of safeguards breaches are retained for 24 months as required by Canadian regulation.

A legal hold or unresolved written access request may require limited information to be retained longer. When no purpose or hold remains, we securely erase, destroy or anonymize it.

10. Your choices and rights

The secure link in every update allows the subscriber to view and change selected topics, stop one topic or unsubscribe from all updates. A written request may also ask whether we hold personal information linked to the address, request access to it, obtain an explanation of the codes, correct it, withdraw consent, request deletion where the information is no longer required, or make a complaint.

Send a request through the contact form at https://medtourism.guide/contact/. To avoid collecting additional identity information, we normally verify control through a one-time link sent to the address concerned. We respond to written access requests within 30 days, unless a permitted extension or exception applies. There is no charge for ordinary requests.

If a privacy concern is not resolved, an individual may contact the Office of the Privacy Commissioner of Canada through the OPC complaint page.

11. Cookies and analytics

This website does not set cookies and does not add analytics scripts. It has no advertising pixels, retargeting, cross-site tracking, device fingerprinting or persistent visitor identifiers. Cloudflare, which serves the website, keeps aggregate traffic statistics and routine security logs, which are deleted after 30 calendar days. When you submit the contact form, the next page is shown by Formspree on its own website and is governed by Formspree's own privacy policy. Any change to analytics or cookie practices will be assessed and this policy will be updated before deployment.

12. Changes and contact

We will post a revised effective date and a clear notice before a material change to the collection, use, disclosure or storage described here. Where a new purpose requires consent, we will request it before the change takes effect.

Questions, requests and complaints should be sent to MedTourism through the contact form at https://medtourism.guide/contact/.

Legal sources for this policy: PIPEDA, ss. 6.1, 8, 10.1–10.3 and Schedule 1; OPC meaningful-consent guidance; OPC cross-border guidelines; CASL, ss. 6, 10, 11 and 13; Electronic Commerce Protection Regulations (CRTC), ss. 2–4; Breach of Security Safeguards Regulations, s. 6. Checked 2026-09-17.