Privacy notice

The short version

• We collect an email address, what you tell us about how you are feeling, and your timing preferences.
• We use it to reply to you and to arrange your visit. Nothing else.
• We share it with the hospital or practitioner who will see you, and with nobody else.
• We never sell it, and we do not use it for advertising.
• You can ask us to delete everything at any time by emailing hello@chinaandyou.me, and we will do it.

Health-related details need your explicit permission

When you tick boxes describing how you are feeling, that is health-related information about you. Under the UK and EU General Data Protection Regulation it is a special category of personal data, and it needs stronger protection than an ordinary email address.

Our legal basis for handling it is your explicit consent, given by ticking the box on the form. That tick is unticked by default, is not bundled with anything else, and the form will not submit without it.

You can withdraw that consent whenever you like. Withdrawing it does not undo anything we did while it was valid, but it stops us going any further and we will delete what we hold.

What we collect, and why

What you type into the form

• Your email address — the only way we have of replying to you, and where the confirmation goes.
• The areas you selected — stored as fixed codes from the list on the form, not as free text. The practitioner needs to know roughly what you are coming about so the right person sees you.
• Anything you wrote in your own words — kept separately from the rest so it can be deleted on its own.
• Preferred treatments, city and timing — to arrange something that actually fits your trip.

We do not ask for your name, your passport number or your date of birth at this stage. If a booking goes ahead, the hospital will need identification to register you, and we will tell you exactly what before you go.

What is collected automatically

• A one-way hash of your IP address — we never store the address itself. The hash lets us spot someone flooding the form; it cannot be turned back into an address.
• Your browser’s user agent — for the same reason.
• Campaign parameters in the link you followed, if there were any, so we know which of our posts brought you here.

We do not use advertising cookies and we do not run third-party analytics on this site.

Who else sees it

Your details go to the people arranging your visit, and to the hospital or practitioner who will see you. Beyond that, they are handled by the services that make the site work:

• Amazon Web Services — hosts the site and the database.
• Cloudflare — routes traffic and screens the form for automated abuse.
• Google Workspace — delivers the confirmation email.

We do not sell your details, we do not trade them, and we do not pass them to advertisers.

Where it is stored

Our database runs in Amazon Web Services in the United States, so your details are transferred outside the UK and the European Economic Area. Where that transfer needs a safeguard under the GDPR, it relies on the European Commission’s standard contractual clauses, which our providers have in place.

Your details are also handled in mainland China by the people arranging your visit and by the hospital that sees you. Chinese law may allow authorities access to information held there in ways UK and EU law would not. If you are not comfortable with that, please do not send us health-related details — we would rather you asked us a general question by email instead.

How long we keep it

• If your visit goes ahead: two years from the visit, so we can deal with any question or complaint that comes afterwards.
• If it does not go ahead: twelve months from your enquiry.
• Abuse-prevention records (the hashed address): ninety days.

Ask us to delete it sooner and we will, unless the law requires otherwise.

Your rights

If the UK or EU GDPR applies to you, you have the right to ask us for a copy of what we hold, to have mistakes corrected, to have it deleted, to restrict or object to what we do with it, to receive it in a portable format, and to withdraw your consent.

Email hello@chinaandyou.me and we will respond within one month. There is no charge. If you think we have handled your details badly you can complain to your national data protection authority; in the UK that is the Information Commissioner’s Office.

Children

This service is for adults. We do not knowingly collect details from anyone under 18. If you believe a child has sent us something, email us and we will delete it.

Changes

If we change this notice we will update the date at the top. If a change materially affects how we handle health-related details, we will email anyone with an open enquiry rather than rely on you noticing.