Privacy notice

Who we are

Clinavia Medical is the controller of the personal data described in this notice. We coordinate medical travel: we help patients find suitable partner hospitals and doctors, and organise the practical steps of their care journey.

• Registered name: Merlifth shpk, trading as Clinavia Medical
• Address: Rruga “Kristo Luarasi”, Kompleksi Lake View, Godina C, Kati 4, Tirana, Albania
• Privacy contact: clinaviamedical@gmail.com · +355 68 563 6468

What we collect

We collect only the data we need to answer your enquiry and coordinate your care:

• Identity and contact details: name and surname, e-mail address, phone or WhatsApp number, country of residence and preferred language.
• Enquiry details: the treatment you are interested in and the content of your messages.
• Health information: medical history, current complaints, diagnoses, test results, reports and images that you choose to share with us.
• Travel details: travel dates, accommodation preferences and, only if you ask us to make bookings, passport details.
• Technical data: IP address and basic server logs recorded by our hosting provider for security.

Our website forms do not store your details or send them to a server. When you press “Send via WhatsApp”, the information you entered is placed in a WhatsApp message on your own device and reaches us only if you send it.

Why we use it and our legal basis

• To answer your enquiry and prepare a care plan — steps taken at your request before entering into an agreement (GDPR Art. 6(1)(b)).
• To assess your health information and share it with the hospital and doctor you choose — your explicit consent (GDPR Art. 9(2)(a)).
• To organise the travel, transfers and accommodation you ask for — performance of our agreement with you (GDPR Art. 6(1)(b)).
• To keep accounting and other records required by law — legal obligation (GDPR Art. 6(1)(c)).
• To keep the website secure and prevent misuse — our legitimate interest (GDPR Art. 6(1)(f)).

We do not sell your data, we do not use it for automated decision-making, and we send marketing messages only if you have separately agreed to receive them.

Health information

Health data is a special category of personal data. We process it only with your explicit consent, only to the extent needed to assess and coordinate your treatment, and only people directly involved in your care can access it.

Clinavia Medical is not a healthcare provider. Medical opinions, diagnoses and treatment decisions are made by the doctors of the partner hospital.

You can withdraw your consent at any time. Withdrawal does not affect processing carried out before it, but we may no longer be able to coordinate your treatment.

Who we share it with

• Partner hospitals and doctors you choose, so they can assess your case and treat you. They act as independent controllers and apply their own privacy notices.
• Travel, transfer and accommodation providers, only when you ask us to book these services.
• Service providers that work for us under contract: Netlify, Inc. (website hosting), WhatsApp / Meta Platforms (messaging) and Google (e-mail, and the contact-page map if you allow it).
• Public authorities, only where the law requires it.

International transfers

Most of our partner hospitals are in Turkey, and some of our service providers are based in the United States. When your data is transferred outside Albania or the European Economic Area, we use the safeguards provided by law: an adequacy decision where one exists, standard contractual clauses approved by the European Commission, or your explicit consent to the specific transfer to the hospital you have chosen.

How partner hospitals in Turkey process your data is explained in our KVKK information notice.

How long we keep it

• Enquiries that do not lead to treatment: up to 12 months after our last contact.
• Coordination records for patients we have assisted: 5 years after the end of treatment, unless the law requires a longer period.
• Accounting and invoicing records: for the period required by Albanian tax law.
• Records of your consent: for as long as we process data on that basis, and afterwards as long as needed to demonstrate it.

When a retention period ends, we delete or anonymise the data.

Security

We protect your data with technical and organisational measures appropriate to the risk, including encrypted (HTTPS) connections, access restricted to those who need it, and confidentiality obligations for our staff and partners.

Please do not send medical records through the website form. Share them only through the channel we provide once we have contacted you.

Your rights

Under the GDPR and Albanian Law No. 124/2024 you have the right to:

• access your data and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased where there is no longer a reason to keep it;
• restrict or object to certain processing;
• receive the data you provided in a portable format;
• withdraw your consent at any time.

Contact and complaints

To exercise your rights, write to clinaviamedical@gmail.com or to our address in Tirana. We will reply within one month.

You also have the right to complain to the Information and Data Protection Commissioner of Albania (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale, idp.al) or to the data protection authority of the EU country where you live.

Children

Enquiries for patients under 18 must be made by a parent or legal guardian, who gives consent on the child’s behalf.

Changes to this notice

We may update this notice. The “Last updated” date on this page shows the current version.