Privacy Policy

Healing Journeys is a planned care navigation service. In this policy, “we”, “us” and “our” mean TranscendIQ Pvt Ltd, of Brigade IRV Centre, Nallurhalli Rd, Nallurhalli, Whitefield, Bengaluru, Karnataka 560066. We are responsible for the personal information described here.

When you send an enquiry, we collect the details you type into the form:

• your full name, email address and phone or WhatsApp number;
• your country of residence and preferred language;
• the care pathway you are interested in; and
• any summary of your medical concern that you choose to write. This is health information. Only share what you are comfortable sharing at this stage; and
• a record of your consent: the date and time you agreed, and which version of this policy and our Terms you agreed to.

When we work with you on your care, we may also collect:

• records you or your doctors send us, such as medical reports, scans, signed consent forms and identification documents such as a passport (PDF, JPEG or PNG files);
• a record of each consent you give us (what it is for, the date, how it was given, and, for sending records abroad, the countries named), and of any consent you withdraw; and
• notes about your case and the stage your care journey has reached; and
• our communications with you.

Records of access. We keep a history of who opened, uploaded, downloaded or removed a document, who recorded or withdrew a consent, who made a secure link for a hospital and when it was opened or downloaded, and when a case moved to a new stage. This protects you by showing who handled your information. These records name our staff and the hospital; they do not copy your medical details.

Technical information. Like most websites, our hosting provider processes basic technical information such as your IP address and the pages requested, in server logs, so the website works and stays secure.

Spam protection. To stop automated abuse of the enquiry form, we briefly keep scrambled versions of the network address your enquiry came from and of the email address you enter, only to count how often they are used. They are deleted within about two hours and are not used for anything else.

This website does not take payments, so we do not collect payment card details through it.

• To respond to your enquiry and contact you by email, phone or WhatsApp. You ask us to do this when you send the form.
• To review your care options. If you wish to go ahead, qualified clinicians review the information you provide, and our team plans the next steps with you.
• To share your information with care providers you choose, only with your agreement (see section 4).
• To keep accurate case records, check quality and protect safety, including the history of who has handled your information.
• To keep the service secure and prevent misuse.
• To meet legal obligations, and to handle complaints and legal claims.

For your health information we rely on your consent, and we ask for it separately for each purpose rather than all at once:

• Medical records: collecting and using your medical records and history to review your care options. We do not accept medical records for a patient until this is recorded.
• Identity documents: collecting your passport or other identity documents, for example for travel and hospital admission. We do not accept these until this is recorded.
• Sharing your records with hospitals abroad: your signed consent, naming the countries your records may be sent to. We do not send your records to any hospital before this is recorded, and only to hospitals in the countries you named.
• Follow-up by WhatsApp or email: optional, and not needed to receive our service.

You first give consent by ticking the box on the enquiry form after reading this policy; the others we ask for in writing, online or by a recorded conversation, before the matching step. We keep a record of what you agreed to, when, and how. You can withdraw any consent at any time (see section 9). Withdrawing does not affect what we did before, and it may mean we can no longer help with your care. If you withdraw your consent to share records abroad, any secure link we made for a hospital is switched off immediately.

We do not use your information for advertising and we do not sell it. We do not make decisions about your care by computer alone: medical decisions are reviewed by qualified clinicians.

Our team. Only signed-in members of our team can see your information, and what each person can see depends on their role. Care navigators coordinate enquiries and cases. Clinical reviewers see the case details and documents they need to review your case. Administrators manage the service. Every access to a case document is recorded.

Hospitals, clinics and clinicians you choose. We share your information with a care provider only when you agree to proceed with that provider, and only what they need. We share only with partner hospitals that have signed a written agreement with us, and only after we hold your signed consent naming the hospital's country. We do not send your records as email attachments. Instead we give the hospital a secure, time-limited link that needs a separate access code, can be switched off at any time, and records every time it is opened and every file downloaded. Providers are independent organisations with their own responsibilities for your information, and our agreements require them to protect it.

Our technology providers. We use these companies to run the service. They process your information on our behalf and only for that purpose:

• Supabase, for our database, staff sign-in and private file storage; and
• Vercel, for hosting the website.

Legal and safety. We may disclose information if the law requires it, or to protect someone's life or safety.

We do not sell personal information, and we do not give it to advertisers.

Your information is stored in Tokyo, Japan, using the technology providers above, whose own staff may access it from other countries to operate and support their services. Our team works from India and accesses it from there. You may live in another country, and the hospital you choose may be in yet another.

We send information across borders only where it is needed to provide the service you asked for. This means sending your records to a partner hospital in the country you agreed to, for example India or Thailand. Many of the countries our patients live in require your written permission before records are sent abroad, which is why we ask for your signed consent first. When we send records to a hospital abroad we use a secure link, not email, only with a hospital that has a written agreement with us, and we send only the documents the hospital needs. We keep a record of each time.

Our technology providers may handle your information in other countries to run their services; they may only do so on our instructions.

We keep your information only for as long as we need it for the purposes in this policy, and to meet legal and medical-record requirements. If an enquiry does not lead to care, we delete or anonymise it after a reasonable period.

You can ask us to delete your information sooner. We will do so unless the law requires us to keep it, and if so we will tell you why.

• The website uses HTTPS, so information is encrypted while it travels.
• Your information is stored in encrypted storage provided by our technology providers.
• Documents are kept in private storage, never in public view, and are opened only through short-lived, logged links.
• Only signed-in team members can see cases, and each person sees only what their role needs.
• We record who opens, adds or removes documents, and who changes a case, and the record cannot be edited.
• Our team must sign in with a password and a second step (a code from an app on their phone). A signed-in session ends automatically after 15 minutes without activity, and after 12 hours in any case.
• Files you send are checked when they arrive: only PDF, JPEG and PNG files are accepted, and files that look unsafe are rejected.
• Links we make for hospitals expire (after at most 14 days), need a separate access code, lock after five wrong codes, and can be switched off by us at any time.
• We only give hospitals the documents they need, not your whole file.

No method of sending or storing information is completely secure. If a breach affects your information, we will tell you and the authorities, within the time the law requires.

The public pages of this website do not use cookies, advertising or analytics trackers, and do not load scripts from other companies.

When a member of our own team signs in, we set one cookie to keep them signed in. It is strictly necessary for that, and it is removed when they sign out. When a partner hospital opens a secure link and enters its access code, we set one short-lived cookie (about 20 minutes) to keep that visit unlocked. It is also strictly necessary and is used for nothing else.

Depending on where you live, laws such as India's Digital Personal Data Protection Act, 2023, Thailand's Personal Data Protection Act and the data protection laws of your own country give you rights over your information. You can ask us:

• to see what information we hold about you, and get a copy;
• to correct information that is wrong or incomplete;
• to ask us to delete your information;
• to withdraw your consent at any time, either all of it or just one purpose (for example sending records abroad);
• to ask which hospitals your records were shared with, and when;
• to object to, or ask us to limit, how we use it;
• to ask for a copy in a form you can move elsewhere; and
• to nominate someone to exercise these rights for you if you are unable to.

To make a request, email gautam.basu@outlook.in. We may need to check who you are first. We will consider every request, tell you what we can do, and aim to reply within 30 days.

If you are unhappy with our answer, you can contact our grievance officer (section 12). You can also complain to the data protection authority in your country, such as the Data Protection Board of India.

This service is for adults aged 18 and over. If you send an enquiry for a child, or for someone who cannot decide for themselves, you must be their parent, legal guardian or otherwise authorised, and you should tell us so.

We may update this policy. When we do, we will change the date at the top of this page. If a change is significant, we will also tell you through the website or by contacting you where we can.

Privacy questions and requests: gautam.basu@outlook.in.

Grievance officer: Gautam Basu, gautam.basu@outlook.in.

We are available Monday to Friday, 09:00 to 18:00 IST.