Privacy Policy
Global scope statement. This Privacy Policy applies to all Clients of MediConnex worldwide. It sets out our general privacy commitments. Where a country-specific addendum, informed-consent form, data-transfer document, or engagement document applies to you, that separate document provides the additional terms required for your jurisdiction and engagement.
1. Quick summary
Legal entity (full details): MediConnex HongKong Limited (Traditional Chinese: 四海雲醫香港有限公司). Hong Kong Business Registration Number: 80524054. Company type: Private Company Limited by Shares. Date of incorporation: 2 June 2026. Current status: Live (still registered).
- We are MediConnex HongKong Limited, a Hong Kong company. We are the data controller for personal information you give us in connection with the Services.
- Because medical information is involved, we treat your health data as a sensitive category of personal data and apply stricter handling.
- Your data may need to move across jurisdictions — from you in your country of residence, to MediConnex in Hong Kong, to our appointed Mainland China service operator, and to the Treatment Provider hospital. Cross-border transfer is inherent to the Service you have requested.
- You can ask to see your data, correct it, delete it, or stop us using it. See section 9.
- The Treatment Provider is a separate data controller for its own medical care and associated data processing. MediConnex is not responsible for that independent processing merely because it shares information with the provider.
- Questions? Email us at info@mediconnex.com.cn for privacy or data-protection enquiries.
2. Who we are
MediConnex HongKong Limited (Business Registration Number 80524054), with its registered office at UNIT 2406B, 24/F, LOW BLOCK, GRAND MILLENNIUM PLAZA, 181 QUEEN'S ROAD CENTRAL, SHEUNG WAN, HONG KONG, Hong Kong SAR, is the data controller of your personal information collected through https://mediconnex.com.cn (the "Website") or in connection with our services (the "Services").
MediConnex complies with the privacy and data-protection laws that apply to our handling of your personal data. For Clients in jurisdictions with additional mandatory privacy requirements, those additional terms are handled through the relevant country-specific addendum, informed-consent form, data-transfer document, or engagement document.
MediConnex has appointed a UK Representative under signed appointment documentation. The representative's business identity and contact details, as confirmed in the signed appointment and any separately confirmed business contact record, are supplied in the UK privacy information, including section 4.4 of the UK Consumer Addendum and the engagement pack, before the relevant processing. Data-protection enquiries may also be sent to info@mediconnex.com.cn.
2A. UK ICO Registration
We are registered with the UK Information Commissioner's Office (ICO) as a data controller. Our registration details are:
- ICO Reference Number: C1955381
- Registration Date: 9 June 2026
- ICO Public Register: You can verify our registration at https://ico.org.uk/ESDWebPages/Search by searching our registration number or organisation name.
3. What data we collect
We collect the following categories of personal data:
3.1 Identity and contact data
Name, date of birth, gender, nationality, passport details, address, email, phone number, emergency contact.
3.2 Health and medical data (sensitive)
Medical history, current medications, allergies, prior procedures, diagnostic images (where you provide them), pre-procedure assessments, post-procedure outcomes, and any medical records you choose to share with us so we can assist with your trip.
3.3 Financial data
Billing address, payment confirmation, partial payment card details (last 4 digits and expiry; full card details are handled by our payment processor and are not stored on our systems).
3.4 Coordination data
Clinical-appointment schedules, dietary requirements, interpreter requests, and (where you voluntarily share them so we can sequence our coordination services) your planned arrival and departure dates and the name of your hotel. We do not collect or store your flight booking, hotel reservation or insurance policy details as part of any booking we make on your behalf — we do not make such bookings; travel details provided for trip coordination are held to schedule our own coordination activities. Separately supplied policy and premium evidence for an optional contribution is handled under section 3.7.
3.5 Communications data
Records of communications you have with us (emails, calls, messaging apps, support chat), including date, time, and content.
3.6 Technical and usage data
IP address, device type, browser type, operating system, pages visited, time on page, referral source, cookie identifiers. See our Cookie Policy.
3.7 Marketing preferences and optional campaign data
Your subscription and channel preferences; for a separately accepted promotional campaign, the selected contributions, images, voice, experience and specifically identified health details, campaign permissions, agreed deliverables and contribution evidence. Insurance policy and premium evidence supplied for a contribution is used to administer that contribution; we do not arrange or purchase the policy.
3.8 Audio-video service recordings
Service records include synchronised sound and images of agreed patient accompaniment, interpreting and coordination, including relevant clinical consultations. They document the relevant communication, interpretation, instructions, documents and service context and may identify participants and reveal health information. The scope is governed by Concierge Agreement clause 8.3; use, disclosure and retention are governed by sections 5, 6.4 and 8 below.
4. How we collect your data
We collect your data:
- directly from you, when you fill in a form on the Website, contact us, sign a Concierge Agreement, attend a video consultation, or upload documents to our secure portal;
- automatically, when you use the Website (via cookies — see Cookie Policy);
- from third parties with your consent, including (where applicable) Treatment Providers (e.g. assessment reports), referring clinicians, your insurer, and your primary care physician.
5. Why we use your data — purpose-based summary
We process your personal data only for the purposes listed below and only for as long as needed for those purposes:
| # | Purpose | Categories of data |
|---|---|---|
| 1 | Responding to enquiries before you become a Client | Identity, contact, communications |
| 2 | Performing the Concierge Agreement (coordinating your clinical visit) | Identity, contact, health, financial, coordination, communications |
| 3 | Sharing your medical information with the Treatment Provider | Identity, contact, health |
| 4 | Processing payments and accounting | Identity, contact, financial |
| 5 | Complying with our legal, regulatory, and tax obligations | All as required |
| 6 | Managing complaints, disputes, and legal claims | All as required |
| 7 | Improving the Website (analytics, if activated after the required notice and consent; no optional analytics tracker is included in the current site package) | Technical, usage |
| 8 | Direct marketing (newsletters), with consent or another lawful route described in the applicable jurisdiction-specific privacy information, and an opt-out | Identity, contact, marketing |
| 9 | Detecting fraud, abuse, or cyber-attack | Technical, identity |
| 10 | Preserving an audio-video record of accompaniment, interpreting and coordination, including relevant clinical consultations, to review and improve service quality and investigate or resolve related complaints, safety incidents and legal claims | Service recordings and only necessary identifying/contextual information |
| 11 | Administering an optional contribution campaign and preparing or publishing the specifically authorised promotional material | Selected campaign media, identified personal/health details, permission and payment records |
Health data and service records. We use the existing Health Data Processing and Cross-Border Transfer Consent Form for any legally required health-data and recording consent and the identified international routes. It records the choices once, using its existing signature. Where processing relies on consent, you may withdraw it by emailing info@mediconnex.com.cn; withdrawal does not affect prior lawful processing or retention supported by a continuing legal basis. The consequences for any affected service are governed by that form, the agreement and applicable law.
For UK Clients, the additional legal-basis information is in the UK Consumer Addendum. Other applicable mandatory requirements remain effective.
Recordings are used to resolve disputes and improve service quality, including reviewing the original communication and its interpretation, investigating complaints or safety incidents, and preserving or lawfully disclosing necessary evidence. The ordinary service-recording permission does not authorise marketing. Selected extracts may be reused for a separately accepted optional campaign only within the specific materials, purposes, recipients, use period and publication mode authorised in that campaign agreement, with any required explicit health-data and publication consent. A website update or service-contract signature does not extend an earlier permission. This permission does not cover facial recognition or AI training. These specific limits, subject only to that selected campaign exception, prevail over broader purpose or recipient wording in this policy. Suspected offences or allegations are distinguished from established facts; their processing requires any additional criminal-offence-data conditions under applicable law, with UK conditions in the UK Consumer Addendum.
For Clients in jurisdictions with mandatory data-protection laws that require additional legal-basis disclosures, those disclosures are set out in the relevant country-specific addendum or engagement document.
6. Who we share your data with
6.1 Inside the MediConnex group
- MediConnex HongKong Limited (Hong Kong) — your contracting party and the data controller.
- our appointed Mainland China service operator — appointed by MediConnex as our service operator. Acts as a data processor under a written data processing agreement requiring substantially equivalent protections.
6.2 Treatment Providers — separate data controllers
The hospital, clinic, or medical professional you choose. The Treatment Provider is a separate, independent data controller in respect of the medical care it provides. We share with the Treatment Provider only what is needed for it to assess and treat you.
The Treatment Provider handles medical-care data under its own privacy notice and applicable law. MediConnex does not undertake to audit or continuously monitor that independent handling, or warrant a particular hospital security standard. Any liability remains subject to the agreed limitations and mandatory law.
6.3 Other recipients
- Other independent service recipients, where necessary — only the information required for a separately requested service or authorised disclosure. Before sharing, your engagement pack identifies the recipient, role, purpose, data categories, location and any required safeguards or consent. The actual processing activity determines controller/processor status; the recipient must provide its own notice where required. Payment or a general service enquiry does not itself authorise health-data sharing.
- Banks and payment providers — the company bank or regulated payment provider used for the payment method identified in your private payment instructions, including Airwallex where used. They process the necessary transaction information under their own privacy notices.
- Insurers and assistance providers — only where you have separately authorised us in writing to liaise with your insurer on a specific matter. The patient purchases and pays for any travel or complications insurance directly; any separately agreed premium contribution is governed by its own private agreement.
- Professional advisers — lawyers, accountants, auditors.
- Authorities and regulators — where required by law.
- A buyer or investor — if we sell or restructure the business, subject to confidentiality protections.
We do not sell your personal data. We do not share your data with advertising networks for behavioural advertising.
6.4 Recording access and evidence disclosure
Original recordings are encrypted and access is restricted to authorised personnel and processors for the stated purposes. Relevant originals may be preserved for evidence. Disclosures are limited to lawful purposes and recipients, including advisers, courts, authorities and persons entitled to receive the material. Irrelevant personal details are redacted where practicable without impairing necessary evidence. Redacted copies do not make identifiable originals anonymous. Applicable recipients, storage/access countries and transfer safeguards are identified in the supplied engagement privacy information; a general recipient listing does not itself authorise access to recordings.
6.5 Optional campaign use
The separate campaign agreement identifies selected service-recording extracts or dedicated marketing material, authorised editing and publication, production/distribution providers, relevant countries and required safeguards. Access-controlled originals are used only for those notified purposes. Public outputs use the agreed de-identification; blurring or removing a name is not automatically anonymity. Identifiable health details require the specific publication permission recorded in that agreement. Public outputs can reach worldwide audiences and be copied or reshared. Patient permission does not grant third-party image, voice or intellectual-property rights.
The Company controls lawful editing, selection and placement within the agreed scope; no routine draft-approval right is conferred. Consent-based campaign processing may be withdrawn at info@mediconnex.com.cn, without affecting prior lawful processing. Participation in filming, a review or a publicity licence is not a condition of the premium contribution. Declining or withdrawing optional campaign permission, or not completing media tasks, does not reduce, delay or require repayment of a contribution for which the insurance and payment conditions are met. Applicable deletion, removal and recipient-notification duties remain, without a guarantee of recalling independent copies outside our control. Publicity permission is not a newsletter subscription, tracking permission or international-transfer mechanism. We do not supply patient audience lists or health profiles to advertising networks for behavioural targeting; authorised advertising providers receive only the campaign materials and data specified for their role.
7. International transfers of your data
7.1 Cross-border transfer is inherent to the Service
The Service you have requested is, by its nature, cross-border medical concierge. You acknowledge and accept that providing the Service may require the transfer of your personal data outside your country of residence to Hong Kong, Mainland China, and the Treatment Provider you have chosen. Without such transfers we may not be able to deliver the Service.
The existing consent form identifies the relevant countries, recipients, data and purposes. Applicable lawful transfer bases and safeguards must be in place; the form alone is not a transfer mechanism.
7.2 Country-specific safeguards
Where the law of your country of residence requires additional privacy notices, legal-basis disclosures, data-transfer terms, representative details, or other safeguards, MediConnex will address those requirements through the relevant country-specific addendum, informed-consent form, data-transfer document, or engagement document. This Privacy Policy is the global baseline and does not by itself list every country-specific mechanism.
7.3 Hong Kong, Mainland China, and Treatment Providers
Data needed for delivering the Service may be shared with our appointed Mainland China service operator and the Treatment Provider. We use reasonable organisational and technical safeguards for transfers, including written data-handling terms with relevant service operators where appropriate, access controls, encryption where practicable, and role-based access limits.
7.4 Mainland China → Treatment Provider
The Mainland Operator shares with the Treatment Provider only the data needed for your medical assessment and treatment. The Treatment Provider is regulated under PRC law. As stated in clause 6.2, the Treatment Provider is a separate, independent data controller. The hospital is responsible for its independent clinical processing.
7.5 Your acknowledgement of residual risk
You acknowledge that:
- legal protections in Hong Kong and Mainland China for personal data may differ from those in your country of residence;
- foreign authorities may, in limited circumstances, have access rights under their domestic law;
- no transfer mechanism can guarantee that no incident will ever occur;
- MediConnex's obligation is to take reasonable steps to protect your data in transit and at rest, applying the safeguards in this clause 7, and not to guarantee any particular outcome.
To the maximum extent permitted by applicable mandatory law, any liability legally attributable to MediConnex in connection with a breach in transit or at a receiving party is subject to the liability cap in clause 11.3 of the Terms of Use (GBP 3,000 or the concierge fee actually paid, whichever is lower).
7.6 Your rights regarding transfers
You may at any time request:
- further information about the safeguards in place;
- a copy of any transfer agreement applicable to your jurisdiction (with commercial terms redacted);
- to withdraw your consent to specific transfers — please note this may make it impossible for us to deliver the Service.
8. How long we keep your data
We keep your data only as long as we need to for the purposes set out above. Indicative periods:
| Data type | Retention period | Reason |
|---|---|---|
| Enquiry-stage data (you did not become a Client) | 12 months from last contact | Respond if you return |
| Concierge Agreement and related records | 7 years from completion of the Services | Tax law in our jurisdiction of incorporation; possible legal claims |
| Service recordings | For as long as reasonably necessary to review and improve the relevant service quality and address complaints, incidents or reasonably anticipated legal claims, taking account of completion, available alternative evidence and applicable claim periods; relevant evidence may be retained through resolution and any required preservation period, with necessity reviewed | Service-quality review, service evidence and lawful protection of rights; no automatic seven-year recording archive |
| Health data shared with us | 7 years from completion of the Services | Limitation period for medical-adjacent claims; you may request earlier deletion subject to overriding legal obligations |
| Selected campaign media and personal data | The recorded campaign use period and only as long as necessary; earlier required cessation or deletion applies on withdrawal. Restricted legal-duty or claim records are separate from continued promotion | Optional, specifically authorised campaign only |
| Campaign agreement, permission, payment and withdrawal evidence | Only as needed for applicable accounting duties and legal claims, with necessity reviewed; payment records follow the seven-year transaction period below | Proof of authority and payment, not continued promotion |
| Marketing contact and preference data | Until consent is withdrawn or 3 years of inactivity, whichever is earlier | Separate optional marketing only |
| Newsletter permission and withdrawal evidence; minimal suppression record | Permission and withdrawal evidence for as long as necessary to demonstrate compliance and address related claims; minimal suppression data for as long as needed to honour the opt-out, with necessity reviewed | Compliance evidence and prevention of unwanted marketing, not continued promotion |
| Complaint-specific investigation records | 6 years after the complaint is closed | Complaint handling and possible legal claims |
| Website analytics (cookie-based) | See Cookie Policy |
A complaint record is distinct from the underlying engagement, health or payment record: opening a complaint does not restart those records' normal retention periods. Payment records are retained for 7 years from the transaction; the engagement and health periods run from completion of the Services. A documented legal obligation or active legal claim may require a limited longer hold, with the reason and review date recorded. After the applicable period we securely delete or anonymise the data.
9. Your rights
To the extent available under applicable law, you may exercise the following rights by emailing info@mediconnex.com.cn; identity information may be requested where needed:
- Right of access — get a copy of the personal data we hold about you.
- Right to rectification — correct inaccurate or incomplete data.
- Right to erasure — where the request meets the conditions under applicable law.
- Right to restriction — limit how we use your data while a dispute is resolved.
- Right to portability — receive your data in a structured, machine-readable format.
- Right to object — to processing based on legitimate interests, including direct marketing.
- Right to withdraw consent — for processing relying on consent.
- Right not to be subject to solely automated decision-making — we do not make decisions about you that are based solely on automated processing.
Requests are handled within the applicable statutory period, including any lawful extension or identity-verification requirements. A fee or refusal applies only where permitted by applicable law.
Additional or modified rights that apply in your country of residence are set out in the relevant Jurisdiction-Specific Addendum.
Right to lodge a complaint with the UK ICO
If you believe we have not handled your personal data in accordance with applicable data protection law, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):
- Website: https://ico.org.uk/make-a-complaint/
- Helpline: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
We strongly encourage you to contact us first so we can address your concerns directly, but you may approach the ICO at any time.
10. How we protect your data
We apply organisational and technical security measures appropriate to the risk, including:
- appropriate encryption in transit and at rest for sensitive data;
- role-based access; access reviews; staff training;
- vendor due diligence and contractual data-protection obligations;
- a documented breach response plan.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Our obligation is to take reasonable steps proportionate to the risk.
11. Children
The Services are intended for adults (18+). We do not knowingly process data of children. If you believe we have collected a child’s data without a lawful basis, contact us. We will assess the information and take the action required by applicable law.
12. Cookies
This policy is supplemented by our Cookie Policy.
13. Changes to this policy
We may update this policy from time to time. The current version is published on the Website; additional notice or consent is provided where required by applicable law.
14. Contact us
Privacy and data-protection enquiries: info@mediconnex.com.cn Postal: MediConnex HongKong Limited, UNIT 2406B, 24/F, LOW BLOCK, GRAND MILLENNIUM PLAZA, 181 QUEEN'S ROAD CENTRAL, SHEUNG WAN, HONG KONG, Hong Kong SAR
For country-specific data-protection contacts (such as a UK Representative or an EU Representative), please see the relevant Jurisdiction-Specific Addendum.