How We Use Your Health Data
1. Purpose
This notice explains how Healthcare Abroad processes your personal and medical information when you use the patient portal and our coordination services. It supplements our Privacy Policy.
2. What we collect in the portal
Depending on your care journey, we may process identity documents, contact details, medical history, GP details, imaging, treatment preferences, travel and finance information needed to coordinate your care.
3. Lawful bases
Contract (Article 6(1)(b)): Processing necessary to take steps at your request or perform our coordination services.
Healthcare (Article 9(2)(h)): Processing necessary for medical diagnosis, provision of health care, and management of health-care systems — including sharing relevant records with hospitals you choose or confirm.
Explicit consent (Article 6(1)(a) / 9(2)(a)): Only where required for optional activities such as contacting your GP, reimbursement support documentation, or non-essential communication channels. You will be asked separately in the portal before these activities.
4. Hospital sharing
We share medical information with approved hospitals involved in your treatment planning. This is necessary to arrange your care and does not rely on a separate consent where Article 9(2)(h) applies. You will confirm your chosen hospital in the portal.
5. Retention
- Medical records and imaging: up to 7 years
- Administrative communications: up to 3 years
- Reimbursement documentation: up to 7 years
6. Your rights
You may access, correct, restrict, or object to processing, and withdraw consent where processing is consent-based. Contact dpo@healthcareabroad.com. You may lodge a complaint with the Data Protection Commission (Ireland) or the ICO (UK).
7. Security
We use encrypted storage, role-based access, and audited access to protected health information. Consumer messaging apps are not used for medical information.