Health Data and Medical Documents

Our privacy policy covers everything we handle. This page covers one part of it in more detail — medical records privacy, and what happens when you attach a file — because it is the part that matters most and the part people are right to think twice about.

When you fill in the enquiry form, most of what you enter is ordinary personal information: a name, an email address, a phone number. But the box where you describe your condition, and any report you attach, are something else. Under European law they are special category data, and under several other frameworks they are sensitive personal information. Both terms mean the same thing in practice: a higher bar to handle them at all, and more that we owe you.

There is a second reason, less legal and more practical. Our readers are in countries where a diagnosis can affect employment, insurance, immigration status, a marriage negotiation or a family's standing. A leaked kidney failure diagnosis is not the same kind of problem everywhere, and we would rather design for the worst case than the average one.

So this page tells you exactly what happens to a medical document from the moment you attach it: what we do with it, who can open it, where it physically sits, what protections exist, what protections do not yet exist, and how to make it all go away.

We handle your medical information on one basis only: your explicit consent under Article 9(2)(a) of the GDPR. Not a contract, not our legitimate interests, not a public health exemption. Explicit consent.

Explicit is a higher standard than ordinary consent. It has to be a clear affirmative act, specific to this purpose, given freely, and it must be as easy to withdraw as it was to give. That is why the enquiry form asks you to tick a separate box for medical information rather than bundling it into one general agreement, and why the exact sentence you agreed to is stored alongside your record. If we later reword that sentence, your record still shows what you actually read.

Building on consent rather than on something more convenient has a cost to us and a benefit to you, and the benefit is the point.

You can withdraw at any time, and we stop. Not "we will consider your request", not "unless we have a legitimate interest in continuing" — we stop.

You never have to justify a deletion request. Under some other legal bases, a controller can weigh its interests against yours. With consent, removing the consent removes the lawfulness, so there is nothing to weigh.

And refusing costs you nothing you are entitled to. You can send an enquiry with no medical details at all, and we will tell you everything we can without them — which is more than most people expect.

Access to an uploaded document requires being signed in as a coordinator or an administrator, and it produces a log entry every time. That log records who opened the document and when, and it is not something a member of staff can switch off for a particular file.

This is worth explaining because it is a different control from the one most organisations describe. Restricting who may access something is a promise about intentions. Logging every access is a record of what happened, which can be checked afterwards by somebody who was not there. If you ever ask us who has opened your reports, we can answer the question rather than describe our policy.

Documents are not reachable at a public address. There is no URL that could be guessed, shared or indexed by a search engine. The only route to a file is a link generated on demand for a signed-in member of staff, which stops working shortly afterwards.

Public content and private case data are kept apart at the database level rather than by careful coding. That distinction matters: a mistake in application code cannot expose a case file through a public page, because the public side has no route to that data at all.

Outside our team, nobody sees a document until you agree to a specific named transplant centre. We do not circulate a case to several hospitals to see who bites, and we do not send anything to a centre you have not been told about.

You are in control of how much you send, and more is not always better. A few practical things worth knowing before you attach anything.

You can enquire with nothing. A question with no medical details at all still gets a useful answer: which centres run the programme, what the pathway involves, whether travel is even lawful for your situation, what a case review would need. Many people should start there.

Send what answers the question, not everything you have. A transplant team assessing candidacy wants recent imaging, recent bloods, and the letters that explain your diagnosis and current treatment. It does not need fifteen years of records, and sending them makes the review slower rather than more thorough.

Remove what is not needed. If a document carries an identity number, an insurance number or an address that has nothing to do with the clinical question, you are entitled to obscure it before sending. Nobody reviewing your case needs it.

Be careful about the device. If you are using a shared or family computer, the browser may keep what you typed in form fields and may keep a copy of a file you attached in a downloads folder. That is the browser rather than us, but it is where information most often leaks in practice.

And if a document belongs to somebody else — a potential donor's reports or identity papers — you need their agreement first. It is their information, and it is not yours to give.

Ask us to delete your information and we will, without asking why. That covers the enquiry, the notes on it, and the uploaded documents, which are removed from storage rather than hidden from a screen.

There are two honest limits, and we would rather state them than let you discover them.

If your case has already been sent to a transplant centre with your agreement, that hospital holds its own copy under its own national law and its own retention rules. We cannot reach into their systems. What we will do is tell you clearly that it happened, which centre has it, and how to make a request to them directly — including the contact details, so it is a five-minute task rather than a research project.

And where a specific law requires us to keep a record, we keep that record for the period the law specifies and no longer. In practice this affects very little, and never the clinical documents.

We will also delete on our own initiative. An enquiry that goes nowhere does not need to sit on a server indefinitely, and the reports attached to it are the most sensitive thing we hold. We would rather hold less.

To make a request, write to the privacy address at the foot of this website and quote your enquiry reference if you have one. We answer within a month, and usually far sooner than that for a deletion, because there is nothing to deliberate about.