Privacy Policy

Organ Transplant Abroad is an information platform about organ and tissue transplantation, and a service that passes a patient enquiry to transplant centres for a case review. This privacy policy applies to this website and to any enquiry you send through it.

We are the data controller for the information described here, which means we decide why and how it is handled and we are the ones you can hold to this policy. The registered entity details and the address for privacy questions are set out at the end of this page.

We are not a hospital, and we do not provide medical care. When your case is sent to a transplant centre, that centre becomes a controller of your information in its own right, under its own policies and its own national law. We say which centre before anything is sent, and nothing is sent until you agree to it.

This policy is written to be read. Where a legal term matters we use it and explain it, rather than hiding the meaning. If any part of it is unclear, ask us and we will explain it — the law requires this policy to be intelligible, and a policy you cannot follow has failed at the only thing it exists to do.

Most of what a website collects is ordinary personal data. Medical information is not. Under the GDPR it is special category data, and handling it needs a second, higher justification on top of the ordinary one. This is the part of health data privacy that most policies skate over, so here it is plainly.

For your name, contact details and the fact that you enquired, our legal basis is your consent under Article 6(1)(a). You give it by ticking the boxes on the enquiry form, and you can withdraw it at any time.

For your medical summary, your uploaded reports, the patient age and anything you tell us about a donor, our legal basis is your explicit consent under Article 9(2)(a). Explicit is a higher standard than ordinary consent: it has to be a clear, specific, affirmative act, which is why the form asks separately rather than bundling everything into one tick.

For keeping this website secure and preventing abuse of the enquiry form, our legal basis is legitimate interests under Article 6(1)(f). This covers things like blocking automated submissions. It never extends to your medical information.

Where a law requires us to keep or disclose something — a tax rule, a lawful order from a court or regulator — the basis is legal obligation under Article 6(1)(c).

Two consequences follow from consent being the basis, and both are in your favour. You can withdraw it at any time, and we then stop. And you never have to justify a deletion request: if consent is what makes the processing lawful, removing consent removes the lawfulness.

Fewer people than you might expect, and no advertiser at any point.

Inside our team, your enquiry is seen by the coordinators handling it and by administrators who maintain the platform. Access to uploaded documents is logged: every time a document is opened, who opened it and when is recorded, so an unexplained access can be found afterwards rather than merely forbidden in advance.

Outside our team, your case is sent to a transplant centre only when you have agreed to that specific centre. We tell you which one, in which country, before anything is transmitted. Once your information reaches that hospital, it is held under the hospital's own policy and its national health law, and any request about it can also be made to them directly.

Our hosting provider stores the database and the uploaded files on our behalf. They are a processor, not a controller: they act on our instructions and cannot use your data for their own purposes.

We may disclose information if a law, a court order or a regulator lawfully requires it. We will tell you when that happens unless we are legally prohibited from telling you.

And the things we do not do, stated as flatly as we can: we do not sell your personal information, we do not share it with advertisers or data brokers, we do not use it to profile you, and we do not send marketing to people who came to us with a medical enquiry.

This matters more for a medical tourism platform than for most websites, because our readers are in Europe, Africa, Asia and the Americas while our servers are in one place, and treatment happens in a third.

Our database and our file storage run in the United States. If you are in the European Economic Area or the United Kingdom, that means your information leaves your jurisdiction as soon as you send it, which the GDPR treats as a restricted transfer under Chapter V. We rely on the European Commission's Standard Contractual Clauses with our hosting provider, together with the UK Addendum for readers in the United Kingdom.

Separately, if you agree to your case being sent to a transplant centre, your information travels to that centre's country — usually Türkiye. That transfer happens on the basis of your explicit consent to it, which is why we name the country and the centre before you decide rather than after.

We think you should know what this genuinely means rather than being reassured by a paragraph of clauses. Once information is in another country, it is subject to that country's law, including the powers its authorities have to demand access. Contractual protections reduce that risk; they do not abolish it. If that trade-off is not one you want to make, do not send medical details through this form — send us a general question instead, and we will tell you what we can without them.

This website sets one cookie, and only administrators ever receive it: a sign-in session cookie for the staff dashboard. It is strictly necessary, it carries no advertising identifier, and it does nothing if you are not signed in as staff.

We run no analytics. There is no Google Analytics, no advertising pixel, no social media tracker, no session recorder, and no embedded third-party content that could set a cookie behind our back. That is why you are not being asked to accept cookies when you arrive: under the ePrivacy rules, a strictly necessary cookie does not need consent, and we have nothing else to ask about. If that ever changes, we will ask before setting anything, not afterwards.

On children: transplantation involves children, and a parent or guardian may well be sending an enquiry about one. Where the patient is a child, we expect the enquiry to come from a parent or guardian, and the medical information in it is the child's. It is treated with exactly the same protection as an adult's, and the rights on this page can be exercised on the child's behalf by whoever holds parental responsibility. We do not knowingly collect information directly from a child, and this website is not directed at children as an audience.

Uploaded documents are kept in private storage that is never publicly readable. They are not served from a guessable address, they are reachable only through a short-lived link generated for a signed-in coordinator, and every single access is logged. Staff passwords are stored hashed, sessions expire, and the platform separates public content from private case data at the database level rather than by convention.

One thing we will not overstate. Automated malware scanning of uploaded files is not yet in place. Our system records every uploaded document as unscanned rather than marking it clean, because a file described as scanned by nobody is worse than a file honestly marked unchecked. We would rather tell you that than let a security page imply a control that does not exist.

If you believe your information has been exposed, or you find a security weakness in this website, write to us and we will investigate. We would much rather hear it from you than not hear it. Where a breach is likely to put people at risk, we will report it to the relevant supervisory authority within 72 hours as the law requires, and tell the people affected.

This policy is written to the GDPR standard because it is the strictest widely applicable one, and we apply it to everybody rather than offering weaker protection to readers whose national law demands less. Several regions add specific rights on top, and those apply too.

If you are in Türkiye, the Personal Data Protection Law (KVKK, Law No. 6698) governs your information, and health data is a special category under Article 6 requiring your explicit consent. A separate Turkish-law information notice and consent text applies to processing carried out there.

If you are in the United States, several states give you rights over sensitive personal information, which includes health data — California, Virginia, Colorado, Connecticut and Texas among them. We do not sell or share personal information as those laws define it, so there is nothing to opt out of, but you may still ask for access or deletion. Washington State's My Health My Data Act gives residents specific rights over consumer health data, and we honour requests made under it.

We are not a HIPAA covered entity and not a business associate of one. HIPAA governs healthcare providers, health plans and clearing houses, and we are none of those. This does not weaken your protection here — it means a different framework applies, and this policy is it.

If you are in Africa, Asia or the Gulf, your national law may add rights — Nigeria's NDPA, South Africa's POPIA, Kenya's Data Protection Act, Saudi Arabia's PDPL and the UAE's PDPL among them. Make any request under your own law and we will treat it on its merits rather than asking which statute you are relying on.

To ask about anything here, to exercise a right, or to have your enquiry and its documents deleted, write to the privacy address published at the foot of this website. Tell us what you want and enough detail to find your record — the reference number from your enquiry is the fastest route. We will not ask you for more identification than we need to be sure it is you.

We answer within one month. If a request is complex enough to need longer, we will tell you inside that month and explain why.

When we change this policy, we change the version and date at the foot of the page. If a change materially affects how we handle information you have already sent us, we will contact people with open enquiries directly rather than relying on them to re-read the page. The consent wording you agreed to is stored with your record exactly as it was shown to you, so a later edit to this page can never quietly rewrite what you agreed to.

And if you are not satisfied with how we answer, you can complain to your national data protection authority. You do not need our permission and you do not need to come to us first, though we would rather have the chance to put it right.