Last updated: 10 October 2026

This policy explains how MedPanda Ltd collects, uses, shares and protects your personal information when you use medpanda.co.uk, contact us, or use our care-coordination services. Please read it together with our Terms & Conditions.

MedPanda is a non-clinical care-coordination company. We help you plan treatment abroad. We do not diagnose or recommend treatment; licensed hospitals make all clinical decisions.

1. Who we are

MedPanda Ltd is the “data controller” for your personal information. This means we decide how and why it is used.

• Company: MedPanda Ltd, registered in England and Wales, company number 16925046
• Registered office: Spark Enterprise Incubation Programme, Nexus Discovery Way, University of Leeds, Leeds, West Yorkshire, LS2 3AA, United Kingdom
• ICO registration number: ZC077488 (registered with the UK Information Commissioner’s Office as a data controller)
• Contact for privacy questions: care@medpanda.co.uk, or write to us at the address above

2. The information we collect

When you ask for a free consultation (our consultation form):

• your name, mobile number, email address and country
• how you would like us to contact you, and how you found us
• anything you choose to write in the message box, which may include details about your health
• a record that you ticked the consent box, and the date and time

When you take part in our Global Referral programme:

• the details on the referral form, including your referral code
• the details of the person you are referring. Please only refer someone if they have agreed to you sharing their details with us.

When you use our care-coordination services (if you go ahead):

• medical reports, scans, test results, prescriptions and other health information you or your doctors send us
• passport and travel details, visa documents, travel and accommodation arrangements, and details of anyone travelling with you
• information kept in your Lifetime Health Passport (your treatment records and summaries)
• messages between you, us and the hospital

When you message us on WhatsApp, by email or by phone: your phone number, name, and what you tell us.

When you comment on our blog: the name and email address you give, your comment, your IP address and the date and time. Your name and comment are shown publicly; your email address is not.

When you browse our website: your IP address and basic technical details (browser, device, pages visited). Google Analytics information is only collected if you click “Accept” on our cookie banner (see section 10).

Health information is “special category data” under data protection law and gets extra protection. We only use it with your explicit consent and only to coordinate your care.

3. Why we use your information, and our lawful basis

• Replying to your enquiry and arranging your free consultation: steps you asked us to take before entering a contract (UK GDPR Article 6(1)(b)). For any health details in your message, your explicit consent (Article 9(2)(a)).
• Sharing your details and medical records with partner hospitals so they can review your case and give a treatment plan and quote: your explicit consent (Articles 6(1)(a) and 9(2)(a)).
• Coordinating travel, visas, accommodation and aftercare: performance of our contract with you (Article 6(1)(b)), and your explicit consent for health details (Article 9(2)(a)).
• Providing your Lifetime Health Passport: performance of our contract (Article 6(1)(b)) and your explicit consent (Article 9(2)(a)).
• Running the referral programme: our legitimate interest in growing our service through recommendations (Article 6(1)(f)).
• Publishing and moderating blog comments: our legitimate interest in running a public blog and preventing spam (Article 6(1)(f)).
• Website analytics (Google Analytics): your consent through the cookie banner (Article 6(1)(a) and the Privacy and Electronic Communications Regulations).
• Keeping the website secure and keeping records of what we did: our legitimate interests (Article 6(1)(f)) and legal obligations (Article 6(1)(c)).
• Keeping financial and legal records, and dealing with complaints or legal claims: legal obligation (Article 6(1)(c)); for health data, establishing or defending legal claims (Article 9(2)(f)).

We do not send marketing messages unless you have separately agreed to receive them. You can opt out at any time.

We do not make decisions about you using fully automated processes.

4. Who we share your information with

We only share what is needed, for the reasons above:

• Partner hospitals and their doctors, currently in India, so they can review your case and treat you. We only share your medical information with a hospital once you have agreed.
• Travel, visa and accommodation partners, only where you ask us to arrange these.
• Service providers who work for us under contract and only on our instructions: Hostinger (website hosting and storage of form entries); Mailgun (delivering emails sent from our website forms); Google (Google Analytics, only if you accept cookies); Automattic (Gravatar, which may show a profile picture next to blog comments, using a scrambled version of your email address); and WhatsApp (Meta), when you choose to message us on WhatsApp. WhatsApp’s own privacy policy also applies.
• Professional advisers (such as lawyers and accountants) and authorities such as regulators, courts or the police, where the law requires it.

We never sell or rent your personal information.

5. Sending your information abroad

To coordinate treatment abroad, we have to send your information outside your home country. In particular:

• To India, to partner hospitals. The UK has not made an “adequacy” decision for India, so we protect these transfers with a signed data sharing agreement with each partner hospital, using the UK’s approved data transfer safeguards. Where that is not possible, we only transfer your information with your explicit consent, after telling you about the risks, or where the transfer is necessary for the service you asked us to provide.
• To the United States, through some of our service providers (such as Mailgun, Google and Automattic). These transfers are protected by the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement.
• From Nigeria, Ghana and Kenya to the UK and India. If you live in one of these countries, we transfer your information to the UK (where MedPanda is based) and to India (where you will be treated), using the safeguards above and with your consent, as allowed by the Nigeria Data Protection Act 2023, Ghana’s Data Protection Act 2012 and Kenya’s Data Protection Act 2019.

You can ask us for a copy of the safeguards we use.

6. How we keep your information safe

We use appropriate technical and organisational measures, including encrypted (HTTPS) connections, access limited to the people who need it, password protection and regular backups. Our partners and service providers must also keep your information secure. No system is completely secure, but we work hard to protect your information, and we will tell you and the regulator if a serious breach happens, as the law requires.

7. How long we keep your information

• Enquiries that do not go ahead: up to 2 years after our last contact, then deleted.
• Records of patients we have coordinated care for: 8 years after your treatment ends, unless you ask us to delete them sooner and we do not need them for legal reasons.
• Lifetime Health Passport: for as long as you keep it open. You can ask us to close and delete it at any time.
• Financial records: 6 years, as UK tax law requires.
• Referral records: 2 years after the referral, or longer if needed to pay a referral reward.
• Blog comments: until you ask us to remove them or we remove the post.
• Your cookie choice: 6 months, then we ask again.
• Google Analytics data: no more than 14 months.

8. Children

Our website and services are for adults aged 18 or over. If a child needs treatment, a parent or legal guardian must contact us and give consent on their behalf. We do not knowingly collect information directly from children.

9. Your rights

Under UK data protection law you have the right to:

• ask for a copy of your information
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to restrict how we use it
• object to us using it, including for any marketing
• ask us to move it to another organisation (data portability)
• withdraw your consent at any time. This does not affect anything we did before you withdrew it, but if you withdraw consent for us to share your medical information, we may not be able to keep coordinating your care.

To use any of these rights, email care@medpanda.co.uk. We will reply within one month. There is usually no charge.

If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to a data protection regulator:

• UK: Information Commissioner’s Office (ICO), ico.org.uk, 0303 123 1113
• Nigeria: Nigeria Data Protection Commission (NDPC), ndpc.gov.ng
• Ghana: Data Protection Commission, dataprotection.org.gh
• Kenya: Office of the Data Protection Commissioner (ODPC), odpc.go.ke

If you live in Nigeria, Ghana or Kenya, you have similar rights under your own country’s law, and we will respect them in the same way.

10. Cookies

Cookies are small files that a website stores on your device.

Cookies we always use (needed for the site to work): a small cookie called mp_consent remembers your cookie choice for 6 months. If you leave a blog comment and tick the box, your name and email are saved on your device so you don’t have to type them again.

Cookies we only use if you click “Accept”: Google Analytics cookies (_ga and _ga_…) help us understand how visitors use the site so we can improve it. They expire after up to 2 years. If you click “Reject”, no analytics cookies are set. We do not use advertising cookies.

You can change your choice at any time using “Cookie settings” at the bottom of every page. You can also delete cookies through your browser settings.

11. Changes to this policy

We will update this policy when our services or the law change. We will post the new version here and change the “Last updated” date. If a change significantly affects how we use your information, we will tell you directly.

12. Contact us

MedPanda Ltd, Spark Enterprise Incubation Programme, Nexus Discovery Way, University of Leeds, Leeds, West Yorkshire, LS2 3AA, United Kingdom

Email: care@medpanda.co.uk
Phone and WhatsApp: +44 7733 626876