Cross-Border Health Data Compliance
Medical records and diagnostic imaging are sensitive personal information. When MedTravel China collects, stores and processes such data within China, it complies with the Personal Information Protection Law of the People's Republic of China, the Data Security Law of the People's Republic of China and other applicable laws, as well as the requirements for cross-border data transfers, and it adheres to the principles of data minimization, purpose limitation, separate authorization and a complete audit trail.
1. Processing Principles
- check_circlePurpose limitation: data is used only for medical record assessment, translation, hospital coordination, visa support and follow-up continuity;
- check_circleData minimization: only the information necessary to complete this medical-travel coordination engagement is collected, and no information unrelated to the patient's condition is gathered;
- check_circleSeparate consent: your separate, specific authorization is obtained before any cross-border transfer, and you are informed of the recipients, the content, the purposes and the duration.
2. Scope of Cross-Border Transfer
The platform discloses necessary medical records only to the departments of the partner public Class-A tertiary hospitals in China that handle your assessment and treatment, and applies pseudonymization or de-identification to reduce risk wherever feasible. The platform never sells, rents or otherwise provides your data to any unrelated third party. Where the laws of the patient's country of residence or of the destination country impose additional requirements on medical data, the platform cooperates with such requirements to the extent permitted by law.
3. Technical Security Measures
- lockEncryption in transit: all online transfers are TLS-encrypted end to end, and large DICOM files are transmitted over dedicated encrypted channels;
- lockAccess control: role-based least-privilege access with login and operation logging, readable only by the coordinators and translators assigned to your case;
- lockStorage and destruction: medical data is stored in tiers according to applicable standards; after authorization ends or the service concludes, data is deleted or anonymized at your request and as required by law.
4. Your Rights & How to Contact Us
You have the right to access, correct or withdraw authorization for your data, and to request deletion of the copies held by the platform; medical records already submitted to a hospital are managed by that hospital under the law of its jurisdiction. For data compliance matters, contact vip@chinamedtourist.com (Data Protection Contact); for reports and complaints: vip@chinamedtourist.com. The platform will respond within 15 working days. This statement is governed by its latest published version.