Consumer Health Data Privacy Policy
Last updated: September 29, 2026
This policy is written for Washington's My Health My Data Act, Nevada's consumer health data law, and similar laws in other states. We apply it to everyone who uses ClinicTrue, wherever they live. It sits beside our main Privacy notice, which covers everything else.
The short version. When you send a request, the procedure you name and anything you write in your message are consumer health data. We collect them only to send your request to the clinics you tick, and we share them only with those clinics, with your consent. We do not sell them. You can see them, delete them or withdraw consent at any time by emailing [email protected].
Who we are
ClinicTrue is run by Distril LLC, 1021 E Lincolnway, Suite 6007, Cheyenne, WY 82001, USA. ClinicTrue is not a clinic. It shows prices that clinics publish and passes your request to clinics you pick. It does not give medical advice and does not perform or supervise any medical care.
What consumer health data we collect
"Consumer health data" means personal information that says something about your health, or that could be used to work it out. On ClinicTrue that is:
- The procedure you ask about, for example a tummy tuck (abdominoplasty).
- The city you want to have it in, together with the procedure, because that shows you are looking into cosmetic surgery there.
- The rough month you are thinking of going.
- Anything you write in the message box. People often mention past surgeries, weight change or medicines. The form asks you not to include your address or ID numbers.
- The fact that you sent a request to a cosmetic surgery clinic at all, and to which clinics.
We do not collect health records, test results, biometric data, precise location or payment details. We do not collect anything about your health when you only browse the site. Pages you read are not stored against your name. Our visit log holds a daily-salted hash of your IP address, never the address itself, and no name.
Where it comes from
Only from you. What you type into the request form, and what you write if you email us. We do not buy health data, we do not infer it from your browsing, and we do not get it from anyone else.
Why we collect it
- To send your request to the clinics you ticked, so they can contact you.
- To send you a copy of your request.
- To keep a record of what you sent and the consent you gave, in case there is a question or a complaint later.
- To answer you if you email us about the request.
- To keep the site free of spam and abuse.
We do not use consumer health data for advertising, for profiling, or to decide anything about you.
Who we share it with
The clinics you tick. Up to 3, named on the form and repeated in your confirmation email. Only those. Each clinic receives its own copy of your request by email, with your first name, your contact details, the procedure, the city, your travel month, your message and the request reference number. A clinic is not told which other clinics you picked. You consent to this by ticking the consent box, which names the clinics. The clinics are in Mexico or Colombia and are independent businesses. Once a clinic has your request, that clinic is responsible for what it does with it. Its privacy notice applies.
Every clinic that can be picked is listed by city on the home page.
Companies that store and send data for us. Contabo GmbH hosts our application server, in France. Cloudflare, Inc. (United States) sits in front of the site and runs the spam check on the form. Resend (United States) sends our email, including your request to the clinics. Encrypted copies of our database are backed up to Google Drive (Google, United States). Each acts on our instructions and may not use the data for itself. We use no other processors.
No one else, unless a law, court or regulator requires it.
We have no affiliates, so we share with none.
We do not sell consumer health data
We do not sell it, trade it or share it for anything of value. Because there is no sale, there is no sale authorization for you to sign. If that ever changed, the law would require your separate, signed authorization first, and we would ask for it.
No geofencing
We do not use geofences, location tracking or anything else to work out whether you are at or near a clinic, hospital or other health facility.
Your rights
You can:
- Ask whether we hold consumer health data about you, see it, and get a list of every clinic and company we shared it with, with their contact details.
- Withdraw consent to further sharing. If we have not yet sent your request, we stop. If we have, we tell you which clinics have it.
- Have it deleted. We delete the request from our systems and from our providers' systems within 30 days. We also write to each clinic that received your request and ask them to delete it. We cannot force a clinic to delete, because the clinic is its own controller once it has your request, but we will send you a copy of what we asked them.
- Appeal if we refuse. A different person at Distril LLC looks at it. If we still refuse, we tell you why and how to contact your state attorney general.
How to use these rights
Email [email protected] with "Health data request" in the subject line, or [email protected] in Spanish. Tell us which right you are using and, if you have it, your request reference number. We reply to the email address on the request to confirm it is you, and we may ask one question to check.
We confirm we got your email within 2 business days. Deletion happens within 30 days. Every other request, and any appeal, is answered within 45 days. If we need longer we say why and when. We do not charge. We never treat you differently for asking.
How long we keep it
We keep requests and related emails for 24 months, then delete them, unless you ask sooner or a law requires us to keep a record.
Changes
If we change this policy we change the date at the top, and we email you before any change affects data you already gave us.
Contact
Distril LLC, 1021 E Lincolnway, Suite 6007, Cheyenne, WY 82001, USA. [email protected]. Spanish: [email protected].