Consumer Health Data Privacy Policy

Last updated: October 1, 2026

This policy is written for Washington's My Health My Data Act, Nevada's consumer health data law, Connecticut's consumer health data rules, and similar laws in other states. We apply it to everyone who uses ClinicTrue, wherever they live. It sits beside our main Privacy notice, which covers everything else.

The short version. If you send a message from a clinic's page, use the WhatsApp button, or write to us, the procedure you name, the clinic you contact and anything you say about your health are consumer health data. We use them to send your message to the clinic you chose, to keep a copy, and to answer you if the clinic cannot be reached. Today we pass them to no other clinic. In future we may share requests with other clinics, which may pay us for them; we will update this policy and ask for your consent before that starts. You can see your data, delete it, or withdraw consent at any time by emailing [email protected].

Who we are

ClinicTrue is run by Distril LLC, 1021 E Lincolnway, Suite 6007, Cheyenne, WY 82001, USA. ClinicTrue is not a clinic. It shows prices that clinics publish and links you to clinics you pick. It does not give medical advice and does not perform or supervise any medical care.

What consumer health data we collect

"Consumer health data" means personal information that says something about your health, or that could be used to work it out. On ClinicTrue that is:

• The procedure you pick, your rough travel month, and anything you write to us about a procedure or your health, in a clinic's message form, an email or the contact form. People sometimes mention past surgeries, weight change or medicines. Please do not include your address or ID numbers.
• The fact that you contacted a particular clinic from its page, by message or by the WhatsApp button, together with the name and number you gave. Which clinic you chose says what kind of surgery you are considering, so we treat it as health data too.

We do not collect health records, test results, biometric data, precise location or payment details. We do not collect anything about your health when you only browse the site. Pages you read are not stored against your name. Our visit log holds a daily-salted hash of your IP address, never the address itself, and no name.

Where it comes from

Only from you. What you type if you use a clinic's message form, the WhatsApp button, the contact form, or email us. We do not buy health data, we do not infer it from your browsing, and we do not get it from anyone else.

Why we collect it

• To email your message to the clinic whose page you wrote from, as you agreed by ticking the box before sending.
• To keep a record that you contacted a clinic by the WhatsApp button, as you agreed by ticking the box beside the button.
• To answer you when you write to us, or when the clinic cannot be reached.
• To keep a record of what you sent and what you agreed to, in case there is a question or a complaint later.
• To keep the site free of spam and abuse.

We do not use consumer health data for advertising, for profiling, or to decide anything about you.

Who we share it with

The clinic you chose. We email consumer health data to the clinic whose page you wrote from, and only after you tick the box that agrees to our Terms and Conditions and Privacy Policy. The email comes from ClinicTrue with your address as the reply-to, and we keep a copy. If we have no working address for the clinic, or the send fails, the message stays with us. When WhatsApp opens to a clinic, what you write there goes to the clinic directly.

Other clinics. None today. If that changes, we will update this policy and ask for your consent first.

Companies that store and send data for us. Contabo GmbH hosts our application server, in France. Cloudflare, Inc. (United States) sits in front of the site and runs the spam check on the forms. Resend (United States) sends our email, including a message to a clinic. Encrypted copies of our database are backed up to Google Drive (Google, United States). Each acts on our instructions and may not use the data for itself. We also use service providers that check that contact details are valid and that deliver alerts to our staff. They act only on our instructions.

No one else, unless a law, court or regulator requires it.

We have no affiliates, so we share with none.

Selling consumer health data

Today we do not sell consumer health data. We do not trade it and we do not share it for anything of value. No clinic pays us anything.

If that ever changes, for example if a clinic pays us for a request, Washington, Nevada and Connecticut law call that a sale of consumer health data. Before it starts we will update this policy, ask for your consent, and where the law requires a separate signed authorization that names the paying clinic, ask for that too. Nothing is sold or shared until then.

No geofencing

We do not use geofences, location tracking or anything else to work out whether you are at or near a clinic, hospital or other health facility.

Your rights

You can:

• Ask whether we hold consumer health data about you, see it, and get a list of every clinic and company we shared it with or sold it to, with their contact details.
• Withdraw consent. If we have not yet emailed your message, we stop. If we have, we tell you which clinic has it. Either way we delete our copy if you ask.
• Have it deleted. We delete it from our systems and from our providers' systems within 30 days. We also write to each clinic that received your request and ask it to delete it. We cannot force a clinic to delete, because the clinic is its own controller once it has your message.
• Appeal if we refuse. A different person at Distril LLC looks at it. If we still refuse, we tell you why and how to contact your state attorney general.

How to use these rights

Email [email protected] with "Health data request" in the subject line, or [email protected] in Spanish. Tell us which right you are using. We reply to the email address you wrote from to confirm it is you, and we may ask one question to check.

We confirm we got your email within 2 business days. Deletion happens within 30 days. Every other request, and any appeal, is answered within 45 days. If we need longer we say why and when. We do not charge. We never treat you differently for asking.

How long we keep it

We keep messages, WhatsApp button records, emails, and any request sent through our earlier request form, for 24 months, then delete them, unless you ask sooner or a law requires us to keep a record. The record of what you agreed to on the form is kept with the message and deleted with it. Encrypted backups of our database are kept for 45 days and then deleted, so something you ask us to delete can stay in a backup for up to 45 days.

Changes

If we change this policy we change the date at the top, and we email you before any change affects data you already gave us. Before we share any request with a clinic the patient did not choose, this policy will say so and we will ask for consent.

Contact

Distril LLC, 1021 E Lincolnway, Suite 6007, Cheyenne, WY 82001, USA. [email protected]. Spanish: [email protected].