Privacy notice

Last updated: October 1, 2026

The short version. ClinicTrue shows prices that clinics publish and lets you contact the clinics directly, or send us a message from the separate message form on a clinic's page. If you send a message in that form, we collect your name, your email and what you write. We email it, with your contact details, to that clinic only, and keep a copy. If we have no working address for the clinic, or the send fails, it comes to us and we reply or pass it on. If you use the WhatsApp button on a clinic's page, we keep your name and number as a record that you contacted that clinic. Today we send your details to no clinic except the one you wrote to. In future ClinicTrue may share requests with other clinics, which may pay us for them; we will update this notice and ask for your consent before that starts. The "Contact this clinic" form is separate: we do not send what you enter there to the clinic. We set no advertising cookies. You can ask us to show, fix or delete what we hold at any time by emailing [email protected].

Who we are

ClinicTrue is run by Distril LLC, 1021 E Lincolnway, Suite 6007, Cheyenne, WY 82001, USA. Distril LLC decides what data the site collects and why. In privacy law that makes us the "controller" of your data.

Email [email protected]. In Spanish, [email protected].

ClinicTrue is not a clinic. We do not give medical advice and we do not perform or supervise any medical care. Clinics listed on ClinicTrue are independent businesses.

What we collect, and why

When you visit the site. We keep a first-party visit log so we can see which pages people use and stop abuse. The log holds the page you viewed, the time, your browser type, the page that sent you to us and any UTM tags on the link. It also holds a hash of your IP address. We salt that hash with a value that changes every day and we never store the raw IP. So we cannot turn the hash back into your address, and we cannot link your visit today to your visit tomorrow. We keep the visit log for 13 months.

We do not use Google Analytics or any other analytics service. If that ever changes, we update this notice before it goes live.

When you click a clinic's website or phone link. We count the click: which clinic, which kind of link, the time and the ClinicTrue page you came from. We store no IP address, no hash of one, no name and no browser details with it. We keep a raw count of the clicks that come from a normal browser, and we count a click as a real visitor's only when your browser had already scrolled, tapped, pressed a key or stayed on that clinic's page for 8 seconds in the last 30 minutes. To check that we compare your daily-salted visit hash with the visit log at the moment you click, and we do not store the hash with the click. After that you deal with the clinic directly, and we do not see what you say to it.

When you use "Contact this clinic". The button opens a short form: your first name, surname, email, phone number and one box to agree to the Terms and this Privacy Policy. We save what you enter, with the clinic, the time, the page you were on, any UTM tags on the link, the country of your phone number, the country you connected from, and a salted hash of your IP address (never the address itself). Only after that do we show you how to reach the clinic (WhatsApp, phone, website or email, whichever it has), and we count each time you press one. ClinicTrue does not send your name, email or phone number to the clinic. We keep them, and you reach the clinic yourself with the buttons we show you. If we ever want to pass your details to a clinic, we will ask you first. ClinicTrue may contact you to help you reach the clinic; you can say no at any time by writing to [email protected], and we will stop. We do not sell your details. What you write to the clinic afterwards goes to the clinic, not to us. We keep these records for 24 months, as for other messages (see Retention).

When you use the WhatsApp button on a clinic's page. Before WhatsApp opens, the button asks for your first name and your WhatsApp number. We store them with the clinic, the time, the page you were on and any UTM tags on the link, as a record that you contacted that clinic from ClinicTrue. We also store the exact consent text you ticked. Then WhatsApp opens on your device. What you write in WhatsApp goes to the clinic, not to us. We also count the click, as above.

When you send a message from the separate message form on a clinic's page. This part applies only to that message form, not to "Contact this clinic" above. The form asks for:

• Your first name.
• Your email, so we can reply and send you a confirmation.
• Your phone or WhatsApp number, if you choose to give one.
• The procedure you are asking about, if you pick one.
• A rough travel month, if you choose to give one.
• A message. Please do not include your address or ID numbers.

You never have to tell us anything about your health. The procedure field and the message are optional, and a message with no health detail still goes to the clinic.

We also store the exact consent text you agreed to, its version, the time you sent the message, the clinic's page it came from and any UTM tags on the link. Every message gets a reference number, which is in your confirmation email. We email the message to the clinic at the address the clinic publishes on its own website, from ClinicTrue, with your address as the reply-to, and we keep a copy. If we have no working address for the clinic, the clinic has asked us to stop, or the send fails, the message comes to us and we reply or pass it on. We send it to no other clinic.

When you email us. We keep the email and our reply so we can deal with your question and look back at it later if we need to.

When you use the contact form or the corrections form. We save what you type before we send it to our inbox, so a mail problem cannot lose your message. The saved message holds your name, your email, what you wrote and the time.

Spam protection. Our contact form and the clinic message form use Cloudflare Turnstile to tell people from bots. Turnstile is run by Cloudflare, Inc. It reads signals from your browser to do this and sets a security cookie on the form page. Cloudflare's own privacy policy covers what it does with those signals.

About clinics. We collect the prices clinics publish on their own websites, the page address and the date we saw it, and what public registries say about them. We also keep contact details for the people at each clinic who deal with us. Clinics in Colombia give us identification details under Colombian consumer law. The For clinics page explains that.

Sharing with other clinics in the future

Today ClinicTrue does not share a request with any clinic except the one you wrote to. In future ClinicTrue may share requests with other clinics, and those clinics may pay ClinicTrue for them. Before that starts we will update this notice and the date at the top, and we will ask for your consent. Requests sent before then are never passed on to other clinics. If a clinic pays us for a request in future, privacy laws in some US states call that a sale of health data and ask for more than a tick; our Consumer Health Data Privacy Policy says what we will do.

Changing your mind. Email [email protected] with your reference number and ask us to withdraw your consent or delete your message. We act at once. Withdrawing does not undo what was already sent to the clinic you wrote to.

Why we are allowed to use your data

The legal bases, in plain words:

• You asked us to. When you write to us we use your message to reply. When you send a message from the separate message form on a clinic's page we email it to that clinic, as you agreed by ticking the box before sending. You can withdraw that consent at any time. See below.
• We need it to run the site. Keeping a visit log, stopping spam and keeping a copy of your consent are things we have to do to run ClinicTrue and to show what happened if there is a dispute.
• The law says so. Some records we must keep, or hand over, when a law requires it.

Who receives your data

The clinic you chose (separate message form only). This paragraph applies only to the separate message form on a clinic's page. The "Contact this clinic" form does not send your details to the clinic: we show you the clinic's own contact options and you reach it yourself. We email your message and contact details to the clinic whose page you wrote from, and only after you tick the box that agrees to our Terms and Conditions and this Privacy Policy. One email per message, to that clinic only. When you follow a link to a clinic, or WhatsApp opens to it, you deal with that clinic. In privacy law the clinic is its own "controller". Its privacy notice applies from then on, not ours.

Other clinics. None today. If that changes, we will update this notice and ask for your consent first.

Companies that work for us. Contabo GmbH hosts our application server, in France. Cloudflare, Inc. (United States) sits in front of the site for security and delivery and runs the spam check on the form. Resend (United States) sends our email, including a message to a clinic. Encrypted copies of our database are backed up to Google Drive (Google, United States). Each of them acts on our instructions and may not use your data for its own purposes. We also use service providers that check that contact details are valid and that deliver alerts to our staff. They act only on our instructions. We have no affiliates.

Google Maps. The map on a clinic's page is served by Google. When the map loads, Google receives your IP address and browser details and may set its own cookies. Google's privacy policy covers that. We keep only the clinic's Google place ID.

Authorities. If a law, court or regulator requires it, we hand over what it requires and no more.

A new owner. If Distril LLC sells ClinicTrue, your data may pass to the new owner under the same rules as this notice. We would email you before that happened.

Selling your data. Today we sell personal data to no one. If that ever changes, we will update this notice and ask for your consent first. We do not share your data for advertising and we do not run targeted advertising.

Where your data goes

Distril LLC is in the United States. Our application server is in France, in the European Union. Cloudflare, Resend and Google, which handle delivery, email and encrypted backups for us, are in the United States.

When you follow a link to a clinic, or we email your message to it, your data goes to a clinic in Mexico, Colombia or Costa Rica. Those countries have their own privacy laws, and they differ from the laws where you live. Once you contact the clinic, the clinic's local law and the clinic's own privacy notice apply.

How long we keep it

Messages from clinic pages, price requests, WhatsApp button records, emails between us, and any request sent through our earlier request form: 24 months from the date of the message, record, email or request. After that we delete them or strip everything that could identify you. Click counts hold no personal data and are kept. Encrypted backups of our database are kept for 45 days and then deleted, so something you ask us to delete can stay in a backup for up to 45 days.

The record of what you agreed to, meaning the consent text you ticked, its version and the time, is kept with the message and deleted with it.

Visit log: 13 months. The IP hash cannot be turned back into your address at any point.

If you ask us to delete sooner, we do, unless a law says we must keep a record. Then we keep only what the law requires and tell you.

Your rights, and how to use them

Wherever you live, you can ask us to:

• Show you what we hold about you, and who we sent it to.
• Give you a copy in a common file format.
• Fix anything that is wrong.
• Delete it.
• Withdraw consent. This does not undo what was sent before you withdrew it.

To use any of these, email [email protected] with "Privacy request" in the subject line. We reply to the email address on the request to make sure it is you, and we may ask one question to check. We do not charge for this. We confirm we got your email within 2 business days and answer within 45 days. If we need longer we will tell you why and when.

If you think we got it wrong, reply and say "Appeal". A different person at Distril LLC will look at it and reply within 45 days. You can also complain to the privacy regulator or attorney general where you live.

You may ask someone else to make a request for you. We will need proof you gave them permission.

We never treat you differently for using these rights.

If you live in a US state with a privacy law

Several US states, among them California, Colorado, Connecticut, Virginia and Texas, give residents rights over their personal data. In plain words they are the rights listed above. To know, to get a copy, to correct, to delete, and to opt out of the sale of your data, of sharing it for targeted advertising, and of profiling that has a legal effect on you.

Today we do not sell personal data, we do not share it for targeted advertising and we do not profile you, so there is nothing to opt out of. If that ever changes, we will update this notice, ask for your consent first, and tell you how to opt out. Either way, write to us and we will confirm in writing.

Whether a state's law formally applies to Distril LLC depends on how many people in that state use the site. We honour these requests either way.

Some of what you might write to us, such as the procedure you are asking about, counts as "consumer health data" under laws in Washington and some other states. Our separate Consumer Health Data Privacy Policy covers it.

If you live in Canada, Canadian privacy law gives you similar rights to see, correct and withdraw consent. Use the same email.

If you live in Colombia

Colombian law (Ley 1581 de 2012 and Decreto 1377 de 2013) calls what you tell us about a procedure or your health "datos sensibles". You are never obliged to give us sensitive data. The procedure field and the message are optional, and a message with no health detail still goes to the clinic.

Your authorization is the consent box you tick before sending. We keep a record of it and give you a copy on request. Distril LLC is a US company and our server is in France, so your data leaves Colombia when you send it. The consent box is your express authorization for that transfer. If we ever share requests with other clinics, we will ask for your express authorization again first.

You can know, update and correct your data, ask for proof of your authorization, revoke it and ask us to delete it. Send your request (a "reclamo") to [email protected] or [email protected] with your name, what you want changed and your reference number if you have one. We answer within 15 business days, or tell you why we need up to 8 more. You can also complain to the Superintendencia de Industria y Comercio. Whether Colombian law formally binds a company outside Colombia is not settled; we follow it anyway.

If you live in Mexico

Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (2025) treats information about your present or future health as sensitive data. It requires your express consent before we process it, and a clause saying whether you accept transfers to third parties. The consent box you tick before sending is your consent to send your message to the clinic you chose. If we ever share requests with other clinics, we will ask for your express consent again first, and update this notice.

You have the rights of access, rectification, cancellation and opposition (ARCO), and you can revoke your consent at any time, with no effect on what was done before. Write to [email protected] or [email protected] with "Solicitud ARCO" in the subject line, and we answer in Spanish if you write in Spanish. Complaints go to the Secretaría Anticorrupción y Buen Gobierno, which took over the INAI's role under the 2025 law.

If you live in Costa Rica

Costa Rica's Ley 8968, the Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales, lists biomedical information as sensitive data ("datos sensibles") and says nobody is obliged to give it. The procedure field and the message are optional. The consent box you tick before sending is your consent to send your message to the clinic you chose. If we ever share requests with other clinics, we will ask for your consent again first, and update this notice.

You can ask to see, correct or delete your data, and you can withdraw your consent at any time. Write to [email protected] or [email protected] with your name, what you want and your reference number if you have one, and we answer in Spanish if you write in Spanish. Complaints go to the Agencia de Protección de Datos de los Habitantes (PRODHAB), the regulator under that law.

Cookies

We set no advertising cookies and no cookies that follow you to other sites. The site sets a session cookie and a security (CSRF) cookie. Both are strictly necessary. They protect the forms and the staff login. On your first visit it also sets one first-touch cookie called ct_ft. It holds the page you landed on, the page that sent you to us and any UTM tags on the link. It lasts 90 days. We use it only to attribute a message you send us, and we store it with that message. On our forms, Cloudflare and Turnstile set security cookies to tell people from bots. That is the full list. If we ever add analytics, we update this section before it goes live.

Children

ClinicTrue is for adults. We do not knowingly collect data from anyone under 18. If you think someone under 18 wrote to us, email us and we will delete it.

Security

We limit who at Distril LLC can see the emails and messages we receive, we use encrypted connections, and our database backups are encrypted. No system stops every risk. If a breach affects your data we will tell you, and any regulator the law names, as fast as the law requires.

Changes to this notice

If we change this notice we change the date at the top. If a change affects what we do with data you already gave us, we email you before it takes effect.

Contact

Distril LLC 1021 E Lincolnway, Suite 6007 Cheyenne, WY 82001, USA [email protected] [email protected] (Spanish)