Privacy notice

Last updated: September 29, 2026

The short version. ClinicTrue shows prices that clinics publish and lets you send a request to up to 3 clinics you pick. To do that we collect your name, email, the procedure you ask about and a few other details. We send them only to the clinics you tick. We do not sell your data and we set no advertising cookies. You can ask us to show, fix or delete what we hold at any time by emailing [email protected].

Who we are

ClinicTrue is run by Distril LLC, 1021 E Lincolnway, Suite 6007, Cheyenne, WY 82001, USA. Distril LLC decides what data the site collects and why. In privacy law that makes us the "controller" of your data.

Email [email protected]. In Spanish, [email protected].

ClinicTrue is not a clinic. We do not give medical advice and we do not perform or supervise any medical care. Clinics listed on ClinicTrue are independent businesses.

What we collect, and why

When you visit the site. We keep a first-party visit log so we can see which pages people use and stop abuse. The log holds the page you viewed, the time, your browser type, the page that sent you to us and any UTM tags on the link. It also holds a hash of your IP address. We salt that hash with a value that changes every day and we never store the raw IP. So we cannot turn the hash back into your address, and we cannot link your visit today to your visit tomorrow. We keep the visit log for 13 months.

We do not use Google Analytics or any other analytics service. If that ever changes, we update this notice before it goes live.

When you send a request to clinics. The form asks for:

• Your first name, so the clinics know what to call you.
• Your email, so the clinics can reply and so we can send you a copy of the request.
• Your phone or WhatsApp number, if you choose to give one.
• How you prefer to be contacted.
• The procedure you are asking about.
• The city.
• The clinics you tick, up to 3.
• A rough travel month.
• A message, if you want to add one. The form asks you not to include your address or ID numbers. Please do not.

We also store the exact consent text you agreed to, the time you sent the request, the page that sent you to us and any UTM tags on the link. Every request gets a reference number. It is in your confirmation email and we quote it to each clinic.

We store all of this so we can send your request, send you a copy, show that you agreed, answer you if you write to us, and handle a complaint.

When you email us. We keep the email and our reply so we can deal with your question and look back at it later if we need to.

Spam protection. The form uses Cloudflare Turnstile to tell people from bots. Turnstile is run by Cloudflare, Inc. It reads signals from your browser to do this and sets a security cookie on the form page. Cloudflare's own privacy policy covers what it does with those signals.

About clinics. We collect the prices clinics publish on their own websites, the page address and the date we saw it, and what public registries say about them. We also keep contact details for the people at each clinic who deal with us. Clinics in Colombia give us identification details under Colombian consumer law. The For clinics page explains that.

Why we are allowed to use your data

The legal bases, in plain words:

• You asked us to. You tick the clinics and the consent box. We send your request because you told us to. You can withdraw that consent at any time. See below.
• We need it to run the site. Keeping a visit log, stopping spam and keeping a copy of your consent are things we have to do to run ClinicTrue and to show what happened if there is a dispute.
• The law says so. Some records we must keep, or hand over, when a law requires it.

Who receives your data

The clinics you tick. Only those. We do not add any. Each clinic gets its own copy of your request by email, and is not told which other clinics you picked. Once a clinic has your request, that clinic decides what it does with it. In privacy law the clinic is its own "controller". Its privacy notice applies from then on, not ours. If you want a clinic to delete your data, ask the clinic. We will help you find the right contact if you ask us.

Companies that work for us. Contabo GmbH hosts our application server, in France. Cloudflare, Inc. (United States) sits in front of the site for security and delivery and runs the spam check on the form. Resend (United States) sends our email. Encrypted copies of our database are backed up to Google Drive (Google, United States). Each of them acts on our instructions and may not use your data for its own purposes. We use no other processors and we have no affiliates.

Authorities. If a law, court or regulator requires it, we hand over what it requires and no more.

A new owner. If Distril LLC sells ClinicTrue, your data may pass to the new owner under the same rules as this notice. We would email you before that happened.

We do not sell your personal data. We do not share it for advertising and we do not run targeted advertising.

Where your data goes

Distril LLC is in the United States. Our application server is in France, in the European Union. Cloudflare, Resend and Google, which handle delivery, email and encrypted backups for us, are in the United States.

When you send a request, it goes to clinics in Mexico or Colombia. Those countries have their own privacy laws, and they differ from the laws where you live. By ticking the consent box you ask us to send your request there. Once it arrives, the clinic's local law and the clinic's own privacy notice apply.

How long we keep it

Requests, the consent text, the time you sent it and emails between us: 24 months from the date of the request. After that we delete the request or strip everything that could identify you.

Visit log: 13 months. The IP hash cannot be turned back into your address at any point.

If you ask us to delete sooner, we do, unless a law says we must keep a record. Then we keep only what the law requires and tell you.

Your rights, and how to use them

Wherever you live, you can ask us to:

• Show you what we hold about you, and who we sent it to.
• Give you a copy in a common file format.
• Fix anything that is wrong.
• Delete it.
• Stop your request going to any clinic that has not received it yet. If it has already been sent, we will tell you which clinics have it so you can ask them directly.
• Withdraw consent. This does not undo what was sent before you withdrew it.

To use any of these, email [email protected] with "Privacy request" in the subject line. We reply to the email address on the request to make sure it is you, and we may ask one question to check. We do not charge for this. We confirm we got your email within 2 business days and answer within 45 days. If we need longer we will tell you why and when.

If you think we got it wrong, reply and say "Appeal". A different person at Distril LLC will look at it and reply within 45 days. You can also complain to the privacy regulator or attorney general where you live.

You may ask someone else to make a request for you. We will need proof you gave them permission.

We never treat you differently for using these rights.

If you live in a US state with a privacy law

Several US states, among them California, Colorado, Connecticut, Virginia and Texas, give residents rights over their personal data. In plain words they are the rights listed above. To know, to get a copy, to correct, to delete, and to opt out of the sale of your data, of sharing it for targeted advertising, and of profiling that has a legal effect on you.

We do not sell personal data, we do not share it for targeted advertising and we do not profile you. So there is nothing to opt out of, but you can still write to us and we will confirm that in writing.

Whether a state's law formally applies to Distril LLC depends on how many people in that state use the site. We honour these requests either way.

Some of what you send us, such as the procedure you are asking about, counts as "consumer health data" under laws in Washington and some other states. Our separate Consumer Health Data Privacy Policy covers it.

If you live in Canada, Canadian privacy law gives you similar rights to see, correct and withdraw consent. Use the same email.

Cookies

We set no advertising cookies and no tracking cookies. The site sets a session cookie and a security (CSRF) cookie. Both are strictly necessary. They protect the forms and the staff login. On the quote form, Cloudflare and Turnstile set security cookies to tell people from bots. That is the full list. If we ever add analytics, we update this section before it goes live.

Children

ClinicTrue is for adults. You confirm you are 18 or older when you send a request. We do not knowingly collect data from anyone under 18. If you think someone under 18 sent us a request, email us and we will delete it.

Security

We limit who at Distril LLC can see requests, we use encrypted connections, and our database backups are encrypted. No system stops every risk. If a breach affects your data we will tell you, and any regulator the law names, as fast as the law requires.

Changes to this notice

If we change this notice we change the date at the top. If a change affects what we do with data you already gave us, we email you before it takes effect.

Contact

Distril LLC 1021 E Lincolnway, Suite 6007 Cheyenne, WY 82001, USA [email protected] [email protected] (Spanish)