Privacy policy

1. Who is responsible

The controller for the processing described here is Vila de serviços, Unipessoal Lda, Rua dos Três Lagares, Incubadora Praça Municipal, 6230-421 Fundão, Portugal, NIF 517159554. We act as a medical tourism facilitator: we arrange, interpret and accompany, and the diagnostics and any treatment are performed by licensed clinics that are separate controllers for what they do.

We are established in Portugal, so the GDPR applies to us directly under Article 3(1), as it does to any controller in the Union. No Article 27 representative is required or appointed. Our supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD) in Lisbon; you may also complain to the authority in your own Member State.

Data protection questions, access requests and deletion requests: admin.doctorsvilla@gmail.com. We answer within 30 days and will tell you if we need the one-month extension that Article 12(3) permits.

2. What we collect, and when

The sequence matters, so it is stated explicitly. Browsing this website requires no personal data beyond what any web server receives. Buying a package requires your name, email and billing address. Your medical information is requested only after payment, through a separate encrypted intake form, because that is the first moment we need it.

• Website use: IP address, user agent, requested page and timestamp, in server logs retained for 14 days for security purposes. Aggregate, cookieless page-view counts only if you consent to statistics.
• Cart: the identifiers and quantities of the packages you select, stored in your own browser. This never reaches our servers except as part of a price calculation, and it contains no personal data.
• Purchase: name, email address, billing address, the package identifiers you bought, and the amount. Card details are entered on Stripe and never reach us.
• Medical intake (after payment, with explicit consent): medical history, current medication, allergies, previous diagnoses, uploaded prior reports and imaging, and — where the examination requires it — pregnancy status and menstrual cycle date.
• Results: your diagnostic reports, their translations and the written summaries we produce.
• Correspondence: emails and messages you send us, and our replies.

3. Why, and on what legal basis

• To sell you a package and arrange it: performance of a contract, Article 6(1)(b).
• To process your health data for the purpose of arranging and interpreting your diagnostics: your explicit consent, Article 9(2)(a). We ask for this separately, in the intake form, and you can withdraw it at any time. Withdrawing it before your appointment means we cannot proceed, and we will refund you under the cancellation terms.
• To keep invoices and tax records: compliance with a legal obligation, Article 6(1)(c).
• To keep our website secure and prevent abuse of the payment endpoints: our legitimate interest, Article 6(1)(f).
• To measure aggregate page views: your consent, Article 6(1)(a), freely refusable with no loss of functionality.
• We carry out no profiling and no automated decision-making within the meaning of Article 22. Which examinations suit you is decided by a human physician.
• We do not sell your data, we do not share it with advertising networks, and we do not use it to train any model.

4. Who else sees your data

• The treating clinic in Korea, which receives the medical information necessary to perform your examinations. It is an independent controller for the medical record it creates under Korean law.
• The medical translators who translate your reports, each bound by a confidentiality agreement and a data processing agreement.
• Stripe Payments Europe, Ltd. (Ireland) as our payment processor: your name, email, billing address, amount and the package references. Stripe never receives your medical intake answers, your history or your findings.
• Our hosting and email providers, as processors under Article 28 agreements, with access limited to what their service technically requires.
• Nobody else. No marketing platform, no analytics product and no advertising network receives any health data at any time.

5. Transfer to Korea

Your data is transferred from the EU to the Republic of Korea, because that is where your examinations happen. Korea holds an adequacy decision adopted by the European Commission on 17 December 2021, which means transfers to recipients subject to the Korean Personal Information Protection Act require no additional safeguard such as standard contractual clauses. The adequacy decision is subject to periodic review by the Commission; if it were withdrawn, we would move to standard contractual clauses and tell you.

6. How long we keep it

• Medical intake, reports and translations: 24 months from your visit, so a repeat checkup can be compared against your baseline. Deleted sooner on request.
• Invoices and accounting records: as required by the applicable statutory retention period, which we cannot shorten even at your request.
• Server access logs: 14 days.
• Correspondence: 24 months.
• Your consent record: for as long as we rely on that consent, plus the limitation period for proving it.

7. Your rights

You have the right to access your data, to have inaccuracies corrected, to have your data erased, to restrict or object to processing, to receive your data in a portable machine-readable format, and to withdraw any consent you have given — withdrawal does not affect processing already carried out on that basis.

Exercise any of these by writing to admin.doctorsvilla@gmail.com. We will not make it difficult and we will not require a specific form. We may ask you to confirm your identity where the request concerns health data, which protects you rather than us.

You also have the right to lodge a complaint with a supervisory authority: either the CNPD in Portugal, where we are established, or the data protection authority of your own country of residence. Either will take the complaint.

8. Security

Transport is encrypted with TLS throughout, including the intake form and every upload. The intake link is single-use and expires after 14 days. Access to medical data is limited to the coordinator assigned to you, the reviewing physician and the translator working on your report, each individually authenticated. We do not send medical information over consumer messaging apps, and if you send us something that way we will ask you to resend it through the secure form.

If a personal data breach occurs that is likely to result in a risk to you, we will notify the competent supervisory authority within 72 hours and inform you directly where Article 34 requires it.

9. Your account

An account is optional. You can order without one, and you are only offered one after you have paid, so that nothing stands between a decision and a confirmation. Declining costs you nothing: the confirmation, the receipt and your results arrive by email either way.

There is no password. We email you a link that is valid for twenty minutes, which proves control of the mailbox — the same thing a password reset proves, without a credential for either of us to lose. Signing in sets one cookie containing your email address and an expiry, signed so that it cannot be altered, for 30 days.

The account shows your orders, their status, which packages they contained, what you have paid, what remains outstanding, and your payment receipts. It shows the packages you ordered but not the individual analyses: a package name is an intention, while an itemised analysis is a suspicion, and the detail is on the invoice you can open rather than on a page.

It holds no medical information whatsoever. Your intake answers, your reports and their translations are kept in a separate clinical system and sent to you by your coordinator. The account is built on top of our payment processor, which is where the order already lives, so no further copy of your data is created in order to show it to you.

From the account you can download everything we hold in these systems as a machine-readable file (Articles 15 and 20) and delete your saved contact details yourself (Article 17). Deletion removes your name, telephone number and billing address, and ends your access. It does not remove invoices and accounting records, which we are obliged by Portuguese tax law to retain and which Article 17(3)(b) therefore excepts. Deletion is also declined while an amount is still outstanding on an order, because until that booking is complete the data are still necessary for performing our contract with you. Medical records are deleted on request to admin.doctorsvilla@gmail.com.