Privacy Policy

What we collect

• Contact details — name, and the WhatsApp / WeChat / email address you give us.
• Medical information — records, imaging and pathology reports you choose to send, used only for hospital pre-review and coordination.
• Travel details — flight and companion information where we arrange pickup or lodging.
• Technical data — this is a static website. It sets no advertising or tracking cookies.

What we do with it

• Coordinate record pre-review, appointments and direct billing with the hospitals you choose.
• Arrange translation, interpretation, travel logistics and accompaniment.
• Reply to your enquiry and, if you engage us, deliver the service you asked for.
• We never sell your information and never use it for advertising.

Who we share it with

• Hospitals you choose — only what is needed for your care, and only after you give separate permission for your medical records.
• Your insurer — only when you authorise direct-billing verification.
• Service providers we use (licensed translators, lodging) — only what is necessary for the task.
• Where the law requires it — court orders or statutory obligations.

Where your data is stored, and cross-border transfer

• Website form submissions are processed by Netlify, which operates outside mainland China. Email is handled by Tencent Exmail. This means information you submit may be transferred to and stored outside the country you are in.
• Where this involves health data, we ask for your separate, explicit consent before any transfer, and we tell you which recipient it goes to.
• We keep written records of the consents you give us and the transfers we make.
• Health information is sensitive personal information under China's Personal Information Protection Law, which requires separate consent, a stated purpose and a defined retention period before it leaves the country. We collect only what a hospital needs to assess your case, and we name the recipient before you send anything.

How long we keep it

• Contact enquiries: 24 months from last contact, unless you ask us to delete sooner.
• Service records: for the period required by the written service agreement and applicable accounting rules.
• Medical records you send: deleted on request at any time. You do not need to give a reason.

Security

• All traffic is HTTPS-encrypted.
• Access to your information is limited to the staff who need it to do the work.
• We do not ask you to email medical records. Contact us first and we send a link to an access-controlled upload folder, reachable only by the coordinator handling your case, with every access logged and the folder deleted after the review or after 90 days, whichever comes first.

Your rights

• You may ask us to show you what we hold, correct it, or delete it, and you may withdraw consent at any time.
• Write to hello@tfucare.com and we will respond within a reasonable period.
• If you are in the EU or UK, you additionally have the rights set out in the GDPR, including the right to lodge a complaint with your supervisory authority.
• The data controller is TFUCare, reachable at the address on this page. Our legal bases are consent (Art. 6(1)(a)), performance of a contract (Art. 6(1)(b)) and, for health data, your explicit consent (Art. 9(2)(a)). We answer any rights request within 30 days.

Changes

• We publish updates on this page with a revised date.