MediStay Medical Travel
Privacy & Data Handling Policy
Public information summary supporting the Medical Travel DPIA, reference MT-DPIA-2026-02, version 0.2 (9 October 2026).
This page explains how MediStay handles Medical Travel enquiries. It supplements the general MediStay Privacy Notice. It is not a medical assessment or a promise of treatment, travel or accommodation bookings.
1. Who is responsible for your information?
MediStay Ltd operates the MediStay Medical Travel enquiry service. Company number 12931955. ICO registration number ZA795674. Registered office: 64 Claughton Street, St Helens, England WA10 1SN. For privacy, access, correction, withdrawal or other enquiries contact info@medistayuk.com. We normally act as the controller of information collected for our own enquiry services. Healthcare providers may be independent controllers of information legitimately disclosed to them; any joint-controller arrangement would need to be separately documented.
2. Information we may collect
We may collect your name and contact details, country and location, travel dates, accessibility preferences, accommodation requirements, enquiries and communications. If you ask for healthcare-related support, we may ask for the broad healthcare category, a short explanation of the help sought, and accessibility or health information that you choose to provide.
Health and disability information may constitute special-category data under the UK GDPR. You do not need to give a diagnosis, detailed medical history or clinical documents for accommodation-only or business-travel-only enquiries. Please do not submit urgent clinical information or medical records through the enquiry form.
3. Why we use the information and our lawful bases
We use information to receive and reply to requests, record communication preferences, operate the enquiry service, respond to data rights requests, and preserve necessary security and compliance evidence. An Article 6 lawful basis is necessary for each processing purpose; health information also requires a separate Article 9 condition. These decisions are documented and reviewed through our controlled DPIA.
| Processing activity | Information | Purpose | Legal assessment / restrictions |
|---|---|---|---|
| Enquiry registration and response | Name, contact preference, email or telephone, broad service requested | Respond to the enquiry and keep the discussion organised | Article 6 basis for this purpose must be verified in the controlled DPIA: potential contract/pre-contract steps (6(1)(b)) or legitimate interests (6(1)(f)) depending on the actual circumstances. |
| Optional healthcare information | Healthcare category, self-described need, accessibility and disability-related information | Understand the relevant healthcare-related request; no diagnosis or treatment | Requires an Article 6 basis AND a separate Article 9 condition; explicit consent under 9(2)(a) is the proposed condition and is recorded separately. |
| Healthcare-provider disclosure (restricted) | Only the specific fields needed for a capability check or later identified referral | Assess whether a verified healthcare provider might be able to consider an enquiry | Not active in the enquiry-only pilot. Further purpose-specific lawful-basis/Article 9 assessment, patient authorisation and approved recipient/transfer safeguards required. |
| Operational security, audit and rights | Enquiry reference, actions, permissions, access and disclosure evidence | Protect confidentiality, enforce rights, investigate incidents and maintain accountable records | Relevant documented Article 6 basis, including legitimate interests and/or legal obligation where applicable, must be confirmed. |
| Optional marketing | Contact information and marketing preference | Send marketing only where lawful and separately requested or otherwise permitted | Separate opt-in and applicable electronic-marketing rules; never bundled with health-data consent. |
Governance status: The final processing-by-purpose Article 6 assessment, special-category condition, and related supplier/transfer reviews remain subject to formal information-governance verification. Inclusion of a potential basis in the table does not mean that an unfinished legal assessment has been approved.
4. Four distinct permissions
Our Medical Travel form records separate choices for ordinary enquiry-processing acknowledgement, explicit health-data consent where relevant, optional healthcare-provider sharing, and optional marketing. Choices are not pre-selected. Consent for one purpose does not automatically permit another. You can withdraw any applicable consent by contacting us; withdrawal stops future processing relying on that consent, subject to other legal obligations.
5. How healthcare-provider sharing works
The proposed process is deliberately staged. First, a limited capability enquiry would contain only the minimum appropriate information. Second, an identified referral would require a verified healthcare provider, a positive capability response, the individual's provider-specific authorisation and all relevant legal, security and transfer checks. Pseudonymised information is not automatically anonymous.
Current restriction: New provider capability checks and identified referrals are blocked in the present enquiry-only pilot while the DPIA and other sharing safeguards await sign-off. We will not treat submitting an enquiry as blanket permission to send your healthcare details to a clinic. This policy does not authorise new disclosures.
Where information has already been lawfully disclosed to a separate provider, withdrawing consent to future MediStay sharing cannot guarantee that the provider will erase information it independently needs to retain.
6. Who may receive information?
Authorised MediStay staff and contracted technology or communications suppliers may access information only as required for the relevant service. Where applicable and lawfully authorised, information could be shared with the specific healthcare provider you have approved. Other recipients may include professional advisers, regulators or authorities where legally required.
Medical Travel health information is not automatically available to MediStay accommodation hosts, Business Travel customers or property-management users. Any cross-service information transfer requires its own lawful purpose and safeguards.
7. Overseas processing and provider destinations
International journeys and technology providers may involve overseas data access or transfers. Any restricted international transfer requires an appropriate UK GDPR transfer route (such as applicable adequacy regulations or an approved safeguard), plus any relevant data protection test and destination/provider assessment. International provider disclosures remain disabled until those steps are recorded.
8. Security, records and storage
MediStay uses measures including limited administrative access, server-side permissions, security logging, separated consent records and controls intended to restrict information disclosed to providers. We review whether these controls work as intended and require contractual and technical evidence from relevant suppliers. We do not claim any internet service is risk-free.
If we remove identifying fields from the main enquiry record but retain linkable consent, disclosure or audit evidence, the result remains pseudonymised personal data, not anonymous information.
9. How long information is retained
We keep information only as long as is reasonably necessary for the relevant purpose, subject to legal requirements and approved retention criteria. The Medical Travel system currently has a 24-month enquiry review interval and 84-month settings for certain compliance records; these are provisional technical settings under formal retention review and must not be taken as approved universal deletion deadlines. Linked records, backups, disclosure snapshots and legal holds require distinct decisions. You can ask us about the retention applied to your record.
10. Children and people acting for someone else
Healthcare-related enquiries may be submitted by a parent, carer or representative. We may request evidence of authority where necessary to protect the individual's privacy. We do not presume that a person submitting another person's information has unrestricted permission to disclose it. Information about children and vulnerable individuals warrants additional safeguards.
11. Your data protection rights
- Ask for access to the personal data we hold about you.
- Request correction of inaccurate or incomplete information.
- Ask for erasure or restriction where the law provides that right.
- Object to applicable processing and request portability where relevant.
- Withdraw consent at any time without making earlier lawful processing automatically unlawful.
- Complain to the Information Commissioner’s Office (ICO).
Contact info@medistayuk.com and give your enquiry reference where available. We may need to verify your identity before disclosing sensitive information. The availability of individual rights depends on the legal circumstances and exemptions.
You may also complain to the Information Commissioner's Office.
12. No automated clinical decisions or emergency service
The enquiry service is not a diagnosis, medical advice service, clinical priority tool or emergency pathway. We do not currently make automated clinical eligibility decisions through this process. If you need urgent medical assistance, contact your local emergency healthcare service.
13. DPIA oversight and changes
MediStay maintains a fuller internal Data Protection Impact Assessment covering ICO assessment stages, data flows, consultation, risks and mitigations, actions and an approval record. The controlled internal assessment is version 0.2, with formal residual-risk and legal verification still outstanding. We may publish an updated public summary after those checks are complete. This public policy will be reviewed following any material change in processing, providers, countries, technology or services.
Reviewed wording: 9 October 2026. Document reference: MT-DPIA-2026-02 — Public Summary.