Privacy Policy

When you use CureMeAbroad, we may collect the following:

• Personal Information: Your name, email address, phone number, gender, age, country, and preferred medical treatment(s).
• Medical Information: Medical history, treatment needs, and diagnostic reports, only if you choose to submit them. This is sensitive data and is handled with the highest level of care.
• Usage Data: Device information, IP address, browser type, time zone, and how you navigate our platform.
• Communications: Messages between you and healthcare providers, or between you and our team.
• Account Data: Login credentials, saved preferences, shortlisted treatments, and any social profiles you choose to link.
• Consent Records: A log of what you have agreed to, including timestamps, so you always have a record.

We only collect what is necessary for the purposes described in this policy, nothing more.

We use your information to:

• Match you with relevant hospitals, clinics, and doctors based on your needs.
• Share your inquiry, only with your permission, with verified medical providers.
• Coordinate support services such as visa assistance, travel, accommodation, and translation where relevant to your inquiry.
• Power the CMA AI Planner to generate personalised treatment and destination suggestions. These are informational only and not medical advice. No significant decision is made purely by automated means without a human review.
• Send service updates, appointment information, and newsletters. You can opt out of marketing communications at any time.
• Improve our platform, detect fraud, and keep our systems secure.
• Meet our legal obligations and respond to lawful requests from authorities.

If we ever need to use your data for a purpose not listed here, we will ask for your consent first.

We do not sell your data to advertisers or third party marketers. We share your information only in the following circumstances:

• Verified medical providers, when you request a quote or consultation and give your permission.
• Service partners such as visa agencies, travel coordinators, and translators, only to the extent needed for your specific inquiry.
• Technology vendors who help us run the platform, such as cloud, CRM, and analytics providers. All vendors are vetted and bound by data protection agreements.
• Law enforcement or legal authorities, when required by law or to protect the safety of our users.
• A successor entity in the event of a merger or acquisition. We will notify you in advance and ensure equivalent protections apply.

Our hospital and clinic partners act as independent controllers when they provide medical care. We recommend reviewing their own privacy policies.

You are in control of your data. Depending on where you live, you may have some or all of the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to fix any inaccurate or incomplete information.
• Deletion: Request that we delete your data. You can also request deletion of your account at any time by contacting us or through your account settings.
• Restriction: Ask us to pause certain types of processing in specific circumstances.
• Portability: Receive your data in a usable format to transfer elsewhere.
• Opt Out: Object to marketing communications or, where applicable, to profiling. California residents may also opt out of any future sale of personal information, though we do not sell data.
• Withdraw Consent: Where we rely on your consent to process data, you can withdraw it at any time without affecting anything we did before.
• Nomination: In accordance with the Digital Personal Data Protection Act, 2023, you may nominate another individual to exercise your rights under this policy in the event of your death or incapacity. You may register or update your nominee through your account settings or by writing to us at info@curemeabroad.com.

To exercise any of these rights, contact us at info@curemeabroad.com. We will acknowledge your request within 72 hours and resolve it within 30 days.

Like most platforms, we use cookies and similar tools to keep our platform working, understand how it is used, and improve your experience. Here is what we use and why:

• Strictly Necessary: These keep the platform functioning, login sessions, form submissions, navigation. They cannot be turned off.
• Analytics: Help us understand page visits, feature usage, and errors so we can improve the platform.
• Functional: Remember your language, region, and preferences between sessions.
• Marketing: Used to measure campaign performance and show relevant content. These are only placed with your explicit consent.

For users in the EU, UK, and other regions where consent is required, no non essential cookies are activated before you give your consent through our Cookie Consent Banner. You can update your preferences or withdraw consent at any time.

We take special care to ensure that tracking tools do not capture or expose your medical information. No health data is used for advertising purposes.

We use industry standard measures to protect your personal and medical data, including encryption in transit and at rest, restricted staff access on a need to know basis, regular security assessments, and thorough vetting of all third party vendors before they handle any data.

If a data breach occurs that affects your information, we will notify you promptly and where the risk is significant provide practical guidance on steps you can take to protect yourself, such as monitoring your accounts or placing fraud alerts.

No system is 100% secure. Please share sensitive information wisely and contact us immediately at info@curemeabroad.com if you believe your account has been compromised.

CureMeAbroad is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. This applies globally, given the medical nature of our services, we hold a consistent minimum age regardless of local variations.

Where a parent or legal guardian submits data on behalf of a minor for medical purposes, we require verification of their identity and authority before proceeding. If you believe someone under 18 has submitted data without appropriate consent, please contact us at info@curemeabroad.com and we will delete it promptly.

CureMeAbroad is a global platform. Your data may be processed and stored in countries where we, our hospital partners, or our service partners operate, including Thailand, Turkey, Spain, Mexico, Korea and more, which may have different data protection standards than your home country.

We keep this list updated as our network of hospital and clinic partners grows or changes. The current list of countries where partner data processing occurs is available on request at info@curemeabroad.com.

Medical and health data is the most sensitive information we handle, and we treat it accordingly. Where applicable, particularly for users in the United States, we align our practices with HIPAA standards and put appropriate agreements in place with any vendors or partners who may handle your health information.

Your health information is used only to provide the services you request. We apply a minimum necessary approach: we share only what is required for a specific purpose, nothing more.

We are incorporated in India, with a subsidiary registered in the United States as CureMeAbroad Inc. This Policy, and our collection, use, and processing of personal data, is governed by and construed in accordance with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, along with other applicable Indian law, and, where relevant to your use of our US operations, applicable US law. Nothing in this section limits any mandatory rights you have under your local law.

We keep your data only for as long as needed:

• Account and profile data is held while your account is active and for three years after closure.
• Medical and health data is retained for a minimum of seven years to comply with applicable laws.
• Communications are kept for three years.
• Consent records are held for seven years.

Once a retention period ends, data is securely deleted or anonymised.

We may update this policy from time to time. If we make significant changes, we will notify you by email or through a notice on the platform before the changes take effect.

For changes that require fresh consent, such as processing a new type of health data, or where the amendment affects the processing of your personal or health data, we will ask for fresh, explicit consent. Continued use of the Platform alone will not be treated as consent to such changes. The Last Updated date at the top of this page shows when it was most recently revised. Previous versions are available on request.

Have questions or want to exercise your privacy rights? We're here to help.