Privacy policy

This policy explains what SergiPathway (Pvt) Ltd collects, why, who can see it, and how long we keep it. It covers this website and the patient portal.

What we collect

• Contact details you give us: name, email address, phone number and the country you are travelling from.
• The procedure you are asking about and anything you tell us about your situation.
• Medical documents you choose to upload: scans, laboratory reports, discharge summaries, prescriptions.
• Messages you exchange with your coordinator through the portal.
• Basic technical information needed to run the site securely, including the IP address a request came from, used for rate limiting and for the audit log.

Why we hold it

To answer your enquiry, to prepare an estimate, to pass your case to a hospital or surgeon for review with your agreement, and to arrange your travel and stay. We do not sell personal data, and we do not use it for advertising.

Who can see it

The coordinator assigned to your case, and where necessary a partner with an administrator account. Where you agree to a case review, the treating doctor or hospital receives the documents relevant to that review. Every time a medical file is opened, the account that opened it is recorded in an audit log.

How it is stored

Uploaded documents are stored outside the public website, under randomly generated filenames, and are only served through an authenticated request. They are scanned for malware before anyone can open them. Data is held on servers in the hosting provider's data centre; message and case records are held in a PostgreSQL database with access restricted by account role.

How long we keep it

• Enquiries that do not proceed: 12 months, then deleted.
• Medical documents: 90 days after your case is marked completed or closed, unless you ask us to keep them longer.
• Case and message records: 5 years, for the reason that questions about a past coordination can surface long after the trip.
• Audit log entries: 2 years.

Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to the contact address in the footer and we will respond within 30 days. If you are in the EU or the Gulf, we handle requests to the standard your own law would expect, whether or not Pakistani law currently requires it.

Children

Where a patient is under 18, we deal with a parent or legal guardian, and the account belongs to that adult.