Privacy Policy & Medical Disclaimer
Last Updated: October 15, 2026 · Controller: Thamel International Medical & Travel Health Clinic Pvt. Ltd.
We practice strict data minimization: when you request an appointment online, your contact and visit details are stored solely in our clinic’s secure Google Workspace Calendar and email (`bookings@thamelclinic.org`) to manage your appointment. We never sell or share patient data with advertising networks.
1. What Information We Collect
- Appointment Booking Data: Name, email address, phone/WhatsApp number, nationality, preferred date/time window, optional symptom summary, and optional travel insurance provider name.
- General Contact Inquiries: Name, email, subject, and message sent via `/contact`.
- Analytics & Technical Logs: Anonymized page views and conversion clicks (via Google Analytics 4 with IP anonymization) and standard anti-abuse IP rate-limiting logs in Firebase Cloud Functions.
2. How & Where Your Data Is Stored (Google Ecosystem)
Appointment requests are processed by Firebase Cloud Functions (`asia-south1`) and written directly as events on our clinic’s access-restricted Google Workspace Calendar (`bookings@thamelclinic.org`), with confirmation emails sent via Gmail API. No public patient portal or third-party marketing database is used.
3. Data Retention & Your Rights (GDPR & International Visitors)
Online booking calendar entries are retained for 90 days for operational and insurance-claim verification purposes, after which they may be archived or deleted upon request. You may request a copy, correction, or deletion of your booking data at any time by emailing info@thamelclinic.org.
4. Google reCAPTCHA v3 Disclosure
Our booking and contact forms are protected against automated spam by Google reCAPTCHA v3. Use of reCAPTCHA v3 is subject to the Google Privacy Policy and Terms of Use.
5. Medical & Emergency Disclaimer
All health guides, articles, pricing tables, and symptom triage tools on thamelclinic.org are provided for general educational orientation for international travelers in Nepal and do not constitute a personal medical diagnosis or doctor–patient relationship until you are examined in person by a licensed physician.
Emergency Guidance: Thamel Clinic is an outpatient primary and travel medicine clinic open daily from 08:00 to 20:00 NPT. We are not a 24/7 inpatient hospital emergency department. For life-threatening emergencies, call Nepal Ambulance at 102 or proceed immediately to the nearest 24/7 hospital ER (CIWEC Hospital Lazimpat, TUTH Maharajgunj, Norvic International Hospital, or Grande International Hospital).
Your Medical Data
Medical information is the most sensitive data we handle — your history, your conditions, your test results. The confidentiality obligation is absolute: shared with your treating team, shared with others only with your authorization (insurer claims, specialist referrals), never sold or used for marketing. The trust is foundational — without it, patients do not share what the doctor needs to know.
Data protection commitments
- Medical records — confidential, access-restricted, retained per requirements
- Insurance claims — shared only as needed for your claim
- Website data — anonymized analytics, no advertising trackers
- Your rights — access, correction, and deletion requests honored
- Secure transmission — HTTPS encryption for all data
The Website Data Layer
Website data is separate from medical data — the analytics that track which pages are read are anonymized and do not connect to your medical record. The forms you submit (contact, intake, booking) become part of your patient file only when you become a patient; website browsing remains anonymous.
What data does the clinic collect?
Contact details (name, phone, email), medical information (history, medications, allergies — necessary for care), insurance details (for claims documentation), and website analytics (anonymized usage data). Medical data is confidential and shared only for your care.
Is my medical information confidential?
Yes — medical records are confidential and shared only with your treating team and parties you authorize (insurer for claims, specialists for referrals). We do not sell or share medical data for marketing.
What analytics does the site use?
Privacy-safe Google Analytics 4 with IP anonymization to measure page views and appointment bookings. No advertising trackers, no marketing pixels, and no medical form data is ever sent to analytics.
How is my data protected?
Encrypted transmission (HTTPS), secure storage, access limited to clinical staff, and retention only as long as medically/legally required. Data protection practices meet international standards for medical information.
Can I request my data or deletion?
Yes — contact the clinic to access your records, request corrections, or ask about deletion. Medical records have retention requirements we must follow, but non-medical data can be removed on request.
