Privacy Policy

1. Scope

This Privacy Policy explains how MedRouteGo handles information when you browse the website, explore public care information, create or use an account, submit or manage an application, or contact the operator. It does not govern the privacy practices of hospitals, clinicians, or other external websites and services.

2. Operator and contact

MedRouteGo is operated by Zean Ma, an individual based in China. It is not operated by a company. Contact the operator on WhatsApp at +86 176 2155 1700. Service address: Room 514-11, Building 9, Zone 2, Shenzhen Bay Tech-Eco Park, No. 3609 Baishi Road, High-tech Zone Community, Yuehai Subdistrict, Nanshan District, Shenzhen, China.

For privacy questions or requests about your information, contact care@medrouteglobal.com, WhatsApp, or use our Contact page.

3. Public browsing and technical information

You can browse public information without submitting an application. Choices made in the public exploration flow are kept in the current browser tab to provide context for that session. When you browse the website, hosting and security services may process technical request information, such as an IP address, request time, browser, or network data, to deliver pages, protect the service, and diagnose reliability issues.

The site uses browser storage and cookies for account sessions and language preferences. Cloudflare Turnstile runs when you submit an application. Read the Cloudflare Turnstile Privacy Addendum for information about its security signals.

4. Account and application information

When you create an account or submit an application, the current system may process account and session identifiers, applicant relationship, the patient’s country of residence, language preference, the stated care-planning goal, an administrative summary, preferred research region, separate Terms and privacy-processing consent records, optional contact and email preferences, application status, and related history. The application flow is for adults aged 18 or older only. The operator reports that real patient health records have not been submitted to the service. Application information linked to an account can still be personal information.

The current application is for administrative planning only. Do not enter patient names, diagnoses, symptoms, medical records, medicines, identity numbers, or other clinical details. The current service does not accept medical records. If a future feature collects patient health records, we will update this policy and provide any notice and choices required by law before that collection begins.

5. How we use information

• Create and secure accounts and maintain sessions.
• Receive, review, update, and respond to applications.
• Research public information within the request scope and show sources, verification status, unknowns, and application updates.
• Keep consent, security, and operational records needed to run the service.
• Send application status messages when you enable that option.
• Detect automated abuse. The application flow sends a Turnstile response to Cloudflare, and the service verifies that response before accepting a submission.

6. Access, service providers, and disclosures

The individual operator may access application information to prepare the requested provider and cost research report. The system uses Supabase for account and application services. Cloudflare Turnstile processes technical signals to check submissions for automated abuse. These providers process information to provide their services, subject to their own terms and privacy information.

Under the current service, we do not send an applicant’s identity, application, medical details, or documents to a hospital, doctor, or other medical provider. Provider information is checked through general enquiries that do not identify an applicant. If this changes, we will explain the recipient, purpose, and information before any disclosure, obtain any consent required by law, and update this policy. Information may also be disclosed when required by law or needed to protect the service and its users. We do not sell personal information.

7. International processing

The service is operated from China and primarily supports users in Indonesia, Malaysia, Vietnam, and Bangladesh. The website can be accessed from other countries around the world. Account and application data are stored using a Supabase project configured in Southeast Asia, as advised by the operator. The operator may access and manage information from China. Hosting, security, support, and backup services may process or retain technical or account data in other locations as needed to provide their services.

Depending on your location and the service activity, applicable requirements may include China’s Personal Information Protection Law, Indonesia’s Personal Data Protection Law, Malaysia’s Personal Data Protection Act 2010 as amended, Vietnam’s Personal Data Protection Law, and Bangladesh’s data protection requirements. These references do not decide whether a law applies to a particular person or activity. This policy does not remove rights that local law gives you.

8. Retention and account controls

You may request account deletion from your account controls. When you submit a deletion request, account access stops. Application data then remains in a 30-day recovery period before deletion. This period means deletion is not immediate. You may also contact the operator to request access, correction, or deletion of personal information.

The operator’s intended retention period for account and application information is up to one year after the last relevant activity unless you request deletion earlier, a longer period is required by law, or information must be retained to resolve a dispute or protect legal claims. The current system does not automatically delete every submitted application, security log, or provider backup after one year. Some technical logs and backups may follow separate retention schedules set by service providers.

Account controls also support application data export. The operator may retain limited records where law permits or requires it.

9. Security

The service uses account controls, access restrictions, and automated submission checks to help protect information. No online service can guarantee absolute security. The operator must confirm and document the production security and incident-response measures before final publication.

10. Children and guardians

MedRouteGo is not for people under 18. You may use the application only if both you and the patient are at least 18. The application form asks you to confirm this, but the service does not independently verify age. Do not submit an application or another person’s information for a minor.

11. Changes

We may update this policy when the service or its legal requirements change. The final policy should show its effective date. Where required, we will notify users of material changes.