Privacy policy

Data controller

The controller is [Company name], [legal form], [Address of the registered office], trading as Airport Medical. For any question about your data, write to contact@airportmedical.com or to our data protection officer: [DPO contact details, if one has been appointed].

[Paragraph to keep if the company is established in Morocco:] Our processing operations are also governed by Moroccan law no. 09-08 on the protection of individuals with regard to the processing of personal data. Health data being sensitive data under this law, their processing has been authorised by the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP): [reference of the CNDP authorisation].

The data we collect

Through the quote form

• Your contact details: name, phone number, email address and your relationship to the patient. For insurers and assistance companies: the company name and the case number.
• The transport: place of departure and destination, desired date, any accompanying person.
• A minimum of health information: the patient’s condition in a few words and their mobility (seated, lying down on a stretcher, in an incubator). For insurers: whether a guarantee of payment has been issued.

We do not ask for a detailed diagnosis in the form. Please do not send medical records through the form or by ordinary email: if they are needed, our medical team requests them from the treating doctor through [secure channel used to exchange medical documents].

When we organise a transport

The patient’s file then contains the medical information needed for a safe transport, exchanged with the treating doctor, identity and travel documents, and the information needed for billing. These data are handled by our coordinators and our medical team only.

When you browse the website

Technical data such as the IP address, the type of browser and the pages viewed, to the extent needed for the secure operation of the website.

Why we use your data, and on what legal basis

• Answering your request and preparing a quote: steps taken at your request before a contract (Article 6(1)(b) GDPR).
• Health information in the quote form: your explicit consent (Article 9(2)(a) GDPR), given by ticking the box in the form. You can withdraw it at any time; this does not affect what was done before.
• Urgent situations where the patient is physically or legally unable to consent: the protection of the patient’s vital interests (Articles 6(1)(d) and 9(2)(c) GDPR).
• Organising and carrying out the transport: the performance of the contract and the provision of medical care by professionals bound by professional secrecy (Articles 6(1)(b) and 9(2)(h) GDPR).
• Accounting and legal obligations once a transport has been carried out (Article 6(1)(c) GDPR).
• Security of the website and contact with insurers’ case managers: our legitimate interest (Article 6(1)(f) GDPR).

When a relative fills in the form for the patient, they confirm that they act with the patient’s agreement, as their legal representative, or because the patient is not able to give their agreement.

Who receives your data

Only the people in charge of your request, bound by confidentiality: our coordinators and our medical team. When a transport is organised, and only for what each one needs, data may be shared with:

• the treating doctor and the receiving hospital;
• the air operator and, on a scheduled flight, the airline’s medical service, which approves the transport;
• the ground ambulance services;
• the insurer or assistance company that has asked us to carry out the transport;
• the authorities that require it for flight permits, border crossings or health formalities.

Our technical providers process data on our behalf, within the limits of their tasks: SeekaHost Ltd for hosting, on OVHcloud servers located in [country of the server], and [email provider] for our email. Your data is never sold and never used for advertising.

Transfers outside the European Union

A repatriation from Africa or from another country outside the European Union means that some data must be sent to hospitals, operators and authorities in that country. These transfers are limited to what the transport requires, and rely on Article 49 GDPR: they are necessary for the performance of the transport you have asked for, or for the protection of the patient’s vital interests when they cannot consent.

Our host is established in the United Kingdom, which benefits from an adequacy decision of the European Commission. [Transfers linked to the email provider, and the safeguards that apply, to be completed.]

How long we keep your data

• Quote requests that do not lead to a transport: one year after our last exchange, then deleted.
• Copies of form submissions stored on the website: deleted after 30 days, once transferred to our case management system.
• Files of patients transported: for the duration of the transport, then archived for the periods required by the rules that apply to our activity [periods to be specified].
• Invoices and accounting documents: for the periods required by accounting and tax law.
• Technical logs: up to one year, on a rolling basis.

Security

The website uses an encrypted connection (HTTPS). Access to the files is restricted to the people who need it, and the medical information is reserved for our medical team. Patient files are kept in [case management system and its host]. We ask you not to send medical documents by ordinary email, and we tell you how to send them securely when they are needed.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time. To exercise these rights, write to contact@airportmedical.com. We reply within one month, which may be extended in the cases provided for by the GDPR.

If you consider that your rights are not respected, you can lodge a complaint with a supervisory authority, in particular in the country where you live or work: the CNIL in France, for example. [If the company is established in Morocco: you can also contact the CNDP.]

Minors

Requests concerning a minor are made by a parent or legal guardian, who exercises the minor’s rights on their behalf.

Cookies

This website only uses cookies that are strictly necessary for it to work: pll_language, which remembers the language you chose (kept for one year). We do not use audience measurement, advertising or social media cookies, which is why no cookie banner is displayed.

Changes to this policy

This policy may change to reflect changes to the website or to the regulations. The version published on this page is the one that applies.