PlacidWay, LLC ("PlacidWay," "we," "us," or "our") respects the privacy of users, patients, prospective patients, website visitors, healthcare providers, and other users of our services. This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, how long we keep it, the choices and rights available to you, and how to contact us about privacy matters.
PlacidWay provides medical-tourism information and marketplace, communication, and care-coordination services. PlacidWay is not itself the medical provider for treatment arranged through independent clinics, hospitals, doctors, dentists, or other healthcare professionals.
Publish date: March 5, 2007 Modified date: Aug 31, 2026
| Topic | Summary |
|---|---|
| What we collect | Contact and account information; treatment interests and health information you choose to provide; communications and files; device, usage, cookie and location information; and provider/business information. |
| Why we use it | To provide the services you request, connect you with selected healthcare providers, communicate with you, secure and improve the platform, personalize services, comply with law, and market our services where permitted. |
| Who receives it | Healthcare providers you select, authorize, or matched via AI; vendors/processors that support our services; affiliates where necessary; professional advisers and authorities when required; and third parties at your direction. |
| Health data | We do not sell medical records for money. Medical records and treatment-inquiry content are used for care coordination and related service purposes, not for third-party targeted advertising. |
| Your choices | You may have rights to access, correct, delete, obtain a copy, object, withdraw consent, opt out of targeted advertising/sale/sharing, limit certain sensitive-data uses, or appeal a decision, depending on your location. |
| Cookies | You can manage non-essential cookies through the website privacy/cookie controls. Where required, we honor recognized opt-out signals such as Global Privacy Control or other universal opt-out mechanisms. |
| HIPAA | HIPAA applies only in specific covered-entity/business-associate contexts. Other health information may instead be protected by the FTC Act, state consumer-health laws, GDPR/UK GDPR, or other privacy laws. |
This Policy applies to personal information processed through PlacidWay services that link to or reference this Policy, including PlacidWay websites and affiliated sites controlled by PlacidWay, mobile applications, patient inquiry and Request for Information forms, provider marketplace features, messaging and communication tools, customer support, newsletters, referrals, and related digital services.
A separate or supplemental privacy notice may apply to a particular product, region, feature, event, employment relationship, or business relationship. If a supplemental notice conflicts with this Policy for the specific processing it covers, the supplemental notice controls for that processing.
This Policy does not govern the independent privacy practices of healthcare providers, travel companies, payment providers, websites, applications, or other third parties that are not controlled by PlacidWay.
PlacidWay, LLC is a Colorado limited liability company and is the controller or business responsible for personal information when PlacidWay determines why and how that information is processed.
PlacidWay, LLC
9800 Mount Pyramid Court, Suite 400
Englewood, Colorado 80112
United
States
Email: info@placidway.com
In some workflows, PlacidWay may process information on behalf of another organization under contract. When that occurs, the other organization may be the controller/business responsible for the relevant data, and its privacy notice may also apply.
When you ask PlacidWay to connect you with a healthcare provider, or you select a clinic, hospital, doctor, dentist, or other provider, PlacidWay may disclose information needed to respond to your inquiry or evaluate your request. The provider may then process your information for its own clinical, administrative, legal, and regulatory purposes.
Healthcare providers are generally independent organizations and may act as separate data controllers, businesses, covered entities, or other regulated entities under the laws that apply to them. Their privacy notices, medical-record rules, consent forms, retention requirements, and local laws may apply after they receive your information. PlacidWay does not control a provider's independent clinical recordkeeping or treatment decisions.
The information we collect depends on how you use PlacidWay. We may collect the following categories:
| Category | Examples |
|---|---|
| Identity and contact data | Name, email address, phone number, country, preferred language, account identifiers and similar contact details. |
| Treatment and health information | Treatment sought, symptoms, diagnosis, medical history, medications, test results, prior treatment, desired procedure, health-related preferences, medical records, images, reports, and other information you choose to provide. |
| Inquiry and care-coordination data | Preferred destination, budget or price range, timing, selected providers, questions, quote requests, consultation requests, travel-related needs, and case status. |
| Communications | Messages, chat transcripts, emails, SMS/WhatsApp messages where enabled, call or video-call metadata, customer-support records, feedback, complaints, and documents exchanged through the service. We will provide any legally required notice or obtain consent before recording calls where recording is used. |
| Account and profile data | Login credentials or authentication information, profile settings, preferences, saved providers or content, subscription choices and consent records. |
| Transaction and financial data | Payment status, billing details, transaction identifiers, invoices, refunds, and limited payment information where PlacidWay facilitates a payment. Full card data may be handled directly by payment processors rather than PlacidWay. |
| Device and usage data | IP address, browser and device type, operating system, app version, device identifiers provided by the operating system, pages/screens viewed, referring URLs, session activity, timestamps, crash/debug data and interactions with features. |
| Location data | Approximate location inferred from IP address and, if you enable a location feature in a mobile app, device location data consistent with the permission you grant. |
| Cookie and advertising data | Cookie identifiers, consent status, analytics events, campaign/referral data and information used for advertising or measurement, subject to the restrictions and choices in this Policy. |
| Media and files | Photos, videos, scans, medical images, identity or insurance documents, and other files you choose to upload. |
| Provider and business data | Professional name, organization, title, business contact details, credentials, licenses, specialties, facility information, service offerings, pricing and account/activity information for provider users. |
| Referral data | If you use a referral feature, limited contact information about the person you ask us to invite, subject to applicable consent and anti-spam rules. |
| Inferences and preferences | Preferences or likely interests inferred from searches, treatment interests, destination interests and interactions, used to personalize or route services. We do not use such inferences to make medical diagnoses. |
Health information requires heightened protection. Depending on the law, health information may include not only medical records and diagnoses but also information that reveals or permits an inference about health, such as treatment searches, appointment requests, page interactions, location associated with healthcare services, or other contextual information.
The U.S. Health Insurance Portability and Accountability Act (HIPAA) does not apply to every company that handles health-related information. HIPAA generally applies to covered entities and their business associates. PlacidWay's general consumer marketplace activities are therefore not automatically governed by HIPAA merely because a user provides health information.
If PlacidWay processes protected health information as a business associate for a HIPAA-covered entity under a valid PlacidWay User Agreement, PlacidWay will process that information in accordance with the applicable agreement and HIPAA requirements. Health information outside HIPAA may still be protected by the Federal Trade Commission Act, the FTC Health Breach Notification Rule, state consumer-health privacy laws, GDPR/UK GDPR, and other applicable laws.
Where a law such as the GDPR or UK GDPR requires a legal basis, PlacidWay relies on one or more of the following, depending on the processing:
| Basis | When it may apply |
|---|---|
| Contract / pre-contract steps | To provide a service you request or take steps you ask us to take before entering a contract. |
| Consent | For processing that requires consent, such as certain marketing communications, non-essential cookies, precise location, or other sensitive processing where consent is the appropriate basis. |
| Legitimate interests | For platform security, fraud prevention, service improvement, analytics, customer support and business operations where our interests are not overridden by your rights and interests. |
| Legal obligation | To comply with law, regulatory duties, tax/accounting obligations, valid legal process and recordkeeping requirements. |
| Vital interests | In limited circumstances where processing is necessary to protect someone's life or physical safety. |
| Special-category condition | For health or other special-category data, we also identify an applicable additional condition, such as explicit consent where appropriate, or another condition permitted by law. |
We may disclose personal information to the following categories of recipients for the purposes described in this Policy:
| Recipient | Purpose / limitation |
|---|---|
| Healthcare providers you select matched or authorize | To review inquiries or medical records, respond to questions, provide quotes or information, schedule consultations, and coordinate potential care. |
| Service providers / processors | Hosting, cloud storage, cybersecurity, communications, customer support, CRM, analytics, translation, document processing, payments, identity/security, email/SMS/WhatsApp delivery, and other vendors that process information for us under appropriate contractual restrictions. |
| Analytics and advertising partners | Limited device, cookie and interaction data where permitted by law and your choices. Medical records and treatment-inquiry form contents are not provided to these partners for targeted advertising. |
| Affiliates and controlled services | Where needed to operate a PlacidWay-branded or affiliated service and consistent with this Policy or a supplemental notice. |
| Professional advisers | Lawyers, auditors, insurers, accountants, consultants and similar advisers where necessary to provide professional services to us. |
| Government, regulators and legal recipients | When required by law, court order, subpoena or other valid process, or when reasonably necessary to protect rights, safety, security or prevent fraud or abuse. |
| Corporate transaction recipients | Potential or actual buyers, investors, lenders or transaction advisers in connection with a merger, acquisition, restructuring, financing, bankruptcy or sale of assets, subject to appropriate confidentiality and legal safeguards. |
| At your direction | Any person or organization you ask or authorize us to disclose information to. |
Privacy laws use terms such as "sell," "share," "targeted advertising," and "cross-context behavioral advertising" in ways that may include some disclosures for advertising even when no money changes hands. PlacidWay does not sell medical records for monetary consideration.
If PlacidWay engages in online advertising or analytics activities that are legally treated as a sale, sharing, or targeted advertising under applicable law, we provide the required notice and opt-out mechanism. Where required, we also honor recognized browser-based or device-based universal opt-out signals, such as Global Privacy Control.
We do not knowingly sell or share personal information of children or teenagers in a manner prohibited by applicable law. We do not use uploaded medical records or patient treatment-inquiry form contents for third-party targeted advertising.
PlacidWay and authorized service providers may use cookies, pixels, SDKs, local storage, log files and similar technologies to operate the services, remember preferences, measure performance, prevent fraud, understand usage and, where permitted, support advertising or campaign measurement.
| Technology purpose | How it is used |
|---|---|
| Strictly necessary | Authentication, security, session management, load balancing, consent preferences and core site functions. These generally cannot be disabled through our cookie tool because they are necessary to provide the requested service. |
| Functional | Remember language, location, display or other optional preferences and enable enhanced features. |
| Analytics / performance | Measure traffic, feature usage, errors and performance so we can understand and improve the service. |
| Advertising / measurement | Measure campaigns or personalize advertising where permitted. We do not intentionally send medical-record contents or patient inquiry-form contents to advertising partners. |
You can manage non-essential technologies through the privacy or cookie preferences control made available on the website or app. Browser settings may also allow you to delete or block cookies. Blocking some technologies may affect functionality. Where required by law, non-essential cookies are not activated until the appropriate consent is obtained.
Where applicable law requires recognition of Global Privacy Control or another approved universal opt-out mechanism, PlacidWay will process the signal as required for the browser/device from which it is received.
PlacidWay may use automated tools or artificial intelligence to assist with search, matching, routing, translation, summarization, customer support, content organization, fraud prevention, or service improvement. These systems may process information such as treatment interests, destination preferences, communications or other case information when necessary for the feature.
If you provide contact information, we may contact you about your inquiry, provider responses, appointments, account, security, support requests, service updates and other transactional or service-related matters. Depending on the feature and your choices, communications may occur by email, phone, SMS, WhatsApp or in-platform messaging.
Where consent is required for marketing or a messaging channel, we request that consent as required. You may unsubscribe from marketing emails through the unsubscribe link and may opt out of marketing text or messaging communications using the instructions provided in the message or applicable messaging terms. Opting out of marketing does not prevent us from sending necessary service, safety, legal or account communications.
If you use a PlacidWay mobile application, the app may process device information, app usage data, crash/performance data and account or case information. Certain optional features may request device permissions, such as:
You can manage device permissions through your operating-system settings. Denying a permission may limit the feature that depends on it but should not affect unrelated features.
We use administrative, technical and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration or disclosure. Depending on the system and risk, safeguards may include encryption in transit, access controls, authentication, logging, network protections, backups, vendor controls, staff training and incident-response procedures.
No internet, mobile, storage or transmission system is completely secure. We therefore cannot guarantee absolute security. You are responsible for protecting your account credentials and for notifying us if you believe your account or information has been compromised.
We investigate suspected security incidents and take steps to contain and remediate them. If an incident triggers a legal notification obligation, we will notify affected individuals, regulators, providers or other parties as required by applicable law. Depending on the data and our role, this may include state breach laws, the FTC Health Breach Notification Rule, HIPAA breach requirements when applicable, GDPR/UK GDPR, or other laws.
PlacidWay operates from the United States and connects users with providers and vendors in multiple countries. Your information may therefore be processed in countries whose privacy laws differ from those where you live.
Where GDPR, UK GDPR or another law restricts international transfers, we use an applicable lawful transfer mechanism. Depending on the transfer, this may include an adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, another approved contractual mechanism, a legally permitted derogation, or reliance on a recipient's valid participation in an approved data-transfer framework where available. We may implement supplementary technical, contractual or organizational measures where appropriate.
PlacidWay does not rely on the former EU-U.S. Privacy Shield as a transfer mechanism. If PlacidWay or a recipient relies on the EU-U.S. Data Privacy Framework or its UK/Swiss extensions, that reliance applies only while the relevant organization is validly certified and the framework is legally available for the transfer.
We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide services, maintain appropriate case and security records, comply with law, resolve disputes and enforce agreements. Because different information serves different purposes, we use category-specific retention criteria rather than a single retention period.
| Category | Retention criteria |
|---|---|
| Account/profile data | While the account is active and for a reasonable period afterward for account recovery, fraud prevention, dispute handling and legal obligations; then deleted or deidentified when no longer needed. |
| Patient inquiry and case communications | For the active case and afterward for a period justified by care-coordination history, user support, safety, dispute, audit and legal needs. Health sensitivity is considered when setting the period. |
| Uploaded medical records and attachments | Only as long as needed to facilitate the authorized provider review/case and meet applicable security, legal or contractual needs. We seek shorter retention where practical because of sensitivity. |
| Marketing data and preferences | Until you opt out or the marketing purpose ends. We may retain limited suppression information to ensure that an opt-out continues to be honored. |
| Security/fraud logs | For a period appropriate to detect, investigate and prevent security incidents, abuse or fraud, and longer when tied to an investigation or legal claim. |
| Transaction/accounting records | For the period required by tax, accounting, financial, anti-fraud or other applicable legal requirements. |
| Cookie/analytics identifiers | According to the applicable cookie/consent settings and the retention periods configured for the relevant technology, as described in our Cookie Policy or privacy preferences interface. |
| Deidentified/aggregated data | May be retained longer where it can no longer reasonably be linked to an individual and we commit not to reidentify it except where permitted for security or legal purposes. |
Depending on where you live and the law that applies, you may have some or all of the following rights:
You may submit a privacy request by emailing info@placidway.com with the subject line "Privacy Request" or through any privacy-request method PlacidWay makes available on the website or app. Please describe the right you want to exercise and the information or account involved.
We may need to verify your identity before fulfilling a request. Verification may require matching information we already hold or requesting additional information reasonably necessary to prevent unauthorized disclosure or deletion. We will not ask for more information than reasonably needed for verification.
Where applicable law permits an authorized agent to submit a request for you, we may require proof of the agent's authority and may also verify your identity directly. If we deny a request and applicable law provides a right to appeal, you may appeal by replying to our decision or emailing info@placidway.com with the subject line "Privacy Appeal."
We respond within the time required by applicable law. Some laws permit an extension for complex or multiple requests, in which case we will provide the required notice.
Residents of certain U.S. states, including Colorado and California, may have additional rights concerning personal data. Applicable laws may require disclosures about categories collected, purposes, recipients, sensitive information, sale/sharing/targeted advertising, retention and request methods. The categories and purposes described throughout this Policy are intended to provide those disclosures at a general level.
If PlacidWay's use of advertising or analytics technologies constitutes "sale" or "sharing" under an applicable state law, you may use the website's Privacy Choices / Cookie Preferences control or another offered opt-out method. Where required, we honor recognized Global Privacy Control or other universal opt-out mechanism signals.
If a state law requires consent before processing certain sensitive data, including health or precise geolocation data, PlacidWay will obtain the required consent before that covered processing. If a state law grants a right to limit use of sensitive personal information, PlacidWay will provide the required method to exercise that right.
Certain U.S. state laws regulate consumer health data that may fall outside HIPAA. Where such a law applies, PlacidWay will provide any required consumer-health privacy notice and obtain consent before collecting or sharing consumer health data when the law requires consent. Applicable rights may include the right to know or access consumer health data, delete it, withdraw consent, or appeal a denied request.
Consumer health data can be broader than a medical record and may include information or inferences associated with health conditions, treatments, reproductive or sexual health, biometric/genetic information, precise location near healthcare services, or other data defined by the applicable law.
PlacidWay services are intended for adults who can make or manage healthcare and travel inquiries. We do not knowingly invite children to create their own PlacidWay accounts or independently submit personal information in violation of applicable child-privacy laws.
A parent, legal guardian, or other legally authorized adult may submit information about a minor patient when seeking care for that child and when legally permitted to do so. In that situation, the adult represents that they have the authority required to provide the information and request the service. We apply heightened care to information about minors and limit its use to the purposes permitted by this Policy and applicable law.
If you believe a child has provided personal information directly to PlacidWay without the authorization required by law, contact us at info@placidway.com so we can review and take appropriate action.
If you use a feature to refer or invite another person, you should provide their contact information only if you are permitted to do so. We use the information to send or facilitate the requested invitation or referral. We do not add the referred person to ongoing marketing solely because you provided their contact information; any additional marketing consent will be obtained as required by law.
PlacidWay may link to healthcare providers, payment services, travel services, social platforms, video services, app stores or other third parties. If you follow a third-party link or use an external integration, that third party may collect information under its own privacy policy. PlacidWay is not responsible for the privacy practices of organizations it does not control.
Where PlacidWay uses APIs or third-party platform services, additional platform terms or policies may apply. For example, use of Google or YouTube API Services may be subject to Google's applicable terms and privacy policy. PlacidWay will comply with applicable API data-use restrictions, including limited-use requirements where they apply.
If PlacidWay is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets or similar transaction, personal information may be reviewed or transferred as part of that transaction where permitted by law. We will require appropriate confidentiality and privacy protections and provide notice when required by applicable law.
We may update this Policy to reflect changes in our services, technology, data practices, legal requirements or organizational structure. We will post the updated Policy and revise the "Last updated" date. If a change materially affects how we use sensitive information or your rights, we will provide additional notice or obtain consent where required by law. A Privacy Policy is a transparency notice; where law requires consent for a particular processing activity, we seek that consent separately rather than treating continued website use alone as consent.
If you have a question, complaint, or privacy request, contact:
PlacidWay, LLC
Attn: Privacy
9800 Mount Pyramid Court, Suite 400
Englewood, Colorado
80112
United States
Email: info@placidway.com
If GDPR or UK GDPR applies to you, you may also have the right to complain to the data-protection authority in the country where you live, work, or believe an infringement occurred. Residents of U.S. states may also have the right to contact their state attorney general or other designated privacy regulator.
We collaborate with internationally accredited hospitals and clinics to ensure the highest standards of safety, quality, and patient care.
Joint Commission International
International Organization for Standardization
COFEPRIS (Federal Commission for Sanitary Risk Protection - Mexico)
Turkey Ministry of Health
Dubai Healthcare City Authority (DHCC)
NABH (National Accreditation Board for Hospitals & Healthcare Providers - India)
Korea Ministry of Health & Welfare (MOHW)