Privacy Policy

Data Controller

CNHeal AI, registered in the European Union. Contact: privacy@CNHeal.ai

Data We Collect

• Identity data: name, email, nationality, passport country
• Health data: medical records, diagnoses, medications (special category under GDPR Art. 9)
• Travel data: intended arrival dates, city preferences
• Payment data: processed by Stripe/PayPal; we do not store full card details

Legal Basis for Processing

• Consent (GDPR Art. 6(1)(a)) for marketing and optional features
• Contract performance (Art. 6(1)(b)) for service delivery
• Legitimate interest (Art. 6(1)(f)) for service improvement

Your Rights (GDPR)

• Right to access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to data portability (Art. 20)
• Right to restrict processing (Art. 18)
• Right to object (Art. 21)

Data Storage

All personal and health data is stored on EU-based servers. Data is encrypted at rest and in transit. We do not sell user data.