Privacy Policy

1. Who We Are

This Privacy Policy explains how personal information is collected, used, disclosed, stored, and otherwise processed through royalelixora.com and its enquiry forms.

The Website presents services associated with Royal Elixora for Tourism Services LLC (Reg. No. 32417), which coordinates travel, accommodation, transport, tourism logistics, and services it actually contracts to provide, and MedicoRoyal Company LLC (Reg. No. 17881), which coordinates clinical aspects of cases and other services it is legally authorized and contractually responsible to provide.

Royal Elixora for Tourism Services LLC (Reg. No. 32417) is the controller of the personal information collected through this Website and its enquiry forms, and determines the purposes and means of that processing. In this Policy, “we,” “us,” and “our” refer to Royal Elixora for Tourism Services LLC.

Where an enquiry requires clinical assessment or case coordination, relevant information is shared with MedicoRoyal Company LLC (Reg. No. 17881), which is responsible for its own processing in that role, as described in Section 5.1. Each entity is responsible for the obligations it undertakes under applicable agreements and law.

Independent hospitals, clinicians, diagnostic facilities, and other suppliers remain responsible for their own professional services and obligations, subject to applicable law and the relevant agreements.

2. Information We Collect

2.1 Patient, family, and referral enquiries

• Full name, email address, telephone or WhatsApp number, country, and preferred language.
• Whether the enquiry concerns the submitter or another person; medical specialty or procedure of interest; mental-health enquiry indicator; and type of Weekend Health Assessment requested, where applicable.
• Tourism interests or requested experiences, referral code or partner name, and free-text message where the form provides one.
• Form type, audience category, submission page, submission date and time, and operational status.

2.2 Institutional partner enquiries

• Organization name and type; contact person's name and professional role; work email; country or region of operation.
• Credentialing stage, credentialing requirements or related notes, message content, form category, submission date, time, and operational status.

2.3 Technical and security information

The Website and its service providers process limited technical information needed to deliver the Website, validate form submissions, prevent abuse, maintain security, and diagnose errors. We do not store your IP address or your browser user-agent string, and we do not forward your IP address to Cloudflare for form verification. Our hosting provider and Cloudflare process request metadata, including timestamps and connection information, in order to deliver and secure the Website.

2.4 Medical information

General enquiry forms are not intended to collect medical records, detailed medical histories, prescriptions, diagnostic images, or other sensitive clinical documents. Please do not submit such information through general enquiry forms.

Selections such as a medical specialty, procedure, mental-health enquiry, or assessment preference may reveal or permit inferences about a person’s health. Free-text messages may also contain sensitive information. Where you reach a form from a specific programme or assessment page, the form adds a short line to the message identifying that programme or assessment so that your enquiry can be routed correctly. We seek to minimize sensitive information and will request additional clinical documentation only through an appropriate process when required for case assessment or coordination.

3. How We Use Information

Subject to applicable legal requirements and the approved lawful basis for each processing activity, personal information may be used to:

• Receive, assess, classify, and respond to enquiries; communicate with patients, families, referral partners, and institutional partners.
• Determine the type of service or partnership requested; coordinate follow-up and, where appropriate, communication with healthcare providers or service suppliers.
• Assess whether additional information is required for case review; manage service enquiries and arrangements that proceed beyond the initial enquiry stage.
• Protect forms against automated submissions, fraud, misuse, and security threats; maintain operational records and internal workflows.
• Meet applicable legal, regulatory, contractual, and recordkeeping obligations; and establish, exercise, or defend legal claims where permitted by law.

A business relationship does not automatically authorize unrelated uses of personal information. The lawful bases on which we rely are described in Section 6.2. Where processing relies on your consent, consent is obtained and managed as required by applicable law.

4. Health-Related Information and Consent

Certain enquiry fields may reveal health-related information, including mental-health interests, medical specialties, requested procedures, and assessment preferences. We process this information in order to receive, assess, and respond to your enquiry, and to take steps at your request before any service arrangement is made. The lawful bases on which we rely are described in Section 6.2.

Please do not provide medical documents or detailed medical histories through general enquiry forms. If additional clinical information is required, we will provide instructions for an appropriate submission process.

5. Who May Receive Information

5.1 Authorized personnel and MedicoRoyal Company LLC

Access is granted to authorized personnel who need the information for enquiry handling, case coordination, clinical review within their professional role, partnership management, or administrative support, and is restricted according to role and operational necessity.

Where an enquiry requires clinical assessment or case coordination, relevant information is shared with MedicoRoyal Company LLC (Reg. No. 17881). MedicoRoyal is a separate legal entity and is responsible for its own processing of that information. Only the information needed for the clinical aspects of the enquiry is shared.

5.2 Airtable

Airtable is our primary operational record system. Form information is stored in the relevant Airtable base and table. Access is limited to named collaborators; there is no public or unauthenticated link to these records.

5.3 Resend and Google Workspace

We use Resend for email delivery and Google Workspace for business email. Enquiry information is processed to send internal notifications and acknowledgement messages. Patient, family, referral, and other non-institutional enquiries are routed to [email protected], and institutional partner enquiries to [email protected].

Automated acknowledgement emails do not contain clinical details. Internal notifications contain the enquiry details needed to process the enquiry.

5.4 Cloudflare Turnstile and hosting providers

Cloudflare Turnstile processes technical information required to verify form submissions and prevent automated abuse. The Website does not store your IP address and does not forward it to Cloudflare for this verification. Turnstile runs in an embedded frame and may use its own technical storage under Cloudflare’s domain as part of its service.

The Website is hosted on DigitalOcean App Platform, in DigitalOcean’s Frankfurt region (FRA1) in Germany. DigitalOcean processes technical information needed to deliver, secure, and maintain the Website. Cloudflare also provides content delivery and DNS for the Website and processes technical request data in that role across its global network.

5.5 Healthcare providers and other service suppliers

Where appropriate and legally permitted, relevant information may be shared with a hospital, clinician, diagnostic facility, or other service provider for case assessment, care coordination, service availability, or fulfilment of a requested arrangement. Information will be shared only for an appropriate purpose and with a lawful basis, subject to any required consent, authorization, confidentiality obligation, or other legal safeguards.

5.6 Legal and other permitted disclosures

Information may be disclosed where required by applicable law, valid legal process, or a competent authority, or where disclosure is otherwise lawfully necessary to protect rights, safety, or legitimate legal interests. We do not intend to make personal information publicly available through enquiry forms or public-facing databases.

6. International Processing and Transfers

Royal Elixora serves an international audience. Some of the service providers that help us run the Website and handle enquiries process information outside Egypt and outside the country in which you are located, including in the United States. The providers involved are listed below.

6.1 Service providers and where they process information

DigitalOcean and Cloudflare are companies based in the United States. DigitalOcean processes the Website’s technical data in Germany, as shown above.

6.2 Legal basis for transfers to these providers

We transfer personal information to Airtable, Resend, Cloudflare, Google Workspace, and DigitalOcean only where a lawful basis for the transfer exists under the data-protection law that applies to the processing. That includes Egypt’s Personal Data Protection Law (Law No. 151 of 2020) and, where it applies to you, the law of your own country or region. Depending on the circumstances, we rely on one or more of the following:

• Handling your enquiry or arrangement. The transfer is needed to take steps at your request before a service arrangement is made, or to carry one out. We cannot receive, record, and respond to your enquiry without storing it in Airtable, sending notification and acknowledgement emails through Resend, and verifying the form through Cloudflare Turnstile.
• Written processor terms and transfer safeguards. Airtable, Resend, Cloudflare, and DigitalOcean act as service providers on our behalf. They may use the information only to provide their services to us, under written data-processing terms. The transfer is also covered by a safeguard recognized by the applicable law, such as standard contractual clauses or an equivalent mechanism, together with any authorization or notification required by the Egyptian Personal Data Protection Centre.
• Another basis the law allows. Where the law permits it, for example to establish, exercise, or defend legal claims.

6.3 Limits and your choices

We limit what is sent to each provider to what its role requires. You can ask us for more information about the safeguards that apply to a particular provider. Where we rely on your consent, you can withdraw it at any time using the contact details in Section 14. Withdrawal does not affect processing that took place before you withdrew, and it may mean we can no longer handle your enquiry.

7. Data Retention

Personal information is retained only for as long as necessary for the purposes for which it is processed, subject to applicable legal, regulatory, contractual, and recordkeeping requirements.

7.1 Retention period

We keep enquiry records for 12 months. This covers patient, family, referral, and institutional partner enquiries, and the related notification and acknowledgement emails. The 12 months run from the date of the last activity on the enquiry. When the period ends, we delete the records from Airtable and our mailboxes, or irreversibly anonymize them, unless a longer period applies under Section 7.2.

The 12-month period is an operational commitment that we have set for ourselves. It is not a period prescribed by law. We apply it through a monthly internal review, prompted by a recurring reminder and carried out by the company’s physicians. Records that have reached the end of their retention period are deleted or irreversibly anonymized at the next monthly review.

Airtable keeps a 14-day edit history, so a deleted record may remain visible in that history for up to 14 days. Technical logs and backups held by service providers are removed in the ordinary course of the provider’s own cycles.

7.2 Longer retention and deletion requests

Some information may need to be kept longer where the law requires it, where it is needed to establish, exercise, or defend legal claims, or where another lawful reason applies. You can ask us to delete your information before the 12 months end; see Section 9. Deletion requests may be subject to legal requirements and technical limitations relating to backups, security records, or third-party systems.

8. Security

We use appropriate technical and organizational safeguards to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

Safeguards in place include server-side processing of all form submissions, with no service credential exposed to the browser; server-side validation of every submitted value; server-side enforcement of automated-abuse verification; storage of service credentials only in our deployment platform’s encrypted environment store and our own credential store, and never in application source code; validation of user-supplied reply addresses to prevent email header injection; restriction of operational records to named collaborators, with no public or unauthenticated link; and acknowledgement emails constructed so that clinical details cannot be included.

No electronic system or method of transmission can be guaranteed completely secure. We review and maintain these safeguards proportionate to the nature of the information and the risks involved.

9. Your Rights and Privacy Requests

Depending on the laws applicable to the processing, you may have rights to request access to, correction of, deletion of, or restriction of the use of personal information; object to certain processing; withdraw consent where processing is based on consent; request a copy where data portability applies; or complain to a competent data protection authority.

The availability and scope of these rights depend on applicable law and the circumstances of the request. To make a privacy request, contact [email protected]. Describe your request and provide enough information to identify the relevant records. We may request reasonable additional information to verify identity or authority to act for another person.

Requests will be handled within the periods required by applicable law, and we will explain any lawful limitations or reasons for refusing a request. Privacy requests are received at [email protected] and handled by the company’s physicians, who are responsible for verifying identity or authority to act, coordinating with the relevant systems, and responding within the applicable deadlines.

10. Children and Representatives

The Website is intended for individuals making medical tourism, service, or institutional partnership enquiries. A parent, legal guardian, or other authorized representative may submit an enquiry on behalf of another person where permitted by applicable law.

Please do not submit a child’s sensitive medical information through a general enquiry form. Where processing involves children or another person’s personal information, any required authority, consent, or additional safeguard must be obtained in accordance with applicable law.

11. Cookies and Analytics

The Website does not set cookies. It uses no analytics, advertising, or tracking service, including Google Analytics, and does not measure your use of the Website through cookies or similar technologies. Because the Website uses no cookies, it does not display a cookie banner or ask you to choose cookie settings. The essential technical and security functions required to operate the forms and protect against misuse do not rely on cookies.

If we introduce analytics or other non-essential cookies or identifiers in future, we will update this Policy and the Cookie Notice before the change takes effect and, where the law requires it, ask for your consent first.

Our Cookie Notice describes this in more detail.

12. Third-Party Websites and Services

The Website may contain links to external websites or services operated by third parties. We are not responsible for the privacy practices of external websites we do not control. Their own privacy notices and terms may apply when you visit or use them. A link does not by itself constitute an endorsement or guarantee of a third party’s services.

13. Changes to This Privacy Policy

We may update this Policy to reflect changes in our services, Website functionality, data-processing arrangements, service providers, or legal requirements. The latest version will be published with an updated effective date. Where required by applicable law, we will provide additional notice or seek renewed consent before implementing material changes.

14. Contact Us

For privacy-related questions or requests, contact [email protected].

Royal Elixora for Tourism Services LLC (Reg. No. 32417), Smouha, Alexandria, Egypt, is the controller of personal information collected through this Website. MedicoRoyal Company LLC (Reg. No. 17881) is responsible for its own processing in connection with clinical case coordination. You may also have the right to complain to a competent data protection authority, as described in Section 9.