Privacy policy

ClinicsCheck helps people find licensed clinics and talk to them. It is run by Opaline Clinique Limited. This policy covers the website clinicscheck.com and the ClinicsCheck app for iPhone and Android.

• We do not sell personal data, show ads, or track you across other companies’ apps and websites.
• Clinics only see what you send them in a chat, with your first name. Never your email or phone number.
• Phone numbers and email addresses typed into chats are hidden on both sides.
• You can delete your account at any time, in the app or on the website.

Opaline Clinique Limited, a company registered in England and Wales, operates ClinicsCheck and is the controller of the personal data described here. For any privacy question or request, email privacy@clinicscheck.com. Related documents: Terms of Use and Clinic Terms of Service.

Account

Your email address, your name, and a mobile number if you add one. If you sign in with Apple, Apple may give us a private relay address instead of your real email. We also keep an account id, when you created the account and when you last signed in.

What you are looking for

The treatment, city and timing you choose, and where you are travelling from if you tell us. Because this can say something about your health, we treat it as sensitive and use it only to show you clinics and to pass it to the clinics you choose to message.

Chats with clinics

The messages you send and receive, when they were sent and read, and the clinics you saved. A clinic sees your first name, the treatment and timing you gave, where you are travelling from, and your messages in that chat.

Online status

While a chat is open we record when you were last active, rounded to the minute, so the other side can see whether you are online. Clinics only see this for chats you started with them.

Reports and blocks

If you report or block a conversation, we keep the report, the reason you gave and the recent messages so our team can review it.

Clinic account

The same sign-in details, the listing you manage, your plan, and the date you accepted the Clinic Terms (with the IP address it was accepted from).

Verification

A one-time code we email to an address at the clinic's own website, and when ownership was confirmed.

Your page

The trading name, description, languages, procedures, prices and photos you add, and the offers you publish. Once the clinic is verified these are public on your clinic page and in the app. Private fields, such as the clinic email and website you give us, are never shown to patients.

Studio

Posts, clinic tour photos and team profiles (names, roles, short bios and photos) that the clinic chooses to publish. Clinics confirm their posts show no patients and no before-and-after results. We count how many times each post is opened, without recording who opened it.

Payments

Gold and Elite plans are billed by Stripe. Stripe holds card details; we receive a customer reference and the subscription status.

The apps collect the account, search and chat information described above, and, for clinic accounts, the photos a clinic chooses to post. They never read the photo library by themselves: the system picker shares only the photos the clinic selects. They do not use your location, contacts, camera or microphone. They contain no advertising or third-party analytics, and they do not track you. Your sign-in is kept in the iPhone Keychain or, on Android, in encrypted storage protected by the Android Keystore. Some pages, such as these policies, open in an in-app browser view.

Analytics

If you accept analytics cookies, Google Analytics records which pages you visit, with your IP address anonymised. It stays off until you agree, and refusing changes nothing about how the site works.

Help assistant

Questions you type into the “Need help?” assistant may be sent to OpenAI to write an answer. Do not put medical or personal details in it. It is not part of the app.

Cookies and storage

A session cookie keeps you signed in. Local storage on your device holds your theme, cookie choice and some saved state.

• To run your account and your chats: performing our agreement with you (the Terms).
• Health-related details you choose to share, such as a treatment or what you write to a clinic: your explicit consent, which you give by entering it. You can withdraw it by deleting the chat or your account.
• Keeping the service safe: reviewing reports, stopping abuse and spam, and security logs: our legitimate interests.
• Billing clinics and keeping records: our agreement with the clinic and our legal obligations.
• Analytics on the website: your consent.

We tell our own team when a new account is created, so we can welcome clinics and spot misuse. We do not use your data for advertising, and we never make automated decisions that have legal or similar effects on you.

We share personal data only with the services that run ClinicsCheck, under contracts that protect it:

Vercel

Hosts the website and the app's server, and keeps short-lived request logs.

Neon

Our database, where accounts, chats and clinic pages are stored.

Resend

Sends sign-in codes, chat notifications, verification emails and, to clinics, emails about their plan and free trial.

Stripe

Billing for clinic plans.

Apple and Google

Sign in with Apple and Google sign-in, if you use them. Google also supplies the ratings, reviews and photos we show for some clinics, and Google Analytics on the website if you accept it.

OpenAI

Answers questions in the website's help assistant.

WhatsApp (Meta)

Our support line, only if you choose to message us there. Please don't send medical details; conversations with clinics stay in the ClinicsCheck chat.

Clinics receive only what you send them in a chat. We may also disclose data if the law requires it, or to protect someone’s safety.

Some of these providers process data in the United States or other countries outside the UK. Where they do, we rely on the UK’s adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Agreement and Addendum to protect it.

• Your account, saved clinics and chats: until you delete them or your account.
• When a patient deletes their account, their chats and messages are deleted. When a clinic deletes its account, its offers, page edits and photos are deleted, and patients keep their copy of past chats.
• Sign-in and verification codes: they expire within minutes. Online status: overwritten each time you are active.
• Google ratings and reviews: refreshed from Google and deleted if not refreshed within 35 days.
• Reports: as long as needed to deal with them and protect users.
• Billing records: as long as tax law requires.
• Request logs: kept briefly by our host for security and diagnostics.

In the app, open Account and tap Delete account. On the website, delete it from your account page (clinics: Plan & billing in the clinic dashboard). Deletion is immediate and cannot be undone; any clinic plan is cancelled first. If you signed in with Apple, we also ask Apple to revoke ClinicsCheck’s access. You can also email privacy@clinicscheck.com and we will do it for you.

Under UK GDPR, the EU GDPR where it applies, and Turkey’s KVKK, you can ask for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, take it to another service, and withdraw consent at any time. Email privacy@clinicscheck.com; we reply within one month. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

ClinicsCheck is for adults. You must be 18 or over to create an account, and we do not knowingly collect data from children. If you think a child has given us personal data, email privacy@clinicscheck.com and we will delete it.

Data is encrypted in transit, sign-ins use one-time codes or Apple and Google rather than passwords, and access to our systems is limited to the people who need it. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Our clinic list reproduces national health-authority registers: T.C. Sağlık Bakanlığı (Türkiye, edition dated 20 Ağustos 2026, 4,810 facilities), and 보건복지부 (South Korea, edition dated 2026-07-21, 4,168 facilities), and Centers for Medicare & Medicaid Services (United States, edition dated 2026-08-10, 12,059 facilities), and Care Quality Commission (United Kingdom, edition dated 26 August 2026, 5,406 facilities), and Rijksinstituut voor Volksgezondheid en Milieu (Netherlands, edition dated March 2025, 250 facilities), and Ministerio de Sanidad (Spain, edition dated 2026-09-01, 53,455 facilities), and Ministère du Travail, de la Santé, des Solidarités et des Familles (France, edition dated 2026-05-12, 11,518 facilities), and Statistisches Bundesamt (Germany, edition dated 2024-12-31, 2,748 facilities), and Centrum e-Zdrowia (Poland, edition dated 2026-08-31, 32,986 facilities), and Nemzeti Egészségbiztosítási Alapkezelő (Hungary, edition dated 2026-07, 936 facilities), and Ústav zdravotnických informací a statistiky ČR (Czechia, edition dated 2026-09-01, 12,124 facilities), and هيئة الصحة بدبي (United Arab Emirates, edition dated 2023-12-25, 1,682 facilities). Where a register publishes a facility’s phone number, address or email we hold it to verify ownership, but we do not publish it. Ratings, reviews and photos from Google are shown with attribution. Prices are set by clinics and labelled as such.

We contact clinics listed on the registers to tell them about their free page: by visiting in person, by email to a business address, and by phone or WhatsApp only where the rules for that channel allow it. To do that, and to stop contacting anyone who asks us to, we keep a short record for each clinic we contact:

• the clinic’s name, district, type and the business phone number the health register publishes;
• the date and channel of each contact, what the clinic decided, and a note of what was agreed, with no personal details beyond the name of the person who asked to be contacted, if they did;
• any WhatsApp number or work email a member of staff gave us to use, and when they agreed;
• whether the clinic asked us not to contact it again, and when.

Our legal basis is legitimate interest: telling a licensed clinic that its public listing exists and how to manage it. For clinics in Türkiye this is also the basis under KVKK article 5(2)(f). We delete a record on request. If a clinic asks us to stop, we stop on every channel and keep only the refusal and its date, for at least a year, so that we do not contact it again. Other records are deleted a year after the last contact if the clinic has not activated its page. To ask us to stop, reply RET or STOP to any message, tell us in person, or email privacy@clinicscheck.com.

If we change this policy in a way that matters, we will update the date at the top and tell account holders by email or in the app before the change takes effect.