Privacy, explained.

Who handles your information?

Gong Zhong operates this website. Questions and rights requests: contact@globalcarefinder.com.

Contact requests

The inquiry form collects your name, email, country of residence, language, time zone and service of interest. You may also provide gender, age, nationality, a preferred contact channel and account, a short health summary, record availability, city and hospital preferences, arrival date, support needs, budget and additional questions. We use these details to respond and coordinate your inquiry. A health summary is optional and requires separate explicit consent. Do not submit medical-record files, identity-document numbers or payment information here.

The operator may email a copy of your contact request to configured staff recipients for follow-up.

Storage and access

Name, email, comments, gender, age, nationality, contact-account details and the optional health summary are encrypted in the application database. Authorized staff can review requests. When detailed email notifications are enabled, the submitted information, including a consented health summary, is emailed to the operator’s configured staff recipients and handled by the email providers involved. The application does not automatically forward requests to hospitals. Contact the operator about withdrawal of health-information consent or deletion; withdrawal does not undo earlier processing or recall delivered emails.

Retention

Contact requests are scheduled for deletion after 90 days without an update. This depends on the host’s scheduled task being configured. Backup copies follow the operator’s documented backup retention schedule, which must be finalized before launch.

Cookies and browser storage

Session and security cookies support forms and staff sign-in. Your browser may store the hospital identifiers you select for comparison; use “Clear” in the comparison bar to remove them. No advertising or analytics trackers are included in this version.

Language preference

A language preference cookie remembers English or Simplified Chinese for up to one year. You can change it using the language switch.

Spam protection and hosting

When contact requests are enabled in production, Cloudflare Turnstile processes a spam check. The hosting provider may retain access and security logs. Provider identities, locations, retention, and applicable international transfer arrangements must be documented by the operator before launch.

Patient portal and health documents

When enabled, the portal uses one-time codes sent to your email address. Your account email and name are encrypted in the database; a keyed lookup value associates sign-ins with your account. Verification codes expire after 10 minutes, permit at most five failed attempts, and can be used once. Patient sessions require verification again after 30 minutes.

Medical-record uploads are optional and require explicit consent for processing the health document and access by authorized care-navigation staff to support your request. Uploaded documents and original filenames are encrypted. Files are stored outside the public website directory, quarantined for local malware scanning, and cannot be downloaded until a scan passes. Staff access requires a password sign-in and a separate email verification step. Access and changes are recorded in an audit log without document contents.

Records are not automatically sent to hospitals or payment providers. Any external clinical sharing requires a separate explanation, your instructions, and applicable transfer arrangements. You can remove a file from the active vault to withdraw its storage consent. The scheduled task removes files 90 days after upload. Backup copies expire under the operator’s separately documented backup schedule.

Appointment requests and payments

Appointment requests store your selected hospital, requested format and time, confirmation details, and status. Staff confirm availability directly with the hospital; the portal does not connect to hospital scheduling systems. Payment records retain amount, currency, charge type, refund terms, acceptance time, status, and processor identifiers. We do not store your card details. Hosted checkout processes payment information under the selected processor’s privacy terms; the Stripe and PayPal integrations send a generic fee label and payment reference, not medical records or treatment descriptions.

Appointment, account, financial, and audit retention periods must be finalized by the operator according to its actual service and applicable obligations. These records are not included in the contact-inquiry deletion rule. Contact the operator for access, correction, deletion, consent withdrawal, or other applicable rights. Legal basis, processor agreements, hosting location, permitted health-data processing and transfer arrangements must be confirmed before these features open.

Your choices

Contact the operator to request access, correction, deletion, or information about other applicable privacy rights. Do not submit a request until the published operator and processing details meet your needs. You can research the directory without sending us a contact request.