Privacy notice | SDB UK Developments Ltd

This notice explains how SDB UK Developments Limited handles your personal information when you use our website or submit an enquiry through our medical tourism facilitation service. It is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are (the data controller)

SDB UK Developments Limited ("SDB", "we", "us", "our") is the data controller responsible for your personal information.

Company number: 12747873 (registered in England & Wales)
Registered office: Kincraigie, Over Ross Street, Ross-On-Wye, HR9 7AU
Data protection contact: hello@sdbukdevelopments.com

We are not required to appoint a statutory Data Protection Officer, but the address above reaches the person responsible for data protection at SDB. We are not currently registered with the ICO for a fee-payer entry; where a registration becomes payable we will register and publish our registration number here.

2. The information we collect

2.1 Information you give us through the enquiry form

Identity & contact: full name, email address, phone number, country of residence, preferred language, preferred contact method.
Demographic: date of birth, sex at birth.
Enquiry details: treatment area, description of your concern, duration, any prior diagnosis, NHS waiting list status.
Health information (special-category data under Article 9 UK GDPR): height, weight, conditions, current medications, allergies, previous surgeries, smoking and alcohol information, pregnancy status, any scans, reports or images you choose to upload.
Practical: timeframe, whether you are travelling with a companion, accessibility needs, passport validity, how you heard about us.
Consent records: the exact consent statements you agreed to, the version of the consent text, and the timestamp.

2.2 Information collected automatically

Technical logs: IP address, user-agent string, referring URL, request timestamps. These are collected by our hosting provider for security and abuse prevention and are retained for a short period.
Strictly necessary cookies: see our cookies notice. We do not use advertising, analytics or third-party tracking cookies.

2.3 Information from third parties

If a partner clinic responds to your case with a plan, we receive that plan and forward it to you. We do not buy contact lists or receive personal information about you from data brokers.

3. Why we use it and our lawful basis

Purpose	Lawful basis (UK GDPR)
Reviewing your enquiry and matching it with a suitable hospital partner	Article 6(1)(b) — steps at your request prior to entering a contract with the clinic
Processing your health information for that purpose	Article 9(2)(a) — your explicit consent
Sharing your case with a hospital partner located outside the UK	Article 49(1)(a) — your explicit consent to the international transfer
Sending you occasional service updates (only if you opted in)	Article 6(1)(a) — your consent, withdrawable at any time
Keeping records of enquiries, consent and correspondence	Article 6(1)(c) & 6(1)(f) — legal obligations and our legitimate interest in accurate record-keeping
Site security, fraud prevention and abuse investigation	Article 6(1)(f) — our legitimate interest in a secure service
Responding to legal claims, regulators or law-enforcement requests	Article 6(1)(c) & 6(1)(f); Article 9(2)(f) for any health data

4. Who we share it with

We share the minimum information necessary, and only with:

Hospital partners reviewing your case. Some partners are located outside the UK (for example in Turkey). We only share what the clinical team needs to open a case file and prepare a plan. We rely on your explicit Article 49(1)(a) consent for these transfers and tell you which country a partner is in before you decide to proceed.
Our processors — a small number of trusted suppliers acting under written data-processing agreements:
- Hosting and application infrastructure (EEA / UK regions where available).
- Transactional email delivery (confirmations and internal notifications).
- Secure file storage for any documents you upload.
- WhatsApp Business (Meta) if you choose to contact us via WhatsApp — Meta's own terms and privacy notice apply to that channel.
Professional advisers (legal, accountants, insurers) where strictly necessary and under duties of confidentiality.
Authorities where we are legally required to disclose information (for example, a court order).

We do not sell your personal information, and we do not use it for advertising or profiling.

5. International transfers

Where personal data (including health data) leaves the UK, we transfer it under one of the safeguards permitted by UK GDPR: (a) an adequacy decision, (b) the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or (c) your explicit consent under Article 49(1)(a) for a specific transfer to a named clinic. You can ask us for a copy of the safeguards in place for a specific transfer by writing to hello@sdbukdevelopments.com.

6. How long we keep it

Enquiry and health information: up to 7 years from your last contact with us, to support aftercare, respond to any complaint or claim, and meet our record-keeping obligations. You can ask us to erase it sooner (see section 8).
Consent records: for as long as we hold the underlying data, so we can demonstrate the consent given.
Marketing contact details: until you unsubscribe or ask us to delete them.
Server and security logs: up to 90 days, then deleted or aggregated.
Accounting records: 6 years, as required by UK tax law.

7. How we protect your information

Transport encryption (HTTPS/TLS) for all pages and form submissions.
At-rest encryption on our hosted database and object storage.
Role-based access — only named staff who need the information can see it.
Uploaded files are held in a private bucket and accessed only through short-lived signed links.
Audit logging of administrative access.
A documented process for detecting, containing and reporting personal-data breaches to the ICO within 72 hours where required, and to affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

8. Your rights

Under UK GDPR you have the right to:

be informed about how we use your information (this notice);
access a copy of the information we hold about you;
have inaccurate information rectified;
have information erased ("right to be forgotten") where the law allows;
restrict our processing in certain circumstances;
object to processing based on legitimate interests;
data portability, where processing is based on consent or contract and is carried out by automated means;
withdraw any consent you have given, at any time, without affecting the lawfulness of processing carried out before the withdrawal;
not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects — we do not carry out any such automated decision-making.

To exercise any of these rights, email hello@sdbukdevelopments.com. We will respond within one month. There is no fee, unless a request is manifestly unfounded or excessive. We may ask you to verify your identity before releasing information.

You also have the right to complain to the UK Information Commissioner's Office if you think we have not handled your information properly: ico.org.uk · Helpline 0303 123 1113. We ask that you contact us first so we can try to resolve the issue.

9. Cookies

See our separate cookies notice. In short: strictly necessary cookies only, no advertising, no third-party analytics.

10. Children

Our service is intended for adults (18+). We do not knowingly collect information from children. If a child under 18 needs treatment, an enquiry must be submitted by a parent or legal guardian on their behalf, and the parent/guardian is responsible for the information provided.

11. Changes to this notice

We may update this notice from time to time. The "last updated" date at the top shows when it last changed. Material changes will be highlighted on the website and, where appropriate, notified to you by email.

12. Contact

SDB UK Developments Limited
Kincraigie, Over Ross Street, Ross-On-Wye, HR9 7AU
Email: hello@sdbukdevelopments.com