Legal
Privacy policy
How this site handles personal information when you browse it and when you send an inquiry.
DRAFT — PENDING LEGAL REVIEW. This document describes an intended approach. It has not been reviewed or approved by a qualified lawyer, it is not a statement of legal compliance, and it must not be relied on as a final privacy notice. Prepared for review by counsel.
Status of this document
This is a working draft written to show what information the service would collect and why. It is published so that travellers, partners and a reviewing lawyer can see the intended design of the service. It will be replaced by a reviewed policy before any public commercial launch. Nothing on this page is a claim of compliance with the GDPR, the PIPL or any other regime: those claims depend on written confirmations from our providers that we do not yet hold.
What we would collect
When you send an inquiry: your name, email address, country of residence, preferred language, and optionally a WhatsApp number and a short message. We also ask for your travel intentions — destination, interests, dates, group size and budget range. Marketing consent is not bundled into the inquiry, and no account is created.
What we deliberately do not collect
We do not ask for medical records, test results, imaging, prescriptions or identity documents. The inquiry form has no field for them, and the free-text box is screened server-side for passport-like, national-ID-like and long digit strings so an obvious identifier is rejected rather than stored. If you paste a medical report into a message anyway, we delete it and ask you again without it.
Sensitive health information and separate consent
If a planning conversation later requires health-related detail, we would ask for it separately, explain why it is needed, who will see it, how long it will be kept, and obtain your explicit consent before it is stored. Sensitive information would never be bundled into a general consent, and refusing it would not block ordinary travel planning.
Why we would use it
To prepare and discuss your plan, reply to you, coordinate the services you ask about, and keep a record of what was agreed. We do not sell personal information, and we do not use enquiry content for advertising.
The AI assistant, and what reaches the model
The concierge panel sends the text you type to a large language model operated through our platform provider (currently the DeepSeek model family). Before you can type anything, a notice appears: it is not a medical service, sensitive details must not be entered, an external model processes the text, and this site does not keep the conversation. The notice has to be acknowledged first. Every message is then screened on our server before anything is forwarded — passport-like, national-ID-like and long digit strings are rejected outright, and text framed as medical records, reports, diagnoses or personal contact details is not forwarded: you are asked to describe the need in general terms instead. Only your message text and a fixed page context (city and hospital directory facts) are sent; your name, email address and WhatsApp number are never included. The conversation is not written to our database and is not sent to any analytics or logging tool: it lives in the browser tab, and closing the tab clears it, so a staff member cannot read it later. Server logs record that an error occurred, never the content of a message. If you want a written record or want a person to see something, send an enquiry — that is the channel staff can actually read.
Cross-border transfers
We operate from China and expect to serve visitors worldwide, so information may be processed outside the country you are in. Before any live collection, this section will name the receiving countries, the safeguards used, and the mechanism for lawful transfer, and will require your acknowledgement where the law demands it.
Third-party service providers and hosting
The site runs on an application platform and a managed PostgreSQL database operated by our platform provider. Customer data — inquiry text, contact details, quotations and shared itineraries — is stored in that managed database. The AI answer is requested through the same provider's managed AI gateway, which routes to the DeepSeek model; we hold no separate model-provider account or key. The exact hosting region has not been contractually confirmed by the provider, so we list it here as an open item rather than guessing: until it is confirmed in writing, we do not claim a specific storage location or a specific transfer safeguard. No other third party receives inquiry data, and there is no analytics, advertising or error-tracking service on this site.
Where things are stored, in plain terms
Inquiry records, internal notes, itineraries and quotations live in the managed database described above. Consent is recorded with the policy version you accepted and a timestamp. Quotation share links use a random token rather than the inquiry number, can be revoked instantly, and can be given an expiry date. Raw IP addresses are not stored; a keyed hash is kept only to detect abuse.
Retention
Enquiry records would be kept only as long as needed to answer your request and meet accounting or legal obligations, then deleted or anonymised. The retention period for each record type will be stated here once counsel has confirmed the requirement.
Your rights
You would be able to ask what we hold about you, request a copy, correct it, ask us to delete it, withdraw consent, or object to a particular use. We would respond in writing within the period required by applicable law. A deletion request would be honoured unless a legal obligation requires us to keep the record.
Security
Access to enquiry records would be limited to staff who need it, protected by authentication and role-based permissions, transported over encrypted connections, and reviewed when someone leaves the team. No system is perfectly secure, and we would tell you if a breach affected your information.
Cookies and measurement
This release uses a cookie only to remember your language choice. If analytics or marketing cookies are added, they will be described here and disabled until you agree.
Changes and contact
Material changes will be dated and summarised on this page. When a customer-facing email address or WhatsApp number is configured in the admin console, it is published in the footer, on the confirmation page and on shared quotations; until then the site states plainly that direct contact channels are not yet available, and no address is invented here.
What this site does with a chat message, step by step
1) You acknowledge the notice in the panel. 2) Your text is sent to our own server, not to the model. 3) The server screens it: identifiers are refused, and medical records, reports, diagnoses or personal contact details are refused, in both cases with an explanation instead of an answer. 4) Only text that passes is forwarded, together with a fixed page context. 5) The answer streams back to your browser and is kept in the tab. 6) Nothing from the conversation is written to the database, and the message text is not logged; only the fact that a request failed would appear in a server log.