Privacy Policy

1. Who we are

Devavia is operated by Depom Ltd, company number 17164981, 5 Mayfair Avenue, Salford, M6 8AF, United Kingdom. It is the data controller for the personal data described in this policy.

Contact for any privacy question or request: info@devavia.com.

Devavia is a marketplace that connects patients with independent clinics and travel services. We do not provide medical services, diagnosis or advice.

2. What we collect

• Your account: name, email address, phone number, country, preferred language and your password (stored only in encrypted, hashed form).
• Treatment requests: the treatment you are interested in, preferred destination and date, number of travellers, budget and any message you write. This can reveal information about your health, which is why we ask for your explicit consent before you send a request.
• Messages you exchange with clinics on Devavia.
• Offers and bookings, including prices and payment status. Card payments are processed by Stripe; we never see or store your card number.
• Travel details you add to your journey: flights, hotel stay and transfers, including the passenger name and phone number used for airport pickup.
• Reviews you write after treatment. Reviews are public and show only your first name and the initial of your last name.
• Technical data: a session cookie that keeps you signed in, a security cookie that protects forms, and—stored with your session—your IP address and browser type. To protect accounts, we briefly count sign-in attempts and block repeated failures. We do not use advertising or analytics cookies.

We do not collect medical documents. Reports, scans and photos are sent by you directly to the clinic, through the clinic's own channel, after your booking is confirmed.

3. Why we use it and our legal basis

• To provide the service (your account, requests, offers, bookings, travel coordination): necessary to perform our agreement with you.
• Health-related information in your requests: your explicit consent, given with the checkbox on the request form. You can withdraw it at any time by contacting us; this does not affect requests already sent.
• Security, fraud prevention and protecting introductions made through the platform: our legitimate interests.
• Keeping payment and accounting records: our legal obligations.

4. Who we share it with

• Clinics you request quotes from see your name and the details of your request. Your email address and phone number are not shown to them; you talk to clinics through Devavia messages.
• The clinic you book with sees your booking and the travel plan needed to coordinate your treatment.
• The transfer company whose offer you accept receives the passenger name, phone number, flight and pickup details—only after you accept its offer.
• Service providers that run Devavia for us: our hosting and email provider (servers and email delivery) and Stripe (payments). Fonts and the location maps on clinic pages are loaded from Google, which receives your IP address when those load. If you contact us on WhatsApp, WhatsApp's own terms apply.
• Authorities, only when the law requires it.

We do not sell your personal data.

5. International transfers

Many clinics on Devavia are outside the United Kingdom—for example in Turkey, Thailand, South Korea, Germany, France or Japan. When you choose to request quotes from or book with a clinic in another country, the details described above are sent to that clinic so it can respond. We do this on the basis of your explicit consent and because it is necessary for the request you make.

6. How long we keep it

We keep your account data for as long as your account is active. When you ask us to delete your account, we delete your personal data, or—where we must keep a booking or payment record for legal accounting reasons—we anonymise it so it no longer identifies you. Session records expire automatically.

7. Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, to receive a copy of it, and to withdraw your consent. Email info@devavia.com from the address registered on your account; we answer within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in Turkey, to the Personal Data Protection Authority (kvkk.gov.tr).

8. Security

Passwords are stored only in hashed form, all traffic is encrypted (HTTPS), sign-in attempts are rate-limited, and each clinic and company can only see the requests and bookings that concern them.

9. Children

Devavia accounts are for adults aged 18 and over.

10. Changes

If we change this policy, we will update the date at the top of this page. If a change affects how we use health-related information, we will ask for your consent again.