We take privacy seriously, especially when the information involved is about your health. This policy explains what we collect, why, who we share it with, how long we keep it, and your rights under the Personal Data Protection Act No. 9 of 2022 of Sri Lanka.
It should be read together with our Terms & Conditions.
1. Who we are
MediGo Lanka is operated by MediGo Lanka PVT LTD (registration number PV 00370669), 383/11A/1/1, NAS Silva Mawatha, Papiliyana, Nugegoda, Sri Lanka ("MediGo Lanka", "we", "us", "our").
MediGo Lanka is the controller of the personal data collected through the MediGo Lanka website and platform (the "Platform"), within the meaning of the Personal Data Protection Act No. 9 of 2022 of Sri Lanka, as amended (the "PDPA").
For any question about this policy or your personal data, contact us at admin@medigolanka.com or +94 77 839 1373.
2. Information we collect
Identity and contact details: name, date of birth, email address, phone or WhatsApp number, and the city and country you are in.
Health information: the reason for your consultation and symptoms, medical reports, test results, images and other documents you upload, and information you share with the doctor. Health information is special category data under the PDPA and receives extra protection.
Booking information: the doctor you choose, requested and confirmed appointment times, booking references, cancellations, reschedules and feedback you give us.
Payment information: the amount, payment status, payment reference and payment method type. Card payments are processed by PayHere; we do not receive or store your full card number or security code.
Account information: if you create an account, your login email and account activity. Passwords are handled by our authentication provider and are never visible to us.
Communications: emails, WhatsApp messages and contact form messages you send us.
Technical information: IP address, browser and device information and essential cookies needed to keep you signed in and to keep the Platform secure.
3. How we use your information
We use your information to:
- receive and manage your appointment requests, confirm appointments and arrange your online consultation;
- share relevant information with the doctor you choose so they can prepare for and carry out the consultation;
- take payments, issue receipts and process refunds;
- send you service messages: request and appointment confirmations, payment instructions and reminders, consultation links, appointment reminders, cancellation and refund notices, and feedback requests;
- respond to your questions and complaints;
- verify doctors and maintain the quality and safety of the service;
- keep the Platform secure and prevent fraud and misuse; and
- comply with our legal, regulatory, accounting and record-keeping obligations.
We do not sell your personal data, and we do not use your health information for advertising.
4. Legal grounds for processing
We process personal data under the PDPA on the following grounds:
- your consent, which you give when you submit an appointment request or upload documents, and which covers the processing of your health information for your consultation;
- where processing is necessary to provide the service you request and to perform our agreement with you;
- where processing is necessary for us to comply with a legal obligation; and
- where processing is necessary for our legitimate interests, such as keeping the Platform secure, provided those interests are not overridden by your rights.
Where we rely on consent, you can withdraw it at any time by contacting us. Withdrawing consent does not affect processing already carried out, but we may not be able to provide a consultation without the information needed for it.
5. Who we share information with
The doctor you book with receives the information needed for your consultation, including your details, the reason for the consultation and any reports you upload.
We use trusted service providers who process data on our behalf and only on our instructions:
- Supabase (secure database, account authentication and encrypted file storage);
- Netlify (website hosting);
- Resend (sending service emails);
- Google Workspace (Google Meet video consultations and appointment calendars, and our business email);
- PayHere (card payment processing); and
- WhatsApp (only if you choose to contact us that way).
Authorised MediGo Lanka staff can access booking and support information where needed to run the service.
We may disclose information where required by law, by a court or by a competent authority, or where necessary to protect someone's vital interests in an emergency.
6. International transfers
Some of our service providers store or process data on servers outside Sri Lanka, for example in the United Kingdom, the European Union or the United States. Many of our patients also live outside Sri Lanka.
Where personal data is transferred outside Sri Lanka, we take the steps required by the PDPA, including using providers that maintain appropriate security and contractual safeguards for the data they process.
7. How long we keep information
Consultation and booking records, including uploaded medical reports, are kept for up to 10 years in line with medical record-keeping practice in Sri Lanka, unless the law requires a different period.
Payment and accounting records are kept for as long as required by Sri Lankan tax and accounting law.
Account information is kept while your account is active. Messages and technical logs are kept only for as long as they are needed for the purposes above.
When information is no longer needed, we delete or anonymise it securely.
8. How we protect your information
Data is encrypted in transit and at rest. Medical files are stored in private storage and are only accessible through short-lived secure links. Access to personal data is restricted to people who need it.
No system is completely secure. If a personal data breach occurs that is likely to affect you, we will notify you and the Data Protection Authority where the law requires.
9. Your rights
Under the PDPA you have the right to:
- access the personal data we hold about you;
- withdraw your consent, and object to processing, in the circumstances set out in the law;
- have inaccurate or incomplete personal data corrected or completed;
- have your personal data erased where the law allows, for example where it is no longer needed (some records must be kept for legal or medical reasons); and
- ask for a review of any decision based solely on automated processing that significantly affects you (we do not make such decisions).
To exercise your rights, email admin@medigolanka.com. We may need to verify your identity before acting on a request, and we will respond within the time required by law.
If you are not satisfied with how we handle your personal data, you may complain to the Data Protection Authority of Sri Lanka (www.dpa.gov.lk). We would appreciate the chance to resolve your concern first.
10. Children
Our services are intended for adults. A parent, legal guardian or other legally authorised person may book a consultation for a child and provide consent for the child's information to be processed for that consultation.
11. Cookies
We use only essential cookies and similar browser storage, which are needed to keep you signed in, remember an unfinished booking form on your device and protect the Platform. We do not use advertising or cross-site tracking cookies.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be published on this page with its last updated date. Where changes are material, we will take reasonable steps to let you know.