Privacy Notice

Concur Medical Ltd ("Concur", "we") is responsible for the personal and health information you provide when you request an independent orthopedic second opinion. You can reach us at care@concurclinical.com for any question about your information.

• Details you enter yourself: age, sex, country, body area, complaint, duration, onset, your existing diagnosis, the treatment proposed to you, treatments already tried and your question for the specialist.
• Documents and images you upload: medical reports, MRI, CT and X-ray reports and images.
• For patients under 18: the name of the parent or guardian and their confirmation of authority.
• Your email address, and the record of the consents you gave, including their version, date and time.
• Payment confirmation from our payment provider. We never see or store your full card details.
• Technical records of access to your case, kept for security and accountability.

We use your information to provide the second opinion you requested and, where you book one, the follow-up video consultation. Health information is processed with your explicit consent for the medical service, and for the purposes of medical assessment carried out by or under the responsibility of a health professional bound by professional secrecy. We also process the minimum necessary to take payment, to meet legal and record-keeping duties, and to keep the service secure.

The consent for the medical service and the consent for research use are always asked separately and are never bundled. If — and only if — you give the optional research consent, a pseudonymised copy of your case may be used to develop and evaluate clinical decision-support models. Pseudonymised means direct identifiers are removed and the copy is held in a separately controlled, strictly restricted store. Declining research consent has no effect whatsoever on the opinion you receive or the speed of the service. You may withdraw this consent at any time by emailing us.

Access is restricted by role. The orthopedic specialist assigned to your case sees your case in order to review it. A small number of authorised administrative staff can see case and payment status to run the service. No one else has access, and every access is logged. We use service providers for secure hosting, file storage, payment processing and email delivery; they act on our instructions only.

The service is available in supported countries, so your information may be processed in a country other than your own. Where information leaves the European Economic Area we rely on recognised safeguards, such as the European Commission's standard contractual clauses, with the providers involved.

Your case, documents and report are kept for as long as needed to provide the service and to meet the medical record-keeping periods that apply to us, after which they are deleted. Any research copy you consented to is held separately under its own retention period. Financial records are kept for the period required by tax law.

All connections are encrypted. Documents are held in private storage and are never available at a public address; when you or your specialist open one, a short-lived private link is generated for that view alone. Clinical and staff accounts use individually issued credentials. We never include medical details in emails or in analytics.

You can ask for a copy of your information, ask us to correct it, ask for deletion, object to or restrict certain uses, withdraw a consent you have given, and receive your data in a portable form. Write to care@concurclinical.com and we will respond within one month. If you are in the EEA or the UK, you may also complain to your national data protection authority.

We use only the cookies and local storage needed to keep you signed in, keep an unfinished case draft, and keep the service secure. We do not use advertising or cross-site tracking cookies.

Where consent is not required and you have not refused tracking, we use Google Analytics and linked Google Ads to measure visits, case-start clicks, checkout starts and successful payments, and to support advertising measurement and optimisation. Payment events contain only a transaction identifier, value of €188 and currency EUR. Google also receives technical request information such as an IP address and browser information. We do not send medical information, case contents, patient contact details or clinical page addresses, and do not enable customer matching or advertising cookies.

We do not show a consent banner. Google measurement is blocked in the EEA, UK, Switzerland, Canada and when your region cannot be determined. Canada is blocked because our country lookup cannot distinguish Quebec. Ad clicks and impressions are still counted by Google Ads. An existing recorded refusal is honoured; you can also block requests to Google through your browser privacy controls.