MEDam.com Privacy Notice

LAST UPDATED: October 2026

MEDam.com is a platform that enables individuals to connect with medical tourism providers in Armenia (the "Platform"), including medical facilities or centers, medical professionals, hotel service providers, transportation service providers and other related service providers (the "Service Providers"). MEDam.com is operated by MED.AM LLC (the "Company," "we," or "us") which processes information that identifies you as an individual or relates to you as an identifiable individual ("Personal Information") when you use the Platform (as a potential patient ("User"), representative of a healthcare facility ("Medical Provider"), as a doctor, or as a (representative of a) provider of a related service ("Related Service Provider") (the Medical Provider and Related Service Provider are together referenced as "Service Provider")), or otherwise interact with us in the context of our Platform or business (e.g., as a vendor, service provider or business partner ("Third Party")). This Privacy Notice describes how we process Personal Information in the context of the Platform and our business.

COLLECTION AND PROCESSING OF PERSONAL INFORMATION

How we collect Personal Information

We collect Personal Information for various purposes and in various contexts as part of our Platform (see descriptions in the table below).

If you are a Medical Provider and you disclose Personal Information relating to your doctors or other medical professionals to us, you represent that you have obtained all necessary consents and have the authority to disclose such information to us and to permit us to use the information in accordance with this Privacy Notice.

Where required by applicable law, we will rely on your consent for the processing of your Personal Information, in addition to the legal bases mentioned in this Privacy Notice.

Users

We process Personal Information of Users, such as:

•Name

•Contact details (e.g., email address and phone number)

•Log-in credentials

•Services requested (this may include health information)

•Status and progress of requested services (this may include health information)

•Date of birth

•Country of residence

•Content of your communications with us, including:

•Reviews and ratings

•Specific requests

•Feedback or comments

•Questions

•Reports and/or reported events (including feedback reports you choose to submit, which may include an optional screenshot of your current view of the MEDam website — a screenshot is never captured while your screening questionnaire or a message you typed to the AI assistant is on screen)

•Before-and-after photos

•Any other information you provide to us on or through the Platform, including by your use of the Platform (such as usage analytics and device information collected by cookies and/or other similar technologies)

Due to the nature of the Platform, our processing of your Personal Information will include health information, such as the fact that you've requested and/or received a medical service or have undergone a medical procedure. We may also enable you to upload certain medical information for purposes of assessing your eligibility for the requested medical service. We will generally process such health information with your explicit consent.

We may also request you to provide health information that is necessary for the treating doctor to evaluate your request or prepare for the procedure. When we request such health information from you, such as when we ask you to complete the pre-treatment screening questionnaire, we do this on behalf of the treating doctor and/or the Medical Provider. This information will not be accessed or used by MEDam for any purpose other than disclosing it to the Medical Provider and/or the treating doctor. The pre-treatment questionnaire specifically will be permanently deleted from our Platform when your treatment is complete or your booking is cancelled or expires. If you need a copy for your own records, please make sure to download the questionnaire from your dashboard before its permanent deletion.

We will not process any information contained in your medical file or medical records related to the requested medical service beyond what is necessary to facilitate the connection between you and the Service Provider and comply with our tax reporting or other legal obligations. Your detailed medical records will be processed by the Medical Provider and/or the individual doctor, who will be the sole controller for such health information. We are not responsible for the Medical Provider's or doctor's processing of your medical records, and you should review their separate privacy notices to learn how they process your personal information.

Providing the Services

We process your Personal Information as necessary to provide the requested service, such as to enable your access to the Platform, connect you with a Service Provider or doctor, and handle specific requests. We also process your Personal Information to process payments related to your requested services.

We process the following information to provide you with our service:

Name
Email address
Log-in credentials
Services requested
Status and progress of requested services
Content of your communications with us

We process the Personal Information in order to perform our contract with you and to pursue our legitimate interest in providing you a trustworthy and reliable Platform.

Reviews and feedback

Processing and publishing your reviews and feedback about our Service Providers. This includes reviews and feedback about the Medical Provider, the doctor(s), and the Platform. It can also contain before-and-after photos that you wish to upload. Feedback can be collected through surveys or interviews.

Medical Providers or individual doctors may also publish before-and-after photos on their own facility or individual profile pages. They will only do so on the basis of your prior opt-in consent.

We process the following information to process and publish your reviews and feedback:

Name
Email address
Services requested
The content of your review or feedback
Your ratings for the Service Provider
Before-and-after photos

By default, we will publish your review in a pseudonymized form, so only your initials will be visible, unless you explicitly choose to publish your full name. You can select your preference when submitting your review.

We process the Personal Information to pursue our legitimate interest of ensuring a high quality of Service Providers and doctors on our platform. Providing a review is not mandatory and does not affect your ability to receive the requested services. Moreover, by posting a review you consent to the processing of the Personal Information contained in such review.

Adverse events and emergency response

We will process your Personal Information if this is necessary to handle an adverse event or respond appropriately to an emergency.

We process the following information for this purpose:

Name
Contact details
Services requested
Status and progress of requested services
Information about adverse event or medical services that you opt to share with us
Content of your communications with us

We process the Personal Information to protect your vital interests or to pursue our legitimate interest of ensuring our Service Providers and individual doctors are and remain of high quality and trustworthy.

Doctors

We process Personal Information of the doctors or other medical professionals providing services, such as:

•Name

•Contact details (e.g., email address and phone number)

•Log-in credentials

•Professional credentials, including:

•Information about your services

•Expertise

•Diploma(s)

•Certificates

•Experience

•Education

•Ratings and feedback received

•Services provided to Users

•Status and progress of services provided to Users

•Availability dates and times

•Information about (serious) adverse events

•Content of your communications with us, including:

•Reviews and ratings

•Specific requests

•Feedback or comments

•Questions

•Reports and/or reported events

•Any other information you provide to us

Providing the Services

We process your Personal Information as necessary to provide the requested service, such as to enable your access to the Platform, connect you with a User, and handle specific requests. We also process your Personal Information to assess, review and monitor your or the Medical Provider's eligibility to be or stay included on the Platform.

We process the following Personal Information to provide you with our Service:

Name
Contact details (e.g., email address and phone number)
Log-in credentials
Professional credentials
Ratings and feedback received
Services provided to Users
Status and progress of services provided to Users
Availability dates and times
Information about (serious) adverse events
Content of your communications with us
Any other information you provide to us

We process the Personal Information to perform our contracts with you and the Medical Provider and to pursue our legitimate interest in providing you a trustworthy and reliable Platform.

Adverse events and emergency response.

We will process your Personal Information if this is necessary to handle an adverse event or respond appropriately to an emergency; to review your eligibility to remain featured on the Platform.

We process the following information for this purpose:

Name
Contact details
Services provided to Users
Status and progress of services provided to Users
Information about (serious) adverse events
Content of your communications with us
Any other information provided to us in relation to your (non-)performance

Service Provider

We process names, contact details and log-in credentials of individuals working for our Service Providers to enable the Service Provider's inclusion on the Platform, allow the Service Provider to provide its services and to otherwise perform our contract with the Service Providers.

Third Party

If you are one of our vendors or suppliers or a member of their staff, we will use Personal Information about you to manage and execute our contracts or to conclude new contracts. The Personal Information includes name, contact details, the company's name, payment details, and financial information included on invoices.

Other purposes for processing - All Individuals

Customer service

We will process your Personal Information when you contact us with requests for support, complaints or questions.

We collect Personal Information as needed to process your request, complaint or question.

Name
Email
Phone number
Content of your message

We rely on our legitimate interest to respond to questions or complaints.

If you request a specific service from us, we will rely on the performance of the contract to process Personal Information needed to provide you with such service.

If you submit a request on the basis of a law (such as an access request based on your rights under European data protection law), we will process your Personal Information as needed to comply with our legal obligation to respond and process your request.

Communicating important changes / Service messages

In certain situations we may need to contact you directly to communicate administrative information with you. This may include important information regarding our relationship with you, our Platform, any changes to our terms, conditions, policies and procedures, and/or other administrative information.

We use your first and last name and at least one contact method to contact you. Depending on the content of the communications, we may also process other Personal Information related to you for this purpose.

We rely on our legitimate interest, such as to ensure our Platform is used in accordance with our terms, conditions, and policies.

We rely on the performance of contract, where the communication relates to our Platform.

In certain instances we may also have a legal obligation to inform you of material changes to our Terms of Service or Privacy Notice (e.g., in case of mergers, acquisitions and other restructurings of our business).

Improving the Platform and developing new features

We will use the Personal Information that we collect about you for analytical purposes, so that we can improve our Platform and existing services and develop new services or features of interest.

For example, we will conduct data analysis to monitor and analyze where most of our Users travel to Armenia from, their age range and what procedures and services are requested most often. We may also use the insights gained to offer new services, such as on the basis of visitor feedback, or to improve existing services or the way we promote them.

We use the Personal Information that we have collected from or about you for this purpose. Where possible and feasible, we will do this in a manner that does not directly identify you (e.g., by creating aggregated insights from pseudonymized data, as described below).

We rely on our legitimate interest for these activities. We have an interest in making sure our Platform remains relevant to our Users.

Aggregating or anonymizing Personal Information.

Where we don't need your Personal Information in identifiable form to pursue our purposes (such as performing analytics to obtain aggregate insights), we will aggregate and/or anonymize your Personal Information so that it is no longer considered Personal Information.

We may aggregate, anonymize or pseudonymize any of your Personal Information as is necessary or required for the relevant purpose of anonymization or pseudonymization.

We rely on our legitimate interests to anonymize your information, such as the interest to generate other data for our use.

Fraud prevention and security

We may use your Personal Information if this comes up in the context of:

security purposes, including system security;
monitoring for and preventing fraud; and
audits to verify that our internal processes function as intended and are compliant with legal, regulatory and contractual obligations.

Depending on the specific purpose, this may include any Personal Information that we have collected about you.

We rely on our legitimate interests, and our legal obligations such as identifying and/or preventing fraudulent transactions and ensuring the security of our systems.

We have a legal obligation to conduct audits.

Legal and compliance

We have general legal and compliance obligations to process your Personal Information. This includes complying with applicable laws; complying with legal processes; responding to requests from public and government authorities; meeting national security or law enforcement requirements.

Enforcing our terms and conditions; protecting our operations; protecting our rights, privacy, or property; and allowing us to pursue available legal remedies, defend claims and limit the damages that we may sustain.

We use the Personal Information as relevant for the specific legal action, regulatory investigation, and/or legal processes in question.

We rely on our relevant legal obligation to process the relevant Personal Information.

We rely on our legitimate interest, such as enforcing terms and conditions and bringing or defending legal claims.

Emergency and incident response

In exceptional circumstances, we may need to process your Personal Information to respond to an incident or emergency. This may include purposes such as: ensuring the safety of Users; responding to and handling medical and other emergencies.

We use Personal Information as necessary and relevant for the specific purpose and context.

We have a legal obligation to adequately address emergencies and incidents. In certain instances, processing Personal Information may also be necessary to protect an individual's vital interests (such as when we need to contact medical or emergency services).

SMS text messages

If you turn on SMS text messages in your notification preferences or during booking, we use your verified mobile phone number to send you the service text messages described in our Terms of Service (booking, consultation and trip updates). Message frequency varies. Message and data rates may apply. We do not sell or share your SMS opt-in data or Personal Information with third parties for marketing purposes. For delivering these messages, your mobile number and your consent record are shared with our messaging delivery provider, solely to deliver them. You can stop receiving text messages at any time by replying STOP to any message or by turning SMS off in your notification preferences.

Marketing

We may process your Personal Information, including marketing data (e.g., your preferences for receiving our marketing communications and details about your engagement with them), for promotional purposes. This includes the following:

•Providing you with our newsletter and/or other marketing materials.

•To send you marketing related emails, with information about our Platform, services, new offers and other news about us.

•Analyzing Personal Information for business reporting and providing personalized services.

•To analyze or predict your preferences in order to prepare aggregated trend reports on how our Platform is used, so we can improve our Services.

•To better understand your interests and preferences, so that we can personalize our interactions with you and provide you with information and/or offers tailored to your interests.

•To better understand your preferences so that we can deliver content that we believe will be relevant and interesting to you.

•Allowing you to participate in our events.

•To plan and host events or webinars for which you have registered or that you attend, including sending related communications to you.

We will process your Personal Information on the basis of our legitimate interests as described above. Where required by applicable law, we will request your prior opt-in consent. For example, we will only send you direct marketing communications by email if you opt in through your notification preferences or otherwise.

You may at all times opt out from receiving marketing-related emails from us. If you no longer want to receive marketing related emails from us on a going-forward basis, you may opt out by clicking the “Unsubscribe” link in the email or by updating your notification preferences on your profile dashboard.

We will try to comply with your request(s) as soon as reasonably practicable. Please note that if you opt out of receiving marketing related emails from us, we may still send you important administrative messages, from which you cannot opt out.

Disclosure of Personal Information

We disclose Personal Information to the following recipients:

•The relevant Service Providers that you've requested services from will receive Personal Information relevant to their provision of the services. The Service Providers are independent controllers for the processing of the Personal Information that we share with them. We have entered into appropriate data sharing agreements with these Service Providers to ensure compliance with applicable data protection requirements.

•Our third party service providers, such as IT and related infrastructure service providers, including: our cloud hosting provider (in the United States); our identity and sign-in provider; the videoconferencing platform we use to facilitate your communication with the Service Provider(s) (which receives your device's connection details when you join a call, but no name and no booking reference from us — each consultation takes place in a single-use, random meeting room; if you use the in-call chat or share files during a consultation, those messages and files pass through the videoconferencing platform, are encrypted, and are automatically deleted within about a minute of the call ending — we do not receive or store them); our AI service provider (which receives the messages you type to the assistant, as described above); and our messaging and email delivery providers (which receive your phone number or email address and the notification text, which never contains medical content).

•Within the services themselves: the Medical Provider's facility staff can see your name and booking progress in order to receive you and coordinate your visit. Within MEDam.com, access to your identity and contact details is restricted to authorized personnel, and bulk or sensitive data access is logged and audited.

Other Disclosures

We will also disclose your Personal Information as necessary or appropriate, in particular when we have a legal obligation or legitimate interest to do so:

•to public and/or government and/or regulatory authorities, including courts, tribunals, regulators, tax authorities and other government authorities;

•to third persons (legal or natural), as relevant for the specific legal action and/or processes in question (such as lawyers, auditors, insurers, advisory firms, etc.); or

•to third parties in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings). You will be notified of any such business transaction and of possible changes to the processing of your Personal Information in accordance with applicable law and the "Updates To This Privacy Notice" section.

AI ASSISTANT (CONCIERGE)

The Platform includes an AI-powered assistant you can chat with to explore procedures, doctors, and prices. The messages you type are transmitted to our AI service provider (located in the United States) solely to generate the assistant's responses. Your messages will not be used by our AI service provider to train their AI model.

MEDam does not store the content of your assistant conversations; we record only non-content facts about each exchange (such as that a conversation occurred, and technical usage measures) for service operation and cost accounting. Please do not include any sensitive or medical information in assistant messages — the assistant does not provide medical advice, and anything medically relevant should be discussed with your doctor.

COOKIES AND SIMILAR TECHNOLOGIES

When you visit our Platform, we may collect Personal Information through the use of cookies and similar technologies. We do not use advertising cookies or third-party analytics services on the Platform. The technologies we do use are:

•Strictly necessary storage: sign-in session cookies (set by our identity provider) and security verification (bot-protection) that keep your account secure.

•Functional storage in your browser: your saved doctor shortlist, an in-progress booking, and your display currency and language preferences. These exist only to make the Platform work for you and are not used to track you.

•A first-party measurement identifier: a randomly generated pseudonymous identifier stored in your browser, used to measure how the Platform is used (for example, how many visitors search and go on to book) and to test design variations. If you sign in, this identifier may be associated with your account so that we can measure complete journeys. It is used only for the aggregate analysis described under "Improving the Platform" above, is never shared with advertisers, and the underlying usage events are deleted after the retention period stated below.

•Third-party content: no third-party content loads on our pages. Facility location maps are static images served by the Platform itself, so viewing a page sends nothing to any map provider. Where we offer a link to open a location in an external maps service, following that link leaves our Platform and the external service receives your device's connection details under its own privacy policy.

SECURITY

We seek to use reasonable organizational, technical and administrative measures to protect Personal Information within our organization. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the "Contacting Us" section below.

HOW YOU CAN EXERCISE YOUR RIGHTS

Users, Service Providers and doctors or other medical professionals can access and update their Personal Information by logging in to their account. To request deletion of your account and associated Personal Information, or a copy of your Personal Information, contact us at privacy@medam.com in accordance with the "Contacting Us" section below.

In addition, if you would like to request to access, correct, update, suppress, restrict, or delete Personal Information, object to or opt out of the processing of Personal Information, withdraw your consent (which will not affect the lawfulness of processing prior to the withdrawal), or if you would like to request to receive a copy of your Personal Information for purposes of transmitting it to another company (to the extent these rights are provided to you by applicable law), you may contact us in accordance with the "Contacting Us" section below. We will respond to your request consistent with applicable law.

In your request, please make clear what Personal Information you would like to have changed or whether you would like to have your Personal Information suppressed from our database. For your protection, we may only implement requests with respect to the Personal Information associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable.

Please note that we may need to retain certain Personal Information for (i) recordkeeping purposes and/or to complete any bookings that you made prior to requesting a change or deletion or (ii) legal or regulatory compliance purposes even after deletion is requested or consent is withdrawn.

If you are in Armenia, you may lodge a complaint with the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia. If you are a resident of the EU/EEA, you may lodge a complaint with an EU/EEA data protection authority for your country or region where you have your habitual residence or place of work or where an alleged infringement of applicable data protection law occurs; a list of EU/EEA data protection authorities is available on the European Data Protection Board website (edpb.europa.eu).

RETENTION PERIOD

We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law, for example, for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

The criteria used to determine our retention periods include (i) the length of time we have an ongoing relationship with you and provide the services to you (e.g., for as long as you have an account on the Platform); (ii) whether there is a legal obligation to which we are subject; or (iii) whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

Specific retention periods we apply today include, for example, the following: your screening questionnaire is permanently deleted when your treatment is completed or your booking is cancelled or expires; platform usage (measurement) events are deleted after 90 days; and feedback reports and their screenshots are deleted after 180 days.

THIRD-PARTY SERVICES

This Privacy Notice does not address, and we are not responsible for the privacy, data, or other practices of any third parties, including Service Providers or individual doctors, or any third-party operating any site or service to which the Platform links (including payment service providers). The inclusion of a link on the Platform does not imply endorsement of the linked site or service by us. We generally have no control over, and are not responsible for, any third party's collection, use and disclosure of your Personal Information.

THIRD PARTY PAYMENT SERVICES

The Platform has functionality allowing you to make payments to MEDam.com and the Service Providers using third-party payment services with which you have created your own account. When you use such a service to make a payment, your Personal Information will be collected by such third party and not by us, and will be subject to the third party's privacy policy, rather than this Privacy Notice. We have no control over, and are not responsible for, this third party's collection, use, and disclosure of your Personal Information.

USE OF SERVICES BY MINORS

The services are not directed to individuals under the age of eighteen (18), and we do not knowingly collect Personal Information directly from individuals under 18.

JURISDICTION AND CROSS-BORDER TRANSFER

MEDam.com is located in Armenia and its service providers may be in countries outside of Armenia, such as the United States. Your Personal Information may be stored and processed outside of your country of residence, and in any case in Armenia and the United States.

Where we transfer Personal Information that is subject to data transfer restrictions under applicable law, we ensure that the relevant requirements of applicable law are met prior to the transfer. For transfers subject to EEA/UK/Swiss data protection law, one of the following safeguards is implemented:

•Adequacy Decisions: Some countries are recognized as providing an adequate level of data protection according to UK, Swiss or EEA standards. This includes transfers to United States recipients that are certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions).

•Standard Contractual Clauses: For transfers of Personal Information from the EEA/UK/Switzerland to third countries which are not considered adequate by the competent authority, we put in place standard contractual clauses adopted by the competent authority to protect your Personal Information. You may obtain a copy of these measures by contacting us in accordance with the "Contacting Us" section below.

SENSITIVE INFORMATION

Unless we request it, we ask that you not send us, and you not disclose, any sensitive Personal Information (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background, or trade union membership).

UPDATES TO THIS PRIVACY NOTICE

The "Last Updated" legend at the top of this Privacy Notice indicates when this Privacy Notice was last revised. Any changes will become effective when we post the revised Privacy Notice on the Platform. When you next log in to your account, you will be presented with the updated Privacy Notice.

CONTACTING US

MED.AM LLC, a company registered in the Republic of Armenia with its registered office at Dzorap Street, 70/3, Yerevan, Armenia, is the company responsible for collection, use, and disclosure of your Personal Information under this Privacy Notice.

If you have any questions about this Privacy Notice, please contact us at privacy@medam.com.

Because email communications are not always secure, please do not include sensitive information in your emails to us.

Have Questions? Let's Connect

Call us Email us