- We only collect what we need to assess whether treatment is right for you and to organise your trip.
- Your health information is shared only with the treating partner clinic, and only with your consent.
- We never sell your data or use it for anyone else's advertising.
- You can ask us to see, correct or delete your data at any time.
1. Who we are
Baltic Bariatric is a medical travel coordination service run by the company below. We are the data controller for the personal data described in this policy.
SIA "Baltic Medical Group" (trading as Baltic Bariatric)Reg. No. 50103334781 · VAT LV50103334781
Viestura prospekts 11-9, Riga, LV-1005, Latvia
Email: balticbariatric.group@gmail.com · WhatsApp: +371 22004252
We coordinate your treatment; the medical treatment itself is provided by licensed partner clinics in Latvia, which are separate controllers for the medical records they create.
This policy applies to all personal data we process about you, however you give it to us: through our website, by email, WhatsApp, Facebook or Instagram, by phone or in person. We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Latvian Personal Data Processing Law and other applicable laws.
2. What data we collect
Information you give us
- Contact details: name, email address, phone / WhatsApp number, country of residence.
- Health information: age, gender, height, weight, BMI, medical conditions, medication, allergies, previous surgery, mental-health history, weight-loss history and anything else you choose to share in our eligibility check or medical questionnaire.
- Travel and booking details: preferred procedure, dates, flight details, hotel and transfer arrangements, and payment records.
- Messages: what you write to us by email, WhatsApp, Facebook or Instagram.
Information collected automatically
When you visit our website, our hosting provider (Netlify) and the services that deliver fonts and images (Google Fonts, Pexels) receive your IP address and basic browser information so the page can load. We only use advertising cookies if you agree to them; see "Cookies and the Meta Pixel" below.
3. Why we use your data and our legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Assessing whether a procedure may be suitable for you and passing your answers to the specialist | Contact and health information | Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
| Replying to your enquiry and preparing a quote | Contact details, procedure of interest | Steps at your request before a contract (Art. 6(1)(b)) |
| Organising your treatment, hotel and transfers, and providing 12-month follow-up | Contact, health, travel and booking details | Contract (Art. 6(1)(b)); explicit consent for health data (Art. 9(2)(a)) |
| Invoicing, accounting and tax records | Name, address, payment records | Legal obligation (Art. 6(1)(c)) |
| Handling complaints and legal claims | Relevant correspondence and records | Legitimate interests (Art. 6(1)(f)) and Art. 9(2)(f) |
| Protecting your health in an emergency during your stay in Latvia, for example sharing information with an ambulance or hospital when you cannot give consent | Contact and health information | Vital interests (Art. 6(1)(d) and Art. 9(2)(c)) |
| Asking for your feedback about our service, and publishing your review, photo or video on our website or social media | Name, country, procedure, your review, photos or video | Your consent (Art. 6(1)(a)); we only publish with your written consent |
| Sending occasional news and useful information to patients who have travelled with us | Name, email | Legitimate interests (Art. 6(1)(f)); you can unsubscribe at any time, free of charge |
Our legitimate interests are: replying to enquiries and staying in touch with our patients, improving the quality of our service, checking the identity of the people we deal with, keeping records as evidence, and resolving disputes or defending legal claims.
If we ever want to use your data for a purpose not described here, we will tell you separately before we do so.
You can withdraw your consent at any time by writing to us. Withdrawing consent does not affect processing that already took place, but we will not be able to continue assessing or organising your treatment without your health information.
4. Who we share your data with
- Partner clinics (Jūrmala Hospital and Dr. Feders Centre, Latvia): the specialist who assesses and treats you receives your health information, only with your consent.
- Hotels and transfer providers: only your name, travel dates and contact details needed to book your stay and pick-ups.
- Service providers who process data on our behalf: email (Google), website hosting and form handling (Netlify), and messaging platforms you choose to contact us on (WhatsApp, Facebook, Instagram, all operated by Meta).
- Authorities: where we are required to by law.
Service providers who process data on our behalf do so under written agreements (Art. 28 GDPR) that only allow them to use your data to provide their service to us and require them to keep it secure.
Some of these providers (Google, Netlify, Meta) may process data outside the European Economic Area, including in the United States. Where this happens, the transfer is protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
5. How long we keep your data
- Enquiries that do not lead to treatment: deleted within 12 months of our last contact, or sooner if you ask.
- Patients who travel with us: kept for the 12-month follow-up period and then for up to 3 years to handle any questions or claims.
- Invoices and accounting records: kept for 5 years, as required by Latvian accounting law.
Medical records created by the partner clinic are kept by the clinic under Latvian healthcare law.
6. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data deleted ("right to be forgotten"), unless we must keep it by law;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw your consent at any time.
To use any of these rights, email balticbariatric.group@gmail.com. Before we release or change any data, we may ask you to confirm your identity, to make sure we are dealing with you. We reply within one month, by email or in another way you ask for.
In some cases the law allows or requires us to refuse a request, for example when we must keep invoices for accounting purposes, or when data is needed to defend a legal claim. If so, we will explain why.
If you are unhappy with how we handle your data, you can complain to the Latvian Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Riga, LV-1050, pasts@dvi.gov.lv, www.dvi.gov.lv, or to the data protection authority in your own country.
7. Cookies and the Meta Pixel
When you first visit, we ask whether you accept advertising cookies. We save your choice in your browser so we do not ask again.
- If you click "Decline": no advertising or analytics cookies are used and nothing is sent to Meta.
- If you click "Accept": we load the Meta Pixel (Meta Platforms Ireland Ltd.). It tells Meta that a page was viewed, or that an enquiry or questionnaire was sent, so we can measure and improve our Facebook and Instagram adverts. We never send your health information, your form answers or your contact details to Meta.
Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy rules). You can change your choice at any time with the "Cookie settings" link at the bottom of our pages, or by clearing your browser's site data.
8. How we protect your data
Access to your information is limited to the people who need it to help you. We use password-protected accounts with two-factor authentication, share health information with the clinic only through secure channels, and delete data we no longer need.
9. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last updated. If we make significant changes, we will tell patients we are working with directly.