Data protection, for your DPO.

Your clinic is the controller: you decide the lawful basis and the purpose. Thera Travel is the processor and acts only on your documented instructions, under a data processing agreement that names every sub-processor. Where your clinic has its own agreement template, we use it.

The model is Claude on AWS Bedrock and runs inside the EU. AWS is the only processor for that step; the model provider has no access to prompts or replies. The list of EU regions is written into the agreement.

The model can run in any of several EU regions, which is why this page says “inside the EU” rather than naming a city.

WhatsApp content is stored through Meta’s Cloud API with local storage set to Germany. That setting has to be made before your number is registered, so we make it at install and show you the evidence.

Front Desk never asks for health data in the chat. Meta’s policy restricts requesting and sending it where the law requires heightened handling, as Article 9 does, and Meta offers no attestation for healthcare use. Your surgeons’ questions, and any documents they ask for, go through a secure form with the patient’s explicit consent, not through the chat. Who hosts the form, where its answers are stored and how long they are kept are written into the agreement and the sub-processor list. Patients sometimes send clinical detail in the chat anyway. When they do, it is acknowledged, passed to your surgical team, never interpreted, and never repeated back on WhatsApp.

Its first message to every patient says that it is an AI assistant working for your clinic, and names the clinic, as Article 50 of the EU AI Act has required since 2 August 2026. In our own testing it did not always do this, so we are moving that sentence into code, where the AI cannot leave it out, before any clinic goes live.

Regulation (EU) 2024/1689, Article 50. The July 2026 omnibus moved the high-risk dates, not this one.

It handles administration: prices, dates, travel, and sending your surgeons’ questions to the patient and passing the answers on. It does not give medical advice, diagnose, or decide who is suitable for surgery. Those limits are enforced by a rule table and a classifier in front of the model, and every reply is logged against the rules in force when it was sent, so any answer can be reconstructed.

A clinic in Turkey that quotes British patients in pounds is in scope of UK GDPR, including the duty to appoint a UK representative. If it markets to patients in the EU, EU GDPR applies too. The transfer paperwork depends on where your clinic is and where the data goes, so we set out what applies to yours, in writing, before you decide.

Thera Travel also refers patients to clinics, and some of those clinics pay us a referral fee. That is a conflict, and the agreement treats it as one: Front Desk runs in a separate environment that our referral side cannot query; nothing your patients tell you is used for our referrals, our price comparisons or anything else of ours; the people who can see your data are named in the agreement; and you receive an access log every month and the right to audit.

• Data processing agreement

  On your template or the Commission’s standard clauses, with our confidentiality obligations in full.

• Sub-processor list

  Every sub-processor named, with notice before any change.

• Article 9 note

  The lawful basis for special-category data, written for your country.

• A completed draft DPIA

  Filled in for your clinic, for your DPO to review and adopt.

All of it arrives before you sign anything.

No audit and no certification. We build against the law itself: the GDPR and the EU AI Act. When we hold an audit we will name the auditor, the scope and the date.

If you work at a clinic and we have emailed or called you about Front Desk, Thera Travel Limited is the controller of the business contact details we used: your name, role, work email, work phone and the clinic you work for. We took them from your clinic’s own website or a public business listing, and we use them only to tell your clinic about Front Desk and to follow up on any reply.

Our lawful basis is legitimate interests: offering a business service to the business you work for. You can object at any time by replying “stop” or writing to hello@theratravel.co.uk, and we will not contact you again. We keep only the address and the date you asked, so that we never write to it by mistake. Otherwise we delete your details 12 months after our last contact, unless you have become a customer.

We do not sell or share them. Our email runs on Google Workspace, which processes them for us under its data processing terms and may do so outside the UK. You can ask for a copy of what we hold, ask us to correct or delete it, and complain to the Information Commissioner’s Office or your own country’s regulator.