Last updated: 5 November 2026
Your health story is yours. You pay us, not the clinics. So we have no reason to use your information for anything except getting you the right care. Here is what we collect, why, who sees it and what you control.
Who this notice covers
This notice covers gisello.com, your Patient Vault, our calls and messages with you, and every service we provide along your journey.
It applies to patients in the United Kingdom, the European Union, Switzerland and the United Arab Emirates. Where the law asks for your consent, we ask for it separately, and you can withdraw it at any time.
What personal information do we collect?
We collect what we need to match you with the right clinic and run your journey end to end, and nothing more.
Information you give us. Your name, contact details and country of residence; your medical history, test results, scans, diagnoses, medications and treatment history; what matters to you, such as dates, budget, language and clinic preferences; travel details needed for bookings; and anything you tell your Care Advisor. If you share information about a partner or donor, we use it only for your journey.
Information collected automatically. How you use our website and Vault: device and browser type, IP address, pages viewed, sign-in times, and a log of who opened which document in your Vault.
Information from other sources. Reports and confirmations from the clinic you choose; documents your home doctor uploads at your invitation; results from testing partners; booking confirmations from travel partners; and payment status from our payment provider. We never receive your full card number.
Health information is special-category data. We collect it only with your explicit consent, or where the law otherwise allows it to provide the service you asked for.
How do we use your information?
We use your information to deliver your journey, keep it safe, and make Gisello better for the next patient.
The table shows each purpose and the legal basis we rely on in the UK, the EU and Switzerland.
| Purpose | What we use | Legal basis |
|---|---|---|
| Create your account and Patient Vault | Contact details, sign-in data | Contract |
| Build your patient brief and match you with clinics | Health information, preferences | Contract and your explicit consent |
| Coordinate treatment, travel and aftercare | Health, travel and contact details | Contract and your explicit consent |
| Take payment | Payment status, contact details | Contract; legal obligation |
| Prevent fraud and keep the service secure | Device data, access logs | Legitimate interests |
| Improve our matching and service | Pseudonymised or de-identified journey and outcome data | Your explicit consent for health data; legitimate interests for other data |
| Send updates and news | Email address | Your consent; unsubscribe any time |
| Meet legal, tax and regulatory duties | Records the law requires | Legal obligation |
| Act in a medical emergency during your trip | Health and contact details | Vital interests |
We do not use your health information for advertising, and we never sell it.
How do we use AI and matching?
AI helps us work faster and more consistently. A person checks every recommendation, and you make every decision.
Reading your records. AI organises the documents you upload into a structured patient brief and flags tests that are missing.
Matching. We rank clinics against more than 20 factors from your medical profile, needs and preferences. Clinics pay us no commission, so they cannot buy a higher place on your list.
Human review. A Care Advisor reviews every match before you see it. Non-standard cases go to our Head of the Centre of Excellence and, where needed, a member of our Scientific Committee.
Your choice. We never make a decision about you based solely on automated processing that has a legal or similarly significant effect. You choose the clinic, and you can ask a person to review any AI output.
Guardrails. Every sensitive action, such as opening a record, sending a brief to a clinic or moving data across borders, is checked by our compliance rules first. Our AI providers act on our instructions under contract and may not use your information to train their own models.
Who do we share your information with?
Only the people and companies who need it to deliver your journey, and only as much as each one needs. We do not sell personal information, and we take no commission from clinics.
Clinics on your shortlist. During matching, a clinic sees only what it needs to confirm it can treat you. Once you book, the clinic you chose receives your full clinical brief, and we tell you when this happens.
People you invite. If you share your Vault with your home doctor, they verify with a one-time code and can read and add documents. You can remove their access at any time.
Travel partners. Airlines, hotels and transfer providers receive your name, travel dates and passport details. They never receive health information.
Payment provider. Our payment provider processes your payment.
Our Scientific Committee. Independent clinicians review complex cases, using pseudonymised information wherever possible.
Service providers. Companies that run parts of our service for us, such as cloud hosting, AI, scheduling, video calls, messaging and email. They may use your information only to provide that service to us.
Legal and safety reasons. When the law requires it, or to protect you or others in an emergency.
Business transfers. If Gisello is reorganised, merged or sold, your information stays protected by this notice.
Anyone else receives your information only with your consent.
Where is your information stored?
Your records move abroad only to the clinic and partners you chose for your treatment.
Where your records are today. During our 2026 pilot, records are stored with Supabase on secure servers in London, United Kingdom.
As we grow. We will store records in each patient’s home region, and tell you in your Vault before anything moves.
Transfers for your treatment. Sending your brief to a clinic in another country is necessary to deliver the service you asked for. Where that country has no adequacy decision, we use the safeguards the law provides, such as the EU Standard Contractual Clauses or the UK International Data Transfer Agreement.
Our team. Your Care Advisor and our team access records only for the patients they serve.
How do we protect it, and how long do we keep it?
We protect your information the way a clinic would, and keep it only as long as you or the law need it.
Security. Encryption in transit and at rest; staff and AI agents see only the cases they are authorised for; and every access to your records is logged.
Your part. Keep your password and sign-in codes private, and sign out on shared devices.
Retention. We keep your Vault while your account is open. You can delete it yourself; deletion completes after a 30-day grace period, so you can change your mind. Some records we must keep longer by law: payment and tax records for 5–7 years, and UAE health records for at least 25 years. We then delete or anonymise them.
What choices and rights do you have?
You can see everything we hold in your Vault, and most choices take one click there.
See and download. Your Vault shows your records, your brief, your clinic matches and who has access. You can download a copy.
Correct. You can correct your information. We keep a note of what changed and why, so your clinic always sees an accurate record.
Delete. Delete your Vault from your settings, subject to the legal retention periods above.
Withdraw consent. Withdraw consent for health data, research use or marketing at any time. This does not undo past processing, and without consent for health data we cannot run your journey.
Object or restrict. Object to processing based on legitimate interests, or ask us to pause using your information.
Take it with you. Ask for your information in a machine-readable format.
Control access. Add or remove your home doctor, and see every clinic that holds your brief.
Stop marketing. Use the unsubscribe link in any email.
We answer requests within one month. If you are unhappy with our answer, you can complain to your data protection authority:
United Kingdom: the Information Commissioner's Office (ICO)
Switzerland: the Federal Data Protection and Information Commissioner (FDPIC)
Other EU countries, such as Germany or Austria: your national or regional data protection authority
United Arab Emirates: the UAE Data Office
Cookies, children and changes
Cookies. We use essential cookies to run the site and Vault. Analytics cookies stay off until you accept them, and you can change your choice at any time with the shield button in the corner of every page.
Children. Gisello is for adults aged 18 and over. We do not knowingly collect information from children.
Changes. We update this notice as our service grows. If a change affects how we use your health information, we tell you in your Vault before it takes effect.
Who we are and how to reach us
Gisello Health Technology, Dubai, United Arab Emirates, is the controller of your information and the company you contract with.
Questions or requests about your information: tanja@gisello.com
Examples of information we collect
Information you give us when you
book your first call or message a Care Advisor
create your profile and tell us what matters to you
upload medical records, test results or scans to your Vault
choose a clinic, confirm dates and pay
share your Vault with your home doctor
tell us how your treatment and recovery went
Information we collect automatically
IP address, device and browser type, time zone
pages viewed on gisello.com and how you arrived there
sign-in times and two-step verification events
which documents were opened in your Vault, and by whom
Information from other sources
treatment reports, invoices and aftercare notes from your clinic
documents your home doctor adds to your Vault
results from testing partners near your home
booking confirmations from travel partners
payment confirmations