Privacy Policy
Last updated: July 29, 2026
Who controls your data
TransplantMatch is operated by Pipa Partners Ibera SA in Valencia, Spain. For privacy questions or requests, email info@transplantmatch.com.
Data we collect
- Consultation and matching data: your name, email address, optional phone number, location, procedure interests, budget, timeline, clinic selections, and any message or photos you choose to submit.
- Necessary technical data: security information, country inferred by our hosting provider, and limited request logs required to operate and protect the site.
- Optional analytics data: a pseudonymous visitor and session identifier, pages viewed, searches, clicks, referrer domain, browser information, and campaign attribution. We collect this only after you accept analytics.
- Optional advertising data: Google click identifiers and campaign parameters used to measure inquiries. We store these only after you accept advertising.
We remove personal contact fields from analytics payloads and do not intentionally send names, email addresses, or phone numbers to Google Analytics.
Why we use data
Provide the service: process your request, generate clinic matches, route your inquiry to the clinics you select or ask us to match, and send confirmations. The legal basis is taking steps at your request and performing the service you requested.
Security and reliability: prevent abuse, diagnose failures, and protect the site. The legal basis is our legitimate interest in operating a secure service.
Analytics and advertising measurement: understand site use and measure campaign results. The legal basis is your consent. You can change or withdraw that consent at any time.
Who receives data
- Clinics you select, or clinics included in the matching request you submit, so they can respond to you.
- Cloudflare for hosting, delivery, and security.
- Supabase for secure storage of lead and first party analytics records.
- AgentMail for operational and confirmation email delivery.
- Google Analytics and Google Ads only according to your consent choices.
Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, standard contractual clauses, or another lawful transfer mechanism.
Storage and retention
We keep lead information only for as long as needed to process the request, manage the clinic relationship, resolve disputes, meet legal obligations, and prevent abuse. Analytics and campaign data follow the retention settings of the relevant service. When data is no longer required, it is deleted or anonymized. You may ask us for the retention criteria that apply to your record.
Cookies and local storage
| Name | Purpose | When used |
|---|---|---|
| tm_consent_v1 | Stores your privacy choice in local storage. | Necessary |
| tm_vid, tm_sid | First party visitor and session analytics identifiers. | After analytics consent |
| tm_attr | Campaign attribution for inquiry measurement. | After advertising consent |
| _ga, _ga_* | Google Analytics identifiers. | After analytics consent |
| _gcl_* | Google Ads attribution. | After advertising consent |
Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, object to certain processing, and withdraw consent. You may also complain to your local data protection authority. To exercise a right, email info@transplantmatch.com. We may need to verify your identity before acting on a request.
Children and changes
TransplantMatch is intended for adults considering medical services. We do not knowingly collect personal data from children. We may update this policy when our services or legal obligations change. The date above shows the current version.
