Privacy Policy

Reni ("we", "us") runs the dialysis travel directory at renidialysis.com. We help people on dialysis find clinics abroad and send them inquiries. We are not a healthcare provider. This policy explains what personal data we collect, why, who receives it, how long we keep it, and the rights you have under the General Data Protection Regulation (GDPR).

1Who is responsible for your data

The data controller is David Pesola, an individual, who operates Reni.

Controller: David Pesola
Postal address: Av Francisco Sa Carneiro, lote 6, 2A, 2415-376 Leiria, Portugal
Privacy contact: reni.support@gmail.com
Website: https://renidialysis.com

We have not appointed a Data Protection Officer. Please send any question about this policy or your data to the privacy contact above.

2What we collect and why

Clinic inquiries

When you send an inquiry to a clinic, you give us your name, email address, phone number (optional), nationality, insurance type (optional), type of dialysis, sessions per week, travel dates and any notes you write. Your notes may include health details, such as your machine type or allergies.

We write to the clinic you chose on your behalf, from our own address, with your first name and the first letter of your last name, travel dates, type of dialysis, sessions per week, insurance, country and any notes you wrote. The clinic replies to us, not to you, and we pass its answer on to you. If the clinic cannot help, or has not answered after five working days, we may ask up to two other listed clinics near it in the same way. We give your full contact details to a clinic only once it can take you. We do not keep a copy of the emails' text; our email provider keeps a delivery record (section 3).

We store a record of the inquiry in our database: your name, email address, type of dialysis, travel dates, the clinic and destination, and your consent choices with the time you gave them, plus your phone number only if you also tick the optional contact box described below. We also keep a case record for your request: a case code, the clinics we asked and their answers, and the date and recipient of each email about it. We use these records to follow up with the clinics, to prevent abuse of the form, and to show that you gave consent.

Our first email gives you a private link to a short form where you can add the details the clinic's own form asks for: your date of birth, home and holiday address and phone, an emergency contact, your insurer and insurance number, how to reach your home dialysis unit and your kidney doctor, your preferred session days and times, and the month of your last routine hepatitis and HIV test (never the result). We use them only to prepare your request for the clinic that can take you. We never ask for medical results on this form: your own unit fills in the clinic's medical pages. These details are part of your case record and are kept and deleted with it.

Legal basis: your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)). The form asks for it with a required checkbox that names the health information and the clinics that may receive it. Without it we cannot send your inquiry. You can withdraw your consent at any time by writing to reni.support@gmail.com; withdrawal does not undo an inquiry we have already sent.

Replies to your request

When you send us a trip planning request or ask for a guide, we reply by email, or by phone or WhatsApp if you tick that box on the form. Replying to a request you sent is part of handling it, so it needs no extra checkbox. WhatsApp is run by WhatsApp Ireland Limited, part of Meta (section 3).

Legal basis: taking the steps you asked for (Art. 6(1)(b)).

Optional follow-up contact

The clinic inquiry form and the Plan my trip form also offer a separate, optional box. It covers only contact beyond your request: on a clinic inquiry, following up with you about it, for example to check that the clinic replied; on Plan my trip, telling you about future trips and offers. We record the wording you agreed to and when. It is never required to send a form. The trip pop-up and our campaign pages have no such box: they ask for one short consent, and we contact you only to reply to that request.

Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time: with Stop follow-up contact on your Account page if you have a community account with the same email address, by writing to reni.support@gmail.com, or by replying to any message from us. When you withdraw, we also delete the phone number we kept with your clinic inquiries and stop phone and WhatsApp contact about your trip requests.

Trip planning requests and guide downloads

When you ask us to help plan a trip or download a destination guide (on the Plan my trip page, the trip pop-up or our campaign pages), we collect your name, email address, phone number (optional), destination, travel dates or travel window, the number of people travelling, your treatment type, sessions per week, insurance type, the country you live in, why you travel (optional), the help you need, years on dialysis (on some forms), your notes, your language and the campaign tags in the link that brought you to us. We use them to reply to your request, send you the guide you asked for and help you plan your trip. With your explicit consent, we share the dialysis details you give us with dialysis clinics at your destination to arrange your sessions. For a request to plan your own trip, we keep a case record as for a clinic inquiry and write to up to three listed clinics near your destination on your behalf, with your first name and the first letter of your last name, travel dates, treatment type, sessions per week, insurance and country; the clinics reply to us. We store the request in our database, and a copy of it reaches our inbox by email.

Legal basis: taking the steps you asked for (Art. 6(1)(b)) and, for the dialysis details, your explicit consent (Art. 9(2)(a)), which you can withdraw at any time by writing to reni.support@gmail.com.

Community accounts

If you create a community account, we process your email address and either a password (stored by our authentication provider, never by us in readable form) or, if you sign in with Google, the name, email address and profile picture Google shares with us. We also keep your nickname, your posts and replies, and a record of which version of our Terms you accepted and when. Your nickname, profile picture, posts and replies are visible to everyone, so please do not post health details you would not want to be public.

Legal basis: providing the account and community you signed up for under our Terms (Art. 6(1)(b)).

Visiting the website

Server logs and security. Our hosting provider records technical data about each request, such as your IP address, browser and the page requested, to run and protect the site. To stop spam and abuse of our forms, we keep a one-way hash (not the value itself) of your IP address and of the email address used on a form, only for the time window of the limit. Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f)).
Search statistics. We record searches made in the directory (the words searched, the destination, the number of results and your browser language), without storing who you are, to learn which destinations people need. Legal basis: our legitimate interest in improving the directory (Art. 6(1)(f)).
Maps. When a page shows a map, your browser loads the map images from OpenFreeMap, which receives your IP address to deliver them.
WhatsApp. If you tap our WhatsApp button, you start a chat in WhatsApp. WhatsApp handles that chat under its own privacy policy, and we see what you send us there.
Analytics and advertising. Only if you allow them in our cookie settings. See section 6.

3Who receives your data

The clinic you choose, and up to two other listed clinics near it if it cannot help. We send your inquiry to the clinic's contact address and, where the clinic lists one, to its second address. Some clinics belong to groups that handle every visitor booking through one central desk (for example Fresenius Medical Care / NephroCare and Diaverum); for those clinics your inquiry goes to that central desk. For a trip planning request, the recipients are the dialysis clinics at your destination that we contact to arrange your sessions. The clinic or group is responsible for your data once it receives it, under its own privacy policy.

Service providers that run the site for us:

Supabase (Supabase Pte. Ltd., Singapore): our database and community sign-in. The database is hosted in the European Union (Ireland).
Vercel (Vercel Inc., United States): hosts the website and runs the server functions that process our forms, which run in the European Union (Dublin, Ireland). With your Analytics consent, Vercel Web Analytics and Speed Insights measure visits and page speed, without cookies.
Resend (Plus Five Five, Inc., United States): sends our emails, including your inquiry to the clinic. The emails leave from its European (Ireland) sending region, but Resend keeps email records and logs in the United States.
Google Tag Manager and Google Analytics (Google Ireland Limited): only with your consent (section 6).

Other companies involved, which also decide themselves how they use the data they receive, under their own privacy policies:

Google: our inbox is a Gmail account, where the clinics' answers to your inquiry, trip planning requests, guide requests and privacy requests arrive. With your Advertising consent, Google Ads measures our ads (section 6). If you choose Google sign-in, Google confirms your identity to us.
Meta (Meta Platforms Ireland Limited): with your Advertising consent, the Meta Pixel measures our ads (section 6). Meta and we are joint controllers for collecting the event data on our site and sending it to Meta; Meta alone is responsible for what it does with the data afterwards. You can exercise your rights with us or with Meta.
WhatsApp (WhatsApp Ireland Limited, part of Meta): carries any WhatsApp chat you start with us, and our replies by WhatsApp when you ask for them.
OpenFreeMap (Hyperknot Software Kft., Hungary): provides the map images.

We may also disclose data to public authorities where the law requires it. We do not sell your personal data.

4Transfers outside Europe

Our database is hosted in Ireland, but some providers process data outside the European Economic Area:

Vercel runs our server functions in the European Union (Dublin, Ireland), but Vercel Inc. is based in the United States: its global network delivers the website from locations outside the European Economic Area, and Vercel may access data from the United States, for example for support. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing adequate protection.
Resend keeps email records and logs in the United States. Resend is certified under the EU-U.S. Data Privacy Framework, and its data processing terms also include the European Commission's Standard Contractual Clauses.
Supabase Pte. Ltd. is based in Singapore and may access data from outside the European Economic Area, for example to give support. Its data processing terms include the Standard Contractual Clauses.
For Google and Meta we deal with their Irish companies. Their US parent companies, Google LLC and Meta Platforms, Inc., are certified under the EU-U.S. Data Privacy Framework.

You can ask us for details or a copy of these safeguards at reni.support@gmail.com.

5How long we keep your data

Case records for your inquiry: our notes are cleared 30 days after your case closes; 12 months after it closes we remove your name, email address and dates and keep only anonymous counts (destination, month, outcome).
Clinic inquiries: 12 months after the end date of your trip, then deleted, together with our notes about them. The clinic keeps its copy under its own policy.
Trip planning requests and guide downloads: 24 months after our last contact with you, then deleted, together with our notes about them.
Optional follow-up consent: until you withdraw it, or until the request it belongs to is deleted.
Community account: until you delete it. When you do, you choose whether your topics and replies are deleted or stay on the forum without your name.
Your cookie choice: 180 days, after which we ask again.
Abuse-prevention hashes: only for the time window of each limit.

6Cookies and similar storage

Strictly necessary (always on, because the site cannot work without it):

dialysis_cookie_preferences (local storage): your cookie choice, its version and date. It is valid for 180 days, or until our cookie settings change; then we ask you again.
The sign-in token of our authentication provider (local storage), while you are signed in to the community.
dt.postLoginRedirect and dt.pendingTermsAcceptance (session storage): bring you back to the right page after sign-in and record your acceptance of the Terms. Deleted when you close the tab.
reni_next_trip_popup_seen (session storage): stops the trip pop-up from showing twice. Deleted when you close the tab.

Analytics & Performance (only with your consent): Google Analytics, which sets the _ga and _ga_* cookies, and Vercel Web Analytics and Speed Insights. They count visits and measure page speed.

Google Tag Manager, the tool that loads Google Analytics and the advertising tags, loads only once you allow Analytics or Advertising.

Advertising (only with your consent): the Meta Pixel and Google Ads, which set cookies such as _fbp, _fbc and _gcl_*. They measure whether our ads work and may show you related ads. Meta and Google receive details of your visit, and because this site is about dialysis travel, they may infer an interest in dialysis care.

None of these analytics or advertising tools load until you choose, and they stay off if you decline. You can change or withdraw your choice at any time with , also linked at the bottom of every page. When you withdraw, we delete the analytics and advertising cookies stored under our domain; cookies that Meta or Google keep on their own domains are managed in your browser or your account with them.

7Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent at any time (this does not affect processing that already happened).

If you have a community account, your Account page offers three tools. They cover your account and also the clinic inquiries and trip requests sent with the same email address:

Download my data gives you a file with your account and sign-in details, profile, topics, replies and Terms acceptances, plus those inquiries and trip requests, their case records and our notes about them.
Stop follow-up contact withdraws the optional contact consent on all of those inquiries and trip requests.
Delete my account deletes your account, profile and Terms records, and those inquiries and trip requests with their case records and our notes about them. A clinic keeps the copy of an inquiry it received. You choose whether your topics and replies are deleted or stay on the forum shown as by "Anonymous". A topic that other members replied to is not removed: its title and text are replaced with "Deleted topic", so their replies stay.

You can also delete any topic or reply you wrote from the forum itself. To protect your data, downloading it and deleting your account ask you to have signed in within the last 15 minutes. The tools reach inquiries and trip requests only once you have shown that the email address is yours: by signing in with Google, through a link we emailed you, or with a password on an account whose address you confirmed through the link we sent when you signed up.

For anything the tools do not cover, and for any other request, write to reni.support@gmail.com. We reply within one month. We may ask you to confirm that the request comes from you, for example by writing from the email address you used.

You also have the right to complain to a data protection supervisory authority: in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or the authority in the country where you live or work.

8Automated decisions

We do not make decisions about you based solely on automated processing.

9Changes to this policy

When we change this policy, we update the date and version at the top of this page.