Legal
Privacy policy
How we collect, use and protect your personal and medical information. Last updated September 2026.
Who we are
MedAssist Lanka (Pvt) Ltd ("MedAssist Lanka", "we", "us") is a limited liability company registered under the Companies Act, No. 07 of 2007 of the Democratic Socialist Republic of Sri Lanka. Our head office is at 912/2, Ambassador's Residence, Electricity Board Road, Pannipitiya Road, Battaramulla, Sri Lanka. For any privacy question, contact us at assist@medassist.lk.
Information we collect
We collect only what we need to deliver assistance, which may include:
- Identity and contact details: name, phone number, email address, nationality and passport details where required for admission, visas or repatriation.
- Insurance information: policy numbers, insurer details and claim correspondence.
- Medical information: clinical history, diagnoses, test results and diagnostic recordings such as Holter and ECG data, where you or your treating clinician provide them.
- Case records: notes of the assistance provided, and correspondence with hospitals, insurers, embassies and authorities acting on your behalf.
How we use it
- To arrange and deliver the medical, travel, diagnostic and legal assistance you request.
- To coordinate with hospitals, laboratories, imaging centres, insurers, embassies and transport providers on your behalf.
- To process insurance claims and, where applicable, to bill your insurer directly.
- To meet legal, regulatory and clinical record-keeping obligations.
We do not sell personal data, and we do not use medical information for marketing.
Diagnostic data processing
Where we analyse Holter, ECG or other diagnostic data for healthcare providers and monitoring companies, that data is processed under encrypted, access-controlled workflows designed to meet HIPAA and GDPR requirements. We act as a processor on behalf of the submitting organisation, handle the data strictly according to their instructions, and retain it only as long as the contract and applicable law require.
Sharing
We share information only with parties necessary to deliver the assistance: treating clinicians and hospitals, accredited laboratories and imaging centres, your insurer or assistance company, transport and evacuation providers, and where relevant your embassy or the responsible authorities. Everyone we work with is expected to keep the information confidential and use it only for the purpose it was shared.
We may also disclose information where required by law, court order or regulatory obligation.
Retention
Case and medical records are retained for as long as necessary to provide the service, to support any related insurance or legal process, and to satisfy clinical and statutory record-keeping requirements. When no longer needed, records are securely deleted or destroyed.
Your rights
Subject to applicable law, you may request access to the personal information we hold about you, ask for corrections, request deletion where we are not required to retain it, object to certain processing, or ask for a copy in a portable format. Write to assist@medassist.lk and we will respond as promptly as we can.
Security
We apply technical and organisational safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest for diagnostic data, access controls limiting records to the staff handling your case, and confidentiality obligations on everyone who works with us.
This website
This site is a static website served from Cloudflare's edge network. It sets no advertising or tracking cookies. The enquiry form on our contact page does not transmit anything to us by itself. It opens a pre-filled message in your own email application, which you send yourself. If we enable website analytics in future, this policy will be updated first.
Changes
We may update this policy from time to time. The date at the top of this page reflects the most recent revision.