Privacy Policy

Who we are

The Pain Clinic is operated by Medifood Malta Limited (company registration C102491), trading as The Pain Clinic, the data controller responsible for your personal data. Our website address is https://painclinic.com.mt. This policy explains what data we collect through our clinic and website, why we collect it, who we share it with, and the rights you have over it.

What personal data we collect

We collect personal data, including health data, in order to provide medical care and run our services. Depending on how you interact with us, this may include:

Account & identity

When you register for an account we collect your name, email address, phone number, date of birth and national identification number, together with authentication data managed through our login provider.

Appointments & intake

When you book or attend an appointment we record booking details and the information you provide in your patient intake form, including your reason for visit, pain score, current medications and related clinical notes. This is health data and is treated with particular care.

Prescriptions & permits

Where treatment requires it, we hold records of prescriptions and the medical-use permits applied for on your behalf, along with the clinical information needed to support them.

Orders & payments

When you place an order we collect the order details and the information needed to fulfil and bill it. Card payments are processed by our payment provider; we do not store full card numbers on our own systems.

Quizzes & eligibility checks

If you complete one of our online quizzes or eligibility checks we record your answers and, where you provide it, your email address so we can follow up or so a clinician can review your responses.

Newsletter & marketing

If you ask to receive our newsletter or marketing emails we store your email address and a record of your consent. Technical information such as your IP address and browser user-agent string may be logged for security, fraud prevention and to evidence consent.

Lawful bases for processing

We only process your personal data where we have a lawful basis to do so:

• Contract. To provide the care, appointments, prescriptions and orders you request from us.
• Legitimate interests. To run our clinic safely and efficiently and to send you essential service communications about your appointments, prescriptions and orders.
• Consent. To send you marketing emails such as our newsletter. We rely on your explicit consent for marketing, and you can withdraw it at any time (see below).
• Legal obligation. Where we are required to retain or disclose data to comply with medical, regulatory, tax or other legal duties.

Because we process health data, we additionally rely on the grounds that permit processing for the provision of health care and for reasons of substantial public interest under applicable data protection law.

Who we share your data with

We do not sell your personal data. We share it only with service providers (processors) who help us run the clinic and website, and only to the extent needed for their service. Our key processors are:

• Brevo — email delivery and marketing list management (newsletter and marketing emails).
• Resend — transactional email delivery used as a fallback for essential service messages.
• Cloudflare — website hosting and our application database (Cloudflare D1).
• Revolut — processing of card and online payments.
• Firebase — account authentication and login.
• Setmore — appointment booking and scheduling.

We may also disclose data to our professional advisers, or to public authorities and regulators, where we are required to do so by law.

Marketing emails & your consent

Marketing emails are sent only on the basis of a single opt-in: you must take a clear affirmative action (such as ticking a consent box) before we add you to our list. We record each opt-in together with a timestamp and the IP address it was made from, as proof of consent.

You can withdraw your marketing consent at any time, with no effect on the essential service emails relating to your care. To withdraw, update the email preferences in your account or use the one-click unsubscribe link included in every marketing email.

To protect deliverability, email addresses that bounce or that mark our messages as spam are automatically suppressed and will no longer receive email from us.

How long we keep your data

We keep personal data only for as long as necessary for the purposes described above. We do not retain data indefinitely.

• Medical and clinical records (including intake, prescriptions and permit records) are retained for the period required by applicable medical record-keeping and regulatory rules, typically up to ten years after your last interaction with us, unless a longer period is legally required.
• Order, payment and accounting records are retained for the period required by tax and accounting law, typically up to ten years.
• Quiz and eligibility-check responses are retained for up to two years to support follow-up and clinical review, unless you ask us to erase them sooner.
• Newsletter and marketing data is retained until you unsubscribe or withdraw consent; a minimal record of your consent or unsubscribe is kept afterwards to evidence that we acted on your choice.

At the end of the relevant period we securely delete or anonymise the data, except where we are legally obliged to keep it.

Your rights over your data

Under data protection law you have the right to access the personal data we hold about you and to receive an export of it, to have inaccurate data corrected, to request erasure of your data, to restrict or object to certain processing, and to data portability. Where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, contact us at info@painclinic.com.mt. We will respond within the timeframes required by law. Please note that we may be required to retain certain data for medical, legal or regulatory reasons even after an erasure request. You also have the right to lodge a complaint with the Information and Data Protection Commissioner in Malta.

Contact information

If you have any questions about this privacy policy, please contact us at info@painclinic.com.mt or call us on +356 2166 6903.