Privacy Policy

Axolotlane ("we," "us," or "our") operates an integrated cross-border dental tourism platform designed to connect consumers with international medical providers. We are committed to safeguarding your personal data, identifying information, and electronic protected health information (ePHI). This Privacy Policy clarifies how our systems capture, encrypt, share, store, and destroy your personal datasets when you interface with www.axolotlane.com or utilize our mobile applications.

This policy applies to all data streams collected through the Platform, including medical intake triage portals, user accounts, installment application modules, and customer support channels. It governs information processed for Canadian citizens, residents of other jurisdictions, and international clinic partners.

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Electronic Protected Health Information" or "ePHI" means patient dental records, diagnostic images, panoramic radiographs, medical history profiles, and clinical triage inputs.
• "Processing" means any digital operation performed on personal data, such as collection, organization, storage, use, transmission, or deletion.

Information You Provide

• Identity and Contact Data: First name, last name, date of birth, home address, province/state of residence, email address, and primary telephone number.
• Identity Verification Data: An image of your government-issued photo ID and the verification result, collected through our identity verification provider before checkout.
• Medical Triage Details: Comprehensive health records, histories of oral health conditions, list of current medications, specific treatment goals, and raw panoramic radiograph files or digital CT image inputs.
• Payment Data: Payment records and the bank details needed to collect prepayments and make refunds. Credit checks for Installment Plans are carried out by the financing partner under its own privacy policy; Axolotlane receives only the approval result and payment status.

Information Collected Automatically

• Device Telemetry: Internet Protocol (IP) addresses, browser variants, operating systems, localized language presets, and chronological interaction metrics.
• Cookie and Session Logs: Core tracking logs mapping navigation paths, specific package tier selections, search history inputs, and engagement lengths across individual clinic views.

We utilize cookies and similar tracking technologies to analyze platform traffic, optimize user experience, and manage marketing campaigns. Our use of cookies is categorized as follows:

• Strictly Necessary Cookies: Essential for the core operation of the Platform, including secure login authentication and session management. These cannot be disabled in our systems.
• Performance and Analytics Cookies: Allow us to count visits and traffic sources to measure and improve platform performance (e.g., Google Analytics).
• Targeting/Marketing Cookies: May be set through our site by our advertising partners to build a profile of your interests and show relevant adverts on other sites.

Users can manage their cookie preferences or opt-out of non-essential tracking through the cookie settings on the Platform or by adjusting their browser settings.

The Platform applies automated machine learning models and vector processing scripts to evaluate user intakes against partner clinic registries. To execute this matching workflow, text descriptions and clinical needs are converted into multi-dimensional arrays. These computational matching vectors are used solely to score clinic compatibility rankings and build optimized travel itineraries.

Axolotlane captures and processes personal and health datasets for the following core operational purposes:

• Generating personalized cross-border dental care Packages and itineraries (clinic appointments, hotel and transfers).
• Collecting prepayments, holding them in trust and paying Partner Clinics and travel providers; passing Installment Plan applications to the financing partner with your consent.
• Securely sharing diagnostic records with selected international Partner Clinics to finalize treatment estimates.
• Providing round-the-clock support via human coordinators and automated communication bots.
• Sending service messages about your bookings and, if you have opted in, promotional messages.

We process personal and clinical datasets under the following legal foundations:

• Contractual Fulfillment: Managing and delivering the Packages, bookings and payment records requested by the user.
• Explicit Consent: Processing sensitive health records and diagnostic image files to match patients with international healthcare providers.
• Legal Obligation: Complying with tax rules, financial monitoring requirements, and medical data retention regulations.

Axolotlane shares designated datasets with specific external entities to complete package configurations:

• Partner Clinics: Selected medical clinics receive your diagnostic records and triage notes to review procedure feasibility.
• Hotel and Transfer Providers: Receive your name, travel dates and contact details to reserve your room and transfers. We do not book flights.
• Financing Partner: Receives the identity and application data you submit when you apply for an Installment Plan, to assess and manage it under its own privacy policy.
• Service Providers: Companies that host our systems or provide payment processing, identity verification, e-signature, messaging, analytics and AI processing services for us. They may use your data only to provide those services to Axolotlane, under contract.

Because Axolotlane facilitates cross-border medical travel, your personal data and health assets will be transmitted outside of your home jurisdiction (e.g., Canada, USA, EU) to the Partner Clinic in the destination you choose (currently Mexico, with Costa Rica and Puerto Rico planned from 2027). We use robust security safeguards, standard contractual clauses (SCCs) where applicable, data access agreements, and strict encryption rules to ensure your information remains protected across all destination borders.

All health information and identity records are hosted within secure cloud facilities that meet enterprise-grade security baselines. We deploy the following strict data defenses:

• Field-level data encryption using hardware-backed AES-256 keys at rest.
• Mandatory TLS 1.3 transport protocols for all data transfers.
• Isolated security environments that separate identifiable user details from diagnostic records.
• Immutable audit logging to record all administrative and clinical access histories.

In the event of a verified data breach that compromises your personal data or electronic Protected Health Information (ePHI) in a way that creates a real risk of significant harm to you (or, where the GDPR applies, a high risk to your rights and freedoms), Axolotlane will notify you and the relevant regulatory authorities (such as the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia or, where applicable, an EU supervisory authority or U.S. state attorney general) without undue delay, and where feasible, within 72 hours of becoming aware of the breach. Notifications will describe the nature of the breach, the data affected, and the mitigation steps taken by the Company.

We retain personal data and clinical history assets for as long as your account remains active or as required to deliver platform services. Tax logs, accounting metrics, and clinical intake files are stored for a minimum of seven (7) years to satisfy financial regulations and medical accountability guidelines.

Canadian Privacy Rights (BC PIPA, PIPEDA & Quebec Law 25)

As a British Columbia organization, Axolotlane is subject to British Columbia’s Personal Information Protection Act (PIPA), and to the Personal Information Protection and Electronic Documents Act (PIPEDA) for personal information that crosses provincial or national borders. We have designated a privacy officer, maintain strict access limits, and provide straightforward tools for users to request copies of their data or delete their accounts. To satisfy Quebec’s Law 25 privacy regulations, our privacy officer applies data minimization rules, carries out privacy impact assessments where required, and keeps a register of confidentiality incidents.

U.S. Privacy Laws and HIPAA Status

For residents of the United States (including California under the CCPA/CPRA), you have the right to request access to your data, request deletion, and opt-out of the "sale" or "sharing" of your personal information (as defined by applicable state law). Axolotlane does not sell your personal data for monetary compensation.

European Union (GDPR Compliance)

For residents of the European Economic Area (EEA), Axolotlane processes your data in accordance with the General Data Protection Regulation (GDPR). In addition to the rights listed below, you possess the Right to Restrict Processing, the Right to Object to processing based on legitimate interests, and the Right to lodge a complaint with your local supervisory authority. Axolotlane acts as the Data Controller for the information collected on the Platform. We rely on your explicit consent and the necessity of fulfilling a contract to transfer your health data to Partner Clinics outside the EEA.

Regardless of your jurisdiction, users retain clear control options regarding their personal data assets:

• Access Requests: The right to request an electronic copy of all personal datasets and health logs stored within platform environments.
• Correction Requests: The right to modify incorrect identification data fields or update contact details.
• Data Portability: The right to receive your personal data in a structured, commonly used electronic format.
• Data Deletion: The right to request the permanent destruction of your account profile, subject to legal data retention requirements.
• Withdrawal of Consent: The right to revoke data processing permissions at any time, which will limit or stop access to platform capabilities.

Axolotlane reserves the right to modify this Privacy Policy at any time. Updates will be posted on this page and the “Last updated” date below will be revised. If changes are material regarding how we process ePHI, we will notify you via email. Continued use of the platform after updates are made indicates consent to the modified privacy rules.

For privacy inquiries, data access requests, or regulatory data concerns, contact our privacy officer at:

• Email: contact@axolotlane.com