Privacy notice

Who holds your information

Phoenix Protocol Union, a Delaware corporation with its business address at 390 NE 191st St, Miami, Florida 33179, United States, trading as Birr Journeys. Write to hello@birrjourneys.com about anything on this page.

What we collect from the person booking

Your name, email address and phone number, and the record of what you booked and paid. Card details are handled by Stripe and never reach us.

What we collect about each traveller

Given names and family name, nationality, passport expiry date, and country of residence.

We do not collect passport numbers. Nationality tells us which visa rules apply; country of residence tells us who may lawfully review a traveller’s health questions. The number itself is what an airline needs at ticketing, and it is the most attractive thing that could sit in a database that also holds health information. So we do not hold it.

The health file, which belongs to the traveller

Before travel, each traveller answers questions about their health on their own private page, reached by a one-time link sent to them directly. It is theirs, not the payer’s.

It is never sent to a family group chat. The person who paid is told the outcome — whether the journey suits — and is told the reason only if the traveller has agreed to that, which is recorded as a separate choice on the page itself.

Every read of a health file is logged, with who read it and when, including reads by us. Our own staff cannot read the answers directly; they are reached only through a recorded, audited path. A traveller resident in Saudi Arabia has their file reviewed by a doctor licensed in Saudi Arabia, and the reviewing doctor’s licensing country is recorded with the decision.

Information leaving your country

A journey takes place abroad, so the people looking after your parents are abroad. Where a traveller’s health information is shared with our ground operation in Georgia, that is a separate transfer, asked for separately and recorded separately. You can decline it; it may mean we cannot run that journey for that traveller, and we will say so plainly.

Our database is hosted in Frankfurt, Germany, and our email is sent from Ireland — both in the European Union. Payment information is held by Stripe in the United States.

Who else sees anything

Stripe, to take payment and make refunds. Resend, to deliver our email. The hotels, airlines and ground operator running your journey, who receive only what is needed to carry the travellers. A reviewing doctor, for the health questions only.

We do not sell anything to anybody, we run no advertising trackers, and we share a traveller’s health information with nobody beyond the review described above.

How long we keep it

The health file is deleted twelve months after the journey ends. That is long enough for an insurance claim or a complaint, and short enough that we are not holding medical information for years.

The record of who read a health file is kept for seven years. It is the audit trail, and deleting it would defeat its purpose.

Bookings, payments and traveller records are kept for seven years, because a US corporation must keep them for tax and for any dispute. Emails we sent you are kept for twenty-four months. An enquiry that never became a booking is deleted after twenty-four months.

What you can ask for

A copy of what we hold about you, a correction, or deletion. A traveller can withdraw consent for their health file at any time and it is deleted — which may mean the journey cannot go ahead, and we will tell you plainly if so.

Write to hello@birrjourneys.com. We answer within thirty days.

Cookies

We use a small number of cookies that are necessary for the site to work: one that remembers which booking you are in the middle of, and one that remembers whether you chose the light or the dark theme.

There are no advertising cookies and no third-party trackers, so there is nothing here to consent to and no banner asking you.