Privacy Policy

Last updated: 13 August 2026

Wholecares ("we", "us") is an international medical tourism facilitator. We connect patients with accredited partner hospitals and clinics abroad. Protecting your privacy — especially your health information — is fundamental to what we do. This policy explains what we collect, why, how long we keep it, who we share it with, and the rights you have.

1. Who is responsible for your data

The data controller is WholeCares Partners Limited (trading as "Wholecares"), a company registered in England and Wales under company number 17398140. Registered office: Unit 6 DBS, Cambridge Road Industrial Estate, Milton, Cambridge, CB24 6AZ, United Kingdom. You can contact us about privacy matters at any time at [email protected] or on +44 7424 621673.

2. What we collect

• Contact details — the name, email address, and phone number you use when you write to us. This site has no contact form and collects nothing on its own; everything we hold comes from a message you chose to send us by email or WhatsApp.
• Health information you choose to share — your message describing your medical goals, medical history, photographs, test results, and similar information needed to assess treatment suitability. This is special category data under UK GDPR and we only process it with your explicit consent.
• Usage data — pages visited, device and browser information, collected through the analytics tools listed in section 6.

3. Why we use it (legal bases)

• To respond to your enquiry and prepare a personalized assessment and quote — consent and steps prior to a contract.
• To share your case with relevant partner hospitals and surgeons so they can evaluate suitability — your explicit consent.
• To coordinate travel, accommodation, and aftercare included in your package — performance of a contract.
• To improve our website and services — legitimate interests (analytics).

4. Who we share it with

We share your information only as needed to deliver our services: with the accredited partner hospitals, clinics, and surgeons relevant to your enquiry; with travel and accommodation providers included in your package; and with our IT and communication service providers. We never sell your personal data.

Two of those providers are worth naming, because you choose them when you choose how to reach us. Email you send to [email protected] is delivered and stored by our email host. Messages you send on WhatsApp travel through WhatsApp, which is operated by Meta, and are subject to their terms as well as this policy. If you would rather not use either, you can ask us to switch channels at any point.

5. International transfers

The independent hospitals Wholecares coordinates with are located outside the United Kingdom (including in Türkiye). Where your information is transferred internationally, we take steps to ensure appropriate safeguards are in place, such as contractual data-protection obligations with the receiving organization, and we transfer only what is necessary for your treatment assessment and care.

6. Cookies and analytics

This site sets no analytics cookies unless you allow it. On your first visit we ask whether you are happy for us to use Google Analytics 4 to measure how people find and use the site. If you decline — or simply ignore the banner — Google Analytics is never loaded and no analytics cookies are set. Everything on the site works the same either way.

You can change your answer at any time through the Cookie Settings link in the footer. Withdrawing consent clears the analytics cookies already stored in your browser. We ask again after six months, so a choice you made long ago does not stand forever.

We do not use session recording, heat-mapping, or advertising cookies on this site.

7. How long we keep your data

Enquiry data that does not lead to treatment is retained for up to 24 months and then deleted. If you proceed with treatment, records are retained as required to deliver aftercare, meet insurance obligations, and comply with legal requirements, and are then securely deleted.

8. Your rights

Under UK GDPR you have the right to access, correct, delete, or receive a copy of your personal data; to withdraw consent at any time; to restrict or object to processing; and to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk). To exercise any right, email [email protected] — we respond within one month.

9. Changes to this policy

We will post any changes on this page and update the date at the top. Significant changes will be highlighted on the website.