Privacy Policy

Last updated: 15 July 2026

Wholecares ("we", "us") is an international medical tourism facilitator. We connect patients with accredited partner hospitals and clinics abroad. Protecting your privacy — especially your health information — is fundamental to what we do. This policy explains what we collect, why, how long we keep it, who we share it with, and the rights you have.

1. Who is responsible for your data

The data controller is Wholecares, operating from London, United Kingdom. You can contact us about privacy matters at any time at [email protected] or on +44 7424 621673.

2. What we collect

• Contact details — name, email address, phone number, preferred contact method, submitted via our consultation forms, email, or WhatsApp.
• Health information you choose to share — your message describing your medical goals, medical history, photographs, test results, and similar information needed to assess treatment suitability. This is special category data under UK GDPR and we only process it with your explicit consent.
• Usage data — pages visited, device and browser information, collected through the analytics tools listed in section 6.

3. Why we use it (legal bases)

• To respond to your enquiry and prepare a personalized assessment and quote — consent and steps prior to a contract.
• To share your case with relevant partner hospitals and surgeons so they can evaluate suitability — your explicit consent.
• To coordinate travel, accommodation, and aftercare included in your package — performance of a contract.
• To improve our website and services — legitimate interests (analytics).

4. Who we share it with

We share your information only as needed to deliver our services: with the accredited partner hospitals, clinics, and surgeons relevant to your enquiry; with travel and accommodation providers included in your package; and with our IT and communication service providers. We never sell your personal data.

5. International transfers

Our partner hospitals are located outside the United Kingdom (including in Türkiye). Where your information is transferred internationally, we take steps to ensure appropriate safeguards are in place, such as contractual data-protection obligations with the receiving organization, and we transfer only what is necessary for your treatment assessment and care.

6. Cookies and analytics

Our website uses the following third-party tools, which may set cookies or collect usage data: Google Analytics 4 (traffic measurement), Microsoft Clarity and Contentsquare (anonymised session insight and heat-mapping used to improve the site). Form fields containing personal or health information are not intentionally captured by these tools. You can control cookies through your browser settings.

7. How long we keep your data

Enquiry data that does not lead to treatment is retained for up to 24 months and then deleted. If you proceed with treatment, records are retained as required to deliver aftercare, meet insurance obligations, and comply with legal requirements, and are then securely deleted.

8. Your rights

Under UK GDPR you have the right to access, correct, delete, or receive a copy of your personal data; to withdraw consent at any time; to restrict or object to processing; and to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk). To exercise any right, email [email protected] — we respond within one month.

9. Changes to this policy

We will post any changes on this page and update the date at the top. Significant changes will be highlighted on the website.