Last updated: 14.08.2026
This Privacy Policy explains how Risus Care ("Risus Care", "we", "us" or "our") collects, uses, shares and protects your personal data when you visit risuscare.com (the "Website"), contact us, or receive medical, aesthetic and travel-coordination services from us.
Because we provide health and medical tourism services, some of the information we handle is health data, which is treated as a special category of personal data and is given a higher level of protection. Please read this policy carefully.
We process personal data in accordance with the Turkish Law on the Protection of Personal Data No. 6698 ("KVKK") and, where it applies to you, the EU General Data Protection Regulation ("GDPR") and the UK GDPR.
1. Who we are (Data Controller)
The data controller responsible for your personal data is:
Legal / trade name: Risus Uluslararası Sağlık Turizmi ve Tic. Ltd. Şti (operating as "Risus Care")
Registered address: Meşrutiyet Mah. Ebe Kızı Sok. Sosko İş Merkezi No: 16/A6, Şişli, İstanbul, Türkiye
Tax office / no.:Mecidiyeköy VD 7351936579
Health-tourism authorization: Authorized by the Republic of Türkiye Ministry of Health and Ministry of Culture and Tourism
Email: info@risuscare.com
Phone / WhatsApp: +90 542 336 64 00
Website: https://risuscare.com
For questions about this policy or your personal data, contact us using the details in Section 13.
2. Scope
This policy applies to personal data we collect through the Website, our contact and enquiry forms, WhatsApp, telephone, email, social media, and in the course of arranging and delivering treatments and travel services. It does not apply to third-party websites or services that we link to but do not control (see Section 11).
3. What personal data we collect
Depending on how you interact with us, we may collect the following categories of personal data.
Information you give us directly
Identity and contact details: name and surname, telephone number, email address, country of residence.
Enquiry content: the message you send us through our contact form, WhatsApp, email or social media, including any details you choose to share about the treatment you are considering.
Booking and travel information: travel dates, accommodation preferences, flight/transfer details, passport or ID details where required for travel or medical arrangements.
Payment-related information processed to arrange your treatment and stay.
Health (special category) data
Medical history, current conditions, medications, allergies, previous treatments and surgeries.
Photographs or images you share for assessment (e.g. hair, dental, aesthetic areas).
Diagnostic information, treatment plans, consultation notes and post-treatment records.
We only collect health data that is necessary to assess, plan and deliver your treatment safely, and we process it on the basis of your explicit consent (see Section 5).
Information collected automatically
Technical and usage data: IP address, browser type, device information, pages viewed and how you use the Website, collected through cookies and similar technologies. See our separate Cookie Policy.
4. How and why we use your personal data
We use your personal data to:
respond to your enquiries and provide quotes, information and consultations;
assess your suitability for a treatment and plan your care safely;
arrange and coordinate your treatment with partner clinics, hospitals and specialist doctors;
organize your travel, transfers, accommodation, concierge and aftercare services;
communicate with you before, during and after your treatment, including follow-up care;
process payments and keep accounting and tax records;
manage our relationship with you and handle complaints or requests;
comply with our legal, medical and regulatory obligations;
with your consent, send you information about our services;
maintain the security and proper functioning of our Website;
establish, exercise or defend legal claims.
5. Legal bases for processing
Where the GDPR / UK GDPR applies to you, we rely on the following legal bases:
Consent — for sending marketing communications and for using non-essential cookies. You can withdraw consent at any time.
Explicit consent — for processing health (special category) data in order to assess and provide your treatment (GDPR Art. 9(2)(a)).
Performance of a contract / steps prior to a contract — to respond to your enquiry and provide the services you request.
Legitimate interests — to operate, secure and improve our services and communicate with you, where this is not overridden by your rights.
Legal obligation — to comply with health, tax, accounting and other laws.
Under the KVKK, we rely on the corresponding legal grounds set out in Articles 5 and 6 of the Law. Where processing relies on your explicit consent, you may withdraw it at any time; this does not affect processing carried out before withdrawal, or processing we are required or permitted to continue by law.
For the Turkish-law (KVKK) explanation of legal grounds, see our Protection of Personal Data page.
6. Who we share your personal data with
To deliver your treatment and coordinate your stay, we may share your personal data (including, where necessary, health data with your consent) with:
Partner clinics, hospitals, physicians and dental/surgical teams who assess and carry out your treatment;
Travel and hospitality providers — airport transfer, ground transport, hotels and concierge partners — limited to what they need to serve you;
Service providers and processors acting on our behalf, such as IT, hosting, communications, translation and payment providers;
Professional advisers such as lawyers, accountants and insurers, where necessary;
Public authorities, regulators or courts where we are required to do so by law.
We require our partners and service providers to keep your data secure and to use it only for the agreed purposes. We do not sell your personal data.
7. International data transfers
Our services are delivered in Türkiye. If you contact us from another country, your personal data will be transferred to and processed in Türkiye, and may be shared with the partners described in Section 6.
Where we transfer personal data of individuals protected by the GDPR / UK GDPR outside their country, we take steps to ensure an appropriate level of protection, for example by relying on your explicit consent to the transfer or by putting in place appropriate safeguards such as standard contractual clauses. You may request more information using the contact details in Section 13.
Transfers governed by the KVKK are carried out in accordance with Articles 8 and 9 of the Law, as explained in our Protection of Personal Data page.
8. How long we keep your data
We keep your personal data only for as long as necessary for the purposes described in this policy, and then delete or anonymize it. In particular:
Enquiries that do not result in treatment: retained for a limited period to respond to and follow up on your request, then deleted.
Treatment, medical and travel records: retained for the period required by applicable Turkish health legislation and by tax and accounting law [confirm specific retention periods with your adviser].
Marketing consent records: retained until you withdraw consent, plus a short period to evidence compliance.
9. How we protect your data
We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure. These include access controls, secure hosting, encryption of communications where appropriate, staff confidentiality obligations, and contractual safeguards with our partners. While we work hard to protect your data, no method of transmission over the internet is completely secure.
10. Your rights
Depending on the law that applies to you, you have rights over your personal data. Under the GDPR / UK GDPR, you have the right to:
access the personal data we hold about you;
request correction of inaccurate or incomplete data;
request erasure of your data in certain circumstances;
restrict or object to certain processing;
data portability;
withdraw consent at any time, where we rely on consent;
lodge a complaint with a supervisory authority.
If you are covered by the KVKK, you have the rights listed in Article 11 of the Law and may exercise them as described in our Protection of Personal Data page.
To exercise any of your rights, contact us using the details in Section 13. We may need to verify your identity before acting on your request.
11. Third-party links and social media
Our Website and communications may contain links to third-party sites and platforms, such as Instagram, Facebook and WhatsApp. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies. When you contact us via WhatsApp or social media, your use of those platforms is also subject to their own terms and privacy policies.
12. Children
Our services and Website are intended for adults. We do not knowingly collect personal data from children without appropriate consent from a parent or legal guardian. Where a treatment involves a minor, we process the minor's data only with the consent and involvement of a parent or legal guardian.
13. Contact us
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:
Email: info@risuscare.com
Phone / WhatsApp: +90 542 336 64 00
Address: Meşrutiyet Mah. Ebe Kızı Sok. Sosko İş Merkezi No: 16/A6, Şişli, İstanbul, Türkiye
14. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The latest version will always be published on this page with the "Last updated" date above. Where required, we will notify you of significant changes.
