Privacy Policy for Cura

This Privacy Policy explains how Cura collects, uses, shares and protects personal data when you visit our website or use our coordination services as an international patient, companion or partner. It applies when we support care coordination in Turkey, Iran and other destinations.

Please read this Privacy Policy together with our Terms of Use. If you do not agree with this policy, you should not use the website or send us personal data.

1. Who controls your personal data

For most activities described in this Privacy Policy, Cura decides how and why personal data is used. For these activities, Cura is a data controller or the equivalent concept under local law.

When we coordinate care with clinics, hospitals and other providers, each provider also acts as an independent controller for the personal data it receives and creates during diagnosis, treatment and follow up. Providers have their own privacy obligations and information notices.

For coordination in Turkey, Cura handles personal data in line with the Law on the Protection of Personal Data and guidance from the Turkish data protection authority.

For coordination in Iran, Cura respects confidentiality duties under local health information rules and general data protection principles, even though there is no single comprehensive data protection law.

If you have questions about our role or the role of a clinic, we can explain this before or during coordination.

2. Personal data we collect

The exact data we collect depends on how you use our services. It may include the categories below.

2.1 Identity and contact details

Identity and contact details may include:

First name, last name and preferred form of address
Email address and phone number
Messaging account details used to contact our team
Country of residence, preferred language and time zone
Passport or ID information when needed for booking support and only when you choose to provide it

2.2 Health and medical information you choose to share

To help clinics understand your case, we may ask you to share health related information such as:

A general description of your health concern, planned procedure or medical goals
Past diagnoses, treatments, operations or medications relevant to your request
Medical reports, images or test results that you choose to upload or send
Information about allergies, lifestyle risks and other factors that clinicians may need to know

Health information is sensitive. We ask only for what is reasonably needed to understand your request and connect you with suitable clinics.

2.3 Travel and coordination data

When you plan travel with our support, we may collect:

Preferred destinations, dates and approximate length of stay
Information about companions who may travel with you, such as name and relationship
Flight arrival and departure details, hotel preferences and transfer needs
Information about visas, insurance and other logistical matters you choose to share

2.4 Communication history and preferences

We keep records of our communications with you, including:

Messages, emails and forms you send to Cura
Notes made by our staff during calls or coordination
Your language preferences and choices about how we contact you

2.5 Technical and usage data

When you use the website, we may collect technical data such as:

IP address and general location based on IP
Device type, browser type and operating system
Pages visited, dates and times of access and how you move through the site

We may use cookies and similar technologies for basic site functions, security and aggregated statistics. You can control many cookies through your browser settings.

3. How we collect personal data

We collect personal data in several ways.

Information you provide directly when you complete inquiry forms, upload documents or contact us by email, phone or messaging tools
Information you share during calls or online meetings with Cura staff
Information that clinics, hospitals or other partners share with us about your bookings, treatment plans and follow up where local law allows and where this is needed to support your request
Technical data collected automatically when you use the website through server logs, cookies and similar tools

4. Why we use personal data and legal grounds

We only use personal data when we have a clear purpose and a lawful basis. We may use your personal data for the purposes below.

To respond to your requests and help you understand options for care abroad
To collect medical and travel details that clinics need to review your case and propose a possible treatment plan
To coordinate appointments, travel support, accommodation and interpretation where you ask for this
To support safety, quality and staff training, including monitoring communications, handling feedback and managing complaints
To meet legal duties such as record keeping, responding to lawful requests from regulators or authorities and complying with data protection rules
To protect vital interests in rare urgent situations, for example sharing essential information with emergency services if we become aware of a serious and immediate risk to life or health
To run secure, reliable services, including preventing fraud, abuse and attacks on our systems, and to produce aggregated statistics for service improvement

The main legal grounds we rely on are:

Your consent, for example when you choose to send health information so that a clinic can review your case
The need to prepare and perform a service you request, such as helping you contact a clinic or manage bookings
Compliance with legal obligations under Turkish personal data and health regulations or other national law that applies to Cura
Protection of vital interests where data must be used to help protect life or health
Our legitimate interests, such as improving services and protecting our systems, where these interests are balanced with your rights

Health information is treated as sensitive data. In Turkey, this type of data is subject to special protection and is usually processed with your explicit consent or under limited conditions, such as when handled by healthcare professionals who are bound by confidentiality.

In Iran, health information is also protected through confidentiality rules, professional standards and specific provisions on the handling and retention of medical records.

5. Sharing your personal data

We do not sell your personal data. We share personal data only when this is needed for the purposes described in this Privacy Policy, when the law allows it and when appropriate safeguards are in place.

Depending on your case, we may share personal data with the categories of recipients below.

Clinics, hospitals, doctors and other healthcare professionals who review your case and may provide treatment
Diagnostic centers, laboratories and imaging providers involved in your care
Accommodation providers, transport companies, interpreters and similar partners who help with travel and local support
Technical service providers who host our systems, maintain the website, provide communication tools or supply analytics, security and backup services
Professional advisers such as legal or accounting advisers when needed to protect our rights or meet legal duties
Public authorities, regulators or law enforcement when we are required to do so by law or when this is necessary to protect vital interests or respond to serious complaints

We share only the minimum data that partners need for their role and expect them to protect your information in line with legal requirements and contractual obligations.

6. International transfers of personal data

Cura is an international coordination service. This means that your personal data may be transferred to and accessed from several countries, including your home country, Turkey, Iran and other countries where clinics, partners or technical providers are located.

When personal data is transferred from Turkey to another country, we follow Turkish personal data protection law and related guidance on cross border data transfers. This includes checking legal conditions for transfer and using appropriate safeguards such as data transfer agreements or other mechanisms recognised by the Turkish data protection authority.

When data is accessed from or stored outside Iran, we take practical and contractual steps to maintain confidentiality and security in line with local expectations on health information and general privacy principles.

Because our services are global, some countries where data is processed may have different data protection rules from your home country. We try to keep a similar level of protection by limiting access to those who need it and by using contractual safeguards, technical measures and internal policies.

7. How long we keep personal data

We keep personal data only for as long as needed for the purposes described in this Privacy Policy and for related legal, business and reporting requirements.

When deciding how long to keep data, we consider:

The type of personal data and the sensitivity of the information
How long we need the data to provide coordination services and handle questions or complaints
Time limits under laws that apply to contracts, tax and accounting
Local rules and practices for health information and medical records in destination countries

After the relevant period ends, we will either delete personal data, anonymise it or store it in a secure archive with restricted access where the law requires longer retention.

8. Your privacy rights

Your privacy rights depend on the laws that apply in your country and in the country where services are provided. In many cases, you may have the rights below.

To know whether we hold personal data about you and receive clear information about how we use it
To request a copy of your personal data and certain details about processing
To ask us to correct inaccurate or incomplete information
To ask us to delete your personal data in specific situations, for example when it is no longer needed or when you withdraw consent and there is no other legal ground
To ask us to limit how we use your data in certain cases
To object to some types of processing, such as certain analytics or marketing activities
To withdraw your consent at any time when processing is based on consent
To receive certain information in a portable format where local law grants this right

The exact rules and timelines for replies can differ between countries. Turkish personal data law, for example, gives individuals rights to information, access, correction, deletion and objection, and sets duties for data controllers to answer these requests within defined periods.

You may also have the right to raise a concern with a data protection authority or similar regulator in your country of residence, place of work or the country where you believe a privacy issue has occurred. We encourage you to contact us first so that we can try to resolve your concern.

9. How we protect personal data

We use a combination of technical, organisational and physical measures to protect personal data against accidental loss, misuse, unauthorised access, disclosure, alteration and destruction.

These measures include, for example:

Access controls that limit personal data to staff and partners who need it for their role
Use of secure systems for storing and transmitting health information
Internal policies about confidentiality and appropriate use of data, supported by staff training
Due diligence and contractual protections for key service providers
Monitoring of systems for security issues and taking steps to fix problems when they arise

Guidance on Turkish data protection law highlights the importance of preventing unlawful processing and access, ensuring data integrity and confidentiality and maintaining appropriate security controls.

Rules and studies on health information in Iran also stress the need to protect medical records and electronic health data against misuse and unauthorised disclosure.

No system can be guaranteed as completely secure. We take reasonable steps to reduce risks, but you should also take care when sending information online and choose secure channels when possible.

10. Children and minors

Our services are mainly designed for adults. If you are under 18 or you do not have legal capacity to make health and travel decisions, you should ask a parent, legal guardian or other authorised representative to act as the main contact with Cura.

When a request concerns a child or another person who cannot act alone, we may ask for proof that the person contacting us has the right to act on their behalf. We may refuse to coordinate services if we cannot confirm this.

Health information about children is especially sensitive. We apply additional care to such cases and follow local rules and professional standards that protect minors.

11. Automated decisions and profiling

Cura does not make decisions about eligibility for treatment or travel based only on automated processing. Clinics and healthcare professionals always make clinical decisions.

We may use limited automated tools to organise inquiries, for example by destination, procedure type, language or urgency, so that the right team can respond. These tools do not replace human review.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in law, regulatory guidance or our services in Turkey, Iran or other destinations.

When we make important changes, we will update the date shown at the top of the page and may provide an additional notice on the website or by email where appropriate. The new version will apply from the date it is published.

13. Contact us about privacy

If you have questions or requests about this Privacy Policy or about how we handle personal data, please contact us using the details below.

Email for privacy questions: [email protected]

Postal address for written requests:

Cura Medical Tourism
Registered office postal address will be published on this page when available

You can also find our latest contact details on the Contact page.

Please remember that this Privacy Policy does not give medical, legal or financial advice. For personal medical decisions, always consult a qualified clinician. For questions about visas, insurance or legal and financial matters, contact the relevant authorities or professional advisers.