Privacy

Thirdline Innovation Studio, registered in the Republic of Mauritius under company number C26232034, is the controller of personal data processed on the Risheh platform.

Registered address: 5th Floor Iconebene, Ave De L'Institut, Ebene, 1704-01, Mauritius

For any question about your data, email privacy@risheh.net.

Information you provide:

Account: name, mobile number, email, country and city of residence, preferred language. Recipients: for orders placed on behalf of another person — their name, phone number, address, and relationship to you. Orders: service details, personal gift-card messages, shopping lists, notes. Payment: amount, currency, date, and payment method. Your full card details are never stored by Risheh and are processed directly by our payment gateway provider. Support communications: messages, emails, problem reports, images you send us. Identity documents: in the limited cases where they are required for compliance with international regulations (clause 09 of the Terms and Conditions).

Sensitive information (health services):

Age, sex, description of symptoms, medical history, current medications, and medical documents submitted for a consultation.

This category is treated as sensitive data and is held under the strictest level of protection. Details in clause 06.

Information collected automatically:

device type, operating system, application version, device identifier; IP address and approximate location (city level) to display relevant services and detect fraud; how the application is used: screens visited, errors, session times.

What we do not collect:

Risheh does not track your precise, real-time location, does not access your contacts without explicit permission, and does not purchase information about you from third parties.

We collect and process your information only to the extent necessary to provide our services. It is used to create and manage your account, to place and fulfil orders, to process payments and refunds, to provide health services and consultations (with your explicit consent), to respond to support requests and handle complaints, to improve the quality, performance, and security of the platform through analysis of aggregated data, to send informational and marketing messages (where you have consented, and with the option to opt out at any time), and to meet our legal and financial obligations and international compliance requirements. This processing is carried out on one of the following legal bases: performance of a contract, your consent, legitimate interests, or legal obligations. Operational messages about your orders (order confirmation, appointment reminders, delivery status) are part of the service and cannot be opted out of except by closing your account.

Some Risheh orders are placed on behalf of another person. In those cases, the data you enter belongs to someone else — someone who has no Risheh account and may never read this page. We take that seriously.

Your undertaking: by entering another person's details, you confirm that you have the necessary permission to do so and that they are aware of your order.

Our undertaking:

Recipient information is used solely to fulfil that order; it is never used to market to the Recipient; it is shared with providers only to the minimum extent needed to do the job — a courier sees the name and address, not your order history; the Recipient may also ask us directly to delete their information. We will action their request and inform you.

Risheh does not sell your data. Ever. That is a hard line for us.

Information is shared only in the following cases:

Health and legal professionals: the information submitted for that specific consultation. These professionals are themselves bound by professional confidentiality obligations. Local providers: the minimum needed to fulfil the order. Our providers sign confidentiality agreements and may not use the information for any other purpose. Infrastructure providers: cloud hosting, SMS, email, payment gateway, and analytics services. These act only on our instructions and under a data processing agreement. Legal authorities: where there is a valid court order or legal obligation. In such cases, where the law permits, we will inform you. In the event of a change of ownership: with prior notice to you and with these commitments preserved.

Medical data follows a separate path at Risheh:

it is held in a segregated, encrypted database; it is accessible only to the physician conducting that consultation and — in the event of a complaint, and with your knowledge — a small compliance team; general support staff, engineering, and marketing have no access to medical content; it is never used for advertising, analytics, or training artificial intelligence models; every access to this data is logged and auditable.

Risheh's servers are located in Türkiye.

Risheh is inherently a cross-border service: the company is registered in Mauritius, data is held on servers in Türkiye, users are in many countries, and the service is sometimes delivered in a third. International data transfer is therefore unavoidable.

Transfers are made only with appropriate safeguards, including standard contractual clauses and encryption in transit. The Risheh team operates across several countries; each team member's access to data is limited to their role and is set on a "minimum necessary access" basis.

We keep your information only for as long as is necessary to provide our services, meet our legal obligations, or fulfil the purposes we have stated. An account is kept for as long as it remains active. Order and payment records are normally kept for 7 years, in line with tax and accounting requirements. Health data is kept for 5 years, or for any other period required by the law of the place where the service is provided. Support communications are kept for up to 2 years after the case is closed. Analytics data, in aggregated and non-identifiable form, may be kept indefinitely. If you close your account, your personal information is deleted or anonymised within a maximum of 30 days, except where the law requires it to be retained.

All communication between the application and our servers is encrypted with TLS. Sensitive data is also encrypted at rest. Account login uses one-time verification codes. Staff access is role-based and logged.

That said, no system is impenetrable. If a breach occurs that puts your rights at risk, we will notify you and the relevant authorities within a maximum of 72 hours.

At any time, you may:

access a copy of your data; ask for inaccurate information to be corrected; request deletion of your data (except where retention is legally required); withdraw your consent — for example, for marketing messages or the processing of health data; request portability and receive a machine-readable copy; object to how your data is processed.

To exercise any of these rights, simply email privacy@risheh.net from the email address or phone number registered to your account, so that we can verify your identity.

We will respond within a maximum of 30 days, and this service is free of charge.

Risheh currently stores no analytics or advertising cookies on your device.

The only cookies that may be used are strictly necessary ones: those without which login, session security, and basic site functionality would not work.

If we decide in future to use analytics or advertising cookies, we will obtain your consent separately and transparently before storing anything, and we will update this page.

Risheh is designed for people aged 18 and over, and we do not knowingly create accounts for children.

If you place an order for a child — a gift, or a paediatric consultation — you do so with the responsibility and consent of their parent or legal guardian.

Where the platform uses artificial intelligence tools for translation, order classification, or service recommendations:

those tools are not trained on your health data; we do not make fully automated decisions producing legal or similarly significant effects on you; any decision affecting your order is reviewed by a person.

If this policy changes, the update date at the top of the page will change. Material changes — particularly any change to how health data is used, or the introduction of non-essential cookies — will be notified through the application and by email before they take effect.

Privacy email: privacy@risheh.net Support email: support@risheh.net Registered address: 5th Floor Iconebene, Ave De L'Institut, Ebene, 1704-01, Mauritius

If our response does not satisfy you, write to us again. Your case will be reviewed at a more senior level, and we will keep working on it until you have an answer that is clear to you.