Data Protection Notice (KVKK)

1. Who is the data controller

The data controller for this website is the operator of Istanbul Medical Tourism, whose details must be entered here. The controller decides the purposes and means of processing and is the party you can exercise your rights against.

Where the controller is established outside Türkiye, KVKK requires that it acts through a representative in Türkiye, and that it registers with the Data Controllers' Registry (VERBİS) through that representative. The representative's details must be recorded here.

2. What data we collect

Depending on how you use the site, we may collect:

• Contact data you submit in a form: name, e-mail address, telephone number.
• The content of your enquiry, which may include health-related information — a condition, a treatment you are considering, medication or test results — and is therefore special-category data under KVKK.
• Travel context you provide: dates, number of travellers, treatment or city of interest.
• Your conversation with the site's AI assistant. The transcript is stored with your enquiry only if you give separate, explicit consent for it; without that consent it is not stored.
• Voice input, if you use the voice feature: the recording is sent for transcription and is not retained by us after the request.
• Technical data: IP address, approximate location, browser and device type, pages viewed, and cookie or analytics identifiers.

3. Why we process it

We process personal data only for these purposes:

• To answer your enquiry and correspond with you about it.
• To operate, secure and improve the website, and to understand how it is used in aggregate.
• To produce general information content and to translate the site into other languages.
• To meet legal, accounting and record-keeping obligations that apply to us.
• To detect and prevent abuse, spam and security incidents.
• We do not use your data for automated decision-making that produces legal effects about you, and we do not sell it.

4. Legal grounds

The grounds we rely on under KVKK are:

• Your explicit consent (m.6) for health-related data and for transfers abroad, which you give by ticking the separate consent boxes on the form; you may withdraw it at any time.
• Necessity for the performance of a contract or to take steps at your request before a contract (m.5(2)(c)), where your enquiry leads to an agreement with us.
• Compliance with a legal obligation (m.5(2)(ç)) for record-keeping.
• Our legitimate interest (m.5(2)(f)) in operating and securing the site, balanced against your rights.
• Where the law expressly permits processing of special-category data without consent (m.6(3)) — for example, data you have made public yourself.

5. Who receives your data

We use service providers (data processors) and may share data with:

• Our hosting provider, whose servers are in the European Union (Finland).
• Our content delivery and security provider, which operates globally and may process requests from the United States.
• Our analytics provider (Google Analytics, United States), loaded only after you accept analytics cookies.
• Our AI assistant provider (mainland China) for the chat feature, and a voice transcription provider (United States) if you use voice input.
• Providers used to deliver our own notifications and e-mails, and professional advisers (legal, accounting) where necessary.

6. Transfer abroad

Because our service providers are located outside Türkiye, using the site involves transferring data abroad, including to the United States, the European Union and, for the AI assistant, mainland China. Transfers of health-related data take place only with your explicit consent, which you give separately on the form, and we take the steps KVKK requires for such transfers (appropriate safeguards and, where required, the standard contract commitments notified to the Authority). You can use the site without the AI assistant and without submitting health details if you prefer no transfer to take place.

7. How long we keep it

We keep personal data only as long as necessary:

• Enquiries and related correspondence: up to 24 months after the last exchange, then deleted.
• Consent records: for the period required to demonstrate compliance, and for the statutory limitation period afterwards.
• AI chat transcripts: only where you consented to storage, and deleted with the enquiry they belong to.
• Voice recordings: not retained after transcription.
• Aggregated statistics and server logs: kept in de-identified or aggregated form for site operations.

8. Your rights (KVKK m.11)

You have the right to:

• Learn whether your personal data is processed, and request information about it.
• Learn the purpose of processing and whether it is used consistently with that purpose.
• Know the third parties, in Türkiye or abroad, to whom your data is transferred.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction of your data within the conditions set by law.
• Request that corrections or deletions be notified to third parties to whom the data was transferred.
• Object to a result that arises solely from automated analysis and is to your detriment, and claim compensation for unlawful processing.

9. How to exercise your rights

Send your request in writing to the contact channel below, stating your identity and which right you are exercising. We answer within 30 days at the latest, free of charge; where the request requires additional cost, the tariff set by the Authority may apply. Use the form and method prescribed by the Communiqué on the Procedures and Principles of Application to the Data Controller.

If your request is refused, answered inadequately, or not answered in time, you may complain to the Personal Data Protection Authority (KVKK Kurulu) within the periods set out in the law.

10. Cookies, VERBİS and visitors from the EU

Cookies: strictly necessary cookies are used to operate the site. Analytics cookies are set only if you accept them; if you decline, no analytics tag is loaded and no analytics cookie is written. You can change your choice at any time from the cookie banner.

Visitors in the EU: to the extent the EU General Data Protection Regulation applies to you, we process on the same legal bases described above (consent for health data and transfers, contract, legal obligation, legitimate interests), you may withdraw consent at any time, and you have the rights in Articles 15–22 GDPR, including complaint to your national supervisory authority.

VERBİS: where the controller is established outside Türkiye, registration with the Data Controllers' Registry is made through a representative in Türkiye, and the registration details must be recorded here.