Privacy Policy — Med World Türkiye

This Privacy Policy explains how Med World Türkiye (“we”, “us”) collects, uses, shares and protects your personal data when you use our website, contact our coordination team or use the patient portal. It is written for patients in every country. It meets the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, for patients in the European Union and the United Kingdom, the EU General Data Protection Regulation and the UK GDPR.

Med World Türkiye is an independent health-travel coordinator based in Istanbul. We are not a hospital, we do not give medical advice or treatment, and we do not employ the doctors. Treatment is given by our partner hospitals, clinics and doctors, who are separate data controllers for the data they process and give you their own privacy notices.

Who is responsible

Data controller: Med World Türkiye
Address: Küçükbakkalköy Mah., Vedat Günyol Cad., Flora Residence, 34758 Ataşehir/İstanbul, Türkiye
Email: health@medworldturkiye.com · Phone: +90 530 242 14 55

What we collect

Identity and contact: name, email address, phone / WhatsApp number, country, preferred language and, if you share it, your age or date of birth.
Your enquiry: the treatment you are interested in, your messages, appointments, travel plan, and the treatment plan and quote from the partner.
Health data (special-category data), only with your explicit consent: medical reports, scans, lab results, photos, medical history and medicines.
Travel details: arrival, departure and accommodation dates; passport details only when needed for an invitation letter or a hotel or hospital registration.
Portal account and security data: sign-in times, IP address, browser, and logs of who opened which document.
Where your enquiry came from: the page of the form, the referring site, campaign (UTM) tags and the ad click ID. The first page of your visit is stored only if you accept analytics or marketing cookies.
Consent records: which version of which text you accepted, when, and from which IP address.

Why we use it and our legal bases

To answer your enquiry, prepare a quote with a partner and coordinate your trip (appointments, accommodation, transfers, interpreters): steps you asked for and the coordination service you start with us (KVKK art. 5(2)(c); GDPR art. 6(1)(b)).
To share your health data with the partner who evaluates your case, send you the treatment plan and quote, and coordinate treatment and follow-up appointments: your explicit consent (KVKK art. 6(3)(a); GDPR art. 9(2)(a)). You give it with the separate checkbox on our forms or in the portal, and you can withdraw it at any time.
Legal obligations such as health-tourism reporting, tax and accounting records and requests from authorities (KVKK art. 5(2)(ç); GDPR art. 6(1)(c)).
Establishing or defending legal claims (KVKK art. 5(2)(e) and 6(3)(d); GDPR art. 6(1)(f) and 9(2)(f)).
Security, preventing misuse, and measuring which channels bring enquiries: our legitimate interests, balanced against yours (KVKK art. 5(2)(f); GDPR art. 6(1)(f)).
Newsletters and marketing messages, and analytics or marketing cookies: your consent, which you can withdraw at any time (KVKK art. 5(1); GDPR art. 6(1)(a)).

Who we share it with

The partner hospital, clinic or doctor chosen to evaluate your case, in Türkiye, only with your consent and only what they need. The partner portal shows you under a reference code unless our team decides your name is needed. Your portal account shows which organisations your files were shared with.
Accommodation and transfer providers: only your name, dates and the contact details they need. Never health data.
Authorities, when the law requires it.
Our lawyers, accountants and auditors, as far as needed.
Technology providers that process data for us (see the next section).

We do not sell your data and do not share it for advertising profiles.

Where your data is stored

Our application servers, database, document storage (including health documents), error monitoring and rate limiting run in Frankfurt, Germany (EU). We also use an email provider, and Google Analytics (United States) only if you accept analytics cookies. Our hosting provider, Vercel Inc., is a US company. For transfers out of Türkiye we use the standard contracts approved by the Turkish Personal Data Protection Board (KVKK art. 9); our providers’ data processing terms apply as well. If you message us on WhatsApp, WhatsApp’s own terms also apply to those messages.

How long we keep it

Enquiries that do not lead to a trip, with their messages and files: 3 years from the last contact.
The coordination file and health documents of a trip that took place: 10 years after the service ends (the general limitation period under Turkish law).
Consent records: while the consent is valid and 10 years after.
Invoices and accounting records: as long as Turkish tax and commercial law require (up to 10 years).
Access and security logs: 2 years.
Marketing preference: until you withdraw it.

After that, the data is deleted, destroyed or anonymised.

Your rights

You can ask us to: tell you whether and how we process your data and give you a copy; correct it; delete it; restrict its use; object to it; and, where the GDPR applies, send it to you or another organisation in a portable format. You can withdraw any consent at any time; this does not affect what we did before. You can also object to decisions made only by automated means (we do not make any).

Write to health@medworldturkiye.com from the email address you used with us, or by post to the address above. We answer within 30 days (within one month where the GDPR applies), free of charge. You may also complain to the Turkish Personal Data Protection Board (kvkk.gov.tr), to the data protection authority of the EU country where you live or work, or, in the UK, to the Information Commissioner’s Office (ico.org.uk).

How we protect it

Encrypted connections (HTTPS) and encryption at rest by our storage providers.
Health documents in a private store: each download is a link valid for 5 minutes, and every opening is logged.
Role-based access: coordinators see only what their work needs; a partner sees only the referrals sent to it.
Patients sign in with one-time links sent to their email; staff sign in with a password (stored only as a hash) or a one-time link, and their sessions end after 8 hours.
Rate limits and spam protection on every form.

Children

Our service is for adults. A parent or legal guardian must make enquiries and give consent for anyone under 18.

Changes

When this policy changes, we update the version and date at the top of this page. If the change affects a consent you gave, we ask for it again.