Last updated:
This is the English translation of our notice under the Turkish Personal Data Protection Law No. 6698 (“KVKK”); the Turkish text is the legally primary one.
Data controller
Meriç Hafız Sağlık Turizmi Tic. Ltd. Şti. (Meric Hafiz Health Tourism Agency), Ataköy 7-8-9-10. Kısım Mah. Karanfil Sok. Ataköy 9.Kısım B11 No:1N İç Kapı No:3, Bakırköy, İstanbul, Türkiye. E-mail: merichafizsaglikturizmi@gmail.com. Phone: +90 535 220 39 49. We are the data controller under the KVKK. The agency is an authorised intermediary for international health tourism (authorisation certificate no. AK-0862). The health institution that treats you is a separate data controller for the patient records it keeps.
What we process, why, and on what legal ground
Contact by the booking form, WhatsApp, phone and e-mail
- Data: your name, phone number, e-mail address, country of residence, preferred language and what you tell us; in the booking form also the institution, date and time you prefer; when you book through us, the identity details your hotel or transport reservation needs.
- Purpose: to answer your enquiry and to arrange your appointment, travel, accommodation and translator.
- Legal ground: KVKK Art. 5/2-c: processing directly related to entering into or performing a contract; for contract, reservation and invoice records also KVKK Art. 5/2-ç: our legal obligations under tax and commercial law.
- How it is collected: when you contact us or send the booking form; electronically or verbally.
Your health information (special category data)
- Data: the diagnosis, reports, test results, scans and photographs you choose to send us.
- Purpose: so that the contracted health institution that would treat you can make a preliminary assessment, and to plan your appointment.
- Legal ground: KVKK Art. 6/3-a: your explicit consent. We ask for it separately before your health information is processed, and you can withdraw it at any time.
- How it is collected: by WhatsApp or e-mail, when you send it. The booking form asks for no health information; please do not write any in it.
You do not have to send health information; without it, only the assessment before travel cannot be made.
Server logs
- Data: IP address, date and time, the page requested, browser type.
- Purpose: to deliver and run the website securely.
- Legal ground: KVKK Art. 5/2-f: legitimate interest (protecting the site and its visitors).
- How it is collected: automatically.
This website has no analytics and no embedded map or video. We make no automated decisions and do no profiling. We do not use your data for marketing without a separate, optional explicit consent (recorded through İYS); using our services never depends on marketing consent.
Who receives your data, and why
We pass data on only on the legal ground named above for each activity, and health information only with your explicit consent (KVKK Art. 8).
- The contracted health institutions (Türkiye): the institution that would treat you receives your contact details and the health information you sent, for the preliminary assessment and your appointment. They are named on the Contracted Health Institutions page.
- Accommodation and transport providers: the identity and contact details your reservation needs.
- Netlify, Inc. (512 2nd Street, Suite 200, San Francisco, CA 94107, USA): hosting of this website; server logs; the booking form: Netlify stores each request you send with it and e-mails it to our mailbox.
- Google LLC (USA), Gmail: when you e-mail us or send the booking form, your message is stored on the servers of Google, which provides our mailbox.
- WhatsApp LLC / Meta (USA, Ireland): your contact details and messages, if you choose to write to us on WhatsApp.
- Public authorities, where the law requires it.
Transfers abroad: Netlify, Google and WhatsApp are service providers located outside Türkiye; when you use the booking form or these channels, your data is processed on their servers abroad. Please do not send through these channels anything you do not want held on a server abroad; you can also reach us by phone.
How long we keep it
- Enquiries that do not lead to an appointment, and the health information sent with them: at most 12 months after the enquiry is closed, including the copies in our mailbox, in WhatsApp and the booking form requests stored with Netlify.
- Contract, reservation and invoice records of the people we serve: for the retention periods the law sets.
- Server logs: kept by the hosting provider for a short period (about 30 days).
Your rights under KVKK Art. 11
You have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose and whether it is used accordingly; to know the third parties it is transferred to; to have it corrected if it is incomplete or wrong; to have it erased or destroyed under KVKK Art. 7; to have those operations notified to the third parties it was transferred to; to object to a result against you that arises from analysis by solely automated systems; and to claim compensation if you suffer damage from unlawful processing.
Send your request in writing to merichafizsaglikturizmi@gmail.com or to our address above. Requests are concluded within 30 days at the latest. If you are not satisfied with the outcome, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
If you live in the European Union and the General Data Protection Regulation (GDPR) applies to you, you also have the rights it gives you and may complain to the data protection authority of your country.
Cookie policy
This website sets no cookies and stores nothing in your browser; it uses no analytics or advertising tools. Fonts and images load from this website’s own address, and opening a page sends no request to a third party. For that reason no cookie consent is asked. If this changes, no non-essential cookie will be set without your consent, and this text will be updated.
Our links to WhatsApp, Google Maps, YouTube, HealthTürkiye and the websites of the contracted institutions take you outside this website; there, the operator’s own cookie and privacy rules apply.