KVKK disclosure and patient data protection charter.

For personal data collected through clinicsuite.io, demo requests, customer accounts, billing and recruitment, ClinicSuite acts as the data controller (veri sorumlusu). The contracting ClinicSuite entity, its MERSİS number and registered address are stated in each customer's order form and are available on request from [email protected].

For patient and lead data processed in a clinic's workspace, the clinic — or, where relevant, the licensed health tourism intermediary — is the data controller and ClinicSuite is the data processor (veri işleyen). ClinicSuite processes that data only on the clinic's written instructions, in line with KVKK Article 12 and our Data Processing Agreement.

Personal data is processed under the conditions in KVKK Article 5(2): where expressly provided by law, where necessary for the establishment or performance of a contract, where necessary to comply with a legal obligation, where data has been made public by the data subject, where necessary to establish, exercise or protect a right, and where necessary for the legitimate interests of the controller without harming the data subject's fundamental rights. Where none applies, explicit consent is obtained under Article 5(1).

Health data is processed under Article 6 as amended by Law No. 7499: with explicit consent, or — without consent — by persons under a confidentiality obligation or authorised institutions for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services.

• Responding to enquiries and coordinating consultations in the patient's language.
• Preparing treatment plans, quotes and deposit links.
• Organising flights, accommodation, transfers and interpreter services for the treatment visit.
• Scheduling surgery and chair time, pre-op reminders and post-op follow-up.
• Meeting medical-records, tax and health tourism reporting obligations of the clinic.
• Measuring advertising performance on banked deposits using hashed, non-clinical identifiers.
• Securing the platform, preventing fraud and keeping audit trails.

International patients share some of the most sensitive data there is with a clinic in another country. ClinicSuite builds the following safeguards into every workspace used for health tourism:

• Authorised providers — workspaces can record the clinic's Ministry of Health international health tourism authorisation and the authorisation of any intermediary agency, so patients are only routed to licensed partners.
• Language-matched consent — information notices and explicit-consent forms are shown in the patient's own language before health data is requested.
• Minimum necessary sharing — drivers, hotels and transfer partners see only the itinerary fields they need — never clinical notes, images or diagnoses.
• Separated consents — consent for treatment, for marketing messages under Law No. 6563 and for using before/after images are collected and stored separately, and can be withdrawn individually.
• Clinical confidentiality — access to health data is limited to clinicians and coordinators bound by professional secrecy, with every view and export logged.

Within Türkiye, data may be shared with the clinic's healthcare professionals, laboratories, pharmacies, payment institutions, travel and accommodation partners, and public authorities where legally required (Article 8).

ClinicSuite's production environment is hosted in the European Union. Transfers abroad are carried out under KVKK Article 9 as amended on 1 June 2024: on the basis of an adequacy decision where one exists, otherwise using appropriate safeguards — principally the standard contracts published by the Personal Data Protection Board, which are notified to the Authority within five business days of signature. Incidental transfers permitted by Article 9(6), such as transfers needed to perform a contract with the patient, are used only where genuinely non-recurring.

Data is collected by automated and partially automated means: website and landing-page forms, AI Voice and telephony calls, WhatsApp Business, Instagram and web chat, email, uploaded scans and images, payment providers, ad-platform lead forms, and integrations with the clinic's CRM and practice-management systems.

Personal data is retained only for as long as required by the purpose and applicable law, in accordance with ClinicSuite's Personal Data Retention and Destruction Policy and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. Periodic destruction runs at intervals not exceeding six months. Clinics set retention for patient records according to their medical-records obligations, and destruction is logged.

Under KVKK Article 11, every data subject has the right to:

• learn whether their personal data is processed;
• request information about the processing if it is;
• learn the purpose of the processing and whether data is used in line with that purpose;
• know the third parties to whom data is transferred, in Türkiye or abroad;
• request correction of incomplete or inaccurate data, and notification of the correction to third parties;
• request erasure or destruction under Article 7, and notification of it to third parties;
• object to a result against them arising solely from automated analysis of their data;
• claim compensation for damage caused by unlawful processing.

Under KVKK Article 13 and the Communiqué on the Procedures and Principles of Application to the Data Controller, requests can be sent in writing, by registered electronic mail (KEP), with a secure electronic signature or mobile signature, or by email from an address previously notified to us, to [email protected]. Please include your name, surname, T.R. identity number (or passport number for foreign nationals), contact address and a clear description of your request.

We answer within 30 days, free of charge; if the response requires additional cost, the fee set by the Board may apply. If your request concerns patient data held by a clinic, we will forward it to the clinic as controller and support its response. If you are not satisfied, you may complain to the Personal Data Protection Board within 30 days of our response, or within 60 days of your application if we do not respond (Article 14).

ClinicSuite applies the technical and administrative measures required by KVKK Article 12 and the Board's guidance on special category data: AES-256 encryption at rest, TLS 1.2+ in transit, role-based access, two-factor authentication, immutable audit logs, staff confidentiality undertakings and regular penetration testing.

Where ClinicSuite is controller, personal data breaches are notified to the Board within 72 hours and to affected individuals as soon as possible. Where ClinicSuite is processor, the clinic is informed without undue delay so it can meet the same deadline.