§ 01
Who we are and what this policy covers
ClinicSuite (“ClinicSuite”, “we”, “us”) provides a revenue and operations platform for dental, hair transplant, plastic surgery and medical tourism clinics: AI voice, treatment planning, a WhatsApp and chat hub, closed-loop ad attribution, clinical operations and CRM integrations. The contracting ClinicSuite entity for each customer is named in its order form.
Our role depends on whose data it is. We act in two distinct capacities, and this policy is clear about which one applies in each section:
- Controller — for data about website visitors, demo and waitlist requests, job applicants, and the accounts of clinic users (names, work emails, login and billing data).
- Processor — for patient and lead data that clinics upload or collect through ClinicSuite. The clinic is the controller (veri sorumlusu under KVKK) and decides why and how that data is used. Our obligations are set out in the Data Processing Agreement at /dpa.
If you are a patient
Your clinic decides how your treatment, travel and payment information is used. Please send requests about your records to your clinic first — we will assist them in answering within the legal deadlines, and we will forward any request we receive directly.
§ 02
Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Website & demo requests | Name, work email, clinic name, phone, country, message, specialties | You, via forms on clinicsuite.io |
| Clinic user accounts | Name, role, work email, branch, login timestamps, IP address, 2FA settings | Your clinic administrator and you |
| Billing | Billing contact, company details, VAT/tax number, invoices | Your clinic |
| Usage & device data | Pages viewed, feature events, browser, device type, approximate location from IP | Automatically, via strictly necessary and (with consent) analytics cookies |
| Patient & lead data (processor) | Contact details, language, enquiry source, treatment plans, odontograms and graft maps, photos and scans, call recordings and transcripts, WhatsApp messages, deposits, travel itineraries | Clinics, and patients interacting with clinic channels powered by ClinicSuite |
| Applicants | CV, portfolio, interview notes, right-to-work information | You, via /careers |
Health data, images and biometric-adjacent material such as facial photos are special category data under GDPR Article 9 and özel nitelikli kişisel veri under KVKK Article 6. ClinicSuite never collects them for its own purposes; they are processed solely on behalf of the clinic.
§ 03
Why we use it and our legal bases
| Purpose | Lawful basis (GDPR / UK GDPR) | KVKK condition |
|---|---|---|
| Providing and securing the platform for clinic users | Contract (Art. 6(1)(b)) | Art. 5(2)(c) — necessary for the performance of a contract |
| Responding to demo, waitlist and support requests | Legitimate interests (Art. 6(1)(f)) or pre-contractual steps | Art. 5(2)(c) and 5(2)(f) |
| Billing, tax and accounting records | Legal obligation (Art. 6(1)(c)) | Art. 5(2)(ç) — legal obligation |
| Product analytics and service improvement | Consent for non-essential cookies; legitimate interests for aggregated, de-identified metrics | Explicit consent (Art. 5(1)) or Art. 5(2)(f) |
| Marketing emails to business contacts | Consent or soft opt-in under PECR / ePrivacy, with one-click unsubscribe | Explicit consent and Law No. 6563 commercial message rules |
| Fraud prevention, security logging and abuse detection | Legitimate interests | Art. 5(2)(f) |
Where we process patient data as a processor, the lawful basis is established by the clinic — typically explicit consent, the provision of health care, or the performance of the treatment contract — and recorded in the clinic's own patient notices.
§ 04
AI voice, transcription and automated features
AI Voice calls, transcribes and translates conversations on the clinic's behalf. Calls open with a country-appropriate recording and AI disclosure, and patients can ask for a human coordinator at any point.
- Patient data is never used to train foundation models shared with other customers. AI sub-processors are contractually bound to zero-retention or EU-region processing.
- Lead scoring and triage suggest a next step to a coordinator; they do not make decisions with legal or similarly significant effects. Treatment decisions always remain with licensed clinicians.
- Clinics can disable recording, set retention periods per country and delete transcripts at any time.
§ 06
International transfers (EU, UK, Türkiye)
Production data is hosted in EU data centres. Medical tourism means patient journeys cross borders, so transfers are mapped and safeguarded rather than avoided:
- EU → UK — covered by the European Commission's adequacy decision for the United Kingdom.
- EU / UK → Türkiye and other third countries — covered by the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, supported by transfer impact assessments and supplementary encryption measures.
- Türkiye → EU / UK — made under KVKK Article 9 using the Board's standard contracts, notified to the Personal Data Protection Authority within five business days of signature, or another safeguard permitted by Article 9.
§ 07
How we protect data
- Encryption in transit with TLS 1.2+ and at rest with AES-256; secrets, OAuth tokens and webhook keys held in a dedicated key management service.
- Logical tenant isolation per clinic, branch-scoped roles, SSO/SAML and enforced two-factor authentication.
- Immutable audit logs of record access, exports, integration syncs and permission changes.
- Least-privilege staff access with just-in-time approval for support sessions, confidentiality undertakings and annual security training.
- Encrypted, geographically separate backups, continuous vulnerability scanning and independent penetration testing.
§ 08
How long we keep it
Data we control is kept only as long as needed for the purpose it was collected for: demo and waitlist records for 24 months after last contact, user account data for the life of the subscription plus 90 days, billing records for the statutory period (up to 10 years under Turkish and EU tax laws), and security logs for 12 months.
Patient data is retained according to each clinic's settings and its medical-records obligations. When a subscription ends, the clinic can export everything for 30 days, after which data is deleted from production within a further 30 days and from backups within 90 days.
§ 09
Your rights
Depending on where you live, you can ask to access, correct, delete, restrict or port your personal data, object to processing based on legitimate interests, withdraw consent at any time, and not be subject to solely automated decisions with significant effects. Turkish residents have the rights in KVKK Article 11, explained on our KVKK page.
Email [email protected]. We respond within one month (GDPR / UK GDPR) or 30 days (KVKK), free of charge, and may ask you to verify your identity. You can also complain to your supervisory authority — for example the ICO in the UK, your local EU authority, or the Kişisel Verileri Koruma Kurumu in Türkiye.
§ 11
Children's data
Our website and platform are intended for clinic professionals. Clinics may process data about minor patients under their own legal basis and guardian-consent processes; ClinicSuite provides guardian fields and access controls to support this but does not knowingly collect children's data for its own purposes.
§ 12
Changes and contact
We will post updates here and change the effective date. Material changes affecting customers are notified by email at least 30 days in advance. Questions can go to [email protected]; our Data Protection Officer can be reached at [email protected].