Privacy notice (KVKK)

1. Data controller

The data controller is HED Sağlık Turizmi Danışmanlık Eğitim Yatırım Sanayi ve Ticaret Ltd. Şti., trading as Mahbua HED Health Tourism Travel Agency.

Trade name

Mahbua HED Health Tourism Travel Agency

Company

HED Sağlık Turizmi Danışmanlık Eğitim Yatırım Sanayi ve Ticaret Ltd. Şti.

Office address

Şahin Plaza, 75. Yıl Mah. Cumhuriyet Cad. No: 69, Kat: 3, İç Kapı No: 4, 34260 Sultangazi, İstanbul, Türkiye

Phone

+90 534 517 92 50

Email

info@hedclinic.com

2. Personal data we process

• Identity data: name, surname, date of birth, nationality, and the passport or ID details needed for flight and hotel bookings.
• Contact data: phone and WhatsApp number, email address, country of residence.
• Health data: information about your health, photos, X-rays, medical reports and records that you send so that a partner facility can assess your request.
• Travel and stay data: flight details, hotel and transfer bookings, details of anyone travelling with you, language preferences.
• Communication records: your messages and notes of calls with our coordinators.
• Financial data: payment and invoice details for services you buy from us.

3. Why we process your data

• To answer your questions and requests.
• To pass your information to a partner hospital or clinic so that its physicians can assess it and prepare a proposal.
• To arrange your appointments, flights, hotel, transfers and interpreters.
• To stay in touch with you during your visit and after you return home.
• To issue invoices and keep accounting records.
• To meet our legal obligations, including health tourism and travel agency rules and requests from public authorities.

4. Legal grounds

We process your personal data on the grounds set out in Article 5 of KVKK: where it is necessary to set up or perform a contract with you, to meet a legal obligation, to establish, exercise or protect a right, or for our legitimate interests without harming your fundamental rights and freedoms.

Health data is a special category of personal data. We process it under Article 6 of KVKK, based on your explicit consent. We ask for your explicit consent before we pass your health data to a partner facility.

5. Who we share your data with

• The partner hospitals and clinics, and their physicians, involved in assessing and providing your care.
• Hotels, transfer companies, airlines and interpreters that we book for you.
• Service providers who support our work, such as accounting, IT and hosting providers.
• Public authorities, where the law requires it.

Some services we use to communicate with you, such as WhatsApp and email, may store data on servers outside Türkiye. Transfers abroad are made in line with Article 9 of KVKK. If you live outside Türkiye, our replies to you are also sent abroad.

6. How we collect your data

We collect your data directly from you by WhatsApp, phone, email or in person, and from partner facilities when they share your proposed treatment plan and schedule with us.

7. How long we keep your data

We keep your data for as long as needed for the purposes above and for the periods required by law, such as the retention periods for commercial and tax records. After that it is deleted, destroyed or anonymised.

8. Your rights

Under Article 11 of KVKK, you have the right to:

• learn whether your personal data is processed;
• request information if it has been processed;
• learn the purpose of processing and whether it is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• ask for incomplete or incorrect data to be corrected;
• ask for your data to be deleted or destroyed under the conditions in Article 7 of KVKK;
• ask for third parties to be informed of any correction, deletion or destruction;
• object to a result against you that arises only from automated analysis of your data;
• claim compensation for damage caused by unlawful processing.

9. How to apply

You can send your request in writing to our office address, or by email from the email address you have used with us. Please include your name, contact details and what you are asking for. We will reply free of charge within 30 days at the latest.

If you live in the European Union, you can use the same channels to exercise your rights under the EU General Data Protection Regulation (GDPR).

10. This website

This website does not use advertising or analytics cookies and has no forms that collect personal data. Fonts and images are served from our own website.

The contact page shows an embedded Google Maps map; when it loads, Google may process data such as your IP address under its own privacy policy. Links to WhatsApp, Instagram and Google Maps open services that have their own privacy policies.

Our hosting provider keeps standard technical server logs, such as IP address and time of visit, for security purposes.

11. Changes to this notice

We may update this notice from time to time. The date of the latest version is shown on this page.