Privacy Policy

PERSONAL DATA PROTECTION AND PROCESSING PRIVACY NOTICE

iMed Medical  ·  International Health Tourism Facilitator

Maccenta Turizm Ticaret Ltd. Şti.  ·  USHAŞ License No: AK-0135  ·  Tax ID: 6090401763  ·  Trade Registry No: 650129

Prepared under Law No. 6698 (KVKK) and, to the extent applicable, the EU GDPR.

Effective date: [April 7, 2016]   ·   Last updated: [September 25, 2026]   ·   Contact: [email protected]

This Privacy Notice explains how Maccenta Turizm Ticaret Ltd. Şti. (“Company”, “we”), trading as iMed Medical, processes personal data as data controller. iMed Medical is a licensed international health tourism facilitator. It does not perform medical procedures and is not a healthcare facility. Medical and surgical services are provided by independent partner physicians and partner healthcare institutions, who act as independent data controllers with respect to the clinical data they process.

Article 1 — Data Controller

The data controller responsible for the personal data described in this notice is the following legal entity:

Maccenta Turizm Ticaret Ltd. Şti. (trading as iMed Medical)

Registered address: Akat Mah. Alev Sok. No: 7, Beşiktaş, İstanbul, Türkiye

Trade Registry No: 650129   |   Tax ID No: 6090401763   |   USHAŞ License No: AK-0135

Email: [email protected]   |   Website: www.imedmedical.com

Article 2 — Scope and Our Role

This notice applies to the processing of personal data of prospective patients, patients, their companions and emergency contact persons, and visitors to our website, in connection with the coordination of international health tourism journeys.

As a facilitator, our role is limited to coordinating the patient’s health tourism journey; this includes communication, preliminary information, planning, appointments, travel, accommodation, transfer, and post-treatment communication coordination. iMed Medical does not provide any medical diagnosis, treatment, operation, examination, prescription, or healthcare service; it does not give medical advice and does not operate as a healthcare facility. Medical and surgical services are provided by the independent partner physicians and/or partner healthcare institutions to whom the patient is referred. These parties act as independent data controllers with respect to their own medical assessment, patient records, diagnosis, treatment, operation, and clinical data processing activities.

Article 3 — Categories of Personal Data Processed

Depending on how you interact with us, we may process the following categories of personal data:

3.1  Identity and contact data

• Full name, date of birth, nationality, passport or national ID number, address, phone number, and email address.
• The name, relationship, and phone number of your emergency contact person.

3.2  Travel and transaction data

• Travel and accommodation details, appointment and planning information, correspondence with us, and records relating to deposits, payments, and refunds.

3.3  Health data (special category)

Where shared by you for the purpose of coordinating your journey, we process health-related information such as the procedure you are interested in, medical history you provide, photographs/visual records, prior operation details, allergy or medication information, and information necessary to refer you to a suitable partner physician or healthcare institution. Your health data is not processed by iMed Medical for the purpose of medical diagnosis or treatment; it is processed only at your request, to the extent necessary, for planning the health tourism process, referring you to an appropriate partner physician or healthcare institution, and coordinating the appointment and operation process. Health data is special category personal data and is, as a rule, processed only on the basis of your explicit consent (see Article 5).

3.4  Technical and usage data

When you visit our website, our servers automatically record technical log data such as the date and time of access, the referring URL, files requested, the volume of data transferred, browser type and version, operating system, IP address, and your internet service provider’s domain.

Information collected through cookies and similar technologies as described in Article 9. Server log data is analysed only for statistical and technical purposes and is then deleted; it is stored separately from other data.

Article 4 — Purposes of Processing

We process personal data for the following specified, explicit, and legitimate purposes:

• Coordinating your medical travel journey, including appointment, travel, accommodation, and transfer arrangements.
• Communicating with you and, where you have authorised us, with partner physicians, partner healthcare institutions, and travel partners.
• Managing deposits, payments, and refunds, and selecting payment methods.
• Responding to your questions, requests, suggestions, and complaints, including those relating to personal data.
• Ensuring the security of our website and systems and resolving technical issues.
• Generating aggregated and anonymous statistics to improve our services.
• Fulfilling our legal, regulatory, tax, and accounting obligations and responding to lawful requests from public authorities.
• Establishing, exercising, or defending legal claims.

Article 5 — Legal Bases for Processing

We rely on the following legal bases under KVKK and, to the extent applicable, the GDPR:

• Performance of a contract / your request: to take steps at your request and to coordinate your journey under the Health Tourism Coordination Agreement.
• Explicit consent: for processes requiring explicit consent, such as the processing of your health data, sending commercial electronic messages, the use of non-essential cookies, and, where necessary, the international transfer of data. Your explicit consent is obtained for a specific matter, on an informed basis, and freely; you may withdraw it at any time (see Articles 7 and 8).
• Legal obligation: for retention, tax, accounting, and regulatory requirements.
• Legitimate interest / establishment of a right: for network and information security and, where legally permitted, for the establishment, exercise, or protection of legal claims.

We may also rely, to the extent applicable, on grounds under which the Law permits processing without explicit consent — for example, data made public by you, processing expressly provided for by law, processing that is mandatory for the fulfilment of a legal obligation, or processing that is mandatory for the establishment, exercise, or protection of a right. Withdrawing your explicit consent for one matter does not automatically affect other lawful processing activities.

Article 6 — Transfer of Personal Data

We do not sell your personal data. We may share personal data, only to the extent necessary for the purposes above and under appropriate safeguards, with the following parties:

• Where you have authorised us, the partner physicians and partner healthcare institutions involved in your journey.
• Travel, accommodation, and transfer partners, to the extent necessary to make your arrangements.
• Professional advisors (legal, financial, tax, and audit) acting on our behalf under appropriate confidentiality and data protection conditions, and our IT and cloud service providers.
• Public authorities, where legally required or to respond to a lawful request.

Our core database and CRM system are hosted domestically (in Türkiye). However, the corporate email system (Gmail/Google Workspace) and the WhatsApp messaging application that we use to communicate with you are processed on the servers of the companies providing these services (Google LLC and Meta Platforms, Inc., respectively), located abroad; personal data and health data you send through these channels are therefore transferred abroad. Certain technical data is also transferred abroad due to the analytics, advertising, and security services used on our website (see our Cookie Policy for details). We do not have a payment infrastructure provider; payments are received directly by bank transfer. Where the international transfer of personal data is necessary, the transfer is carried out in accordance with the cross-border transfer provisions of KVKK and, to the extent applicable, the GDPR. In this context, depending on the nature of the transfer, appropriate safeguards recognised by the Board, standard contracts, the data subject’s explicit consent, or other lawful transfer mechanisms provided for in legislation are considered. For special category data (including health data), international transfer is, as a rule, based on your separately and explicitly obtained consent.

Article 7 — Your Rights

Subject to the conditions specified in applicable legislation, you have the following rights:

• To learn whether your personal data is being processed and, if so, to request information about it.
• To learn the purpose of processing and whether your data is used in accordance with that purpose.
• To know the third parties, domestic or abroad, to whom your data is transferred.
• To request the correction of incomplete or inaccurate data and to have this notified to third parties to whom it has been transferred.
• To request the deletion or destruction of your data where the conditions are met, and to have this notified to third parties.
• To object to a result to your detriment arising exclusively from the automated analysis of your data.
• To claim compensation for damages arising from unlawful processing.
• To lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu) or, where applicable, a competent EU supervisory authority.

To exercise these rights, please contact us using the details in Article 11. We may need to verify your identity before responding. Complaints relating to health tourism may also be submitted via the Ministry of Health’s SABİM helpline (184).

Article 8 — Marketing Communications

Commercial electronic messages for promotional, informational, campaign, or marketing purposes are sent only with your prior explicit consent and where permitted by applicable legislation. These activities are carried out in accordance with KVKK, Law No. 6563 on the Regulation of Electronic Commerce, the Message Management System (İYS) regulations, and the promotional and informational rules applicable to the health tourism sector.

You may withdraw your marketing consent at any time, free of charge, via the unsubscribe link in any electronic message, through İYS, or by writing to [email protected]. Withdrawing marketing consent does not affect the lawfulness of processing carried out before withdrawal and does not affect the health tourism coordination services provided to you.

We do not contact prospective patients without their prior consent or an inbound request from them. Patients or prospective patients first contact us themselves — by completing a form, sending a direct message, writing via WhatsApp, or by email or phone. We respond only in relation to that request, through the same or a related channel.

Article 9 — Cookies and Similar Technologies

Our website uses cookies and similar technologies to enable site functionality, ensure security, remember your preferences, analyse site usage, and, where permitted by legislation, carry out advertising/targeting activities.

Analytics and advertising/targeting cookies, other than necessary cookies, are used only where your explicit consent has been obtained in accordance with applicable legislation. Detailed information on the types of cookies used on our website, their purposes, retention periods, third-party cookies, and how to manage your cookie preferences is available in our Cookie Policy published on our website. You may change or withdraw your cookie preferences at any time.

Article 10 — Data Retention and Security

We retain personal data only for as long as necessary for the purposes described in this notice, including any applicable statutory limitation periods required by law. Details of retention periods are set out in our Personal Data Retention and Destruction Policy. When data is no longer needed, it is deleted, destroyed, or anonymised in accordance with that policy.

We take appropriate technical and administrative measures to protect personal data against unauthorised access, loss, alteration, or disclosure. Data is stored electronically and/or physically and is backed up regularly. No method of transmission or storage is completely secure; if we become aware of a security breach affecting your data, we will act in accordance with our legal obligations and, where necessary, notify the affected individuals and authorities.

Article 11 — Contacting Us and Submitting a Request

You may submit requests relating to your personal data — subject to identity verification — using the application form on our website, in writing to our registered address, through a notary, using a secure electronic/mobile signature, or by emailing [email protected] from the email address you have previously provided to us and which is registered in our systems. Your requests will be evaluated and concluded within the periods stipulated by KVKK and applicable legislation.

Email / data requests: [email protected]

Contact form: www.imedmedical.com/contact

Registered address: Akat Mah. Alev Sok. No: 7, Beşiktaş, İstanbul, Türkiye

Article 12 — Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We recommend that you review the privacy notice of any site you visit.

Article 13 — Updates to This Notice

We may update this notice from time to time to reflect changes in our services, technology, or legal obligations. The current version, together with its last update date, is always published on our website.

 

iMed Medical   |   www.imedmedical.com   |   [email protected]   |   +90 544 252 93 05

Data Subject Application Form

Under Article 11 of the Turkish Personal Data Protection Law (KVKK, Law No. 6698), you have the right to request information about how your personal data is processed. To submit a request, please complete the Data Subject Application Form and send it to us through one of the methods described in the form.

View the Data Subject Application Form (PDF)