COOKIE POLICY
1. PURPOSE AND SCOPE
This Cookie Policy explains the cookies and similar technologies used on the TreatX Health platform (the "Platform"), operated by TREATX Medikal Turizm Sanayi ve Ticaret A.Ş. ("TreatX" or the "Company"), the purposes and legal grounds for their use, the service providers to whose servers data is transmitted, and how you can manage your preferences. The Company is the data controller under Turkish Personal Data Protection Law No. 6698 ("KVKK") in respect of personal data processed through cookies; the Company’s contact details and further information about your rights are set out in the privacy notices published on the Platform.
This Policy has been prepared with reference to the Turkish Personal Data Protection Authority’s Guidelines on Cookie Practices and constitutes the detailed second layer of the cookie notice displayed when you first access the Platform.
2. COOKIES AND SIMILAR TECHNOLOGIES
Cookies are small text files stored on your device through your browser by the website you visit. The Platform may also use similar technologies, such as local storage (localStorage), that perform functions comparable to cookies; in this Policy, the term "cookie" also covers such technologies. Cookies are classified according to three criteria:
Criterion | Type | Description |
Duration | Session cookie | Deleted when the browser is closed. |
Persistent cookie | Remains on your device until the specified period expires or you delete it. | |
Party | First-party cookie | Placed under the Platform’s domain. |
Third-party sourced cookie | Created using the technology of a service provider used on the Platform and involves transmission of data to that provider’s servers. | |
Purpose | Strictly necessary | Strictly necessary for the operation and security of the Platform and to provide a service you explicitly request; not subject to your consent. |
Functional | Enables additional functionality requested by the user. | |
Analytics | Helps improve the Platform by measuring how it is used; subject to your consent. | |
Marketing / advertising | Enables interest-based advertising and retargeting; not used on the Platform. |
3. COOKIES WE USE
All cookies used on the Platform are listed below. All cookies in the inventory are placed under the Platform’s domain (first-party); however, where a company other than TreatX is identified in the provider column, the cookie is created using that provider’s technology and involves transmission of data to that provider’s servers (third-party sourced).
Cookie | Provider | Purpose | Category | Duration |
treatx_auth | TreatX | Session management and secure authentication | Strictly necessary | 24 hours |
treatx_csrf | TreatX | Protection against CSRF attacks | Strictly necessary | 24 hours |
treatx_cookie_consent | TreatX | Storing your cookie preferences, preference date and current Cookie Policy version locally and applying your preferences | Strictly necessary | Until the preference is changed or reset, or the current Policy version changes |
treatx_consent_anon_id | TreatX | Storing a random identifier that links an anonymous visitor’s cookie-preference record to the server-side record | Strictly necessary | Until local storage is cleared |
__cf_bm | Cloudflare | Bot management; distinguishing automated and malicious traffic | Strictly necessary (security) | 30 minutes (after inactivity) |
cf_clearance | Cloudflare | Storing evidence that you passed a security challenge | Strictly necessary (security) | Variable depending on Cloudflare security configuration |
g_state | State management for Google sign-in functionality | Functional | Duration determined by Google | |
ph_<project>_posthog (cookie and local storage) | PostHog | Usage analytics and measurement; counting visits and interactions using a random (pseudonymous) identifier | Analytics — after consent | 365 days |
Technologies we do not use: The Platform does not use advertising, retargeting or social-media cookies or pixels. If this changes, the Policy will be updated and your consent will be requested separately for the relevant category.
Payment step: Where payment is collected through the secure payment screen of the Payment Service Provider (currently iyzico), cookies used on that screen are subject to the Payment Service Provider’s own cookie and privacy policies.
4. LEGAL GROUNDS AND EXPLICIT CONSENT
Category | Legal ground (KVKK) | Your consent |
Strictly necessary | Establishment and performance of the Platform use and membership agreement (Art. 5/2-c); legal obligation relating to data security (Art. 5/2-ç and KVKK Art. 12); legitimate interest in ensuring Platform security (Art. 5/2-f) | Not required |
Functional (Google sign-in) | Provision of the sign-in service you request when you choose “Continue with Google” (Art. 5/2-c) | Not required |
Analytics | Explicit consent (Art. 5/1) | Required (off by default) |
Consent-based cookies are not placed and no data is collected through them unless you provide consent. In the cookie notice, "Accept All", "Reject All" and "Manage Preferences" are presented on the first layer with equal prominence; categories are not pre-selected, scrolling the page or continuing to use the Platform does not constitute consent, and access to the Platform is not conditional upon accepting cookies. You may give consent by category and withdraw it as easily as you gave it. This Policy is for information purposes; your consent is obtained through your separate choices in the cookie notice (Principle Decision No. 2026/347).
Your preferences (date, scope and Policy version) are retained for 3 years for evidentiary purposes. Your preferences are requested again every 12 months and whenever there is a material change in cookie use.
5. HEALTH DATA AND COOKIES
As TreatX is a healthcare services marketplace, it applies the following principles in relation to cookies and similar technologies:
6. SERVICE PROVIDERS AND INTERNATIONAL DATA TRANSFERS
The service providers included in the inventory and the data transmitted to them are shown below:
Provider | Role | Data transmitted | Location and transfer safeguards |
Cloudflare, Inc. | Data processor — content delivery and security (bot management, attack protection) | IP address, browser and device information, request information, encrypted bot score | Global server network (headquartered in the USA) — safeguards compliant with KVKK Art. 9 |
PostHog, Inc. | Data processor — usage analytics (only with your consent) | Random identifier, page-view and interaction events, browser and device information | USA (PostHog US Cloud) — safeguards compliant with KVKK Art. 9 |
Google LLC | Google sign-in service; separate data controller for data within this scope | Sign-in state information; name and email address transmitted by Google to the Company when you sign in with Google | You complete the sign-in process directly with Google; Google’s privacy policy applies |
Data transmitted to Cloudflare and PostHog is transferred abroad in accordance with the safeguards prescribed under Article 9 of the KVKK; acting as data processors, these providers may not use data obtained through cookies for their own purposes outside the Company’s instructions. When you use the Google sign-in option, you complete the sign-in process directly with Google; for data within this scope, Google acts as a separate data controller subject to its own privacy policy.
7. HOW CAN YOU MANAGE YOUR PREFERENCES?
You may change your preferences at any time and withdraw your consent through the cookie notice displayed when you first access the Platform and the [Cookie Settings] link available at the bottom of every page. When you withdraw your consent, the relevant cookies are no longer used and are deleted from your device; data previously collected within this scope is destroyed in accordance with the Personal Data Retention and Destruction Policy.
You may also delete or block cookies through your browser settings:
Browser | Help page |
Google Chrome | https://support.google.com/chrome/answer/95647?hl=tr |
Safari (Mac) | https://support.apple.com/tr-tr/guide/safari/sfri11471/mac |
Mozilla Firefox | https://support.mozilla.org/tr/kb/cerezleri-silme-web-sitelerinin-bilgilerini-kaldirma |
Microsoft Edge | https://support.microsoft.com/tr-tr/microsoft-edge/microsoft-edge-de-tanımlama-bilgilerini-silme-63947406-40ac-c3b8-57b9-2a946a29ae09 |
If you block strictly necessary cookies, you may be unable to sign in to the Platform or may repeatedly encounter security verification. Deleting cookies through your browser settings may also delete your cookie preferences and cause the notice to be displayed again.
8. YOUR RIGHTS
KVKK m.11 kapsamındaki haklarınızı, Platform'da yayımlanan Veri Sorumlusuna Başvuru Formu'nda sayılan yöntemlerle kullanabilirsiniz; başvurunuz en geç 30 gün içinde ücretsiz sonuçlandırılır. Başvurunuzun reddedilmesi, cevabı yetersiz bulmanız veya süresinde cevap verilmemesi hâllerinde Kişisel Verileri Koruma Kurulu'na şikâyet hakkınız saklıdır (KVKK m.13-14).
9. CHANGES AND EFFECTIVE DATE
The Policy is updated when the cookie inventory changes; if a new consent-based category is added or the purpose of a cookie changes, the cookie notice is displayed again and your consent is requested again. Material changes are announced on the Platform. This Policy entered into force on 3 October 2026; previous versions are archived for evidentiary purposes.