PRIVACY NOTICE
This Privacy Notice has been prepared pursuant to Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") to explain which of your personal data are processed when you use the TreatX Health Platform, for what purposes and on which legal grounds they are processed, to whom and why they may be transferred, how long they are retained, and how you may exercise your rights under the Law.
1. DATA CONTROLLER
TREATX Medikal Turizm Sanayi ve Ticaret A.Ş. ("TreatX" or the "Company") — MERSIS No.: 0859154003100001 — Address: Adalet Mah. Manas Blv. No: 47B, Interior Door No: 2809, Bayraklı/İzmir, Türkiye — Email: info@treatx.health — Registered Electronic Mail (KEP): treatxmedikal@hs03.kep.tr — Website: www.treatx.health (including its subdomains, the "Platform"). TreatX is the data controller under the Personal Data Protection Law No. 6698 ("KVKK") in respect of the processing activities described in this Privacy Notice. For questions regarding the protection of personal data, you may contact our data protection contact point through the channels stated above.
2. SCOPE, DATA SUBJECTS AND CHANNELS
This Privacy Notice covers: (i) the in-Platform messaging module between the Service Recipient and the Service Provider; (ii) support/help channels (in-account requests and email); and (iii) the 24/7 call line required under the International Health Tourism Regulation ("IHTR") (data subject categories: Service Recipient, Service Provider representative, and caller). Messaging is not a diagnostic or treatment tool and must not be used for emergencies.
3. PERSONAL DATA PROCESSED, PURPOSES AND LEGAL GROUNDS
Data category and examples | Purposes of processing | Legal ground (KVKK) |
Content: correspondence, shared files and images (may contain health data — special categories of personal data) | Enabling and transmitting communications with the Service Provider; carrying out the booking process | Art. 5/2(c); for health-related content, explicit consent under Art. 6/3 (within the scope of the consent obtained in the booking flow) |
Metadata: sender/recipient, date and time, channel, read status, message status | Record management; security; service quality | Art. 5/2(ç); Art. 5/2(f) |
Call records: caller number, date and time, duration, [where recorded] audio recording, call notes | 24/7 communication obligation under the IHTR; handling the request; evidence in disputes | Art. 5/2(ç); Art. 5/2(e) |
Translation records: conversations and translations carried out through an interpreter | Bilingual communication obligations | Art. 5/2(ç) |
Request/complaint: subject matter, history and outcome records | Conducting support processes; service quality | Art. 5/2(c); Art. 5/2(f) |
Processing based on Article 5/2(f) of the KVKK is carried out only where the Company's legitimate interests apply, provided that such processing does not prejudice your fundamental rights and freedoms. Content may be monitored through automated rules and limited authorised access for the purposes of preventing use contrary to healthcare promotion and advertising legislation, redirection outside the Platform, and misuse; access to messages containing health data is subject to the authorisation matrix set out in the Security Policy. Content is not analysed for marketing purposes.
4. METHOD OF COLLECTION
Data are collected through the messaging module, support forms, email and the call line, in electronic form (and verbally during calls), by fully automated, partially automated and non-automated means.
5. TRANSFERS
Your message is transmitted only to the Service Provider to whom it is addressed (where the Service Provider is located abroad, the safeguards under Article 9 of the KVKK apply). Except for transfers to hosting and communications infrastructure providers acting as data processors, translation service providers, and legally authorised public authorities and private-law persons in response to lawful requests, the data are not shared with third parties.
6. RETENTION PERIODS
Messaging records are retained for the duration of membership and for the applicable evidentiary periods relating to the associated booking; call audio recordings are retained for [3 years]; and support records are retained for [3 years] following closure. Periodic destruction is carried out upon expiry of the applicable period. Health data contained in such content are subject to the principles set out in the Privacy Notice – Booking and Health Data.
7. DATA SECURITY
Your personal data are protected in accordance with the technical and administrative measures set out in the guidance of the Personal Data Protection Board, including encryption in transit and at rest, role-based access and authorisation matrices, multi-factor authentication, maintenance of access logs, regular penetration testing, personnel confidentiality undertakings, and awareness training. For special categories of personal data, the adequate measures specified in the Personal Data Protection Board's Decision dated 31 January 2018 and numbered 2018/10 are also applied. For further details, please refer to the Security Policy published on the Platform.
8. YOUR RIGHTS AND APPLICATION
Pursuant to Article 11 of the KVKK, you have the right to apply to the Company to:
Application procedure: You may submit your application in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller by: (i) using the account/support channel on the Platform; (ii) completing the [Data Controller Application Form]; (iii) submitting a written application to the postal address stated above; (iv) sending it to our Registered Electronic Mail (KEP) address at treatxmedikal@hs03.kep.tr; (v) sending it from the email address registered in our system to info@treatx.health; or (vi) using a secure electronic signature/mobile signature. Additional verification may be requested to establish your identity. Depending on the nature of your application, it will be concluded free of charge as soon as possible and in any event within 30 (thirty) days at the latest (where the transaction requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged). If your application is rejected, you consider the response insufficient, or no response is provided within the prescribed period, you retain the right to lodge a complaint with the Personal Data Protection Board within 30 days from the date on which you become aware of the response and, in any event, within 60 days from the date of your application (Articles 13–14 of the KVKK).
9. EFFECTIVE DATE AND AMENDMENTS
This Privacy Notice entered into force on 2 October 2026. The Company updates this Privacy Notice in line with changes to its processing activities; the current version is published on the Platform and previous versions are archived for evidentiary purposes.