PRIVACY NOTICE
This Privacy Notice has been prepared pursuant to Article 10 of the Personal Data Protection Law No. 6698 ("KVKK") to explain which of your personal data are processed while you use the TreatX Health Platform, for what purposes and on which legal grounds they are processed, to whom and for what reasons they may be transferred, how long they are retained, and how you may exercise your rights under the Law.
1. DATA CONTROLLER
TREATX Medikal Turizm Sanayi ve Ticaret A.Ş. ("TreatX" or the "Company") — MERSİS No.: 0859154003100001 — Address: Adalet Mah. Manas Blv. No: 47B, İç Kapı No: 2809, Bayraklı/İzmir, Türkiye — E-mail: info@treatx.health — Registered Electronic Mail (KEP): treatxmedikal@hs03.kep.tr — Website: www.treatx.health (including its subdomains, the "Platform"). TreatX is the data controller under the Personal Data Protection Law No. 6698 ("KVKK") in respect of the processing activities described in this Notice. For questions concerning the protection of personal data, you may contact our data protection contact point through the channels specified above.
2. SCOPE AND DATA SUBJECTS
This Notice applies to the natural-person representatives and authorised persons, physicians and other healthcare professionals, and employees using the Platform on behalf of healthcare institutions that apply to or register with the Platform as a Service Provider (data subject category: Service Provider representative/employee). When entering its personnel’s data into the Platform, the Service Provider is responsible for informing those individuals.
3. PERSONAL DATA PROCESSED, PURPOSES AND LEGAL GROUNDS
Data category and examples | Purposes of processing | Legal ground (KVKK) |
Identity and contact: representative/authorised person’s full name, Turkish ID/passport no. [where verification is required], role/title, corporate e-mail address and telephone number | Conclusion of the Membership Agreement; opening and administration of the account; notifications | Art. 5/2(c) |
Professional information: diploma, specialty and employment certificate information, experience, academic title, information to be published on the profile, and photograph | Verification; creation of the profile page within the framework of information permitted under applicable legislation | Art. 5/2(c); Art. 5/2(ç); Art. 5/2(f) |
Authorisation and licence: International Health Tourism authorisation certificate, operating permit/licence, signature circular, power-of-attorney information | Verification of compliance with the International Health Tourism Regulation and professional legislation; Platform reliability | Art. 5/2(ç); Art. 5/2(f) |
Financial: IBAN, invoicing and tax information | Service Provider settlement payments; commission, set-off and invoicing arrangements | Art. 5/2(c); Art. 5/2(ç) |
Usage records: account activity, messaging records, access logs, content publication history | Account security; compliance monitoring under healthcare promotion legislation; record-keeping obligations; evidence in disputes | Art. 5/2(ç); Art. 5/2(e); Art. 5/2(f) |
Processing based on Article 5/2(f) of the KVKK is carried out only where the Company has a legitimate interest and provided that such processing does not prejudice your fundamental rights and freedoms.
4. METHOD OF COLLECTION
Data are collected electronically through application forms, the contracting process, the document-upload module, use of the Platform and verification against official records (including verification of authorisation certificates), by fully automated, partially automated and non-automated means.
5. TRANSFERS
Data may be transferred, solely for the purposes set out below, to our suppliers (data processors), business partners, legally authorised public institutions and organisations, and legally authorised private-law persons:
Recipient group | Purpose of transfer | Domestic / international |
Payment Institution and banks | Service Provider settlement payments and collection flow | Domestic |
Ministry of Health / USHAŞ | Authorisation certificate and audit processes | Domestic |
Financial adviser, auditors and legal advisers | Regulatory compliance, books and records, dispute management | Domestic |
Hosting and IT suppliers (data processors) | Operation of the infrastructure | Germany, USA |
The Company’s group companies / affiliates [if such a structure exists] | Centralised management of finance, accounting and information technology processes | Domestic |
Service Recipients | Professional information published on the profile page (only the fields intended for publication) | Countries in which the Platform is accessible |
6. RETENTION PERIODS
For evidentiary purposes, data are retained throughout the membership relationship and for the general limitation period of 10 years following its termination; invoice- and tax-related records are retained for the periods prescribed by tax legislation; electronic commerce transaction records are retained for 3 years; and access logs are retained for [1 year]. At the end of the applicable retention periods, the data are destroyed during periodic destruction cycles.
7. DATA SECURITY
Your personal data are protected in accordance with the technical and administrative measures set out in the Board’s guidelines, including encryption in transit and at rest, role-based access controls and an authorisation matrix, multi-factor authentication, maintenance of access logs, regular penetration testing, personnel confidentiality undertakings and awareness training. For special categories of personal data, the adequate measures specified in the Board’s Decision dated 31 January 2018 and numbered 2018/10 are also applied. For further details, please refer to the Security Policy published on the Platform.
8. YOUR RIGHTS AND APPLICATION
Pursuant to Article 11 of the KVKK, by applying to the Company you have the right to:
Application procedure: You may submit your application in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller: (i) through the account/support channel on the Platform, (ii) by completing the [Data Subject Application Form], (iii) in writing to the postal address stated above, (iv) to our registered electronic mail (KEP) address at treatxmedikal@hs03.kep.tr, (v) from the e-mail address registered in our systems to info@treatx.health, or (vi) using a secure electronic signature/mobile signature. Additional verification may be requested to establish your identity. Depending on the nature of your application, it will be concluded free of charge as soon as possible and in any event within 30 (thirty) days at the latest (where the transaction entails an additional cost, the fee set out in the tariff determined by the Board may be charged). If your application is rejected, you find the response insufficient, or no response is provided within the prescribed period, you retain the right to lodge a complaint with the Personal Data Protection Board within 30 days from the date on which you become aware of the response and, in any event, within 60 days from the date of your application (Articles 13–14 of the KVKK).
9. EFFECTIVE DATE AND AMENDMENTS
This Notice entered into force on 2 October 2026. The Company updates this Notice in line with changes to its processing activities; the current version is published on the Platform, and previous versions are archived for evidentiary purposes. [Version: v1.0]