Last updated: 14 October 2026
Data controller
Metropolmed Sağlık Hizmetleri ve Turizm A.Ş. is the controller of your personal data. We apply the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR to patients and visitors in those regions, together with Turkish Personal Data Protection Law No. 6698.
- Metropolmed Sağlık Hizmetleri ve Turizm A.Ş.
- Address: Atalar, Üsküdar Cd. No:112, 34862 Kartal/İstanbul, Türkiye
- Email: [email protected]
- Phone: +90 216 504 52 69 · WhatsApp: +90 549 540 58 40
Categories of personal data
- Identity and contact data: name, phone number, email address, country.
- Health data (special category): photos, medical history, test results and treatment records.
- Booking and payment data: travel dates, hotel and transfer details, payment records.
- Technical data: IP address, device and browser information, website logs.
- Communication data: messages you send us and your marketing preferences.
Legal bases (Articles 6 and 9 GDPR)
- Article 6(1)(b), contract: to answer your enquiry, prepare your treatment plan and provide treatment and related services.
- Article 9(2)(a), explicit consent: to process your health data and photos for a medical assessment.
- Article 9(2)(h), healthcare: for medical diagnosis, treatment and aftercare by professionals bound by confidentiality.
- Article 6(1)(c), legal obligation: medical record-keeping, tax and accounting duties.
- Article 6(1)(f), legitimate interests: keeping our website secure and answering follow-up questions.
- Article 6(1)(a), consent: marketing messages, which you can withdraw at any time.
Recipients
Our doctors and patient-support team; service providers acting on our instructions (CRM, hosting, email and messaging, payment providers); hotels, transfer companies and interpreters for bookings you request; healthcare partners involved in your treatment; and authorities where the law requires.
Transfers outside the EEA and UK
We are based in Türkiye, which does not have an EU adequacy decision. When you send us your data from the EEA or the UK, it is transferred to Türkiye so that we can answer you and provide treatment you request (Article 49(1)(b) GDPR), and, for health data, on the basis of your explicit consent. Where we use service providers in other countries, we rely on adequacy decisions or standard contractual clauses.
Retention
We keep your data only as long as needed for the purposes above and as required by law. Details are in our Privacy Policy.
Your rights under Articles 15–22 GDPR
You have the right to:
- access your personal data (Article 15);
- rectification of inaccurate data (Article 16);
- erasure (Article 17);
- restriction of processing (Article 18);
- data portability (Article 20);
- object to processing based on legitimate interests and to direct marketing (Article 21);
- withdraw consent at any time, without affecting earlier processing (Article 7(3));
- lodge a complaint with the data protection authority in your country of residence or work.
To use your rights, email [email protected] with the subject “GDPR request”. We reply within one month.
Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
Other legal pages: Privacy PolicyCookie PolicyTerms & ConditionsRefund & Cancellation Policy