Privacy Policy

Last updated: 14 October 2026

Who we are

This website is operated by Metropolmed Sağlık Hizmetleri ve Turizm A.Ş. (“Metropolmed”, “we”, “us”), trading as Metropolmed Health Group. We are the data controller for the personal data described in this policy.

Metropolmed Sağlık Hizmetleri ve Turizm A.Ş.
Head office: Atalar, Üsküdar Cd. SS Plaza No:87/15, 34862 Kartal/İstanbul, Türkiye
Clinic: Atalar, Üsküdar Cd. No:112, 34862 Kartal/İstanbul, Türkiye
Email: [email protected]
Phone: +90 216 504 52 69 · WhatsApp: +90 549 540 58 40

Which data we collect

We only collect the data we need to answer your request and to plan and provide your care:

Identity and contact data: name, phone number, email address, country and preferred language.
Enquiry data: the treatment you are interested in, your message, how you heard about us and the page you sent the form from.
Health data you choose to share: photos (for example of your hair, face or teeth), medical history, medication and test results needed for a medical assessment.
Travel and booking data: travel dates, flight details, hotel and transfer preferences, passport details where needed for an invitation letter or hotel check-in.
Payment data: the amount and method of payment. Card details are entered directly on our payment providers' secure pages; we do not store full card numbers.
Technical data: IP address, approximate location (country and city), device and browser type, and the pages you visit.

Why we use your data and our legal basis

To answer your enquiry and prepare a medical opinion and treatment plan: your request and steps before a contract; for health data, your explicit consent.
To provide treatment, aftercare and follow-up: performance of our agreement with you and our legal obligations as a healthcare provider.
To arrange your hotel, VIP transfer, interpreter and invitation letter: performance of our agreement with you.
To contact you by phone, SMS, WhatsApp or email about your enquiry and appointments: your consent and our legitimate interest in answering you.
To send offers and news: only with your consent, which you can withdraw at any time.
To keep our website secure and improve it: our legitimate interest.
To meet legal, tax and medical record-keeping obligations: legal obligation.

Who we share your data with

We never sell your data. We share it only when needed for the purposes above, with:

Our own doctors, coordinators and patient-support team.
Service providers acting on our behalf: our CRM system (Bitrix24), email and messaging providers (including WhatsApp), website hosting, and payment providers (QNBpay, Stripe, Wise and our banks).
Hotels, transfer companies, airlines and interpreters, only for the bookings you ask us to make.
Hospitals, laboratories and other healthcare professionals involved in your treatment.
Public authorities when the law requires it.

International transfers

Because our patients come from many countries and some of our service providers operate outside Türkiye and the European Economic Area, your data may be transferred abroad. We do this only with appropriate safeguards, such as standard contractual clauses, or with your explicit consent where Turkish law (KVKK) requires it.

How long we keep your data

Enquiries that do not lead to treatment: up to 3 years after our last contact, unless you ask us to delete them earlier.
Medical records and treatment documents: for the period required by Turkish health legislation.
Accounting and invoice records: for the period required by Turkish tax and commercial law (usually 10 years).
Marketing consent: until you withdraw it.

Your rights

Depending on where you live, you have the right under the GDPR and KVKK to:

Access your personal data and receive a copy.
Correct inaccurate or incomplete data.
Ask us to delete your data or restrict its use.
Object to processing based on our legitimate interests, and to direct marketing at any time.
Receive your data in a portable format.
Withdraw your consent at any time, without affecting earlier processing.
Complain to your data protection authority, or in Türkiye to the Personal Data Protection Authority (KVKK).

To use your rights, email [email protected] with the subject “Data request”. We reply within 30 days.

Security

We protect your data with encrypted connections (HTTPS), access controls, staff confidentiality obligations and trusted service providers. No online system is completely secure, so please do not send card numbers or passwords by email or message.

Children

Our services are for adults. We do not knowingly collect data from children under 18 without the consent of a parent or legal guardian.

Changes to this policy

We may update this policy. The latest version is always on this page, with the date it was last updated.

Other legal pages: Cookie Policy GDPR Terms & Conditions Refund & Cancellation Policy