Privacy Policy and Personal Data Protection Notice

1. Data Controller and Scope of Our Services

Brand and platform name: MedFind Global

Data controller: Simge Ticaret ve Turizm Anonim Şirketi

Registered office address: Kavakdibi Mevkii, Serender Blok No: 16, Köprübaşı Köyü, Çamlıhemşin / Rize, Türkiye.

Branch address: Üniversite Mahallesi, Hastahane Caddesi No: 1/19, Karadeniz Teknik Üniversitesi Farabi Hastahanesi, Ortahisar / Trabzon, Türkiye.

Email: info@medfindglobal.com

Telephone: +90 850 302 9553

Registered Electronic Mail (KEP): simgeticaretturizm@hs01.kep.tr

MedFind Global is a health tourism and remote healthcare information system platform operated by Simge Ticaret ve Turizm Anonim Şirketi.

Our company manages patient enquiries, communication with healthcare providers, appointment scheduling, the coordination of travel, transfers and accommodation, and the operation of the platform.

MedFind Global’s remote healthcare information system registration relates to the use of its software for remote healthcare services. Medical assessments, consultations, second opinions and clinical follow-up services offered through the platform are provided by authorised healthcare professionals operating within healthcare institutions that hold the necessary operating authorisations.

These services may involve physicians from partner healthcare institutions or physicians directly contracted by MedFind Global. Direct contracts with physicians do not replace the requirements concerning the healthcare institution’s operating authorisation or the physician’s authorisation to practise.

The identity of the healthcare institution and physician providing the service, together with the service scope and fees, is disclosed to the patient before the consultation.

This notice concerns the processing of personal data relating to website visitors, platform users, patients and prospective patients requesting information or services, accompanying persons, and other individuals who contact us.

2. Personal Data We Process and How We Collect It

Depending on your enquiry and the services involved, we may process the following personal data:

Identity information: Name and surname and, where necessary, date of birth, nationality, identity document or passport details.
Contact information: Telephone number, email address, postal address and preferred communication language.
Enquiry and service information: Requests, appointments, quotations, reservations, contracts, enquiries and complaint records.
Health information: Medical reports, test results, discharge summaries, medical images and other health information necessary for the relevant service.
Travel and accommodation information: Travel dates, transport, transfers, accommodation and necessary details of accompanying persons.
Financial information: Payment, invoice and accounting records relating to the service.
Transaction security information: IP addresses, session records, access logs, transaction logs and authorisation records.
Cookie and usage information: Device, browser, page visit and interaction information, depending on the technologies used and your preferences.

Personal data is collected through website forms, applications and document uploads submitted through the platform, electronic or physical communication channels, service agreements and transactions performed on the platform. Where required for the service, information may also be obtained from the relevant healthcare institution, subject to applicable legal conditions.

The transmission of audio or video during a consultation does not itself mean that the consultation is being recorded. The conditions applicable to audio and video recordings are explained in Section 7.

Please avoid sharing information unrelated to your enquiry. Where you act on behalf of another person, verification of your authority to represent that person may be requested.

3. Purposes and Legal Bases for Processing

Your personal data is processed, to the extent necessary for the relevant activity, for the purposes set out below.

Responding to enquiries, preparing quotations and contracts, and providing appointment and coordination services: Where processing is directly related to and necessary for entering into or performing a contract, we rely on Article 5(2)(c) of Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”).

Invoicing, accounting, mandatory recordkeeping and reporting: Where processing is expressly provided for by law or necessary to fulfil a legal obligation, we rely on Articles 5(2)(a) and 5(2)(ç) of the KVKK.

Managing legal matters and protecting rights: Where processing is necessary for the establishment, exercise or protection of a right, we rely on Article 5(2)(e) of the KVKK.

Maintaining platform security and preventing unauthorised access or misuse: Where processing is necessary for our legitimate interests without prejudicing your fundamental rights and freedoms, we rely on Article 5(2)(f) of the KVKK.

Processing health data: Health data is a special category of personal data. For our application coordination and transmission activities involving healthcare institutions, we obtain your separate explicit consent where no other applicable processing condition under Article 6 of the KVKK exists. Entering into a service agreement or reading this notice does not constitute explicit consent.

The purposes and legal bases for processing carried out by healthcare institutions as part of medical services are explained separately in their respective privacy notices.

4. Sharing Personal Data and Access

Subject to the conditions established by the KVKK and limited to the information necessary, your personal data may be shared with the following recipient groups:

Healthcare institutions and authorised healthcare professionals: To assess your enquiry and carry out appointment, medical service and follow-up processes.
Accommodation, transport and transfer providers: To fulfil the reservations and arrangements you request.
Interpreters and coordination service providers: To the extent necessary for language support and service coordination.
Technical service providers: To the extent necessary for hosting, maintenance, security and technical support.
Accounting and legal service providers: To fulfil financial obligations and manage legal matters.
Authorised public institutions and other competent authorities: To meet statutory reporting and inspection requirements and respond to lawful requests for information.

Patient reports are shared with the relevant hospitals through the platform. Access is restricted to the permissions required for the relevant application and service. Our teams in Georgia and Azerbaijan do not have access to medical reports.

Disclosures made in connection with the Ministry of Health, USHAŞ and HealthTürkiye processes are limited to the purposes and scope required by the relevant legal obligation or valid processing condition.

A complete patient file is not shared with every service provider. For example, accommodation and transfer arrangements are generally managed using only the identity, contact and reservation information necessary for those services.

5. Cookies and Similar Technologies

Our website uses technologies necessary for its operation and security, as well as Google Analytics to evaluate visitor statistics and Meta Pixel to measure advertising performance.

Depending on their configuration, these tools may process IP addresses, cookie identifiers, device and browser information, pages visited and interaction data.

Analytics and advertising technologies that require explicit consent are not activated before you make the relevant choice. Rejecting these technologies does not prevent you from using essential enquiry and service request functions.

You can change your preferences and withdraw your consent through the cookie management area. The names, providers, purposes, durations and transfer details of the cookies used are explained in the Cookie Policy.

Patient reports, consultation content and health information are excluded from the data sent to analytics or advertising tools.

6. International Data Transfers

Our website server is located in Türkiye. However, the use of third-party services may involve separate transfers of personal data abroad.

International transfers arising from services such as Google Analytics and Meta Pixel are also subject to Article 9 of the KVKK. Consent to the use of cookies does not, by itself, mean that all legal conditions for regular international transfers have been satisfied.

For activities involving international transfers, an applicable processing condition must exist and the necessary transfer requirements, such as an adequacy decision or appropriate safeguards, must be met. Exceptional transfer provisions apply only in circumstances that satisfy the statutory conditions.

The recipient, purpose, categories of data transferred and legal transfer mechanism are explained in the relevant privacy notice. A service requiring an international transfer is not activated unless the necessary legal conditions have been met.

7. Privacy and Records in Remote Healthcare Services

Before a remote healthcare service begins, the patient is informed about the healthcare institution and professional providing the service, its scope, limitations, fees, technical conditions and the steps to take in an emergency. The relevant healthcare institution carries out the necessary identity verification procedures.

If an interpreter, accompanying person or another individual participates in the consultation, or if a third party can hear or see the consultation, the other party is informed.

Under the applicable regulation, making audio or video recordings of a remote healthcare service or taking photographs during the consultation requires the explicit consent of both parties. Granting access to a camera or microphone does not constitute explicit consent to recording.

Audio and video recordings made with explicit consent are stored at the healthcare institution providing the service or at secure data centres authorised by the Ministry of Health. These recordings may not be retained for longer than twelve months and are deleted when that period expires.

Clinical records, transaction records and access logs are distinct from audio and video recordings and are subject to the applicable statutory recordkeeping, reporting and retention requirements.

8. Data Security and Responsibilities of the Parties

Technical and organisational measures appropriate to the nature of the data are implemented to prevent unlawful processing and access and to protect personal data.

Access permissions are limited according to role and service requirements. Additional security requirements applicable to special categories of personal data are taken into account when protecting health data.

Simge Ticaret ve Turizm Anonim Şirketi is responsible for the processing activities it carries out in connection with its platform and coordination services. Healthcare institutions retain their responsibilities concerning clinical services.

Activities in which our company acts as a data processor on behalf of and under the instructions of a healthcare institution are distinguished from activities in which it determines the purposes and means of processing as a data controller. These roles are assessed according to the actual processing arrangements. The parties’ responsibilities are explained in the relevant agreements and privacy notices.

9. Retention and Disposal

Personal data is retained for the periods prescribed by applicable legislation and for as long as necessary for the relevant processing purpose.

Retention periods are determined by considering the nature of the data, the service relationship, mandatory recordkeeping obligations and the periods necessary for the establishment, exercise or protection of a right. A single retention period does not apply to all categories of data.

When all applicable grounds for processing cease to exist, personal data is deleted, destroyed or anonymised in accordance with the relevant legislation.

Medical records held by healthcare institutions are subject to their applicable legal requirements. The twelve-month limit stated in Section 7 applies specifically to audio and video recordings of remote healthcare services.

10. Your Rights Regarding Your Personal Data

Under Article 11 of the KVKK, you have the right to:

Learn whether your personal data is being processed.
Request information about the processing of your personal data.
Learn the purposes of processing and whether your data is used in accordance with those purposes.
Know the third parties to whom your data is transferred within Türkiye or abroad.
Request the correction of incomplete or inaccurate personal data.
Request deletion or destruction where the statutory conditions are met.
Request that corrections, deletions or destruction be notified to third parties to whom your data has been transferred.
Object to a result detrimental to you arising from analysis of your data exclusively through automated systems.
Seek compensation for damage caused by unlawful processing.

11. How to Submit a Request

You may submit requests concerning your rights to Simge Ticaret ve Turizm Anonim Şirketi through the following methods:

A signed written application sent to our registered office address.
A Registered Electronic Mail (KEP) application sent to simgeticaretturizm@hs01.kep.tr.
An email sent to info@medfindglobal.com from an email address you previously provided to us and that is registered in our system.
Other methods accepted under the legislation governing applications to data controllers.

Your application must include your name and surname; your signature for written applications; your Turkish identity number if you are a Turkish citizen or, for foreign nationals, your nationality and passport number or identity number, if available; your address for correspondence; your email address and telephone number, if available; and the details of your request. Relevant supporting information and documents should be attached.

Additional information that is necessary and proportionate may be requested to verify your identity.

Applications are resolved as soon as possible, depending on their nature, and no later than thirty days. If the process involves an additional cost, a fee may be charged in accordance with the tariff established by the Personal Data Protection Board.

12. Privacy Notices and Explicit Consent

This notice is provided for information purposes. Reading it, visiting our website or requesting a service does not mean that you consent to every use of your personal data.

Where explicit consent is required, the relevant purpose and scope are explained and your choice is obtained separately. Consent to different activities, such as processing health data, recording consultations and using advertising technologies, is not interchangeable.

You may withdraw your explicit consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Applicable obligations continue to apply to records that must be retained on another legal basis.

Last updated: 27 September 2026