Version of 15 November 2026.
This policy explains what data the TurkeyClinics directory collects, why, who receives it, how long we keep it and how you can control it. It is written with the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection in mind. Where the law of your country gives you more rights, those rights apply.
We aim to collect as little as possible. You can read the directory, guides and reviews without registering or sending us any personal data.
1. Who is responsible
The data controller is Oleksii Kravchenko, FOP (sole proprietor), address Kyiv, Ukraine, email [email]. Our EU representative under Article 27 GDPR is [to be named if appointed]. For any data question, write to [email] with the subject "Data".
TurkeyClinics is not a healthcare provider and keeps no medical records. We process only the health details you choose to send us, and only with your explicit consent.
2. What data we process
Depending on how you use the site, we may process the following categories of data:
- technical visit data, including IP address, browser and device type, language, request time and page address, which our hosting provider Cloudflare receives automatically;
- your settings on the site, namely your cookie choice and selected currency, which are stored only in your browser;
- enquiry data such as name, email, phone or messenger, country, treatment of interest, preferred dates and message text;
- health details you add voluntarily, for example a description of the problem, photos of teeth or hair, X-rays and test results;
- review data, including the name you give, rating, text and attached photos;
- correspondence with us by email or messenger.
We do not ask for or keep passport details, payment card numbers, passwords or copies of documents. Please do not send them to us in any form.
3. Health information
Photos, X-rays and descriptions of symptoms are special category data. We process them only on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the box in the form. Without it the form cannot be sent. Sending such details is optional, and you can request a quote without them, although it will be less precise.
You can withdraw consent at any time by writing to [email]. Withdrawal does not affect processing carried out before it and does not recall data already passed to the clinic you chose. The full terms are set out in the consent text.
4. Purposes and legal bases
Each purpose has its own legal basis:
| Purpose | Data | Legal basis |
| Running the site and protecting it from attacks | Technical data | Legitimate interest (Art. 6(1)(f) GDPR) |
| Remembering your settings | Cookie choice, currency | Necessary for the site, your consent for external content |
| Passing your enquiry to clinics you chose | Enquiry data | Your request (Art. 6(1)(b)) and consent (Art. 6(1)(a)) |
| Passing on health details | Photos, X-rays, description | Explicit consent (Art. 9(2)(a)) |
| Publishing a review | Review data | Consent (Art. 6(1)(a) and 9(2)(a)) |
| Answering emails and correcting data | Correspondence | Legitimate interest and your request |
| Visit statistics | Anonymised data without cookies | Legitimate interest in improving the site |
| Legal compliance and defence against claims | The minimum needed | Legal obligation and legitimate interest |
We do not sell personal data, do not use it for third-party advertising and do not make automated decisions that have legal effects on you.
5. Who receives your data
Data goes only to those without whom the site or your enquiry cannot work:
- clinics you selected in your enquiry receive your contact details, request and attachments;
- Cloudflare, Inc. provides hosting, page delivery and attack protection, see the Cloudflare privacy policy;
- Google Ireland Ltd. and Google LLC receive your IP address when fonts, Google Maps and YouTube videos load, see the Google privacy policy;
- requests and reviews sent through the forms arrive in a private Telegram channel (Telegram FZ-LLC) that only the site administrators can access;
- our email provider stores our email correspondence;
- Cloudflare Web Analytics counts visits without cookies and without writing anything to your device, and we only see overall figures that are not linked to any individual;
- public authorities and courts receive data only when lawfully required.
Once a clinic receives your enquiry, it becomes an independent controller of your data and processes it under its own rules and Turkish law. We do not control what a clinic does and are not responsible for how it uses, stores or shares that information. Before sending data, it is worth reading the clinic's own privacy policy.
6. Transfers outside the EU and the UK
Türkiye has not been recognised by the European Commission as offering an adequate level of data protection. Your enquiry is passed to a Turkish clinic on the basis of your explicit consent (Article 49(1)(a) GDPR). This means different protection rules may apply in Türkiye and your rights may be harder to enforce there.
Cloudflare and Google may process data in the United States. Such transfers rely on the EU-US Data Privacy Framework, in which these companies participate, and on the European Commission's standard contractual clauses.
7. How long we keep data
| Data | Period |
| Cloudflare technical logs | Under Cloudflare's rules, usually no more than a few days |
| Settings in your browser | Up to 6 months or until you delete them |
| Enquiries and attachments | 12 months after the last contact, then deleted |
| Published reviews | While the review is on the site, deleted on request |
| Correspondence | 24 months after the last email |
| Records needed to defend against claims | Until the limitation period ends |
8. Your rights
You may exercise the following rights at any time:
- to find out what data we hold about you and receive a copy;
- to have inaccurate data corrected;
- to have data erased where there is no lawful reason to keep it;
- to restrict processing;
- to receive data in a machine-readable format and pass it to another controller;
- to object to processing based on legitimate interest;
- to withdraw consent without giving reasons;
- to complain to the data protection authority of your country.
To exercise a right, write to [email]. We reply within one month and may ask you to confirm your identity so that we do not disclose data to someone else. Only the clinic itself can delete data from its systems, so such requests should be sent to the clinic directly.
9. Security
The site runs only over secure HTTPS, and access to enquiries is limited to a small number of people. Even so, no method of transmission over the internet is completely secure. Email and messengers do not guarantee the protection of messages, and you send information through them at your own risk. If a serious breach affects your rights, we will inform you and the supervisory authority within the time limits set by law.
10. Age
The site is intended for people aged 18 and over. We do not knowingly collect data from minors. If you fill in an enquiry on behalf of a child, you confirm that you are their legal representative.
11. Links to other sites
Our pages contain links to maps, videos and other resources. Those sites follow their own rules, and we are not responsible for how they process data.
12. Changes to this policy
We may change this policy, for example when we add services or the law changes. The current version is always published on this page with its date at the top. If changes significantly affect data already collected, we will announce them prominently on the site or by email.