Personal Data Protection Law

EN — Personal Data Protection Information Notice

PERSONAL DATA PROTECTION INFORMATION NOTICE

Last Updated: September 2026

MedicaTour values the protection of personal data. This Information Notice explains, in accordance with applicable data protection legislation, including Türkiye’s Law No. 6698 on the Protection of Personal Data (“KVKK”), the purposes for which your personal data may be processed, the parties to whom it may be transferred, the methods and legal grounds for collection, and your rights.

Data Controller

For the purposes of applicable data protection legislation, the data controller is:

Medicatur Sağlık Hizmetleri Otomotiv Turizm İnşaat Limited Şirketi
Brand: MedicaTour
Website: www.medica-tours.com
Email: info@medica-tours.com

Categories of Personal Data We May Process

Depending on your relationship with MedicaTour, we may process:

• Identity information
• Contact information
• Country and language information
• Information relating to requested treatments or healthcare services
• Appointment and travel information
• Accommodation and transfer preferences
• Information relating to healthcare provider and treatment coordination
• Limited financial and payment-related information
• Requests, complaints and communication records
• IP address, device, browser and technical usage information
• Cookie preferences

Where you provide such information for treatment assessment or healthcare coordination purposes, the following may constitute special category personal data:

• Medical history
• Test results
• X-rays
• Photographs
• Imaging results
• Other health-related information

Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

• Responding to enquiries and requests
• Coordinating international healthcare and medical tourism processes
• Facilitating communication with selected healthcare providers and professionals
• Supporting treatment assessment and planning
• Managing appointment processes
• Coordinating accommodation, transfers and travel arrangements
• Providing international patient support
• Managing requests and complaints
• Fulfilling financial and accounting obligations
• Maintaining information and Website security
• Improving Website performance and user experience
• Complying with legal obligations
• Responding to requests from competent public authorities
• Sending commercial communications where the required consent or other applicable legal basis exists

Methods of Collection

Personal data may be collected through:

• Forms on www.medica-tours.com
• Email
• Telephone
• WhatsApp
• Online communication tools
• Coordination processes with healthcare providers
• Contracts and other documentation
• Website and cookie technologies

Data may be collected by fully or partially automated means or by non-automated means where the data forms part of a data filing system.

Legal Grounds for Processing

Personal data may be processed on the legal grounds set out under Articles 5 and 6 of KVKK, depending on the relevant processing activity.

These may include:

• Processing expressly provided for by law
• Processing directly related to the establishment or performance of a contract
• Compliance with a legal obligation
• Establishment, exercise or protection of a right
• Legitimate interests of the data controller, provided that fundamental rights and freedoms are not adversely affected
• Explicit consent where required

Special category personal data is processed only where an appropriate legal condition under Article 6 of KVKK applies and appropriate technical and organisational measures are implemented.

The appropriate legal basis for processing health data is assessed according to the specific processing activity.

Transfer of Personal Data

Where necessary and limited to the relevant purpose, personal data may be transferred to:

• Selected healthcare providers
• Relevant doctors and healthcare professionals
• Accommodation providers
• Transfer and transportation providers
• Technology and infrastructure service providers
• Accounting, legal and professional advisers
• Competent public authorities
• Other persons or organisations where disclosure is legally required

Transfers are carried out only to the extent necessary for service delivery, compliance with legal obligations or other lawful processing purposes.

International Transfers

As MedicaTour supports international patients and certain technology or communication services may involve providers located outside Türkiye, personal data may in some circumstances be transferred internationally.

Such transfers are carried out in accordance with Article 9 of KVKK and applicable secondary legislation, including, where appropriate, adequacy decisions, appropriate safeguards, standard contracts or other legally permitted transfer mechanisms.

Health Data

Health data is special category personal data.

Where health information is provided to MedicaTour for treatment assessment or healthcare coordination purposes, it is processed only for the relevant purposes and may be shared with selected healthcare providers or healthcare professionals where necessary.

MedicaTour is not a healthcare provider. Medical assessment, diagnosis and treatment decisions remain the responsibility of the relevant healthcare professional and healthcare provider.

Data Security and Retention

MedicaTour implements appropriate technical and organisational measures designed to prevent unlawful processing, unauthorised access and loss of personal data.

Personal data is retained only for the period necessary for the relevant processing purpose and any applicable statutory retention periods.

When the legal basis or purpose for processing no longer exists, personal data is deleted, destroyed or anonymised in accordance with applicable law.

Your Rights

Under Article 11 of KVKK, you may have the right to:

• Learn whether your personal data is being processed
• Request information if your personal data has been processed
• Learn the purpose of processing and whether data is used in accordance with that purpose
• Know the third parties to whom your personal data is transferred domestically or internationally
• Request correction of incomplete or inaccurate personal data
• Request deletion or destruction where the legal conditions are met
• Request notification of corrections, deletion or destruction to third parties to whom data has been transferred
• Object to an adverse result arising exclusively from automated processing
• Request compensation for damage arising from unlawful processing

Applications and Contact

You may submit requests concerning your personal data via:

Email: info@medica-tours.com

or through other methods permitted under applicable legislation.

Requests will be evaluated within the periods prescribed by applicable law.