Last updated · 21.10.2026
This is a translation for information. The Turkish text prevails.
1. What this notice is about
This privacy notice has been prepared by Medassist Turizm ve Seyahat A.Ş. ("MedAssist") under Article 10 of Turkish Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains for which purposes and on which legal grounds we process the personal data of people who visit our website, fill in our contact form or contact us by phone, email or WhatsApp, to whom the data may be transferred, and what rights these people have.
MedAssist is an international health tourism intermediary authorised by the Ministry of Health of the Republic of Türkiye. MedAssist is not a healthcare facility and does not provide medical services. It organises and coordinates, for patients coming from abroad, their consultations with hospitals and doctors in Türkiye, their travel and accommodation, and interpreting and accompaniment services. All decisions on medical assessment, diagnosis and treatment belong to the hospitals and doctors who provide the treatment; these institutions fulfil their own information obligations separately.
2. Data controller
The data controller under the Law is Medassist Turizm ve Seyahat A.Ş., whose identity and contact details are given below.
– Company name: Medassist Turizm ve Seyahat A.Ş.
– Address: Alibeyköy Mah. Namık Kemal Cad. 73-77, Kat: 1 No: 23, Eyüpsultan / İstanbul, Türkiye
– Email: medassist@medassist.com.tr
– Phone: +90 212 427 47 47 (office), +90 532 360 56 47 (mobile)
– Tax number: 6141179403
– Istanbul Chamber of Commerce registration number: 184968-5
– Ministry of Health International Health Tourism Authorisation Certificate No: AK-0098
– TÜRSAB licence No: 11741
3. Which personal data we process
When you only visit our website: As on any website, the server logs of our hosting provider record your IP address, browser and device information, the time of access and the address of the page you viewed, as transaction security data. A cookie that remembers the language you selected is also used (see section 9). Our website has no analytics, advertising or social media tracking tools.
When you fill in the contact form: Identity data (full name), contact data (email address; optionally phone number and country), your preferred language, the treatment area you are interested in (optional) and your message (optional). The treatment area you are interested in and any information about your health that you share in your message are special category personal data (health data) within the meaning of Article 6 of the Law. The form does not ask for your date of birth, identity or passport number, diagnosis or medical documents. We recommend that you write in the message field only as much as you wish to share.
When you contact us by phone, email or WhatsApp: Your phone number or email address, the content of the call or correspondence, and any health information you choose to share through these channels.
If you choose to continue with the organisation process, and only to the extent necessary for that process and when we ask you for it separately: the medical reports, test results and images that the treating hospital requests for its preliminary assessment; passport details and travel documents; identity and contact details of your companion, if any; travel, accommodation and transfer preferences; payment and invoicing details.
4. Why we process your personal data
– To answer your request and communicate with you in your preferred language.
– To inform you about hospital and doctor options suited to your area of interest, and to organise the appointment and preliminary assessment process on your behalf.
– To organise and coordinate travel, accommodation, transfer, interpreting and accompaniment services.
– To conclude, perform and invoice the intermediary service contract.
– To fulfil record-keeping, notification and reporting obligations under international health tourism, tax and other legislation, and to respond to lawful requests from competent authorities.
– To keep our website secure and to prevent misuse such as automated (bot) submissions.
– To establish, exercise and protect our rights in possible disputes.
Your personal data is not used for marketing profiling or advertising targeting. We do not send you commercial electronic messages without your consent.
5. Legal grounds
Your general personal data (identity, contact, language preference and transaction security data) is processed on the following legal grounds listed in Article 5(2) of the Law:
– Processing is necessary for the conclusion or performance of a contract, provided that it is directly related to it (answering your request, running the organisation process).
– Processing is necessary for the data controller to fulfil its legal obligations (obligations under health tourism, tax and commercial legislation).
– Processing is necessary for the establishment, exercise or protection of a right.
– Processing is necessary for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms (secure operation of the website, server logs, blocking bot submissions, remembering your language preference).
Your health data is processed only on the basis of your explicit consent under Article 6(3)(a) of the Law. The explicit consent box in the contact form is not pre-ticked; if you do not tick it, the form is not sent, because we cannot process a request that may contain health information without your consent. You can withdraw your explicit consent at any time through the channels in section 11. Withdrawal does not affect the lawfulness of processing carried out up to that date; once you withdraw it, your health data is deleted, except for records we are legally required to keep, and your request can no longer be processed.
6. How we collect your personal data
Your personal data is collected electronically on the legal grounds set out in Articles 5 and 6 of the Law: through the contact form on our website (sent to our server over an encrypted HTTPS connection), email, phone calls and WhatsApp correspondence. Transaction security data is recorded automatically by the hosting infrastructure while you access the site. Medical and travel documents needed during the organisation process are obtained from you or from a person you authorise; information about the process from the treating hospital is obtained from that hospital with your knowledge.
7. To whom your personal data may be transferred
Within Türkiye, and limited to the relevant purpose, your data may be transferred to the following groups of recipients:
– Contracted hospitals and doctors who will provide treatment in Türkiye: your identity and contact details, your area of interest and the health information you share for this purpose, for appointments and preliminary assessment.
– Travel, accommodation and transfer service providers: only identity, contact and travel details. No health information is transferred to these providers.
– Interpreters and accompanying staff: identity, contact and language details as required by the service; health information needed for interpreting during medical consultations.
– Persons and organisations providing us with legal, accounting and audit services.
– Competent public authorities (Ministry of Health, USHAŞ, tax and judicial authorities): only where and to the extent required by law.
– Our IT, hosting and email service providers: as data processors, on our behalf and on our instructions.
Transfers abroad: Your personal data may be transferred abroad in the following cases:
– Hosting: Our website is hosted on the infrastructure of Vercel Inc. (USA). Data you send through the contact form and server logs pass through this infrastructure. The site's server functions (including form submission) run in Vercel's Frankfurt (Germany) region; static pages are served from Vercel's global content delivery network.
– WhatsApp: If you choose to write to us on WhatsApp, your correspondence is transmitted through the servers of Meta Platforms Ireland Limited and Meta Platforms, Inc. (USA), which provide the WhatsApp service, and is subject to WhatsApp's own privacy policy. We recommend that you share health information through the contact form or by email rather than on WhatsApp.
– Email: Your email correspondence is kept on the infrastructure of our email service provider; its servers may be located abroad.
– Your doctor, your insurance company or persons you authorise in your country: only at your request.
Transfers abroad are made in accordance with Article 9 of the Law: to countries or organisations for which the Personal Data Protection Board has issued an adequacy decision; where there is no adequacy decision, provided that appropriate safeguards such as the standard contract announced by the Board are in place; and where neither exists, in incidental cases under Article 9(6) of the Law, on the basis of your explicit consent after you have been informed of the possible risks, or where the transfer is necessary for the performance of the contract between us. The possible risks are: the country to which your data is transferred may not have data protection legislation equivalent to Türkiye's, an independent data protection authority or an effective means of redress; the public authorities of that country may access your data under their own legislation.
8. Retention periods
Your personal data is kept for as long as the purpose of processing requires and for the limitation and retention periods set by law; at the end of that period it is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
– Contact requests that do not lead to a service contract: not kept longer than the purpose requires after the request is concluded.
– Requests that lead to a service contract, and contract records: for the statutory limitation periods following the end of the contractual relationship.
– Health data: only for as long as the organisation process requires; when you withdraw your explicit consent or the process is completed, it is deleted, except for records we are legally required to keep.
– Invoices and accounting records: for the periods set by the Tax Procedure Law and the Turkish Commercial Code.
– Server access logs: for the period set by the hosting infrastructure for security purposes.
9. Cookies
Our website uses only one cookie, which is strictly necessary for the site to work: the "NEXT_LOCALE" cookie, which remembers the language you selected. This cookie does not identify you, does not track you on other sites and is not shared with third parties. Our website has no analytics, advertising or social media cookies; all site resources, including fonts, are served from our own infrastructure, and no requests are sent to third-party services (for example Google) during your visit. Session cookies of the content management panel, used only by MedAssist staff, are not written to visitors' browsers. You can delete the cookie in your browser settings; your language preference will then be asked again on your next visit.
10. Your rights
Under Article 11 of the Law, you have the right to apply to the data controller to:
– learn whether your personal data is processed,
– request information if it has been processed,
– learn the purpose of processing and whether it is used in line with that purpose,
– know the third parties in Türkiye or abroad to whom it has been transferred,
– request its correction if it is incomplete or inaccurate,
– request its deletion or destruction under the conditions set out in Article 7 of the Law,
– request that third parties to whom it has been transferred be notified of correction, deletion or destruction,
– object to a result against you arising from analysis of the processed data exclusively through automated systems,
– claim compensation if you suffer damage because of unlawful processing.
You can also withdraw at any time the explicit consent you gave for the processing of your health data.
11. How to exercise your rights
You can send your application, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in one of the following ways:
– in writing, by delivering your signed application by hand to "Alibeyköy Mah. Namık Kemal Cad. 73-77, Kat: 1 No: 23, Eyüpsultan / İstanbul" or sending it through a notary public,
– by sending your application signed with a secure electronic signature or mobile signature to medassist@medassist.com.tr,
– by writing to medassist@medassist.com.tr from the email address you previously gave us and which is registered in our records.
Your application must include your name and surname; your signature if the application is in writing; your Turkish identity number if you are a citizen of the Republic of Türkiye, or your nationality and passport number or identity number, if any, if you are a foreign national; your place of residence or business address for notification; your email address for notification, if any; your phone number; and the subject of your request. The details of the application procedure are on our "KVKK" page.
Your application is concluded free of charge as soon as possible, depending on the nature of the request, and within thirty days at the latest. If the process involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, you can file a complaint with the Personal Data Protection Board within thirty days of learning of the answer and in any case within sixty days of the application date.
12. Updates
This notice is updated in line with changes in legislation or in our data processing. The current version is always published on this page. The Turkish version of this notice prevails; versions in other languages are for information.