Privacy notice (KVKK)

1. Data controller

Data controller: [COMPANY_LEGAL_NAME]. Address: [COMPANY_ADDRESS]. MERSIS: [COMPANY_MERSIS]. KEP: [COMPANY_KEP]. For personal data requests: destek@medicoly.com.

2. Personal data we process

Identity and contact: full name, email, phone (optional), country, year of birth (optional), language preference. Transaction security: password hash, session records, an irreversible hash of your IP address and browser information.

Special-category health data: the form answers and notes you enter in a quote request (only with your explicit consent). Appointment notes, review content, notifications, your conversations with the AI assistant and your requests to providers may also be processed.

Your ID or passport number is entered only during review verification; it is not stored in raw form — only an irreversible hash is compared.

3. Purposes and legal bases

We process your data to create and manage your account, forward your quote/appointment/package requests to the relevant provider, run verified reviews and security checks, provide support, meet legal obligations and improve the service.

Legal bases: establishing and performing a contract (KVKK Art. 5/2-c), legal obligation (Art. 5/2-ç), legitimate interest (Art. 5/2-f) and, for health data, explicit consent (Art. 6). You do not have to give explicit consent, but the quote service, which requires health data, cannot be provided without it.

4. Transfers

Health data in a quote request goes only to the clinics you select; your name, email and phone go only to the provider whose quote you accept or to whom you consent in a package/appointment request. Hotels and transfer companies in a package do not see your contact details.

Our service providers: hosting and database (data centre in the EU), email delivery (Resend) and the AI assistant (Anthropic). The AI assistant and email services may process data abroad; transfers abroad are made under KVKK Art. 9 with your explicit consent or other safeguards provided by law. We recommend not entering health information into the AI assistant.

5. Retention

Health data in closed or cancelled quote requests is deleted 90 days after closure; cancelling a request withdraws consent and deletes the health data. Appointment notes are deleted on cancellation or completion. AI assistant conversations are deleted after 30 days.

Account data is kept for the life of your account; on a deletion request it is anonymised within 30 days. Records subject to legal retention (for example invoices and the audit trail) are kept for the required period.

6. Your rights and how to apply

Under KVKK Art. 11 you may learn whether your data is processed, request information, request correction, deletion/destruction, learn which third parties received it, object, and claim compensation for damage.

Send requests from the profile page in your account (account deletion request), by email to destek@medicoly.com, or to our KEP address [COMPANY_KEP]. Requests are answered within 30 days.

7. Security

To protect your data we apply technical and organisational measures such as access authorisation, encrypted connections, password hashing, not storing ID numbers or IP addresses in raw form, an audit trail and rate limiting.