Privacy Policy & KVKK Notice

The data controller is CNR Medicare · CNR World Health & Travel Assistance (TÜRSAB licence no. 9796), which operates the Tourist Doctor Services service.

Address: Binbirdirek, Babayani Sk. No:5, 34122 Fatih / İstanbul. Phone and WhatsApp: +90 537 567 91 64.

It covers this website, the consultation wizard, the quick request builder, the symptom guide and every contact you start with us by WhatsApp or phone.

The quick request builder and the symptom guide work entirely in your browser: they only prepare a WhatsApp message that you decide whether to send. The consultation wizard additionally sends your request securely to our medical coordination desk (our CRM) when you submit it with your consent.

Depending on how you contact us, we may process:

• Identity and contact data: name, phone / WhatsApp number, preferred language and contact channel.
• Request and health data: the service you request, notes or symptoms you choose to share, preferences such as a female physician, and medical records created during your care (special category data).
• Location data: hotel name, room number or district you type, and GPS coordinates only if you tap the location button.
• Insurance and billing data: insurer details and invoice information when you ask for insurance paperwork.
• Campaign and technical data: the advertising campaign or website that brought you (UTM parameters, click identifiers), IP address, browser and device type, and the time the form took.
• Communication records: the messages and call details you exchange with our coordinators.

We process your data to answer your request, assign the nearest suitable physician or nurse, quote and confirm the service, provide medical care, prepare medical reports and invoices, coordinate clinics, laboratories and transfers, meet our legal obligations, keep the service secure and measure which campaigns bring patients.

Under KVKK we rely on Article 5(2)(c) (establishment and performance of a contract), 5(2)(ç) (legal obligation), 5(2)(f) (legitimate interest) and, for health data, your explicit consent and Article 6 (processing by persons under a duty of confidentiality for medical diagnosis, treatment and care). Under the GDPR we rely on Article 6(1)(b), (c) and (f) and, for health data, Article 9(2)(a) (explicit consent) and 9(2)(h) (provision of health care).

You can withdraw your consent at any time; this does not affect processing carried out before the withdrawal or care that has already been provided.

Your data is shared only as far as necessary with:

• The licensed physicians, nurses, partner clinics, hospitals and laboratories that provide your care.
• Your travel insurer or assistance company, only when you ask us to prepare or send insurance documents.
• Service providers acting on our instructions: website hosting (Vercel), our secured CRM database infrastructure (Supabase), WhatsApp (Meta) for the messages you send, and Google for the embedded map and audience measurement (Google Tag Manager, Google Analytics and Google Ads; see section 7).
• Public authorities when required by law.

Some service providers process data outside Türkiye (for example in the EU or the USA). Such transfers are carried out under Article 9 of KVKK and, where the GDPR applies, with appropriate safeguards such as the European Commission's standard contractual clauses or an adequacy decision.

Our own visit measurement uses no cookies: when a page opens and when you tap a WhatsApp or call button, our server records the page address (without query parameters), the button position, the campaign source of the visit, a random identifier that lives only until you close the tab, the device type and the approximate country and city derived from the network. It is stored in our CRM so the coordination desk can see which pages and campaigns bring requests. It never contains your name, phone number, messages or medical notes.

Analytics and advertising cookies are used only if you allow them in the cookie banner. Until you do, Google Tag Manager, Google Analytics and Google Ads run in Google Consent Mode with analytics and advertising storage denied and send only cookieless, aggregated signals.

If you allow them, Google Analytics and Google Ads cookies measure visits and show which campaigns bring patients to us. We do not send your name, phone number, messages or medical notes to these tools; events only record which button, step or service section was used. You can change or withdraw your choice at any time with the “Cookie settings” link at the bottom of every page; after you withdraw it, the tools go back to cookieless signals and the cookies they set on this website are removed from your browser.

Your cookie choice is kept in your browser's local storage. The browser's session storage keeps the campaign source of your visit until you close the tab so that your request can be matched to it, and the app's service worker stores pages for offline emergency access. The embedded Google Map may set its own cookies when it loads.

Medical records, invoices and accounting documents are kept for the periods required by Turkish health, commercial and tax legislation. Requests that do not lead to a service, campaign data and communication records are deleted, destroyed or anonymised once they are no longer needed for the purposes above or for resolving possible disputes.

Under Article 11 of KVKK you may ask whether your data is processed, request information about it, learn the purpose of processing and whether it is used accordingly, know the third parties it is transferred to in Türkiye or abroad, request correction, deletion or destruction, request that third parties be notified of these steps, object to a result arising exclusively from automated analysis, and claim compensation for damage caused by unlawful processing. Under the GDPR you also have the rights of access, rectification, erasure, restriction, data portability and objection.

To exercise your rights, contact us via WhatsApp or phone at +90 537 567 91 64, or write to Binbirdirek, Babayani Sk. No:5, 34122 Fatih / İstanbul. We answer free of charge within 30 days at the latest. You may also lodge a complaint with the Turkish Personal Data Protection Board (KVKK) or, in the EU/EEA, with your local data protection authority.

Data is transmitted over encrypted connections (HTTPS). Wizard requests are signed on our server before they reach the CRM, access is limited to authorised medical and coordination staff, and health data is never placed in analytics or advertising tools.

Requests for minors must be made by a parent or legal guardian, who provides the child's information and consents on the child's behalf.

We may update this notice when our services or the law change. The date at the top of the page shows the current version.