KVKK Privacy Notice (Turkish Data Protection Law No. 6698)

For the personal data processed through this platform, the data controller within the meaning of the KVKK is WhichClinic. You may reach us at hello@whichclinic.net or through our contact form for any question or request concerning your personal data.

WhichClinic's registered trade name, tax/registration details and registered office address will be published in this notice and on our legal documents page once finalised. Where the KVKK requires the appointment of a representative or a data controllers' registry (VERBİS) filing, the relevant information will likewise be added here.

Depending on how you use the platform, we may process the following categories of personal data:

• Identity and contact data — name and surname, email address, telephone number and country of residence you provide when requesting a quote or registering.
• Account data — username, password (stored only as a secure hash), preferences and account activity.
• Quote-request (lead) data — the treatment or procedure you are interested in, your messages and any details you choose to share so that we can match you with suitable clinics.
• User-generated content — reviews you submit and any photographs you attach to them (all subject to moderation before publication), clinic likes/favourites and related interactions.
• Clinic account data (for clinics) — business details, photographs and documents uploaded for listing and verification.
• Technical and usage data — IP address, device and browser information, pages viewed, and analytics data collected with your consent (Google Analytics 4 in consent mode, and our own first-party measurement of clinic-profile views and clicks, which uses a short-lived pseudonymous identifier renewed daily and does not store your IP address or user-agent).

Messaging, phone sharing and verification documents

• Conversation data — the content of the messages you send to a clinic while signed in, the clinic's replies, and the time and read status of the exchange. The clinic sees the name and email address on your account so that it can answer you.
• Opt-in telephone number — your number is added to a conversation and shown to the clinic only if you expressly choose to share it. When you withdraw that choice the number is removed from the conversation. A number you have not chosen to share is never disclosed to a clinic.
• Verification documents (for clinics) — copies of authorisation certificates, licences, diplomas and similar records, together with their review status and expiry date. Such documents may contain personal data of doctors and staff; we process them solely for verification and restrict access to authorised personnel.
• Clinic records compiled from public sources — described in the next section.

Part of our directory consists of records compiled from publicly available sources such as Google Places and OpenStreetMap: business name, address, telephone number, website, opening hours, category and the publicly displayed Google star rating with its review count. Where such a record concerns a natural person — for example a sole practitioner or a named doctor — it constitutes personal data, and this section is the notice required by Article 10 of the KVKK for data that was not obtained from the data subject.

Our legal basis is Article 5(2)(d) of the KVKK (data made public by the data subject, processed in a manner consistent with the purpose of that publication) and, in the alternative, Article 5(2)(f) (legitimate interest, balanced against fundamental rights). We limit ourselves to publicly available business information and we do not collect special-category data about clinics or practitioners from these sources. Where we contact a clinic, or where a clinic claims its profile, we provide this notice again.

If you are named in such a record you may ask us at any time to correct it, to remove it from the directory or to object to the processing, through our contact form or at hello@whichclinic.net. We act on the request without undue delay and in any event within 30 days.

We process your personal data for the following purposes, limited to what is necessary for each:

• Matching quote requests — forwarding your enquiry to relevant clinics so they can prepare and send you offers.
• Account management — creating and securing your account, authentication and providing account features.
• Reviews and interactions — publishing your moderated reviews and enabling likes/favourites.
• Analytics — measuring and improving the platform and producing aggregate clinic-profile statistics (through Google Analytics 4 and our own first-party, pseudonymous measurement), only where you have given consent.
• Security and fraud prevention — protecting the platform, preventing abuse and ensuring service integrity.
• Communications — sending transactional and service emails (via our email provider, Resend).
• Legal compliance — meeting our obligations under applicable law and responding to lawful requests.

Patient–clinic messaging — delivering, storing and securing the two-way conversation between a signed-in patient and a clinic and preventing its misuse; your telephone number is passed on only if you have chosen to share it. Clinic verification — reviewing the authorisation certificates, licences and other documents a clinic uploads and setting the verification level shown on its profile. Directory maintenance — keeping records compiled from public sources accurate and handling correction, objection and removal requests.

We rely on the following legal grounds set out in Article 5 of the KVKK for general (non-special-category) personal data:

• Performance of a contract — where processing is necessary to provide the services you request (e.g. handling your account and quote requests).
• Legitimate interests — provided your fundamental rights and freedoms are not overridden (e.g. platform security, fraud prevention and service improvement).
• Compliance with a legal obligation — where the law requires us to process the data.
• Establishment, exercise or protection of a right — where processing is necessary in connection with legal claims.
• Explicit consent — where none of the above applies, in particular for analytics cookies.

For special-category data (your treatment/health preferences) covered by Article 6 of the KVKK, and for analytics cookies, our sole legal ground is your explicit consent. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

In line with Articles 8 and 9 of the KVKK, we may transfer your personal data to the following recipients, limited to the purposes set out above:

• Matched clinics — when you submit a quote request, we forward the relevant data to the clinics you are matched with so they can prepare offers. These clinics act as independent data controllers for their own processing.
• Data processors — our infrastructure and hosting providers (data is stored in a PostgreSQL database) and our transactional email provider (Resend).
• Analytics and directory providers — Google (Google Analytics 4, in consent mode) and, for our clinic directory-import tool, mapping/place data sources such as Google Places and OpenStreetMap.
• Public authorities — where disclosure is required by law or by a lawful request.

Some recipients (e.g. Google) may be located abroad. Cross-border transfers are carried out in accordance with Article 9 of the KVKK — on the basis of an adequacy decision, appropriate safeguards (such as standard contracts), or one of the exceptional grounds set out in the law, including your explicit consent where required.

Transfers abroad follow the order set out in Article 9 of the KVKK as amended by Law No. 7499: (i) transfer to a country covered by an adequacy decision announced by the Personal Data Protection Board; (ii) failing that, on the basis of appropriate safeguards provided by the parties — an undertaking authorised by the Board, binding corporate rules, the standard contract published by the Board (which must be notified to the Board within five business days of signature), or an agreement that is not in the nature of an international treaty; (iii) only where none of these is available, one of the exceptional cases in Article 9(6), including your explicit consent given after you have been informed that the transfer carries risks. We follow this order when we work with providers established abroad, such as Google, and will tell you on request which safeguard applies to a particular transfer.

We retain personal data only for as long as necessary for the purposes described above and for the periods required by applicable law:

• Account data — for as long as your account remains active, and thereafter for any period required to comply with legal obligations or defend legal claims.
• Quote-request (lead) data, including special-category data — for the period needed to handle your enquiry and any resulting relationship, then deleted or anonymised unless a longer statutory period applies.
• Reviews and user content — while published on the platform, subject to our moderation and content rules.
• Technical and analytics data — for the limited retention windows configured in our analytics tooling.

At the end of the applicable period, personal data is deleted, destroyed or anonymised in accordance with our retention and destruction policy and the Turkish Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

As a data subject, under Article 11 of the KVKK you have the right to:

1. 1learn whether your personal data is being processed;
2. 2request information about the processing if your data has been processed;
3. 3learn the purpose of processing and whether your data is used in accordance with that purpose;
4. 4know the third parties to whom your data is transferred, in Turkey or abroad;
5. 5request correction of your personal data if it is incomplete or inaccurate;
6. 6request erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
7. 7request that corrections, erasures or destructions be notified to the third parties to whom the data was transferred;
8. 8object to a result that arises to your detriment through the exclusively automated analysis of your data;
9. 9claim compensation for damage suffered due to unlawful processing of your personal data.

You may exercise the rights above by applying to us under the Communiqué on the Procedures and Principles of Application to the Data Controller. Please submit your request:

• in writing, or
• via registered electronic mail (KEP), secure electronic signature or mobile signature, or
• through an email address you have previously notified to us and that is registered in our systems.

Include your identity information and the specific request so that we can verify you and respond. You can reach us at hello@whichclinic.net or via our contact form. We will conclude your request as soon as possible and within 30 days at the latest. The process is generally free; where a fee is permitted, we may charge the tariff set by the Personal Data Protection Board.

If your application to us is rejected, our response is insufficient, or we do not reply within the statutory period, you have the right to lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under Articles 13 and 14 of the KVKK.

The complaint must be filed within 30 days of learning our response and, in any event, within 60 days of the date of your application. Exercising this right does not affect any other remedies available to you under general law.

In line with Article 12 of the KVKK, we take appropriate technical and administrative measures to keep your personal data secure and to prevent unlawful access, processing or loss:

• Technical — encryption of data in transit (TLS), storage of passwords as secure hashes, role-based access controls, network and application security controls, backups, and logging and monitoring.
• Administrative — internal data-protection policies, staff confidentiality undertakings and training, the principle of data minimisation, and written agreements with our data processors requiring equivalent safeguards.

No method of transmission or storage is entirely risk-free; we continuously review and improve our measures in light of technological developments and the nature of the data processed.

We may update this Privacy Notice from time to time to reflect changes in our processing, technology or the law. When we make material changes, we will update the date below and, where appropriate, notify you through the platform.

The current version is always available on this page. This document is general information and does not constitute legal advice; the Turkish-language version prevails in case of any discrepancy. Last updated: 29 July 2026.