KVKK Privacy Notice (Turkish Data Protection Law No. 6698)

For the personal data processed through this platform, the data controller within the meaning of the KVKK is WhichClinic. You may reach us at hello@whichclinic.net or through the /contact page for any question or request concerning your personal data.

WhichClinic's registered trade name, tax/registration details and registered office address will be published in this notice and on the /legal page once finalised. Where the KVKK requires the appointment of a representative or a data controllers' registry (VERBİS) filing, the relevant information will likewise be added here.

Depending on how you use the platform, we may process the following categories of personal data:

• Identity and contact data — name and surname, email address, telephone number and country of residence you provide when requesting a quote or registering.
• Account data — username, password (stored only as a secure hash), preferences and account activity.
• Quote-request (lead) data — the treatment or procedure you are interested in, your messages and any details you choose to share so that we can match you with suitable clinics.
• User-generated content — reviews you submit (subject to moderation), clinic likes/favourites and related interactions.
• Clinic account data (for clinics) — business details, photographs and documents uploaded for listing and verification.
• Technical and usage data — IP address, device and browser information, pages viewed, and analytics data collected via cookies (Google Analytics 4 in consent mode).

We process your personal data for the following purposes, limited to what is necessary for each:

• Matching quote requests — forwarding your enquiry to relevant clinics so they can prepare and send you offers.
• Account management — creating and securing your account, authentication and providing account features.
• Reviews and interactions — publishing your moderated reviews and enabling likes/favourites.
• Analytics — measuring and improving the platform via cookies, only where you have given consent.
• Security and fraud prevention — protecting the platform, preventing abuse and ensuring service integrity.
• Communications — sending transactional and service emails (via our email provider, Resend).
• Legal compliance — meeting our obligations under applicable law and responding to lawful requests.

We rely on the following legal grounds set out in Article 5 of the KVKK for general (non-special-category) personal data:

• Performance of a contract — where processing is necessary to provide the services you request (e.g. handling your account and quote requests).
• Legitimate interests — provided your fundamental rights and freedoms are not overridden (e.g. platform security, fraud prevention and service improvement).
• Compliance with a legal obligation — where the law requires us to process the data.
• Establishment, exercise or protection of a right — where processing is necessary in connection with legal claims.
• Explicit consent — where none of the above applies, in particular for analytics cookies.

For special-category data (your treatment/health preferences) covered by Article 6 of the KVKK, and for analytics cookies, our sole legal ground is your explicit consent. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

In line with Articles 8 and 9 of the KVKK, we may transfer your personal data to the following recipients, limited to the purposes set out above:

• Matched clinics — when you submit a quote request, we forward the relevant data to the clinics you are matched with so they can prepare offers. These clinics act as independent data controllers for their own processing.
• Data processors — our infrastructure and hosting providers (data is stored in a PostgreSQL database) and our transactional email provider (Resend).
• Analytics and directory providers — Google (Google Analytics 4, in consent mode) and, for our clinic directory-import tool, mapping/place data sources such as Google Places and OpenStreetMap.
• Public authorities — where disclosure is required by law or by a lawful request.

Some recipients (e.g. Google) may be located abroad. Cross-border transfers are carried out in accordance with Article 9 of the KVKK — on the basis of an adequacy decision, appropriate safeguards (such as standard contracts), or one of the exceptional grounds set out in the law, including your explicit consent where required.

We retain personal data only for as long as necessary for the purposes described above and for the periods required by applicable law:

• Account data — for as long as your account remains active, and thereafter for any period required to comply with legal obligations or defend legal claims.
• Quote-request (lead) data, including special-category data — for the period needed to handle your enquiry and any resulting relationship, then deleted or anonymised unless a longer statutory period applies.
• Reviews and user content — while published on the platform, subject to our moderation and content rules.
• Technical and analytics data — for the limited retention windows configured in our analytics tooling.

At the end of the applicable period, personal data is deleted, destroyed or anonymised in accordance with our retention and destruction policy and the Turkish Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

As a data subject, under Article 11 of the KVKK you have the right to:

1. 1learn whether your personal data is being processed;
2. 2request information about the processing if your data has been processed;
3. 3learn the purpose of processing and whether your data is used in accordance with that purpose;
4. 4know the third parties to whom your data is transferred, in Turkey or abroad;
5. 5request correction of your personal data if it is incomplete or inaccurate;
6. 6request erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
7. 7request that corrections, erasures or destructions be notified to the third parties to whom the data was transferred;
8. 8object to a result that arises to your detriment through the exclusively automated analysis of your data;
9. 9claim compensation for damage suffered due to unlawful processing of your personal data.

You may exercise the rights above by applying to us under the Communiqué on the Procedures and Principles of Application to the Data Controller. Please submit your request:

• in writing, or
• via registered electronic mail (KEP), secure electronic signature or mobile signature, or
• through an email address you have previously notified to us and that is registered in our systems.

Include your identity information and the specific request so that we can verify you and respond. You can reach us at hello@whichclinic.net or via /contact. We will conclude your request as soon as possible and within 30 days at the latest. The process is generally free; where a fee is permitted, we may charge the tariff set by the Personal Data Protection Board.

If your application to us is rejected, our response is insufficient, or we do not reply within the statutory period, you have the right to lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under Articles 13 and 14 of the KVKK.

The complaint must be filed within 30 days of learning our response and, in any event, within 60 days of the date of your application. Exercising this right does not affect any other remedies available to you under general law.

In line with Article 12 of the KVKK, we take appropriate technical and administrative measures to keep your personal data secure and to prevent unlawful access, processing or loss:

• Technical — encryption of data in transit (TLS), storage of passwords as secure hashes, role-based access controls, network and application security controls, backups, and logging and monitoring.
• Administrative — internal data-protection policies, staff confidentiality undertakings and training, the principle of data minimisation, and written agreements with our data processors requiring equivalent safeguards.

No method of transmission or storage is entirely risk-free; we continuously review and improve our measures in light of technological developments and the nature of the data processed.

We may update this Privacy Notice from time to time to reflect changes in our processing, technology or the law. When we make material changes, we will update the date below and, where appropriate, notify you through the platform.

The current version is always available at /legal/kvkk. This document is general information and does not constitute legal advice; the Turkish-language version prevails in case of any discrepancy. Last updated: 20 July 2026.