Privacy Policy

WhichClinic (the “Platform”, “we”, “us” or “our”) is the controller of the personal data processed through the website https://whichclinic.net. Our registered entity details are [registered business name and address to be published].

For any privacy or data-protection question, or to exercise your rights, please contact us at privacy@whichclinic.net. For general enquiries you can write to hello@whichclinic.net or use the contact form at https://whichclinic.net/contact.

We are not currently subject to a statutory obligation to appoint a Data Protection Officer, but all privacy matters are handled centrally through privacy@whichclinic.net. The Platform serves international users and applies GDPR-level protections to everyone’s personal data. If you are in Türkiye, please also read our separate KVKK notice.

This policy applies to the personal data we process when you (a) browse the site, (b) submit a quote request, (c) register a patient account, (d) write reviews or “like” clinics, (e) register or manage a clinic listing, or (f) contact us.

WhichClinic is a comparison marketplace, not a clinic. The clinics we list are independent controllers of the data they receive. Once your quote request is matched and forwarded to a clinic, that clinic processes your data on its own responsibility and under its own privacy policy.

Please read this policy together with our Cookie Policy and, if you are in Türkiye, our KVKK notice.

Depending on how you use the Platform, we may collect the following categories of personal data:

• Identity and contact data — your name, email address, telephone number and country or city.
• Quote-request details — the treatment or specialty you are interested in, your preferred destination, budget, timing, the free-text message you write, and any health-related preferences or medical background you choose to include (see the special-category section below).
• Account data — your login credentials in hashed form, saved preferences and language settings.
• Reviews and likes — the ratings and review text you publish and the clinics you have liked.
• Clinic-account data — for clinic users: business details, staff contact information, and uploaded photos and documents such as licences and certificates.
• Usage and device data — pages viewed, approximate location derived from your IP address, device and browser type, and the source that referred you, collected through cookies and analytics and only where you have consented.
• Communications — the content of the emails and messages you send us.

We collect only the data we need for the purposes described in this policy, and you decide how much detail to include in a quote request.

A quote request may reveal information about your health — for example the treatment you are seeking, a medical condition, or photographs you attach. This is a special category of personal data under Article 9 GDPR, which benefits from enhanced protection.

Our legal basis for processing such data is your explicit consent under Art. 9(2)(a) GDPR, which you give when you knowingly submit a quote request so that we can forward it to relevant clinics. You may choose not to include sensitive details, and you may withdraw your consent at any time (see your rights), although withdrawal does not affect any processing already carried out on the basis of your consent before it was withdrawn.

We process your personal data only where we have a lawful basis to do so. The table below summarises our main purposes and the corresponding legal bases under the GDPR.

We use strictly necessary cookies to make the site work and, only with your consent, Google Analytics 4 (GA4) for analytics and measurement. GA4 runs under Google Consent Mode, which means no analytics or measurement storage takes place until you consent, and your IP address is truncated or handled according to Google’s settings.

For a full list of the cookies we use and how to change or withdraw your choice at any time, please see our Cookie Policy.

We never sell your personal data. We share it only in the following circumstances:

• Matched clinics — the clinics your quote request is forwarded to. Each is an independent controller and processes your data under its own privacy policy.
• Service providers (processors) acting on our instructions — providers of hosting and infrastructure, our PostgreSQL database host, Resend for transactional email, and Google (Analytics) subject to your consent.
• Legal authorities — courts, regulators or public authorities where we are required to disclose data by law.
• Business transfers — a buyer or successor in the context of a merger, acquisition or reorganisation, subject to appropriate safeguards.

Our processors act only on our documented instructions and are bound by data-processing agreements that require them to keep your data confidential and secure.

Because our Platform serves international users and works with clinics in Türkiye and with service providers located in different countries, your personal data may be transferred to, and processed in, countries other than your own — including outside Türkiye and the European Economic Area (EEA). Data-protection laws in those countries may differ from those in the country where you live.

Whenever we transfer personal data abroad, we rely on one of the following safeguards:

• Adequacy — the destination country provides an adequate level of protection recognised by the competent authority (under the GDPR, an adequacy decision of the European Commission; under Turkish law, a country for which the Personal Data Protection Board has declared adequate protection).
• Appropriate safeguards — where there is no adequacy decision, we put in place appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (or the equivalent written undertaking approved under Turkish law), together with any additional technical and organisational measures needed to protect your data.
• Explicit consent or contractual necessity — in specific situations, such as forwarding your quote request to a clinic located in another country, the transfer is made on the basis of your explicit consent or because it is necessary to perform the service you have requested.

You may ask us for more information about the safeguards applied to a particular transfer, and where relevant for a copy of the relevant documentation, by contacting hello@whichclinic.net.

We keep your personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements. In determining retention periods we consider the nature and sensitivity of the data, the purpose of processing, whether we still have an ongoing relationship with you, and applicable statutory limitation and record-keeping periods. The table below sets out our indicative retention periods.

When personal data is no longer needed, we securely delete it or irreversibly anonymise it so that it can no longer be associated with you. Where immediate deletion is not possible (for example, data held in secure backups), we isolate the data and protect it from further processing until deletion is possible.

Subject to the conditions and exceptions set out in applicable law (the GDPR and, in Türkiye, the KVKK), you have the following rights over your personal data:

• Access — to be told whether we process your data and to receive a copy of it, together with information about how and why we process it.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your data deleted where it is no longer necessary, where you withdraw consent, or where it has been unlawfully processed (the ‘right to be forgotten’).
• Restriction — to have our processing of your data restricted in certain circumstances, for example while a dispute about its accuracy is resolved.
• Portability — to receive the data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Objection — to object to processing based on our legitimate interests and, at any time, to processing for direct-marketing purposes.
• Withdrawal of consent — to withdraw your consent at any time where we rely on it (including for health-related data and analytics), without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please email us at hello@whichclinic.net (or privacy@whichclinic.net) or use the contact form at /contact. We may need to verify your identity before acting on your request. We will respond without undue delay and in any event within one month (30 days) of receiving your request; where a request is complex or you have made several requests, we may extend this period by up to two further months and will tell you if we do so. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.

When you submit a quote request, we use simple, rules-based logic to match it with clinics that appear relevant — for example based on the treatment or specialty you selected, your preferred destination and clinic availability. This helps us forward your request to clinics that are more likely to be able to help you.

This matching does not involve any solely automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. The decision whether to offer you a treatment, a price or an appointment is always taken by the clinics themselves, on their own responsibility. We do not carry out profiling in order to make automated decisions about you, and we do not use your data for automated credit, eligibility or comparable decisions.

If we ever introduce processing that does involve such automated decision-making, we will inform you beforehand, explain the logic involved and its likely consequences, and ensure that you can obtain human intervention, express your point of view and contest the decision.

The Platform is intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18 without the consent and involvement of a parent or legal guardian. If you are under 18, please do not submit a quote request, create an account or otherwise provide personal data unless a parent or guardian is doing so together with you and on your behalf.

If you believe that a child has provided us with personal data without appropriate consent, please contact us at hello@whichclinic.net so that we can review the matter and delete the data where required.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, loss or destruction, taking into account the nature of the data and the risks involved. These measures include, among others:

• Encryption of data in transit using HTTPS/TLS, and protection of login credentials by hashing them rather than storing them in plain text.
• Access controls that limit access to personal data to authorised personnel and processors who need it for the purposes described in this policy.
• Use of reputable infrastructure and service providers, with our data held in a PostgreSQL database and transactional email handled by Resend under data-processing agreements.
• Network and application safeguards, logging and monitoring to detect and prevent misuse, and regular review of our security practices.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, the affected individuals, in accordance with applicable law.

We may update this Privacy Policy from time to time to reflect changes in our services, our technology, or our legal obligations. When we make material changes, we will update the “last updated” date below and, where appropriate, provide a more prominent notice — for example a notice on the Platform or, where we have a lawful basis to contact you, by email. We encourage you to review this policy periodically.

This Privacy Policy was last updated on 20 July 2026.

We would always prefer to hear from you first, so if you have any concern about how we handle your personal data, please contact us at hello@whichclinic.net and we will do our best to resolve it.

You also have the right to lodge a complaint with a supervisory authority:

• In Türkiye — the Personal Data Protection Authority and the Personal Data Protection Board (Kişisel Verileri Koruma Kurumu / Kişisel Verileri Koruma Kurulu, ‘KVKK’). For more detail on how we comply with Turkish data-protection law and how to apply to us and to the Board, please see our KVKK notice at /legal/kvkk.
• In the EEA — the data-protection authority of the EU/EEA country where you live, where you work, or where the alleged infringement took place.

Exercising your right to complain does not affect any other administrative or judicial remedy available to you.