Last updated: September 2026
This notice explains what personal data Clinic-Y collects, why, who sees it, and your rights under Türkiye’s Law on the Protection of Personal Data No. 6698 (KVKK) and, where it applies to you, the EU General Data Protection Regulation (GDPR).
Who we are
Clinic-Y is an independent healthcare facilitation agency based in Istanbul, Türkiye. We are not a hospital and do not provide medical treatment. For the personal data described here we act as data controller. Contact: care@clinic-y.com.
What we collect
- Contact details: name, email, phone or WhatsApp number, country.
- Health data: the description of your condition, medical reports, scans, photos and test results you choose to send us. This is special-category data and we process it only with your explicit consent.
- Travel details: flight numbers, dates, hotel and companion information, if you use the travel plan.
- Payments: invoice references, amounts and the method you report. We do not store card numbers.
- Messages: conversations with coordinators and clinics on the platform, and questions you ask the site assistant.
- Technical data: IP address, browser and pages visited, and cookies as set out in our Cookie Policy.
Why we use it
- To review your case with specialists at partner hospitals and send you written proposals (your consent, and steps you ask us to take before a contract).
- To arrange treatment, travel and aftercare once you accept a proposal (performance of our agreement with you).
- To issue invoices and keep accounting records (legal obligation).
- To keep the platform safe: screening messages for contact details and abuse, preventing fraud (legitimate interest).
- To improve the site, using aggregated analytics only where you have accepted analytics cookies (consent).
Who sees your data
Your medical files are shared only with the partner clinics a coordinator invites to review your case. Clinics see your medical information but not your identity until you accept a proposal. After that, the clinic treating you receives the details needed to treat you. We also use service providers for hosting, email and payments, bound by contract to protect your data. We do not sell personal data.
International transfers
If you live outside Türkiye, your data is transferred to Türkiye so that we and our partner hospitals can review and treat you. Where GDPR applies, we rely on your explicit consent and on the transfer being necessary for a contract you requested.
How long we keep it
Case files are kept for as long as your case is open and then for ten years, the period Turkish health regulations require for medical records held by providers. Accounting records are kept for ten years. Enquiries that never became a case are deleted after two years. Assistant conversations are kept for twelve months.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and to withdraw consent at any time. Withdrawing consent does not affect processing already carried out. Write to care@clinic-y.com; we reply within 30 days. You may also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU, your local supervisory authority.
Security
Medical files are stored outside the public website and opened only through signed, per-user links; every opening is logged. Staff access is limited by role and can be switched off per account.