SMIRNI HEALTH SERVICES TOURISM CONSULTANCY TRADE LIMITED COMPANY
PRIVACY NOTICE UNDER THE PERSONAL DATA PROTECTION LAW AND GDPR
The personal data you submit to us through this form is stored in our CRM infrastructure located abroad,
evaluated through authorized physicians and interpreters, and processed in accordance with the Personal Data
Protection Law No. 6698 (KVKK) and the GDPR. Please read this notice carefully before submitting the form.
1. DATA CONTROLLER
| Company Title | Smirni Health Services Tourism Consultancy Trade Limited Company |
|---|---|
| Trade Name | Quality Life Health Travel |
| Address | Kartaltepe Mahallesi Saydam Sokak No:13/A Küçükçekmece / Istanbul |
| Phone | +90 538 971 49 33 |
| consultancy@qualitylifehealthtravel.info | |
| Website | qualitylifehealth.com |
| Tax Number | 772 155 4065 |
| Applicable Legislation | Personal Data Protection Law No. 6698 (KVKK) | GDPR 2016/679 for data subjects located in the EU/EEA | UK GDPR 2018 for residents of the United Kingdom |
2. META PLATFORM AND JOINT DATA CONTROLLERSHIP
Meta Platforms Ireland Ltd. (4 Grand Canal Square, Dublin 2, Ireland), which operates the Facebook and Instagram
advertising infrastructure, acts as an independent data controller with respect to personal data collected directly
through the Lead Ads form. Meta’s own data processing activities are subject to Meta’s Privacy Policy.
Our Company acts as an independent data controller within the scope of Article 3/1-ı of the KVKK and Article 4/7
of the GDPR in relation to the processing of personal data obtained through Meta within our own systems.
The data controllership relationship between Meta and our Company is regulated under Meta’s Page Controller Addendum.
Some fields in the form, such as phone number and email address, may be automatically populated by Meta using the
user’s profile information. All data included in the form, including automatically populated data, is transmitted
to our Company.
3. PERSONAL DATA PROCESSED AND ITS CATEGORIES
The personal data collected through the form is listed below by category:
| Data | Nature | Purpose of Processing |
|---|---|---|
| Name and Surname | General Personal Data | Identity verification, communication, creation of patient records |
| Phone Number | General Personal Data | Communication via WhatsApp Business and phone, appointment coordination |
| Email Address | General Personal Data | Providing treatment offers, sending informational emails, conducting official correspondence |
| Country / City of Residence | General Personal Data | Assigning interpreters, determining language needs, planning travel organization |
| Preferred Treatment Category | Health Data – Special Category Personal Data | Matching with the appropriate clinic and specialist physician; within the scope of Article 6 of the KVKK and Article 9 of the GDPR |
| Meta User ID / Advertising Interaction Data | General Personal Data | Optimization of advertising campaigns and measurement of campaign performance – only with explicit consent |
| IP Address / Technical Identifiers | General Personal Data | Ensuring security, preventing fraud, fulfilling log retention obligations under Law No. 5651 |
4. PURPOSES OF PROCESSING AND LEGAL GROUNDS
Your personal data is processed for the purposes listed below and based on the legal grounds specified for each
purpose. The same data may be processed for more than one purpose; a separate legal basis is determined for each
processing purpose.
| Purpose of Processing | Legal Basis under KVKK | Legal Basis under GDPR |
|---|---|---|
| Receiving the application and establishing initial contact | Art. 5/2-c – Necessary for the establishment of a contract | Art. 6(1)(b) – Performance of a contract |
| Organizing health tourism intermediary services | Art. 5/2-c – Performance of a contract | Art. 6(1)(b) – Performance of a contract |
| Matching with the appropriate clinic and physician according to the treatment category | Art. 6/3 – Through an authorized healthcare institution; Art. 6/2 – Explicit consent | Art. 9(2)(a) – Explicit consent; Art. 9(2)(h) – Healthcare services |
| Recording the patient file in Bitrix24 CRM | Art. 5/2-f – Legitimate interest, service management | Art. 6(1)(f) – Legitimate interest |
| Maintaining communication via WhatsApp, email or phone | Art. 5/2-c – Performance of a contract; Art. 5/1 – Explicit consent for marketing communications | Art. 6(1)(b) – Contract; Art. 6(1)(a) – Explicit consent for marketing |
| Measuring the performance of Meta advertising campaigns | Art. 5/1 – Explicit consent | Art. 6(1)(a) – Explicit consent |
| Accounting, invoicing and fulfillment of legal obligations | Art. 5/2-ç – Legal obligation | Art. 6(1)(c) – Legal obligation |
| Mandatory registration with the USHAŞ / HealthTürkiye portal | Art. 5/2-ç – Legal obligation under USHAŞ legislation | Art. 6(1)(c) – Legal obligation |
| Improving service quality and conducting statistical analysis | Art. 5/2-f – Legitimate interest | Art. 6(1)(f) – Legitimate interest |
| Conducting mandatory travel insurance and complication insurance processes, issuing policies and sharing data with relevant insurance companies |
Art. 5/2-c – Performance of a contract; Art. 5/2-f – Legitimate interest; Art. 6/2 for health data | Art. 6(1)(b); Art. 6(1)(f); Art. 9(2)(a) |
5. TRANSFER OF PERSONAL DATA AND INTERNATIONAL TRANSFER
Your personal data is shared only with the recipient groups listed below and solely for the purposes described.
Your personal data is never sold to third parties for commercial purposes.
| Recipient | Purpose of Transfer | Safeguard Mechanism |
|---|---|---|
| Contracted clinics and specialist physicians | Creating the treatment plan and managing appointment processes | Domestic transfer in Türkiye – KVKK Art. 8; within the scope of the patient agreement |
| Interpreters / Patient coordinators | Transferring health data to the physician | Domestic transfer in Türkiye – KVKK Art. 8; Confidentiality Undertaking + Data Processing Agreement |
| Bitrix24 CRM (Alaio Cloud Ltd.) | Creating and following up patient records | International transfer – GDPR Art. 28 DPA; SCC under Art. 46; notice under KVKK Art. 10 |
| Meta Platforms Ireland Ltd. | Form transmission and campaign measurement | International transfer to the EU – Meta Lead Ads DPA; subject to GDPR |
| WhatsApp Business (Meta) | Conducting patient communication | International transfer – Meta policy; end-to-end encryption |
| Hotels and accommodation service providers | Reservation and logistics organization | Domestic transfer in Türkiye – KVKK Art. 8; Service Provider Framework Agreement |
| Transfer and transportation companies | Airport transfer and transportation organization | Domestic transfer in Türkiye – KVKK Art. 8; Service Provider Framework Agreement |
| USHAŞ A.Ş. / HealthTürkiye Portal | Mandatory legal notification | Domestic transfer in Türkiye – Legal obligation; KVKK Art. 8/2-a |
| Banks and payment institutions | Processing payments and invoicing | Domestic transfer in Türkiye – KVKK Art. 8/2-ç; legal obligation |
| Authorized public institutions and organizations | Fulfillment of legal obligations | Domestic transfer in Türkiye – KVKK Art. 8/2-a; legal obligation |
INTERNATIONAL TRANSFER NOTICE UNDER GDPR ARTICLE 49:
Türkiye is not currently among the countries for which the European Union has issued an adequacy decision.
The transfer of your personal data to Türkiye is carried out based on your explicit consent under Article 49(1)(a)
of the GDPR. You may withdraw your consent at any time; however, such withdrawal shall not affect the lawfulness
of processing carried out prior to the withdrawal date.
6. RETENTION AND DESTRUCTION OF PERSONAL DATA
Your personal data is retained only for the period required by the purpose of processing and in accordance with
the retention periods prescribed by the relevant legislation. When the retention period expires or the purpose of
processing ceases to exist, your data is deleted, destroyed or anonymized in accordance with Article 7 of the KVKK
and the Regulation on the Deletion, Destruction or Anonymization of Personal Data.
| Data Type | Retention Period |
|---|---|
| Contact and application data, including name, email and phone | Active service relationship + 3 years under the general statute of limitations of the Turkish Code of Obligations |
| Health data, including treatment category and medical documents | Until consent is withdrawn; up to 10 years where legally required under Ministry of Health legislation |
| Accounting and invoice documents | 5 years under Article 253 of the Tax Procedure Law |
| Contracts and legal documents | 10 years under Article 146 of the Turkish Code of Obligations |
| Log / IP records | 2 years under Law No. 5651 |
| Bitrix24 CRM records | Active patient period + 3 years; 10 years for health data |
| Meta Lead Ads campaign data | When consent is withdrawn or when the campaign ends; maximum 2 years |
7. YOUR RIGHTS AS A DATA SUBJECT
Under Article 11 of the KVKK and Articles 15–22 of the GDPR, you have the following rights:
| Right | Description |
|---|---|
| Right to information – KVKK Art. 11/1-a,b | GDPR Art. 15 | To learn whether your data is being processed and the conditions of such processing |
| Rectification – KVKK Art. 11/1-d | GDPR Art. 16 | To request correction of incomplete or inaccurate data |
| Erasure / Right to be forgotten – KVKK Art. 11/1-e | GDPR Art. 17 | To request deletion of your data under certain conditions |
| Restriction of processing – GDPR Art. 18 | Applicable only under GDPR; to restrict processing under certain conditions |
| Data portability – GDPR Art. 20 | Applicable only under GDPR; to receive your data in a machine-readable format |
| Objection – KVKK Art. 11/1-g | GDPR Art. 21 | To object to automated decision-making or processing based on legitimate interest |
| Withdrawal of consent – KVKK Art. 11 | GDPR Art. 7(3) | To withdraw your consent at any time for any processing based on explicit consent |
| Right to lodge a complaint – KVKK Art. 14 | GDPR Art. 77 | KVKK: Personal Data Protection Authority of Türkiye | GDPR: Data Protection Authority of the EU country where you are located |
| Compensation – KVKK Art. 11/1-ğ | GDPR Art. 82 | To request compensation for damages caused by unlawful processing |
| Application Channel | Information |
|---|---|
| consultancy@qualitylifehealthtravel.info – Subject: KVKK/GDPR Application | |
| Postal Address | Kartaltepe Mahallesi Saydam Sokak No:13/A Küçükçekmece / Istanbul |
| Response Period | KVKK: 30 days | GDPR: 1 month, extendable by 2 additional months where necessary |
| Identity Verification | Documents verifying your identity must be attached to your application; for foreign nationals, a passport copy is accepted. |
8. COOKIES AND META PIXEL
Meta Pixel, an online data tracking tool, is used within the scope of our website and Meta advertising campaigns.
Through Meta Pixel, data related to website visitor behavior, advertising conversions and audience creation may
be collected. This data is activated only based on your explicit consent.
- Strictly necessary cookies are operated without requiring explicit consent under KVKK Art. 5/2-f, based on
legitimate interest. - Analytical and marketing cookies are activated only if explicit consent has been obtained.
- Data processed by Meta Pixel is subject to Meta’s Privacy Policy.
- You may change your cookie preferences through the cookie management panel on our website.
