SMIRNI HEALTH SERVICES TOURISM CONSULTANCY TRADE LIMITED COMPANY
PRIVACY NOTICE UNDER THE LAW ON THE PROTECTION OF PERSONAL DATA AND GDPR
The personal data you provide to us through this form are stored in our overseas CRM infrastructure, evaluated by authorized physicians and interpreters, and processed in accordance with the KVKK and GDPR. Please read this notice carefully before submitting the form.
1. DATA CONTROLLER
| Company Name | Smirni Health Services Tourism Consultancy Trade Limited Company |
| Commercial Brand | Quality Life Health Travel |
| Address | Kartaltepe Neighborhood, Saydam Street No:13/A, Küçükçekmece / Istanbul |
| Phone | +90 538 971 49 33 |
| consultancy@qualitylifehealthtravel.info | |
| Website | qualitylifehealth.com |
| Tax Number | 772 155 4065 |
| Applicable Legislation | Law No. 6698 on the Protection of Personal Data (KVKK) | GDPR 2016/679 for data subjects residing in the EU/EEA | UK GDPR 2018 for residents of the United Kingdom |
2. META PLATFORM AND JOINT CONTROLLERSHIP
Meta Platforms Ireland Ltd. (4 Grand Canal Square, Dublin 2, Ireland), which operates the Facebook and Instagram advertising infrastructure, acts as an independent data controller with regard to the personal data it directly collects through the Lead Ads form. Meta’s own data processing activities are subject to the Meta Privacy Policy.
Our Company acts as an independent data controller pursuant to Article 3/1-ı of the KVKK and Article 4/7 of the GDPR with respect to the processing of the personal data obtained through Meta within our own systems. The data controllership relationship between us and Meta is regulated under Meta’s Page Controller Addendum.
Certain fields in the form (such as phone number, email address, etc.) may be automatically populated by Meta from the user’s profile information. All data included in the form, including those automatically filled in, are transmitted to our Company.
3. PROCESSED PERSONAL DATA AND THEIR CATEGORIES
The personal data collected through the form are listed below by category:
| Data | Nature | Purpose of Processing |
|---|---|---|
| Full Name | General Personal Data | Identity verification, establishing communication, creating a patient record |
| Phone Number | General Personal Data | Communication via WhatsApp Business and telephone, appointment coordination |
| Email Address | General Personal Data | Providing treatment proposals, sending informational emails, conducting official correspondence |
| Country / City of Residence | General Personal Data | Assigning an interpreter, determining language, planning travel arrangements |
| Preferred Treatment Category | Health Data (Special Category of Personal Data) | Matching with an appropriate clinic and specialist physician; processed under Article 6 of the KVKK and Article 9 of the GDPR |
| Meta User ID / Advertising Interaction Data | General Personal Data | Optimization of advertising campaigns and performance measurement – only with explicit consent |
| IP Address / Technical Identifiers | General Personal Data | Ensuring security, preventing fraud, fulfilling logging obligations under Law No. 5651 |
4. PURPOSES OF PROCESSING AND LEGAL GROUNDS
Your personal data are processed for the purposes set out below and based on the legal grounds determined for each purpose. The same data may be processed for more than one purpose; it is essential to determine a separate legal ground for each purpose.
| Purpose of Processing | Legal Ground under KVKK | Legal Basis under GDPR |
|---|---|---|
| Receiving the application and establishing initial contact | Art. 5/2-c – Necessary for the establishment of a contract | Art. 6(1)(b) – Performance of a contract |
| Organizing the health tourism intermediary service | Art. 5/2-c – Performance of a contract | Art. 6(1)(b) – Performance of a contract |
| Matching clinics and physicians according to the treatment category | Art. 6/3 – Through an authorized healthcare institution; Art. 6/2 – Explicit consent | Art. 9(2)(a) – Explicit consent; Art. 9(2)(h) – Health care services |
| Recording the patient file in Bitrix24 CRM | Art. 5/2-f – Legitimate interest (service management) | Art. 6(1)(f) – Legitimate interest |
| Maintaining communication via WhatsApp, email, or telephone | Art. 5/2-c – Performance of a contract; Art. 5/1 – Explicit consent (for marketing communication) | Art. 6(1)(b) – Contract; Art. 6(1)(a) – Explicit consent (marketing) |
| Measuring the effectiveness of Meta advertising campaigns | Art. 5/1 – Explicit consent | Art. 6(1)(a) – Explicit consent |
| Fulfilling accounting, invoicing, and legal obligations | Art. 5/2-ç – Legal obligation | Art. 6(1)(c) – Legal obligation |
| Mandatory registration to the USHAŞ / HealthTürkiye portal | Art. 5/2-ç – Legal obligation (USHAŞ legislation) | Art. 6(1)(c) – Legal obligation |
| Improving service quality and conducting statistical analysis | Art. 5/2-f – Legitimate interest | Art. 6(1)(f) – Legitimate interest |
| Managing compulsory travel insurance and complication insurance processes, issuing policies, and sharing data with relevant insurance companies | Art. 5/2-c – Performance of a contract; Art. 5/2-f – Legitimate interest; for health data, Art. 6/2 | Art. 6(1)(b); Art. 6(1)(f); Art. 9(2)(a) |
5. TRANSFER OF PERSONAL DATA AND INTERNATIONAL DATA TRANSFERS
Your personal data are shared only with the recipient groups listed below and for the purposes explained. They are never sold to third parties for commercial purposes.
| Recipient | Purpose of Transfer | Safeguard Mechanism |
|---|---|---|
| Contracted clinics and specialist physicians | Establishing the treatment plan, carrying out appointment processes | Domestic transfer – KVKK Art. 8; within the scope of the patient agreement |
| Interpreters / Patient coordinators | Transmitting health data to the physician | Domestic transfer – KVKK Art. 8; Confidentiality Undertaking + Data Processing Agreement |
| Bitrix24 CRM (Alaio Cloud Ltd.) | Creating and tracking patient records | International transfer – GDPR Art. 28 DPA; SCCs (Art. 46); information provided under KVKK Art. 10 |
| Meta Platforms Ireland Ltd. | Form transmission, campaign measurement | International transfer (EU) – Meta Lead Ads DPA; subject to GDPR |
| WhatsApp Business (Meta) | Managing patient communication | International transfer – Meta policy; end-to-end encryption |
| Hotels and accommodation service providers | Reservation, logistics organization | Domestic transfer – KVKK Art. 8; Service Provider Framework Agreement |
| Transfer and transportation companies | Airport transfers, transportation organization | Domestic transfer – KVKK Art. 8; Service Provider Framework Agreement |
| USHAŞ Inc. / HealthTürkiye Portal | Mandatory legal notification | Domestic transfer – Legal obligation; KVKK Art. 8/2-a |
| Banks and payment institutions | Carrying out payment transactions and invoicing | Domestic transfer – KVKK Art. 8/2-ç; legal obligation |
| Authorized public institutions and organizations | Fulfilling legal obligations | Domestic transfer – KVKK Art. 8/2-a; legal obligation |
INTERNATIONAL DATA TRANSFER NOTICE (GDPR Art. 49): Türkiye is not yet among the countries for which the European Union has issued an adequacy decision. The transfer of your personal data to Türkiye is carried out on the basis of your explicit consent under Article 49(1)(a) of the GDPR. You may withdraw your consent at any time; however, such withdrawal shall not affect the lawfulness of processing carried out before the date of withdrawal.
6. RETENTION AND DELETION OF PERSONAL DATA
Your personal data are retained for as long as required by the purpose of processing and limited to the retention periods stipulated by the relevant legislation. Upon the expiry of the retention period or if the purpose of processing ceases to exist, your data are deleted, destroyed, or anonymized in accordance with Article 7 of the KVKK and the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.
| Data Type | Retention Period |
|---|---|
| Communication and application data (name, email, phone) | Active service relationship + 3 years (general limitation period under the Turkish Code of Obligations) |
| Health data (treatment category, medical documents) | Until consent is withdrawn; maximum 10 years under legal obligation (Ministry of Health legislation) |
| Accounting and invoice documents | 5 years (Tax Procedure Law Art. 253) |
| Contracts and legal documents | 10 years (Turkish Code of Obligations Art. 146) |
| Log / IP records | 2 years (Law No. 5651) |
| Bitrix24 CRM records | Active patient period + 3 years; 10 years for health data |
| Meta Lead Ads campaign data | When consent is withdrawn or the campaign ends; maximum 2 years |
7. YOUR RIGHTS AS A DATA SUBJECT
Under Article 11 of the KVKK and Articles 15-22 of the GDPR, you have the following rights:
| Right | Description |
|---|---|
| Right to be informed (KVKK Art. 11/1-a,b | GDPR Art. 15) | To learn whether your data are being processed and under which conditions |
| Right to rectification (KVKK Art. 11/1-d | GDPR Art. 16) | To request correction of incomplete or inaccurate data |
| Right to erasure / right to be forgotten (KVKK Art. 11/1-e | GDPR Art. 17) | To request deletion of your data under certain conditions |
| Restriction of processing (GDPR Art. 18) | Only under the GDPR; to request restriction of processing under certain conditions |
| Data portability (GDPR Art. 20) | Only under the GDPR; to receive your data in a machine-readable format |
| Right to object (KVKK Art. 11/1-g | GDPR Art. 21) | To object to automated decision-making or processing based on legitimate interest |
| Withdrawal of consent (KVKK Art. 11 | GDPR Art. 7(3)) | To withdraw your explicit consent at any time for any processing based on consent |
| Right to lodge a complaint (KVKK Art. 14 | GDPR Art. 77) | KVKK: Personal Data Protection Authority | GDPR: Data Protection Authority in your EU country of residence |
| Compensation (KVKK Art. 11/1-ğ | GDPR Art. 82) | To request compensation for damages suffered due to unlawful processing |
| Application Channel | Information |
| info@qualitylifehealth.com (Subject: KVKK/GDPR Application) | |
| Post | Kartaltepe Neighborhood, Saydam Street No:13/A, Küçükçekmece / Istanbul |
| Response Time | KVKK: 30 days | GDPR: 1 month (extendable by +2 months if necessary) |
| Identity Verification | An identity verification document must be attached to applications; for foreign nationals, a copy of the passport is accepted |
8. COOKIES AND META PIXEL
Meta Pixel (online data tracking tool) is used within the scope of our website and Meta advertising campaigns. Through Meta Pixel, data regarding visitor behavior, ad conversions, and audience creation are collected. These data are activated only on the basis of your explicit consent.
- Strictly necessary cookies operate without requiring explicit consent (KVKK Art. 5/2-f; legitimate interest).
- Analytics and marketing cookies are activated only if explicit consent has been obtained.
- Data processed by Meta Pixel are subject to Meta’s Privacy Policy.
- You may change your cookie preferences through the cookie management panel on our website.
