KVKK information notice

Data controller

The data controller is SETTE TECHNOLOGICAL SOLUTIONS YAZILIM SANAYİ VE TİCARET ANONİM ŞİRKETİ ("SetteTech"), a company established in Türkiye. Klinikbook is a brand of SetteTech.

Registered address: Muradiye Mah. Celal Bayar Üniversitesi Kampüsü Küme Evleri Tekno Kent No: 22, Yunusemre / Manisa, Türkiye.

MERSİS number: 0764090615400001.

Trade registry: Manisa Ticaret Sicili Müdürlüğü, 22818.

Contact for personal data: [email protected].

Personal data processed

• Identity: your name and surname.
• Contact: e-mail address, telephone number, country of residence, preferred language and time zone.
• Health data (special category): what you write in your treatment request and the medical questionnaire, previous operations, conditions, medication and allergies, and the medical documents and photographs you upload.
• Customer transaction: your requests, the offers prepared for you, your selection, the reservation and travel plan, and your messages with the operations team.
• Finance: the amount, currency and reference of your bank transfer and the transfer receipt you upload. No card details are requested.
• Transaction security: sign-in and session records, IP address, browser information and the audit trail of changes.
• Marketing: only if you allow it — the campaign source that brought you to the site (stored in an optional cookie) and your choice about commercial messages.

Purposes of processing

• Creating and running your account and answering your questions.
• Assessing your treatment request and preparing offers with clinics and surgeons.
• Coordinating the offer you select: payment, reservation planning, travel arrangements and follow-up.
• Verifying payments and keeping accounting and tax records.
• Keeping the platform secure, preventing fraud and misuse, and investigating incidents.
• Meeting legal obligations and answering requests of authorities.
• Establishing, exercising or defending legal claims.
• Measuring which campaigns bring visitors, and sending commercial messages — only with your consent.

How the data is collected, and the legal grounds

Personal data is collected electronically: through the forms of the website and the patient portal, the documents you upload, the e-mails you send, cookies and the platform's security records.

• Performance of the contract with you (KVKK art. 5(2)(c)): account, request, offer, payment and reservation data.
• Legal obligation (art. 5(2)(ç)): accounting and tax records, answers to authorities.
• Establishing, exercising or protecting a right (art. 5(2)(e)): records kept for disputes and claims.
• Legitimate interest (art. 5(2)(f)): security and audit records, provided it does not harm your fundamental rights.
• Explicit consent (art. 6 and art. 5(1)): health data and its transfer to providers and abroad (see the explicit consent text), the campaign-source cookie and commercial messages.

Recipients and transfers abroad

Storing data on servers in Germany and routing traffic through Cloudflare are transfers abroad under KVKK article 9. They are based on your explicit consent or, where available, on the appropriate safeguards that article 9 allows, such as standard contractual clauses.

• The clinic, hospital or doctor preparing your offer, and the one you select: the parts of your request needed to assess your case and to treat you.
• Service providers processing data on the operator's behalf: Contabo (servers in Germany), Cloudflare (network and security, servers worldwide including the United States) and Hostinger (e-mail delivery).
• Public authorities and courts where the law requires it, and the operator's legal and financial advisers.

How long the data is kept

Personal data is kept for as long as the purpose requires and the law obliges, and is then deleted, destroyed or anonymised. The privacy policy lists the periods for each kind of record.

Your rights under article 11

• To learn whether your personal data is processed.
• To request information about the processing.
• To learn the purpose of processing and whether the data is used accordingly.
• To know the third parties in Türkiye or abroad to whom the data is transferred.
• To request the correction of incomplete or inaccurate data.
• To request deletion or destruction under article 7.
• To request that recipients be notified of a correction, deletion or destruction.
• To object to a result against you that arises solely from automated analysis.
• To claim compensation for damage caused by unlawful processing.

How to apply

You can apply in writing to the address above, or by e-mail to [email protected] from the e-mail address registered in your Klinikbook account, as the Communiqué on the Procedures and Principles of Applications to the Data Controller provides. Please state your name, a way to reach you and what you request.

Applications are answered free of charge within thirty days at the latest. If answering requires a separate cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your application is rejected or the answer is insufficient, you may complain to the Personal Data Protection Board.