Privacy policy

Who is responsible for your information

The data controller is SETTE TECHNOLOGICAL SOLUTIONS YAZILIM SANAYİ VE TİCARET ANONİM ŞİRKETİ ("SetteTech"), a company established in Türkiye. The operator runs the platform: it reviews treatment requests, prepares offers with clinics and surgeons, and is the address for everything in this notice.

Registered address: Muradiye Mah. Celal Bayar Üniversitesi Kampüsü Küme Evleri Tekno Kent No: 22, Yunusemre / Manisa, Türkiye.

MERSİS number: 0764090615400001.

Trade registry: Manisa Ticaret Sicili Müdürlüğü, 22818.

The platform serves people in Türkiye and in the European Union, so your information is protected by the Turkish Personal Data Protection Law (KVKK, Law No. 6698) and — where the GDPR applies to you — by the General Data Protection Regulation. This notice describes the standards that follow from both.

Privacy questions and data-subject requests: [email protected]. Everything else: [email protected].

What we collect

• Account and contact data: your name, e-mail address, telephone number, country of residence, the language and time zone you chose, and the date you registered.
• Treatment request data, including health-related information: the procedure you are considering, your own description of what you want changed, the answers you give in the guided questionnaire, previous operations, ongoing conditions, medication and allergies, and the documents or photographs you upload.
• Payment data: the record of the transfer you make and the proof of payment you upload. Bank transfers carry no card number, and the platform does not store card details.
• Technical data: the IP address and browser identification recorded in security and access logs, the pages requested, and the internal correlation identifiers that let us trace one request through the system.
• Consent records: which document you accepted, its version, and the date, time, language and source of the decision.
• Campaign source, only if you accept the optional cookie: the campaign parameters, the referring site and the page you first landed on (see the cookie policy).

Why we process it, and on what legal basis

Every processing activity is tied to a legal basis. Nothing is processed merely because it might be useful one day.

• To create and run your account, deliver the service and answer you: performance of the agreement with you (KVKK art. 5(2)(c); GDPR art. 6(1)(b)).
• To prepare and deliver offers — reviewing your request, contacting the clinic or surgeon whose offer is being prepared, recording the offer and passing it to you: the same basis, because this is the service you asked for.
• To process health-related information — your request, the questionnaire, the documents and photographs you upload — and to transfer it to the providers preparing your offers: your explicit consent (KVKK art. 6(2) and 6(3); GDPR art. 9(2)(a)). It is asked for separately at registration and covers nothing else.
• To verify the payment you upload and keep accounting records: a legal obligation (KVKK art. 5(2)(ç); GDPR art. 6(1)(c)).
• To keep the platform secure — detecting abuse, preventing unauthorised access, keeping an audit trail of changes, investigating incidents: the legitimate interest in a secure service (KVKK art. 5(2)(f); GDPR art. 6(1)(f)), balanced against your rights. These records are not used to profile you for marketing.
• To send marketing messages about the service and its offers, only if you asked for them: your consent (KVKK art. 5(2)(a) and Turkish commercial-communication rules; GDPR art. 6(1)(a)). Withdrawing it stops the messages.
• To measure which campaigns bring visitors, only if you accept the optional cookie in the cookie banner: your consent (KVKK art. 5(1); GDPR art. 6(1)(a) and the ePrivacy rules on cookies). You can change the choice at any time under “Cookie preferences”.

Health-related information: explicit consent

Health data belongs to the special categories of personal data. The platform processes it only on your explicit consent, asked for at registration as its own decision, and that consent covers: the treatment request you write, including medical history and medication; the documents and photographs you upload; and the transfer of that information to the providers that prepare your offers — including transfers abroad, because the treatment is delivered in Türkiye. The explicit consent text states exactly what this consent covers.

You can withdraw this consent at any time by writing to [email protected]. Withdrawal stops future processing, it does not make earlier processing unlawful, and it may mean the platform can no longer prepare or continue an offer for you.

Who receives your information

We do not sell your information and we do not pass your request to clinics as a marketing lead. Nothing you submit is published on the public website.

• The operator's operations team, which reviews requests and prepares offers.
• The clinic or surgeon whose offer is being prepared for your case — only the parts needed to assess it, which is the same information a patient would take to a consultation.
• Service providers that run parts of the platform under contract: hosting at Contabo in Germany; Cloudflare, which carries the traffic between your browser and the platform and protects it from attacks; Hostinger, which delivers the platform's e-mail; and object storage for documents and photographs.
• Professional advisers, courts or authorities where the law requires it, or where it is necessary to establish or defend a legal claim.

Where your information is stored, and transfers abroad

Everything the platform stores about you is held on servers operated by Contabo in Germany, inside the European Union.

Cloudflare handles each connection to the website and the portal: it processes connection data — your IP address, the page requested, technical details of your browser — on servers that may be outside Türkiye and the EU, including in the United States, and it does not keep the content of your request. Hostinger processes the e-mails the platform sends you. Both work under data-processing terms that bind them to the safeguards the KVKK and the GDPR require for transfers abroad.

The operator is a Turkish company and the clinics and surgeons that deliver the treatment are in Türkiye, so your information is also processed in Türkiye: the operations team works from there, and the provider preparing your offer receives the parts of your request it needs to assess your case. For people in Türkiye this is a transfer abroad under KVKK art. 9, and it is based on your explicit consent, given at registration. For people in the EU/EEA, a transfer of personal data out of the EU/EEA is made only where the GDPR permits it — with the safeguards of Chapter V written into the operator's agreements with the recipient, or with your explicit consent where the transfer rests on it.

How long we keep it

Information is kept only as long as it is needed for the purpose it was collected for, or as long as the law requires. Where a period is set by law or by the platform's configured policies we state it; where a period is not fixed yet, we say what governs it instead of naming a number.

• Account and profile data: kept while your account exists. If you close it, what accounting and legal obligations require — and what is needed to answer claims or investigations — is kept for the applicable statutory periods, and everything else is deleted. That tail is, as a rule, ten years: the retention period for commercial records under Turkish law and the general limitation period for claims.
• Treatment requests, and the medical documents and photographs you upload: ten years (3,650 days) from upload — the retention the platform's file policy sets for treatment documents and payment proofs.
• Payment records and the proof of transfer: ten years from the end of the accounting year they belong to, the statutory retention period for accounting records under Turkish commercial law.
• Security and access logs, and the audit trail of changes to personal data: kept for as long as security, incident investigation and audit purposes require, under the operator's logging and audit policy, and deleted once they no longer serve those purposes.
• Consent records: kept for as long as the operator may need to demonstrate that processing was lawful — normally for the same period as the data the consent covers.
• Messages and form submissions you send us: kept until the enquiry is closed, and afterwards with the account or request they belong to.

Your rights

Under the KVKK and the GDPR you can: learn whether your information is processed; ask what is processed, for what purpose and who receives it; receive a copy and, under the GDPR, receive it in a portable, machine-readable form; have inaccurate information corrected; have information deleted or anonymised where the law allows; restrict processing or object to it; withdraw a consent at any time; and claim compensation for damage caused by unlawful processing.

To exercise any of these rights, write to [email protected] — from the address on your account is easiest — and you do not need to give a reason. It is free of charge. We answer in writing within the period the law sets: thirty days under the KVKK and one month under the GDPR.

If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or to the data-protection authority of the EU/EEA country where you live or work, or where you believe the problem occurred.

How we protect your information

• Passwords are stored only as salted hashes (PBKDF2). No one, including platform staff, can read your password, and it is never sent back to you.
• Staff access requires a password and a second factor: a short-lived, time-based code from an authenticator application.
• Access to requests, documents and payment records is authorised by role — only authenticated staff whose work requires it can open them, and every access is checked against the person's permissions.
• Documents and photographs are held in private storage and served through time-limited, signed links. They never sit at a public address.
• Traffic between your browser and the platform is encrypted in transit, and changes that touch personal data are written to an audit trail that records who did what, and when.

Children

The platform is for adults. Klinikbook does not offer treatment coordination to people under 18 and does not knowingly collect information about them. If the operator learns that an account belongs to someone under 18, the account is closed and the information deleted, unless the law requires it to be kept.

Changes to this notice

This notice has a version number and an effective date, both printed on the page. When it changes, the new version is published with a new effective date; where the change affects a consent you gave, the portal asks you to accept the new version before it applies to you. The version the platform records against your account is the one you actually accepted, not the one currently published — so the record shows what you agreed to.