Clinic and doctor data-sharing terms

Parties and scope

SETTE TECHNOLOGICAL SOLUTIONS YAZILIM SANAYİ VE TİCARET ANONİM ŞİRKETİ ("SetteTech"), a company established in Türkiye operates Klinikbook. These terms cover all patient information the Provider receives through the platform: the treatment request, health information, documents and photographs, and the identity and contact details shared after a patient selects the Provider.

Roles

SetteTech is the data controller for coordinating the request and the offer. The Provider is a separate data controller for the medical assessment and the treatment, and complies with the KVKK, the Regulation on Personal Health Data, patient-rights legislation and the rules of medical confidentiality.

Use only for the patient's request

• The Provider uses patient information only to assess the case and prepare an offer and, if selected, to provide the treatment.
• It is not used for marketing or profiling, not combined with other data sets and not disclosed to third parties.
• The Provider does not contact a patient outside the platform before the patient has selected it.

Confidentiality and security

• Access is limited to the staff who need it, under a duty of confidentiality.
• The Provider takes the technical and administrative measures of KVKK article 12: secure storage and transmission, access control, records of access.
• Patient files are not shared through personal messaging applications, personal e-mail accounts or public channels.

Data breaches

The Provider informs SetteTech of any breach affecting patient information received through the platform without delay, and within 24 hours of becoming aware of it at the latest, and cooperates so that the Personal Data Protection Board and the patients concerned can be notified within the legal period.

Retention and deletion

If the Provider is not selected, it deletes or destroys the patient information it received within 30 days after the offer expires or is declined, unless a law obliges it to keep it. If it is selected, it keeps medical records for the periods health legislation sets.

Transfers and sub-processors

The Provider does not transfer patient information abroad or to service providers acting for it without the prior written approval of SetteTech and a valid legal ground.

Patients introduced through the platform

For twelve months from the date a patient's request is shared, the Provider does not make offers to or contract with that patient for the same treatment directly or through third parties outside the platform. A breach is subject to the consequences set in the cooperation agreement.

Audit and liability

SetteTech may ask the Provider for information and documents showing compliance with these terms. The Provider is responsible for its own processing and for the medical service it gives, and indemnifies SetteTech against claims arising from its breach of these terms.

Term and governing law

These terms apply for as long as the cooperation lasts; the confidentiality, deletion and liability obligations survive its end. They are governed by Turkish law, and the courts and enforcement offices of Manisa have jurisdiction.