Privacy Policy

Who we are

The controller responsible for your personal data is MAY SAĞLIK TURİZM HİZMETLERİ VE MEDİKAL CERRAHİ DANIŞMANLIK LİMİTED ŞİRKETİ, trading as MAYCLINIK, Levent Mah. Üstzeren Sok. No:7/1, 34330 Beşiktaş/İstanbul, Türkiye.

MAYCLINIK is a health tourism facilitator authorised by the Turkish Ministry of Health (International Health Tourism Authorisation AK-0086) and a member of TÜRSAB (no. 11886). We are not a hospital. Treatments are carried out by independent, licensed doctors in accredited hospitals we have contracts with.

We also have offices in London (106 Crawford St, London W1H 2HY, United Kingdom) and Ludwigsburg (Myliusstraße 5, 71638 Ludwigsburg, Germany).

For any question about your data, please contact us. E-mail: info@mayclinik.com · Phone: +90 850 241 18 31

What data we collect

We only collect what we need to answer you and, if you decide to go ahead, to organise your treatment and your stay.

• Enquiry and consultation forms: first name, surname, e-mail address, phone number with country code, the country of that code, the treatment you are interested in and your message. The medical consultation form also asks whether you have had surgery before, which treatment area interests you and when you plan to have treatment.
• Technical details sent with a form: the page you sent it from, the page where you first arrived on our website, the website that referred you, campaign parameters contained in the link you used (for example utm_source or a Google, Meta or Microsoft click ID), your IP address, browser details (user agent), language and the time of sending.
• Live chat: your messages and any name, e-mail address or phone number you give in the chat. The chat service also records technical data such as your IP address, browser and the pages you view on our website.
• WhatsApp, phone and e-mail: your phone number or e-mail address, your profile name, the content of our conversation and any files you send us.
• Health information: photos of the area to be treated, medical history, medication, test results and similar information that you choose to share so that a doctor can assess whether a treatment is suitable for you.
• If you book treatment: passport or ID details, date of birth, flight and accommodation details, an emergency contact, payment and invoice details, and records of the services we arrange for you.
• Every visit to the website: our hosting provider processes standard log data (IP address, date and time, requested page, browser) to deliver the website and keep it secure.
• Cookies and similar technologies: see our Cookie Policy. If you visit us from the EU, the EEA, the UK or Switzerland, analytics and marketing cookies are only used with your consent.

Health information

Information about your health belongs to the special categories of personal data. We only process it with your explicit consent (Article 9(2)(a) GDPR and UK GDPR) and only to arrange a medical assessment, your treatment and aftercare. We never use it for advertising.

Your health information is seen only by the MAYCLINIK staff who coordinate your case and by the doctors and hospital you are referred to.

You can withdraw your consent at any time. This does not affect processing that took place before you withdrew it, but without this information a doctor cannot assess you or plan treatment.

Why we use your data and our legal basis

Article references are to the EU General Data Protection Regulation (GDPR) and, for the UK, to the UK GDPR, which uses the same numbering.

• To answer your enquiry, arrange a doctor’s assessment and send you a quote: steps taken at your request before entering into a contract (Art. 6(1)(b)); for health information, your explicit consent (Art. 9(2)(a)).
• To organise your treatment, transfers, accommodation and aftercare: performance of our contract with you (Art. 6(1)(b)); for health information, your explicit consent (Art. 9(2)(a)).
• To contact you by phone, WhatsApp or e-mail about your enquiry: steps taken at your request (Art. 6(1)(b)) and, where you ticked the box on the consultation form, your consent (Art. 6(1)(a)).
• To measure how the website is used and how our advertising performs: for visitors from the EU, the EEA, the UK and Switzerland, your consent to analytics and marketing cookies (Art. 6(1)(a)); for visitors from other countries, our legitimate interest in measuring and improving our website and advertising (Art. 6(1)(f)). You can switch this off at any time in the cookie settings or in your browser.
• To know which page or campaign an enquiry came from: our legitimate interest in planning our marketing efficiently (Art. 6(1)(f)).
• To keep the website and our systems secure and to block spam: our legitimate interest (Art. 6(1)(f)).
• To keep invoices and records and to meet our obligations to the Turkish Ministry of Health and other authorities: legal obligation (Art. 6(1)(c)).
• To handle complaints and to establish, exercise or defend legal claims: our legitimate interest (Art. 6(1)(f)) and, for health information, Art. 9(2)(f).

Where we rely on legitimate interest, we have weighed it against your interests and rights. You can object to this processing at any time (see “Your rights”).

Who receives your data

We do not sell your data. We only share it where this is needed for the purposes above:

• MAYCLINIK staff in İstanbul, London and Ludwigsburg who handle your enquiry.
• Contracted doctors and hospitals in Türkiye, which assess your case and carry out treatment. They keep your medical records under their own responsibility.
• Providers who arrange your stay, such as transfer companies, hotels and interpreters, who receive only the details they need.
• Zoho (Zoho Corporation B.V., Netherlands), which hosts our customer relationship management system and our live chat as our processor.
• Google (Google Ireland Limited): Google Tag Manager, Google Analytics and Google Ads (from the EU, the EEA, the UK and Switzerland only with your consent); also the embedded maps and YouTube videos.
• Meta (WhatsApp Ireland Limited and Meta Platforms Ireland Limited): when you contact us on WhatsApp, and to measure our advertising (from the EU, the EEA, the UK and Switzerland only with your consent).
• Microsoft (Microsoft Ireland Operations Limited): Microsoft Clarity, to understand how visitors use the website (from the EU, the EEA, the UK and Switzerland only with your consent).
• Trustpilot (Trustpilot A/S, Denmark), which provides the review widget on our pages.
• Our website hosting provider, as our processor.
• Authorities, courts, lawyers, accountants and insurers, where the law requires it or where it is needed to defend legal claims.

Transfers outside the UK and the EEA

MAYCLINIK is based in Türkiye, and so are our partner doctors and hospitals. Neither the European Commission nor the UK government has recognised Türkiye as providing an adequate level of data protection. We transfer your data to Türkiye because that is where the services you ask for are provided: the transfer is necessary to take steps at your request and to perform our contract with you (Art. 49(1)(b)), and for health information it is based on your explicit consent (Art. 49(1)(a)).

Some of our service providers process data outside the UK and the EEA or can access it from there, for example from the United States or India. In these cases we rely on an adequacy decision where one exists (such as the EU–US Data Privacy Framework and its UK extension for certified US companies) or on the European Commission’s Standard Contractual Clauses, together with the UK Addendum for data from the UK. You can ask us for a copy of these safeguards.

How long we keep your data

• Enquiries and chat conversations that do not lead to treatment: up to 2 years after our last contact, then deleted.
• Patient records and correspondence: while we coordinate your treatment and aftercare, then for as long as Turkish commercial and tax law requires (generally up to 10 years) or until possible legal claims are time-barred.
• Technical and security logs: only for a short period, normally no longer than 30 days.
• Cookies: see our Cookie Policy.

If you withdraw your consent or ask us to delete your data, we delete it unless the law requires us to keep it.

Your rights

Under the GDPR and the UK GDPR you have the right to:

• access the data we hold about you and receive a copy (Art. 15);
• have incorrect data corrected (Art. 16);
• have your data deleted (Art. 17);
• restrict how we use your data (Art. 18);
• receive data you gave us in a common electronic format or have it sent to someone else (data portability, Art. 20);
• object to processing based on our legitimate interest, and at any time to direct marketing (Art. 21);
• withdraw your consent at any time, without affecting processing that took place before (Art. 7(3)).

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

To use any of these rights, write to info@mayclinik.com. We may ask you to confirm your identity. We reply within one month, free of charge.

Complaints

If you think we have handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where the issue occurred:

• United Kingdom: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk
• Germany: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, baden-wuerttemberg.datenschutz.de
• France: Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr
• Other EU countries: the authority in your country, listed at edpb.europa.eu/about-edpb/about-edpb/members_en
• Türkiye: Kişisel Verileri Koruma Kurumu, kvkk.gov.tr

Security

We use encrypted connections (HTTPS), access controls and service providers that offer appropriate security guarantees. Only people who need your data for their work can see it.

No transmission over the internet is completely secure. Please send health information only through the channels described here.

Do you have to give us your data?

No. But without your name and a way to contact you we cannot answer your enquiry, and without health information a doctor cannot assess you or plan treatment.

Children

Our website is not intended for people under 18. We only handle enquiries about patients under 18 through a parent or legal guardian.

Changes to this policy

We update this policy when our services or the law change. The date at the top of the page shows the current version. If a change significantly affects how we use data you have already given us, we will tell you directly.