Privacy Policy

This Privacy Policy applies when you use the Goturkey website, mobile experience, patient account, treatment case, support messaging, and travel coordination features (the "Platform"). Goturkey, as the operator of the Platform, is responsible for the personal data described here unless a clinic, doctor, airline, hotel, payment provider, or other supplier explains that it acts as a separate data controller.

Because treatment coordination involves health information, some of the data we handle is sensitive or special-category personal data and receives additional protection.

We receive information directly from you, from a person acting with your permission, from clinics and other providers involved in your request, and automatically from your device and use of the Platform. Sign-in, phone verification, payment, storage, and travel partners may also return confirmation and security data to us.

We use personal data to:

• create and secure your account and verify your contact details;
• prepare, route, and manage your treatment case;
• match your request with relevant doctors, clinics, and services;
• enable messages, uploads, quotations, bookings, payments, and support;
• coordinate flights, accommodation, transport, and follow-up where requested;
• detect abuse, investigate incidents, keep audit records, and protect the Platform;
• improve accessibility, reliability, and user experience; and
• meet accounting, tax, regulatory, legal, and dispute-resolution obligations.

Depending on the context and applicable law, we process data to perform a contract or take steps you request, comply with legal duties, protect vital interests, pursue legitimate interests such as platform security and service improvement, or with your consent.

Health data and other special-category data are processed only where an additional legal condition applies, such as your explicit consent or processing permitted for healthcare-related purposes by authorised persons subject to confidentiality. You may withdraw consent for future processing, but this does not invalidate processing already performed and may prevent us from continuing a treatment request.

Goturkey may use automated tools to organise case information, perform a preliminary image or information check, create a non-diagnostic preview, or suggest a provider category. These tools support preparation and do not replace clinician review. Goturkey does not use an AI pre-check by itself to make a final medical decision or a decision producing legal effects about you. You may ask for human review through support.

We share only what is reasonably needed with:

• doctors, clinics, hospitals, laboratories, and care coordinators reviewing or providing your requested service;
• airlines, hotels, transfer providers, insurers, and other travel suppliers when you request booking or coordination;
• service providers supporting authentication, SMS or calls, payments, cloud hosting, file storage, communications, security, analytics, and AI features;
• professional advisers, regulators, courts, law enforcement, or other parties when legally required or necessary to protect rights and safety; and
• a buyer or successor in a merger, financing, reorganisation, or sale, subject to appropriate safeguards.

We do not sell personal data. We do not share health information for third-party behavioural advertising.

Depending on the feature you use, Goturkey may rely on Firebase for authentication, Twilio for phone verification and communications, Stripe for card payment processing, database and cloud-hosting providers for application data, and media or AI providers for files and requested analysis. These providers process information under their own terms and our service arrangements. The providers in use may change as the Platform develops.

Health travel is international by nature. Your information may be transferred to or accessed from Turkiye, your home country, the country of a technology provider, or another location involved in your request. Where required, we use an appropriate transfer mechanism and safeguards under applicable data-protection law.

We keep personal data only as long as reasonably needed for the purposes in this policy, including active case coordination, follow-up, account history, legal claims, safety, accounting, and regulatory duties. Retention periods vary by data type, provider relationship, and applicable law. Data may be deleted, anonymised, or securely isolated when no longer required.

We use technical and organisational safeguards designed for the sensitivity of the data, including access controls, authentication, audit records, secure transmission, and restricted staff access. No online system can guarantee absolute security, so keep your account and device protected and contact support if you suspect unauthorised access.

The Platform may use cookies, browser storage, and similar technologies to keep you signed in, remember your case and interface state, prevent fraud, and maintain essential functionality. We may also use limited measurement technologies to understand performance. Browser settings can block some storage, but essential features may then stop working correctly.

To request deletion of your GoTurkey health account and associated data, visit our account deletion page. This works in a web browser without installing the app and is also available from the in-app account menu. Requests are sent to our support team; submission does not mean deletion has already been completed. We will confirm completion and explain any records we must retain for legal, regulatory or security reasons and the applicable retention period.

Subject to applicable law, you may ask whether we process your data, request access or a copy, correct inaccurate information, request deletion or restriction, object to certain processing, withdraw consent, request portability, learn about recipients, and ask for human review of a significant automated decision. You may also complain to the relevant data-protection authority.

In Turkiye, rights under Article 11 of Law No. 6698 include access, correction, deletion or destruction, information about transfers, objection to certain solely automated outcomes, and compensation for unlawful processing. To exercise a right, contact us through the signed-in support conversation. We may need to verify your identity before acting on a request.

Official resources: Turkish Personal Data Protection Authority / European Commission data-protection rights

The Platform is intended for adults. A parent or legal guardian must contact Goturkey before providing a child's information. We do not knowingly invite children to create their own accounts.

We may update this policy as services, providers, or laws change. We will change the effective date and provide additional notice when a material update requires it.

Privacy questions and rights requests may be sent through the Goturkey in-app support conversation. Please do not send passport copies, medical images, or other sensitive information through an unsecured channel.