Privacy Policy: How We Handle Your Data

Last updated: 15 November 2026.

Who we are

Treat Journey ("we", "us") runs this website, a guide to medical treatment in Turkey that helps international patients compare hospitals and doctors and request treatment plans. For the personal data described here we are the data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for visitors in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR / UK GDPR).

Contact for all privacy questions and requests: [email protected]. Postal address: Büyükdere Cad. No:100, Şişli, 34394 Istanbul, Turkey.

What data we collect

We collect only what we need to answer your request and run the site:

Contact details you give us in a form or account: name, e-mail address, phone number (and messaging app, if you choose it), country.
Treatment request details: the treatment, hospital or doctor you are interested in, your message, preferred dates and answers to the questions in our forms.
Health data you choose to share, such as symptoms, diagnoses, medical history, test results, scans and photographs. This is a special category of personal data and we process it only with your explicit consent.
Account data if you register: login e-mail, a securely hashed password, profile details, the requests, documents and messages in your account.
Reviews you submit about a hospital or doctor, with the name or initials you choose to show.
Technical data: IP address (stored only as a one-way hash for abuse prevention), browser type, pages visited, the page where you first arrived and the campaign or website that referred you.

We do not ask for payment card details; we do not take payments from patients.

Why we use your data and our legal bases

To answer your request and prepare a treatment plan: contacting you, reviewing your request with a patient coordinator and obtaining plans and quotes from hospitals and doctors. Legal basis: steps taken at your request before a contract (GDPR art. 6(1)(b); KVKK art. 5(2)(c)).
To process health data for that plan: your explicit consent, given with the form (GDPR art. 9(2)(a); KVKK art. 6). You can withdraw it at any time; this does not affect processing already carried out.
To run your account and keep your requests and documents in one place: performance of our agreement with you.
To keep the site secure, prevent spam, fraud and duplicate requests, and improve our pages: our legitimate interests (GDPR art. 6(1)(f); KVKK art. 5(2)(f)).
To meet legal obligations, such as answering authorities and keeping records required by law (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)).
Newsletters: only if you subscribe; you can unsubscribe in every e-mail.

We do not sell your data and we do not use your health data for advertising.

Who we share data with

Hospitals, clinics and doctors you ask about, or that we suggest to you, so they can review your case and prepare a plan and a quote. We share only what they need, and only after you have asked for a plan. Once they receive your data they are independent controllers responsible for it under their own privacy notices and Turkish health law.
Service providers working on our instructions: hosting and database servers, e-mail delivery, and messaging and video-call tools you choose to use. They may not use your data for their own purposes.
Authorities, when the law requires it.

When you contact a hospital, doctor, hotel or transfer company directly, their own privacy terms apply.

International transfers

Hospitals and our coordinators are in Turkey, and some service providers may store data outside your country. When data leaves the EEA or the UK we rely on the safeguards the law provides, such as European Commission standard contractual clauses, or on your explicit consent to the transfer needed for your treatment request. For transfers abroad from Turkey we follow KVKK article 9.

How long we keep data

Treatment requests and the related messages and documents: up to 3 years after our last contact with you, so we can follow up and answer questions about your treatment, unless you ask us to delete them sooner.
Accounts: while your account is open. When you delete it, we remove or anonymise your personal data, except records we must keep by law.
Technical and security logs: up to 12 months.
Newsletter: until you unsubscribe.

How we protect your data

Connections to the site are encrypted (HTTPS). Passwords are stored as one-way hashes, access to requests and documents is limited to the staff who need it, and IP addresses are kept only as hashes. No system is perfectly secure, so please do not send more health information than your request needs, and tell us at once at [email protected] if you think your account has been misused.

Cookies and similar technologies

We use a small number of first-party cookies and browser storage:

Essential: keeping you signed in, remembering the page to return to after login, protecting forms against abuse. These are needed for the site to work and do not need consent.
Preferences: remembering choices such as currency or dismissed messages, stored only in your browser.
Source of your visit: the first page you landed on and the referring site or campaign, saved with your request so we know how patients find us.

Fonts are loaded from Google Fonts, which receives your IP address when your browser requests them. If we add analytics or advertising tags in the future, we will ask for your consent first where the law requires it and update this policy. You can delete cookies and site data in your browser settings at any time.

Your rights

Depending on where you live, you have the right to:

learn whether we process your data and get a copy of it;
have inaccurate data corrected and incomplete data completed;
have your data deleted or anonymised;
restrict or object to processing, including processing based on our legitimate interests;
receive data you gave us in a portable format;
withdraw consent at any time;
know the third parties your data was shared with, and object to a decision made solely by automated means (we make none);
claim compensation for damage caused by unlawful processing (KVKK art. 11).

Write to [email protected]. We answer within 30 days. You can also complain to a supervisory authority: in Turkey the Personal Data Protection Authority (KVKK), in the EEA the authority of your country, in the UK the Information Commissioner's Office.

Children

The site is meant for adults. Requests for a child's treatment must be made by a parent or legal guardian, who gives the consents described here on the child's behalf.

Changes to this policy

We will update this policy when our services or the law change. The date at the top shows the latest version; for significant changes we will also tell account holders by e-mail.