PRIVACY NOTICE

Last review: 10.08.2026

1. Who We Are and Scope
2. Data We Collect and Its Sources
3. Purposes and Legal Bases
4. Sharing and Controller Roles
5. International Transfers and Communications
6. Cookies and Marketing
7. Retention, Security and Incidents
8. AI and Automated Support
9. Minors
10. Your Rights and Complaints
11. Changes and Contact

1. Who We Are and Scope

Globalmedik is a brand and information and service platform operated by CTK Global Sağlık Turizmi ve Danışmanlık Hizmetleri Limited Şirketi (“CTK Global”). In this Notice, “Globalmedik”, “we”, “us” and “our” mean CTK Global when it determines why and how personal data is processed.

Controller:

CTK Global Sağlık Turizmi ve Danışmanlık Hizmetleri Limited Şirketi
Erenköy Mah. Ethem Efendi Cad. No: 83/3, Kadıköy, İstanbul, Türkiye

This Notice covers the Globalmedik website, enquiry forms, communications with coordinators, medical-tourism facilitation, agreed travel or coordination services, accounts, reviews, payments to Globalmedik, and other services that refer to it. It does not govern an independent hospital, clinic, doctor, laboratory or other healthcare provider (“Medical Provider”) when that provider determines its own purposes and means of processing. A Medical Provider will normally be a separate controller for diagnosis, medical records, informed consent, treatment and clinical follow-up; its own notice then applies.

We process data under the Turkish Personal Data Protection Law No. 6698 (KVKK). The EU General Data Protection Regulation (GDPR) applies only where its territorial conditions are met. National rules implementing the ePrivacy Directive may also apply to cookies and electronic communications. Nothing in this Notice reduces mandatory rights.

For Globalmedik’s service boundaries and the role of Medical Providers, see Terms of Use and Services.

2. Data We Collect and Its Sources

The data depends on how you interact with us and may include:

• identity and contact data, such as name, age or date of birth where relevant, nationality, country of residence, telephone number, email, preferred language and, only where needed for a booking or journey, passport or identification details;
• health data, such as the requested treatment, symptoms, diagnosis, medical history, medication, allergies, disabilities or access needs, pregnancy information, reports, laboratory results, scans, prescriptions and medical photographs;
• service and travel data, such as selected providers, consultations, appointments, companions, flights, accommodation, transfers and interpretation needs;
• transaction data, such as the amount, currency, payment recipient, invoice details, payment status, transaction reference, cancellation and refund information;
• communications and account data, such as enquiries, emails, messages, support history, complaints, preferences, account identifiers, reviews, ratings and information used to check a review;
• technical data, such as IP address, browser and device information, approximate location derived from IP, referral source, pages and functions used, cookie identifiers, consent choices, and security logs.

We obtain data directly from you; from a parent, guardian or authorised representative; from a Medical Provider or travel provider at your request or where law permits; from payment and communications services used for your request; automatically through the website; and from official or public professional sources where lawful. If you provide another person’s data, you must be authorised to do so and should give them this Notice where required.

Please provide only information relevant to the current request. Do not send full medical files, identification documents or payment details unless requested through an appropriate channel for a stated purpose.

3. Purposes and Legal Bases

We use data only where a legal basis applies and for defined purposes:

• Enquiries and services: to respond, identify potentially relevant Medical Providers, obtain preliminary proposals, arrange communications or appointments, coordinate agreed travel or support, administer bookings and provide customer service. Under GDPR, the basis may be steps requested before a contract or performance of a contract, and for limited administration our legitimate interests. Under KVKK, corresponding statutory conditions may include contract necessity, establishment or exercise of a right, or legitimate interests that do not harm fundamental rights.
• Health information: to understand the request and transmit relevant information to selected Medical Providers. Health data is special-category data. Where GDPR applies, an Article 6 basis and a separate Article 9 condition are both required. Where KVKK applies, an Article 6 condition is required. Because Globalmedik is an intermediary rather than the treating healthcare institution, we do not automatically rely on exceptions reserved for healthcare professionals or competent institutions. We normally request explicit consent where no other condition clearly applies. Other conditions are used only when their requirements are actually met.
• Transactions and compliance: to document payments, refunds and contracts; meet accounting, consumer, regulatory and court obligations; and establish, exercise or defend legal claims. The basis may be contract, legal obligation, or the protection of rights.
• Safety and integrity: to secure services, prevent fraud or misuse, maintain necessary logs and investigate complaints. The basis may be legal obligation or proportionate legitimate interests.
• Optional analytics, cookies and marketing: to measure or promote services only where applicable consent or another lawful basis permits. Medical information supplied for care coordination is not a marketing consent.

A privacy notice is not consent. Where consent is required, we request it separately, specifically and in an informed form. You may refuse or withdraw it without affecting earlier lawful processing. If necessary health data cannot lawfully be processed, we or a Medical Provider may be unable to assess or coordinate the request.

4. Sharing and Controller Roles

At your request and with a valid basis, we may share relevant data with selected Medical Providers. We limit disclosure to what is reasonably necessary. Before sensitive information is sent to several providers, you should be told the intended recipients or a meaningful recipient category and the applicable basis. Medical Providers decide whether to accept a case and remain responsible for their own clinical processing.

We may also disclose limited data, where necessary, to processors supporting hosting, communications, document storage, customer service, cybersecurity, translation, analytics or payment administration; to hotels, drivers, interpreters, travel agencies, insurers or payment providers involved in an agreed service; to professional advisers and auditors; and to courts, regulators or public authorities where required. Each recipient receives only data relevant to its role. An accommodation provider, for example, does not need a medical record merely because a room is arranged.

Processors acting for us must be subject to appropriate data-processing, confidentiality and security terms. Other recipients may be independent controllers and provide their own notices.

Globalmedik does not permit patient medical records or health information submitted for coordination to be sold to data brokers or used to create unrelated advertising audiences. A treatment enquiry does not authorise publication of a testimonial, photograph, before-and-after image or patient story. Any separate public or promotional use requires its own lawful basis and, where required, specific documented consent. See Patient Reviews & Comments Policy.

5. International Transfers and Communications

Medical tourism may require data to move between countries. A transfer is made only where a lawful transfer route applies.

For transfers governed by KVKK Article 9, the route may be an applicable adequacy decision, an approved safeguard, the Authority’s standard contract, binding corporate rules, or a limited statutory exception. General consent is not used as a routine substitute for appropriate safeguards. 

For transfers governed by GDPR Chapter V, we use an applicable adequacy decision, European Commission standard contractual clauses or another recognised safeguard; a derogation is used only where its conditions are met. Where required, transfer-risk assessment and supplementary measures accompany the safeguard. This Notice itself is not a transfer mechanism.

If you choose email, telephone or a messaging application, that service may independently process data in other countries under its own terms. Use the designated channel and send no more sensitive information than necessary.

6. Cookies and Marketing

Strictly necessary technologies may operate to provide or secure the website. Where prior consent is required, analytics, advertising, personalisation and other non-essential technologies must remain inactive until you choose them. The consent interface should provide clear Accept, Reject and Preferences choices without making rejection harder, and a persistent way to change or withdraw consent. Core functions not dependent on optional cookies should remain available. Providers, purposes and storage periods should be described in the cookie interface or cookie policy. 

We send promotional email, SMS, calls or messages only with the permission or other basis required in the recipient’s country, and provide a simple opt-out. Marketing consent is separate from health-data processing and refusal does not prevent an enquiry. Contact data obtained from a referral partner is not automatically permission to market. We do not intentionally transmit form contents, diagnoses, reports or medical-case details to advertising platforms or use children’s health data for behavioural advertising.

7. Retention, Security and Incidents

We retain data only while needed for the stated purpose, a current relationship, statutory recordkeeping, complaint handling, or legal claims. The period is determined by the data type, purpose, contract, applicable limitation period and legal duty. When no basis remains, data is deleted, destroyed or anonymised under applicable law. Public reviews may require separate moderation and dispute records.

We apply technical and organisational measures proportionate to the sensitivity, volume, systems and risks involved, including limiting access to people who need it. No internet service is absolutely secure. If a personal-data breach occurs, we assess it, document required action and notify the competent authority and affected people when applicable law requires.

8. AI and Automated Support

If AI-assisted or automated tools are used for translation, summarisation, routing, search, content organisation, security or spam detection, they must remain subject to purpose limitation, access control, processor assessment and international-transfer rules. Patient data must not be placed in publicly accessible AI tools without an appropriate basis and safeguards. Such tools do not diagnose, prescribe, select treatment or replace a qualified Medical Provider. If a solely automated decision produces legal or similarly significant effects, we will provide the information and safeguards required by applicable law.

9. Minors

A minor should not independently submit sensitive medical data where parental or guardian authority is required. We may request evidence that an adult is authorised to act for the child or another person who cannot provide valid consent. The Medical Provider remains responsible for clinical consent requirements.

10. Your Rights and Complaints

Depending on the law, you may ask whether we process your data and request access, correction, completion, deletion, destruction, restriction, portability, information about recipients, or notification of correction or deletion to recipients. You may object to legitimate-interest processing or direct marketing, withdraw consent, and challenge qualifying automated decisions. KVKK also provides rights concerning purpose, domestic or overseas recipients, adverse results of exclusively automated analysis, and compensation for unlawful processing. Rights are subject to statutory conditions and exemptions.

Send a request to info@ctkglobal.com.tr or the postal address above. Describe the request and the contact details needed to locate the data. We may request proportionate identity verification and will respond within the applicable legal period.

You may complain to the Turkish Personal Data Protection Authority after the applicable controller-request step. Where GDPR applies, you may also complain to the competent EEA supervisory authority. Contacting us first does not waive that right.

11. Changes and Contact

We may update this Notice when law, services or processing changes. The published version will show its review date. If a change materially affects processing, we will provide further notice or seek fresh consent where required.

Questions and rights requests: info@ctkglobal.com.tr.

General website enquiries: manager@globalmedik.com.