Effective Date: 25.02.2026
1. Data Controller Information
In accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the General Data Protection Regulation (“GDPR”), your personal data is processed by:
Company Name: Soraca Med
Registered Address: Kuşkavağı, 542. Sk. No:4/B, 07070 Konyaaltı / Antalya, Turkey
Email: [email protected]
Phone: +90 507 070 10 26
Responsible Data Controller: Soraca Med Management
Soraca Med acts as the “Data Controller” within the meaning of Article 4(7) GDPR and Article 3 KVKK.
2. Legal Basis for Processing Personal Data
Your personal data is processed in accordance with:
- Article 6 GDPR
- Article 9 GDPR (Special Categories of Data)
- Article 5 and 6 of KVKK
Legal bases include:
- Explicit consent
- Performance of a contract or pre-contractual measures
- Compliance with legal obligations
- Legitimate interests of the clinic
- Protection of vital interests
- Processing of health data for medical diagnosis and treatment (Article 9(2)(h) GDPR & KVKK health data provisions)
3. Categories of Personal Data Collected
3.1 Identity Information
- Name and surname
- Passport information (if required for health tourism services)
3.2 Contact Information
- Phone number
- Email address
- WhatsApp communication details
3.3 Health Data (Special Category Data)
- Medical history
- Treatment information
- Diagnostic records
- Before/after photographs (with explicit consent)
3.4 Technical Data
- IP address
- Browser type
- Device information
- Cookie data
3.5 Marketing Data
- Contact form submissions
- Advertising interaction data
- Campaign analytics
Health data is processed as a special category of personal data and subject to enhanced protection.
4. Methods of Data Collection
Your personal data may be collected through:
- Website contact forms
- WhatsApp communication
- Email correspondence
- Phone calls
- Online consultations
- Social media platforms
- Cookies and tracking technologies (via Cookiyes consent management system)
5. Purpose of Processing Personal Data
Personal data is processed for the following purposes:
- Providing medical consultation
- Treatment planning and evaluation
- Appointment scheduling
- Health tourism coordination services
- Legal and regulatory compliance
- Improving website functionality and user experience
- Marketing and advertising activities (only with explicit consent)
- Post-treatment patient follow-up
6. Processing of Health Data (Special Category Data)
Health-related data is:
- Processed only with explicit consent or under applicable medical regulations
- Used strictly for medical diagnosis, treatment, and healthcare services
- Handled under professional confidentiality obligations
- Stored using enhanced technical and organizational security measures
7. Data Sharing and International Transfers
7.1 Third-Party Service Providers
Your data may be shared with:
- IT infrastructure providers
- Website hosting providers
- CRM systems
- Advertising platforms (such as Meta and Google)
- Analytics providers
- Legal or regulatory authorities when required by law
All third-party providers are contractually obligated to ensure data protection compliance.
7.2 International Data Transfers
Where personal data is transferred outside the European Economic Area (EEA), appropriate safeguards are implemented, including:
- Standard Contractual Clauses (SCCs)
- Adequacy decisions issued by the European Commission
- Additional technical and contractual safeguards
8. Data Retention Period
Personal data is retained:
- In accordance with applicable legal retention obligations
- For medical record retention periods required by Turkish health regulations
- Until withdrawal of marketing consent (if applicable)
- Until the purpose of processing is fulfilled
At the end of the retention period, data is securely deleted, anonymized, or destroyed.
9. Data Security Measures
Soraca Med implements appropriate technical and organizational measures, including:
- SSL encryption
- Secure hosting infrastructure
- Restricted access to personal data
- Internal authorization controls
- Health data protection protocols
- Regular system monitoring
10. Rights of Data Subjects
Under GDPR (Articles 15–22), you have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request deletion (“Right to be Forgotten”)
- Restrict processing
- Request data portability
- Object to processing
- Withdraw consent at any time
Under KVKK, you have the right to:
- Learn whether your data is processed
- Request information regarding processing
- Request correction or deletion
- Object to unlawful processing
To exercise your rights, you may contact:
📧 [email protected]
11. Automated Decision-Making and Profiling
Soraca Med does not carry out automated decision-making that produces legal effects on individuals. Marketing-related profiling may occur only with explicit consent.
12. Cookies and Tracking Technologies
Our website uses cookies and tracking technologies managed via Cookiyes Consent Management Platform.
Cookies are categorized as:
- Strictly Necessary Cookies
- Functional Cookies
- Analytics Cookies
- Marketing Cookies
You may manage or withdraw your cookie consent at any time via the cookie banner.
For detailed information, please refer to our separate Cookie Policy.
13. Complaints and Supervisory Authority
If you believe your data protection rights have been violated, you may contact:
Turkish Data Protection Authority (KVKK)
www.kvkk.gov.tr
If you reside in the European Union, you may also contact your local Data Protection Authority.
14. Updates to This Privacy Policy
Soraca Med reserves the right to update this Privacy Policy at any time in compliance with legal requirements.
The updated version will be published on this page with a revised effective date.