Data protection

Data protection notice

Last reviewed: 25 May 2026

This notice explains how Mapa Health processes personal data when you use this website, contact us by form, email, phone, WhatsApp or social media, or ask us to coordinate a medical tourism service in Turkey. It is written for patients, relatives, website visitors, business contacts and other people who communicate with us.

Controller and privacy contact

Controller: Mapa Sağlık Hizmetleri ve Tıbbi Danışmanlık Ltd. Şti., operating under the brand Mapa Health. Address: Avrupa Residence, Yamanevler, Dr. Fazıl Küçük Cd. A2 Blok, Kat:9, D:43, Ümraniye, Istanbul 34764, Turkey. Email: info@mapahealth.com. Phone: +90 544 916 62 72. For privacy requests, use the subject line "Data Request".

Categories of data we process

• Identity and contact data, such as name, email, phone number, country, language and preferred communication channel.
• Inquiry and coordination data, such as requested treatment, budget questions, travel dates, messages, call notes and appointment preferences.
• Health related data you choose to share, such as medical history, photos, scans, test results, medication notes, allergies or previous procedures.
• Logistics and service data, such as hotel, transfer, companion and interpreter needs, where needed for coordination.
• Website and communication metadata, such as IP address, device information, visited pages, referral URL, UTM data, cookie identifiers and server logs.

Purposes of processing

We process data to answer your request, understand the service you are asking about, prepare a non-binding coordination estimate, arrange communication with suitable partner facilities, plan appointments, transfers and follow-up, provide customer support, protect the website against spam and misuse, keep business records and meet legal obligations.

Legal bases

Where GDPR applies, processing may rely on consent, pre-contractual steps or contract performance, legal obligations, legitimate interests, vital interests in urgent situations, and special rules for health data under Article 9 GDPR. Where Turkish law applies, processing may rely on KVKK Articles 5 and 6, explicit consent, contract necessity, legal obligation, establishment or protection of a right, legitimate interest and health service related grounds where available.

Health data and sensitive information

Health data is treated as sensitive. We ask you to send only information that is relevant for assessment and coordination. We use health information to request preliminary feedback from licensed partner facilities, to help you compare written plans and to support follow-up communication. Final diagnosis, suitability and treatment decisions belong to the treating physician or facility, not to the website.

Recipients and partner facilities

Data may be shared, when necessary, with our coordination team, licensed partner hospitals or clinics, physicians, interpreters, transport and accommodation providers, IT, hosting, email, CRM, analytics, accounting, legal and security providers, and public authorities where legally required. Hotels and transfer providers receive only logistical information needed for their service.

International transfers

Mapa Health is based in Turkey and works with international patients. If you contact us from the EU, UK or another country, your data may be transferred to Turkey and, where necessary, to service providers or partner facilities involved in your request. We use the minimum necessary data and rely on consent, contract necessity, appropriate safeguards or other lawful transfer mechanisms where applicable.

Cookies, analytics and advertising tools

We use essential cookies and server logs to operate and protect the website. We may use analytics and advertising tools such as Google Analytics or Google Ads to understand page performance and campaign results, subject to consent where required. These tools may process cookie identifiers, IP information and usage events. You can control cookies through your browser settings and any consent tool shown on the site.

Retention

We keep personal data only as long as needed for the purpose collected, follow-up, evidence, legal limitation periods and accounting or health tourism obligations. General inquiries are reviewed periodically and deleted or anonymized when no longer needed. Server logs are normally kept for a short security period unless an incident requires longer retention.

Your rights

Depending on the law that applies to you, you may request access, correction, deletion, restriction, portability, objection to processing, withdrawal of consent and information about transfers. You may also complain to a competent data protection authority. Under KVKK, you may exercise the rights listed in Article 11. Write to info@mapahealth.com with enough information to verify and handle your request. We aim to respond within 30 days.

Security

We use technical and organisational safeguards such as access limitation, role based handling, secure communication practices, spam controls, hosting security and staff confidentiality rules. No online transmission is completely risk free, so please avoid sending unnecessary sensitive information through open channels.

Children

Our services are intended for adults. If a request concerns a minor, it must be made by a parent or legal guardian and only information necessary for coordination should be provided.

Changes to this notice

We may update this notice when our services, providers, technologies or legal duties change. The current version is published on this page.