Privacy Policy

Version: 2026-09

This Privacy Policy explains how your personal data is processed when you use The More Clinics health-tourism marketplace (the pages under /marketplace, the patient account and the clinic, doctor and agency portals; together the “Platform”). It is written to meet the information duties of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and of the EU General Data Protection Regulation (“GDPR”). Our corporate website (the home page and the corporate pages under it) has its own privacy notice.

1. Data controller

• Company: The More Clinics Anonim Şirketi
• Address: Fener, 07160 Muratpaşa / Antalya, Türkiye
• E-mail: info@themoreclinics.com
• Phone: +90 532 679 89 95

The Platform is not a healthcare provider. It is an independent marketplace that connects patients with listed clinics, doctors and agencies (“Providers”). When we pass one of your requests to a Provider, that Provider becomes a separate controller of your data for the service it offers you and is bound by its own privacy obligations.

2. What personal data we process

2.1 Account and contact data

When you open a patient account: your name, e-mail address and password (stored only as an irreversible hash); on your profile, if you choose, phone, country, language and time zone. For provider applications: organisation name, contact person, e-mail, phone, address, website and organisation details.

2.2 Request and quote data

Through the request forms on clinic, doctor and agency pages, the quick quote form on blog articles, the cost calculator and the “Ask a doctor” form: name, e-mail, optional WhatsApp/phone number, the country you live in, the treatment you are interested in, budget, preferred period and contact preference, and the message or question you write. The quotes you receive (price, currency, scope, validity), appointments and related notes.

2.3 Health data (special category data)

Health information in your message, your question or the photos and documents you share is special category data. We process it only with your explicit consent: every form carries an unticked consent box that states plainly to whom (the Provider’s name and country) and why your information will be passed on. Your consent is recorded with its date, language, text version and the Provider and country concerned. We do not ask for photos in the first request form; you share photos and documents later, through the messages in your account, with a separate consent.

2.4 Messages and attachments

Your conversations in your account and the files you attach. Message texts are stored encrypted. Photo attachments are re-encoded, which removes the location (GPS) and device information inside the photo. Attachments are kept in non-public storage that only you, the authorised people of the Provider your request went to, and Platform administrators can access.

2.5 Reviews, questions and content

Reviews (rating, title, text), which you can write only for a completed appointment, and “Ask a doctor” questions. In reviews your name is shown as “Ayşe K.”, with only the initial of your surname. Publishing your question publicly requires a separate, optional consent, and it is published without your name.

2.6 Order, membership and payment data

For memberships and provider plans: name, e-mail, phone, billing address, the plan and payment status. Your card details are neither processed nor stored on the Platform; payment pages are served directly by the payment institution. For buyers in Türkiye, the Turkish ID number required by the payment institution iyzico is sent only to iyzico and is not stored on the Platform.

2.7 Provider documents

The licences, diplomas, specialty certificates, authorisations and agreements Providers upload for approval, and the patient’s signed consent form for before/after photos. These are kept in non-public storage. None of them is published except documents a Provider chooses to show and our compliance team has approved; identity, tax and insurance documents are never published.

2.8 Technical and security data

Session data (session ID, IP address, browser information, last activity), login attempt limits, security records of account and administrative actions, and e-mail delivery records. In the contact form and the cost calculator your IP address is kept only as an irreversible hash and is deleted after 90 days. Profile view counts are recorded as numbers only, without personal data.

3. Why we process your data and on what legal basis

Purpose	Legal basis (KVKK / GDPR)
Opening and managing your account, securing sign-in	Formation and performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b))
Passing your request to the Provider you chose, delivering quotes and messages, your patient assistant adding notes to quotes	Performance of a contract; for health data, your explicit consent (KVKK Art. 6(2); GDPR Art. 9(2)(a))
Passing your request to a Provider abroad	Your explicit consent (KVKK Art. 9; GDPR Art. 49(1)(a))
Memberships, provider plans, refunds and receipts	Performance of a contract; legal obligation (tax and commercial law; KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c))
Checking Providers’ licences and documents, showing badges	Legitimate interest — protecting patients from unverified providers (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f))
Moderating reviews and questions, preventing abuse and fraud	Legitimate interest; legal obligation
Service e-mails (new quote, message, appointment, request status)	Performance of a contract; you can switch notification e-mails off in your account
Security records, establishing and defending legal claims	Legitimate interest; establishing, exercising or defending a right (KVKK Art. 5(2)(e))
Proving your consent (consent records)	Legal obligation and legitimate interest

We do not send marketing e-mails, we do not profile you for advertising and we do not sell your data. If we ever start marketing communications, we will do so only with a separate consent from you.

4. Who we share your data with

• The Provider you choose: Your request goes only to the clinic, doctor or agency named on the form. The consent box shows the Provider’s name and country. If you choose to send an unanswered request to “similar doctors”, it goes to at most three more Providers, with a separate consent for each.
• Our patient assistant team: Platform staff who help you by message with your requests and quotes. Requests from the cost calculator and the blog quick quote form go to this team only.
• Payment institutions: iyzico (İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.) for membership and provider plan payments and, when enabled, Stripe or PayTR. They receive the name, e-mail, phone, address, order and IP details needed for the payment.
• Infrastructure providers: our hosting (server) and e-mail delivery providers, which process your data only on our behalf and on our instructions.
• Authorities: courts, prosecutors and competent public bodies where the law requires it.

For clinic ratings we fetch only the clinic’s summary rating from Google and Trustpilot; we do not send your data to these services. The AI translation service used to translate interface texts receives site texts only — never users’ personal data or messages. Exchange rates come from the European Central Bank’s public data; no personal data is shared in the process.

5. International transfers

Some Providers are located outside Türkiye (for example in Hungary, Greece or other countries). When we pass your request to a Provider abroad, your data is transferred to that country; the transfer is based on your explicit consent, given on a consent box that names the country. Some of our payment and infrastructure providers may also be located abroad; those transfers take place under adequacy decisions, standard contractual clauses or other appropriate safeguards in line with Article 9 KVKK and Chapter V GDPR.

6. How long we keep data

Data	Retention
Account, request, quote, message and appointment data	While your account is open. After you request deletion, it is deleted or anonymised within 30 days, except data we must keep by law.
Requests sent as a guest	Until the request is completed and for the time needed for possible disputes; deleted on request, except where the law requires us to keep it.
Order, payment, refund and receipt records	For the period required by tax and commercial law (generally 10 years).
Explicit consent records	For the duration of the relationship and the statutory limitation periods, to prove consent. In these records the IP address is kept only as an irreversible hash.
IP hashes from the contact form and the cost calculator	90 days; then deleted automatically.
Session data	For the session (120 minutes of inactivity); if you choose “Remember me”, up to about 400 days.
Security records	For as long as needed for security and for defending legal claims.
Before/after photos	While the patient’s consent lasts; when consent is withdrawn the photo is taken off the site immediately.

7. Your rights

Under Article 11 KVKK and the GDPR you have the right to:

• learn whether your personal data is processed and, if so, request information about it;
• learn the purpose of processing and whether data is used accordingly;
• know the third parties in Türkiye or abroad to whom it is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for it to be erased or destroyed, and for these actions to be notified to the third parties it was transferred to;
• object to a result against you that arises solely from automated analysis (no such automated decisions are made on the Platform);
• claim compensation if you suffer damage from unlawful processing;
• if the GDPR applies to you, also: ask for processing to be restricted, object to processing based on legitimate interest, and receive your data in a portable format.

What you can do in your account: correct your profile, download all your data (requests, quotes, appointments, messages, questions, reviews, favourites and orders) as a file, switch notification e-mails off entirely or by type, withdraw a request, and ask for your account to be deleted.

Withdrawing explicit consent: You can withdraw your explicit consent to the processing of your health data at any time by writing to info@themoreclinics.com. Withdrawal does not affect processing carried out before it, but your request can no longer be shared with the Provider concerned. To have data already shared erased, you may also need to contact that Provider; we will help you with this.

How to apply: Send your request in writing to info@themoreclinics.com or to Fener, 07160 Muratpaşa / Antalya, Türkiye. We will respond free of charge within 30 days at the latest. If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (KVKK Kurulu) or, if you live in the EU, to the data protection authority of your country.

8. Security

Connections are encrypted with HTTPS. Passwords are stored irreversibly; message texts, request contact details and payment session data are encrypted. Documents and message attachments are kept in non-public storage, accessible only to authorised people. Sign-in attempts are rate-limited, and two-step verification and passkeys are available. Administrative actions are logged. No system can guarantee complete security; in the event of a data breach we will notify the authority and the people affected as the law requires.

9. Children

The Platform is not directed at anyone under 18. A treatment request for someone under 18 may be sent only by a parent or legal guardian.

10. Cookies

The Platform uses only cookies it needs to work and cookies that remember the language and currency you choose; it uses no analytics or advertising cookies. See the Cookie Policy for details.

11. Changes

We may update this policy to reflect changes to the Platform or the law. The current text is always published on this page with its effective date. We will announce material changes separately by e-mail to the address on your account or on the Platform.