MedBook Global OÜ

Privacy Policy

Effective date: 20.04.2026 | Updated: 18 May 2026

1. Who We Are

MedBook Global OÜ ("Company", "we", "us") is a digital health tourism platform connecting international patients with certified dental clinics in Turkey. We act as data controller for patient data and as data processor on behalf of clinics.

2. Data We Collect

2.1 Personal data

• Full name
• Email address
• Phone number
• Date of birth
• Country of residence
• Language preference
• Account credentials
• Billing information
• Device and browser information

2.2 Health data (Article 9 GDPR — special category)

• Medical history and chronic conditions
• Symptoms and diagnoses
• Allergies and medications
• Smoking status and pregnancy status
• Dental treatment type and volume
• Uploaded X-ray and CT scan documents
• Medical questionnaire responses

2.3 Travel data (collected for trip planning)

• Preferred treatment city in Turkey
• Travel dates and length of stay
• Accommodation requirements
• Transfer / airport pickup needs
• Preferred flight windows (arrival and departure)

2.4 Automatically collected data

• IP address
• Cookies and tracking technologies
• Browser type and session information
• Usage analytics

3. Legal Basis for Processing (GDPR)

4. How We Use Your Data

• AI-powered clinic matching based on your medical profile and preferences
• Anonymised patient profile creation for clinic review (identity withheld until booking confirmed)
• Trip plan generation including treatment timeline, flight windows, accommodation, and transfer
• In-platform chat facilitation between patient and clinic (no direct contact details shared before booking)
• Travel coordination: sharing minimal travel-relevant data with contracted travel agency partners for hotel, transfer, and flight package assembly
• Regulatory reporting to USHAS as required by Turkish health tourism law
• Platform security, fraud prevention, and analytics

5. Sharing of Information with Third Parties

Full list of third parties:

We do not sell personal data to any third party.

6. International Data Transfers

Patient data is transferred to Turkey (dental clinics, USHAS) and may be processed by travel agency partners in other countries. Turkey does not have an EU adequacy decision. We protect transfers through:

• Standard Contractual Clauses (SCCs) — EU Commission approved model clauses signed with all partners
• Data Processing Agreements with all processors and sub-processors
• Anonymisation of patient identity before transfer to clinics
• Minimisation of medical data transferred to travel agencies (travel-relevant fields only)
• Encrypted infrastructure for all data in transit (TLS 1.3) and at rest (AES-256)

7. Data Retention

8. Your Rights (GDPR Articles 15–22)

• Right of access (Art. 15): Request a copy of all data we hold about you within 30 days.
• Right to rectification (Art. 16): Correct inaccurate data via account settings at any time.
• Right to erasure (Art. 17): Request deletion of your account and all data. Medical documents deleted within 72 hours.
• Right to restrict processing (Art. 18): Pause processing while a dispute is resolved.
• Right to data portability (Art. 20): Receive your data in machine-readable format (JSON/CSV).
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to withdraw consent: Withdraw consent for health data or travel data sharing at any time. This will prevent clinic matching and trip package assembly.
• Right to lodge a complaint: File a complaint with your national Data Protection Authority.

To exercise any right: founder@medbook.global

9. Security Measures

• AES-256 encryption of all data at rest
• TLS 1.3 encryption for all data in transit
• Role-based access control — clinics see only anonymised profiles they are matched to
• Multi-factor authentication for all staff access
• Audit logging and anomaly detection
• Data breach notification to supervisory authority within 72 hours (GDPR Art. 33)
• Quarterly internal security reviews

10. Cookies

• Essential cookies: session management, authentication (no consent required)
• Analytics cookies: anonymised usage statistics (opt-in via cookie banner)
• No advertising or tracking cookies

11. Children's Privacy

Our platform is not directed at persons under 18 years of age. We do not knowingly collect data from minors. Contact founder@medbook.global to request deletion of any inadvertently collected minor data.

12. Changes to This Policy

Material changes will be notified to registered users by email at least 14 days before taking effect.

13. Contact