Your journey is personal.
Your privacy matters.

The CK Health Turkey patient application and related digital patient-journey services are operated by Kutlu Seyahat Turizm Özel Sağlık İnşaat ve Ticaret Limited Şirketi (“CK Health Turkey”, “we”, “us” or “our”). This Privacy Policy explains how personal data is handled when you use the patient app and connected journey services.

Hospitals, clinics, doctors and other healthcare providers involved in your treatment may act as separate data controllers for the clinical care and records for which they are legally responsible.

Depending on your journey and the features you use, we may process identity and contact details; account and authentication information; treatment and operation details; doctor, hospital and coordinator information; appointment and timeline information; travel and accommodation information; patient documents; health information; app feedback; notification tokens; device/platform information; and security or audit data.

Information about treatment, medical background, care notes, photos, measurements and medical files may constitute health data or other specially protected personal data. We apply additional safeguards to this information.

Acceptance of the app Terms of Use is not treated as blanket consent for every use of health data. Where applicable law requires a specific legal condition, professional confidentiality, explicit consent or another additional safeguard for a particular use or transfer, that requirement must be satisfied separately.

We may receive information directly from you, from your existing CK Health Turkey patient or sales-order record, from coordinators and support teams, and from contracted hospitals, clinics, doctors, laboratories, hotels, transport providers, travel partners and other service providers involved in your journey.

Files and information you upload through the app are also added to or associated with your patient journey record where the relevant feature is designed to do so.

We use personal data to authenticate access; provide and administer your patient journey; coordinate treatment-related logistics, accommodation and transfers; display treatment and travel information; communicate with you; provide documents and patient-support features; manage safety, fraud prevention and security; maintain service quality; respond to legal-rights requests; and meet legal, regulatory, tax, accounting, health-tourism, contractual and dispute-handling obligations.

Depending on the activity and the law that applies, processing may be based on performance of a contract or steps requested before a contract, compliance with legal obligations, legitimate interests that do not override your rights, protection of vital interests, and an applicable condition for processing health or other specially protected data. Where consent is the appropriate or legally required basis, we ask for it separately and it may be withdrawn for future processing.

Data is shared only where relevant with persons and organisations that need it for the stated purposes. These may include CK Health Turkey personnel and coordinators; contracted doctors, hospitals, clinics and laboratories; travel, hotel and transfer providers; Zoho CRM and related business systems; Oracle Cloud Infrastructure and other hosting or infrastructure providers; Expo and Apple or Google notification infrastructure when push notifications are enabled; email and communications providers; and professional advisers, auditors, insurers, regulators, courts or public authorities where legally required.

Where a third party processes personal data on our behalf or receives it through the patient app, we require appropriate confidentiality, security and data-protection safeguards consistent with the commitments in this policy and applicable law. We do not sell personal data through the CK Health Turkey patient app.

CK Health Turkey serves international patients and uses service providers that may process data in Türkiye or other countries. Before a restricted international transfer is made, we use an applicable legal transfer mechanism and safeguards required by the relevant law.

Depending on the transfer, these may include adequacy decisions, standard contractual clauses or data-transfer agreements, the Turkish KVKK standard-contract mechanism, or another lawful safeguard or exception. You may contact us for information about the safeguard relevant to a particular transfer.

If you create a Family Companion code, you intentionally authorise a person who has both your CK Health email address and the time-limited code to view a restricted, read-only version of the selected journey.

The family view may include your name, treatment or operation summary, arrival and departure information, doctor, hospital, hotel, transfer timing, driver and vehicle details. It is designed not to expose passport files, invoices, payment information, medical background, care notes or private feedback. Family codes expire after the configured access period (currently up to 30 days) and can be revoked from the app. Share a code only with someone you trust.

If you allow notifications, the app may create an Expo push token and associate it with the active patient journey so that journey reminders or important updates can be delivered. Some reminders and app preferences are stored locally on your device. You can control notification permission in your device settings.

We keep information only for as long as needed for the purpose for which it is used and for applicable medical, health-tourism, contractual, tax or accounting, safety, fraud-prevention, legal-claims and regulatory requirements. Different categories therefore have different retention periods.

Time-limited Family Companion access expires automatically; push-token records are replaced or cleared when appropriate; local app data can be removed from the device; and security or audit logs are retained only for operational security, incident investigation and accountability needs. When information is no longer required, it is deleted, anonymised or access-restricted as appropriate. A deletion request does not necessarily require deletion of records that must lawfully be retained.

Subject to the law that applies to you, you may have rights to request access to personal data, correction, deletion in certain circumstances, restriction, objection, portability, information about international-transfer safeguards and a copy of your data. Where processing is based on consent, you may withdraw that consent for future processing.

The app provides options to request your information and request account deletion. These requests are recorded for review because some patient, medical, contractual or regulatory records may need to be retained. You may also contact us at [email protected]. If you are entitled to complain to a data-protection authority, you may do so in the jurisdiction applicable to your data and rights.

We use technical and organisational controls intended to protect patient access and data, including authenticated sessions, access restrictions, upload controls, audit logging and secure transport. No system can guarantee absolute security.

Please protect your login details, use Family Companion only with trusted people and tell us if journey information appears incorrect or if you suspect unauthorised access. We may update this policy when the app, our providers or legal requirements change. Material changes are versioned and the app may require you to review the updated notice before continuing.