Privacy Policy

This policy explains how Hetzner Health Medical Travel Ltd. ("Hetzner Health", "we") processes personal data when you visit this website or contact us. We process personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for visitors from the European Economic Area and the UK, the GDPR / UK GDPR.

1. Data controller

Hetzner Health Medical Travel Ltd.
Teşvikiye Caddesi No: 12/4, Nişantaşı, Şişli, 34365 Istanbul, Türkiye
[email protected]

We also operate offices in Antalya and İzmir, Türkiye.

2. What data we collect

• Contact data you provide: name, e-mail address, phone/WhatsApp number, country.
• Health-related information you volunteer in messages — for example the procedures you are interested in, medical history you choose to share, or documents you send us. Under KVKK and GDPR this is special-category (sensitive) data and is processed only with your explicit consent.
• Technical data collected automatically: IP address, browser type, pages visited, referring page. See our Cookie Policy.
• Advertising identifiers: cookies set by the Google Ads tag and Meta Pixel, and — only when you submit our contact form — a cryptographically hashed version of your name and e-mail address, sent to Meta for ad matching ("Advanced Matching"). See our Cookie Policy for details.

3. Why we process it

• To answer your enquiry and arrange consultations, quotes and travel itineraries (performance of pre-contractual steps / contract).
• To share relevant information with the partner surgeons and hospitals you choose to be referred to — only with your explicit consent.
• To operate, secure and improve this website (legitimate interest).
• To comply with legal obligations under Turkish law.

4. Sharing with third parties

We never sell your data. We share it only with: (a) the partner clinics, surgeons and hospitals involved in your care, with your explicit consent; (b) service providers that host our website and communication tools, bound by data-processing agreements; (c) public authorities where the law requires it; and (d) Google and Meta, for advertising and conversion measurement — this includes the hashed contact-form data described in Section 2 above. Where data is transferred outside your jurisdiction, we rely on your explicit consent and/or appropriate safeguards.

You can opt out of Google's ad personalisation in Google Ads Settings, and manage how Meta uses your data in your Facebook/Instagram ad preferences.

5. Retention

Enquiry correspondence is retained for as long as needed to handle your enquiry and for a maximum of 3 years thereafter, unless a longer period is required by law (for example, accounting records). You may request earlier deletion at any time.

6. Your rights

Under KVKK Art. 11 and GDPR Arts. 15–22 you have the right to: learn whether we process your data; request access, correction or deletion; object to processing; withdraw consent at any time; request data portability (GDPR); and lodge a complaint with a supervisory authority (in Türkiye, the KVKK Board; in the EU, your local data-protection authority). To exercise any of these rights, write to [email protected].

7. Security

We use encrypted connections (HTTPS), access controls and confidentiality obligations for everyone who handles your data. No method of transmission is 100% secure, but we treat the sensitivity of our community's data as a design principle, not an afterthought.

8. Children

Our services are intended for adults (18+). We do not knowingly collect data from minors.

9. Changes

We may update this policy from time to time; the "last updated" date above always reflects the current version.