Privacy Policy

The data controller is Vellorian Health, Levazım Mah., Bomonti İş Merkezi, Beşiktaş, Istanbul, Türkiye. We are a medical clinic licensed by the Turkish Ministry of Health.

For any privacy question or request, write to [email protected].

• Contact details: name, email address, phone or WhatsApp number and country.
• Health data about the patient (usually your child): age, diagnosis status, treatment goals, medical history and any medical reports or images you upload.
• Messages: what you write in our forms, chat assistant, emails, phone calls and WhatsApp conversations.
• Technical data: IP-derived country, browser and device type, the page you came from, and how you use our website (collected through cookies and similar technologies).
• Treatment data: if you become a patient, clinical records created during evaluation, treatment and follow-up.

Health data is a special category of personal data (sensitive personal information under US law). We only collect it because you choose to share it with us.

• To answer your inquiry, review medical records and prepare a preliminary evaluation — steps taken at your request before a contract, and your explicit consent for health data (GDPR / UK GDPR Art. 6(1)(b), 9(2)(a); KVKK Art. 5(2)(c), 6(3)).
• To provide treatment, travel coordination and follow-up care — performance of a contract and medical diagnosis and treatment by professionals under a duty of confidentiality (GDPR / UK GDPR Art. 9(2)(h); KVKK Art. 6(3)).
• To keep medical and financial records required by law — legal obligation (GDPR / UK GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
• To keep the website secure and working — legitimate interests (GDPR / UK GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• To measure website traffic and the performance of our advertising — your consent where required (GDPR / UK GDPR Art. 6(1)(a); KVKK Art. 5(1)).

We do not use your data for automated decision-making that produces legal or similarly significant effects. You can withdraw your consent at any time; this does not affect processing carried out before withdrawal.

We share personal data only as needed for the purposes above:

• Our physicians and patient coordinators, who are bound by medical confidentiality.
• Service providers acting on our instructions: website hosting and file storage (Vercel), database hosting (Supabase), content delivery and security (Cloudflare), internal team notifications (Telegram), messaging (WhatsApp / Meta), and analytics and advertising measurement (Google).
• Partner hospitals, laboratories, travel and accommodation providers, only when needed to deliver the treatment you have chosen.
• Public authorities, courts or regulators when the law requires it.

We do not sell personal data, and we do not share health data for advertising.

Our clinic is in Türkiye, so data you send us from the EU, UK, US or elsewhere is transferred to Türkiye. Some of our service providers process data in the EU, the US or other countries.

For transfers from the EU or UK we rely on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum where available, the EU–US and UK–US data frameworks for certified providers, and otherwise on the transfer being necessary for steps you requested or on your explicit consent (GDPR / UK GDPR Art. 46 and 49(1)(a)–(b)). Transfers out of Türkiye follow KVKK Article 9.

• Inquiries that do not lead to treatment: up to 2 years after our last contact, then deleted.
• Patient medical records: for the period required by Turkish health legislation.
• Financial and accounting records: for the period required by tax law (generally 10 years).
• Analytics data: up to 14 months.

When a retention period ends, we delete or anonymise the data.

We use encrypted connections (HTTPS), access controls limited to staff who need the data, and providers with recognised security standards. No online system is completely secure; if a breach affects your data, we will notify you and the competent authorities as the law requires.

Our services are often for children, but the information is provided by a parent or legal guardian. Please do not submit a child's data unless you are their parent or legal guardian. We do not knowingly collect personal data directly from children under 16 (under 13 in the US); if we learn that we have, we delete it.

We use Google Tag Manager and Google Analytics to understand how visitors use the website and to measure our advertising campaigns. These tools may set cookies and collect technical data such as your device, browser and pages visited.

You can block or delete cookies in your browser settings and opt out of Google Analytics with Google's opt-out browser add-on. Where the law requires, we ask for your consent before setting non-essential cookies, and we honour Global Privacy Control signals as an opt-out request.

Under the GDPR and UK GDPR you have the right to:

• access your data and receive a copy;
• correct inaccurate data;
• have your data deleted;
• restrict or object to processing, including direct marketing;
• data portability;
• withdraw consent at any time.

You can also complain to your local data protection authority — for example the Garante per la protezione dei dati personali in Italy or the Information Commissioner's Office (ICO) in the UK.

Under Article 11 of KVKK you have the right to:

• learn whether your data is processed and request information about it;
• learn the purpose of processing and whether data is used for that purpose;
• know the third parties in Türkiye or abroad to whom data is transferred;
• request correction of incomplete or inaccurate data, and deletion or destruction of data;
• request that corrections and deletions are notified to third parties who received the data;
• object to a result against you arising from analysis solely by automated systems;
• claim compensation for damage caused by unlawful processing.

We answer requests within 30 days at the latest. If you are not satisfied with our answer, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

Depending on your state of residence (for example California, Colorado, Connecticut, Virginia, Texas or Washington), you may have the right to:

• know what personal information we collect, use and disclose;
• access and receive a copy of your personal information;
• correct or delete your personal information;
• opt out of the sale of personal information, sharing for cross-context behavioural advertising, and targeted advertising;
• limit the use of sensitive personal information, including health data;
• appeal our decision on your request.

We do not sell personal information and do not use health data for advertising. We collect consumer health data only with your consent and only to respond to you and provide care. We will not discriminate against you for exercising your rights. An authorised agent may submit a request on your behalf; we may need to verify your identity before acting.

Email [email protected] with your request and enough information for us to identify you. We respond within one month (EU / UK), 30 days (Türkiye) or 45 days (US), and may extend these periods where the law allows; we will tell you if we do.

We may update this policy from time to time. The date at the top shows the latest version; for significant changes we will provide a more prominent notice.