One Clinic Istanbul
Login
KVKK & EU GDPR COMPLIANT

Patient Privacy & Data Protection Policy

At One Clinic, we protect and process our international patients' clinical records, medical history, and personal data under the highest banking-grade 256-bit encryption standards in strict compliance with Turkish KVKK and EU GDPR.

Republic of Türkiye Ministry of Health Facilitator License: AK-1339 • TÜRSAB: 16184 • Last Updated: October 1, 2026

1Data Controller Identity & Regulatory Scope

Pursuant to the Turkish Law on the Protection of Personal Data No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”), ONE CLINIC SAĞLIK TURİZM REKLAM HİZMETLERİ VE DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ (“One Clinic”) acts as the Data Controller for all personal and medical information shared through our website (https://oneclinic.co), consultation portals, WhatsApp communication lines, and clinical premises.

Corporate Entity: ONE CLINIC SAĞLIK TURİZM REKLAM HİZMETLERİ VE DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ (VKN: 6430830394, VERBİS: 20912877)
Headquarters: Şirinevler Meydanı, Mareşal Fevzi Çakmak Cd. Yaman İş Merkezi No: 1-3 Kat: 4 Kapı No: 10-11, 34188 Bahçelievler/İstanbul, Türkiye
Clinical Branch: Kocatepe Mah. 33. Sok. No:5 Shop:1, 34045 Bayrampaşa / Istanbul
Medical Tourism License: AK-1339 • TÜRSAB #16184 (Magicstar Health Tourism Travel Agency) • TÜRKPATENT: 2024 075840
Email: info@oneclinic.co • KEP: oneclinicsaglik@hs01.kep.tr • VERBİS: 20912877 • Web: https://oneclinic.co

2Categories of Personal & Confidential Health Data Processed

The following data categories are collected and processed during your medical consultation and treatment journey:

Identity & Direct Contact RecordsFull legal name, passport / national identification number, date of birth, gender, nationality, mobile phone / WhatsApp number, email address, residential address.
Special Categories of Medical & Health DataSurgical and clinical history, pre-existing chronic conditions, regular medications, allergies, BMI measurements, pre- and post-op photos for medical evaluation, laboratory test results, radiology and epicrisis reports.
Financial & Digital Security RecordsTreatment package payments, deposit vouchers, invoicing details, IP addresses, server log entries, cookie records, and portal navigation data.
Audio-Visual & Travel Coordination DataCall center recordings, clinic security CCTV footage, flight arrival itineraries, VIP chauffeur transfer coordination, and 5-star hotel accommodation booking records.

3Purposes of Data Processing

  • Evaluation of medical diagnosis, surgical feasibility, and aesthetic treatment plans by our medical board and specialist surgeons,
  • Mandatory statutory reporting under the International Health Tourism and Tourist Health Directives of the Republic of Türkiye,
  • Coordination of airport VIP chauffeur transfers and 5-star hotel accommodation arrangements,
  • Conducting 12-month post-operative follow-up care in your native language through dedicated patient coordinators,
  • Complying with oversight and audit requests from the Ministry of Health, TÜRSAB, and judicial authorities.

4Data Transfers & Bank-Grade Security Measures

Your personal and medical records are shared domestically strictly for procedure execution and regulatory compliance with: the Republic of Türkiye Ministry of Health, contracted partner hospitals meeting international quality standards, operating specialist surgeons, and diagnostic laboratories. Your data is never sold, leased, or shared with external foreign agencies or commercial third parties; access to our cloud patient management (CRM) panels belongs exclusively to authorized One Clinic staff. Technical server hosting and encrypted routing via cloud CRM (Zoho), cybersecurity/CDN (Cloudflare), online payment (PayPal), and patient-initiated messaging (WhatsApp) infrastructure located outside Türkiye are governed strictly under KVKK Article 9 and EU GDPR Chapter V safeguards on 256-Bit SSL, ISO 27001-certified servers.

5Your Rights as a Data Subject under KVKK & GDPR

Under Article 11 of KVKK and Articles 15-22 of EU GDPR, you are entitled to the following rights:

Right of Access & Information: Learn whether your personal data is processed and request detailed information regarding processing purposes.
Right to Rectification: Request correction of inaccurate or incomplete personal and medical records.
Right to Erasure ('Right to be Forgotten'): Request deletion of data upon expiration of statutory medical retention periods.
Right to Object & Complain: Object to automated processing outcomes and lodge inquiries with regulatory data protection bodies.
Data Protection & Privacy Inquiry Channels:

You may exercise your legal rights by submitting an official inquiry in writing or via your registered email address:

Email: info@oneclinic.coKEP: oneclinicsaglik@hs01.kep.trVERBİS: 20912877Official Post / Registered Mail: Şirinevler Meydanı, Mareşal Fevzi Çakmak Cd. Yaman İş Merkezi No: 1-3 Kat: 4 Kapı No: 10-11, 34188 Bahçelievler/İstanbul, Türkiye