Privacy Policy

MedicaTurn Medical Tourism Company ("MedicaTurn", "we", "us") is the data controller for the personal data described in this policy. We are based at 420 Edgware Road, London, W2 1ED, United Kingdom. You can contact us at info@medicaturn.com or +44 7366 832288.

MedicaTurn is a medical tourism facilitator, not a healthcare provider — we arrange treatment, hotel and transfer bookings with independent partner clinics, hospitals, hotels and transfer providers in Turkiye. We do not perform any medical procedure ourselves.

Identity & contact details: first and last name, date of birth, gender, email address, phone number, and country, collected when you use our treatment planner.

Booking details: your preferred treatment date range, chosen treatment and configuration options, and the price quoted to you.

Health information: answers to our health questionnaire, which may include chronic conditions, current medications, allergies, previous surgeries, and (where relevant) pregnancy/breastfeeding status. This is "special category" data under UK GDPR and is only collected with your explicit consent.

Documents you upload: photographs, X-rays or medical reports you choose to provide to help assess your treatment.

Agreement records: if you accept our Service Agreement, we store your typed signature name, the exact contract text and version you agreed to, and the IP address and browser/device information used at the moment of signing, as evidence of that agreement.

Billing details: if we issue you an invoice, we hold your name, email and (if provided) billing address, the currency and itemised amounts. We do not collect or store payment card details — the Booking Deposit and Treatment Balance are paid by bank transfer, not through this website.

Technical data: your IP address and browser information are processed briefly to auto-detect your currency and, if you contact us, in ordinary web server/email logs.

Currency preference ("currency"): stores GBP, EUR or USD based on your country, set for one year, so prices display in your local currency on return visits.

Admin session ("medicaturn_admin_session"): an internal cookie used only when MedicaTurn staff log in to the admin panel, set for 7 days. This is never set for patients or visitors.

Analytics: if enabled, this site can use Google Analytics and/or the Meta (Facebook) Pixel to measure how the site is used and to track successful applications as conversions. These are only active when configured, and set their own cookies according to Google's and Meta's respective policies.

To prepare your treatment plan, price estimate, and to communicate with you about it — necessary to take steps at your request before entering into a contract, and to perform that contract (UK GDPR Art. 6(1)(b)).

To process your health questionnaire answers and any documents you upload, and to share the relevant health information with the treating clinic — only with your explicit, separate consent (UK GDPR Art. 9(2)(a)), given at the Agreement step, distinct from accepting the Service Agreement itself.

To issue invoices and keep financial records — necessary to comply with our legal obligations (UK GDPR Art. 6(1)(c)).

To keep our site secure and understand how it's used (including via analytics, where enabled) — our legitimate interests (UK GDPR Art. 6(1)(f)), balanced against your privacy.

The treating clinic, hospital, hotel and/or transfer provider in Turkiye handling your treatment and travel — only after you give explicit, informed consent to this specific transfer, separately from the Service Agreement, having been told that Turkiye does not have a UK "adequacy decision" (meaning its data protection framework has not been formally assessed as equivalent by the UK government).

Service providers who process data on our behalf to run this website and our booking process: Vercel (hosting and file storage), Neon (database), and Resend (transactional email for quotations and confirmations). Some of these providers may process data outside the UK/EEA (for example, in the United States); where that happens, we rely on the safeguards those providers offer (such as the UK/EU Standard Contractual Clauses) — [PLACEHOLDER: confirm each processor's current data processing agreement/transfer mechanism before relying on this line].

We do not sell your personal data to anyone.

Uploaded photographs, X-rays and reports are automatically deleted 14 days after upload, whether or not your application proceeds, as a data-minimisation measure.

Your application, questionnaire and contract records are currently kept for as long as needed to arrange your treatment, handle any follow-up, and meet our legal/accounting obligations, and are reviewed manually rather than on a fixed automatic schedule. [PLACEHOLDER: set and publish a fixed retention schedule for this data once decided.]

Under UK GDPR, you have the right to: access the personal data we hold about you; have inaccurate data corrected; ask us to erase your data; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time (including consent to share your data with the clinic in Turkiye), without affecting the lawfulness of processing before you withdrew it.

To exercise any of these rights, contact us at info@medicaturn.com. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or 0303 123 1113.

Our services are not directed at, and our treatment planner does not accept, anyone under 16 years of age.

We may update this policy from time to time. The version date at the top of this page shows when it was last changed.