Privacy Policy
Last updated: October 2026
This policy explains how we handle your personal data, especially health information, when you contact us about treatment at BHT Clinic in Istanbul. It applies to patients worldwide. Additional information for specific countries is in Section 12.
1. Who we are (data controller)
Rabiya Caliskan
Am See 50, 47279 Duisburg, Germany
Email: support@bht-clinic.com
Phone / WhatsApp: +49 163 2650605
We are an independent patient coordinator. We do not provide medical services. All medical decisions and treatment are the responsibility of BHT Clinic.
2. What data we process and why
| When | Data | Purpose | Legal basis (EU/UK GDPR) |
|---|---|---|---|
| You visit our website | IP address, date/time, page visited, browser, operating system | Delivering the website securely | Legitimate interest, Art. 6(1)(f) |
| You contact us (WhatsApp, email, phone) | Name, phone, email, country, treatment of interest, travel period, your message | Answering you and preparing a quote | Pre-contractual steps, Art. 6(1)(b) |
| Medical pre-assessment | Health data such as photos, medical reports, lab results, medical history, medication, height/weight | Assessment and treatment planning by BHT Clinic | Explicit consent, Art. 9(2)(a) |
| Booking and travel | Name, date of birth, contact details, passport details (if required by hotel/clinic), travel dates, billing data | Organizing clinic, hotel, transfer and interpreter; payment | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Aftercare | Contact details, information about your recovery | Follow-up support | Contract and explicit consent |
We only process health data after you have given explicit consent. Please do not send medical documents until we have asked for your consent.
3. Website hosting
Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel processes technical access data to deliver the site. Vercel is certified under the EU-U.S. Data Privacy Framework and its UK Extension and acts as our processor under a data processing agreement.
4. WhatsApp
Our WhatsApp buttons open WhatsApp with a pre-filled message. No data is sent until you send the message yourself. WhatsApp is provided by WhatsApp Ireland Ltd. (EU/EEA users) or WhatsApp LLC (other regions). Data may be transferred to Meta Platforms Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. Messages are end-to-end encrypted. WhatsApp still processes metadata such as phone numbers and timestamps. You can also contact us by email instead. The pre-filled message contains a reference number (e.g. "Ref: P-ABC123") that only helps us match your request internally.
5. Email
Our mailbox is hosted by ALL-INKL.COM – Neue Medien Münnich, Friedersdorf, Germany (servers in Germany).
6. Sharing with BHT Clinic in Turkey
To assess and treat you, we share your information with BHT CLINIC İstanbul Tema Hastanesi (Bahat Sağlık Grubu), Atakent Mah. 4. Cadde No: 36, 34307 Küçükçekmece, İstanbul, Turkey. The clinic is an independent controller for your medical treatment and is bound by medical confidentiality and the Turkish Personal Data Protection Law No. 6698 (KVKK).
Please note: The European Commission has not recognized Turkey as providing an adequate level of data protection. This means your rights may be harder to enforce there and public authorities may have broader access to data. We therefore transfer your data only (a) because it is necessary for the treatment contract you requested (Art. 49(1)(b) and (c) GDPR) and (b) for health data, additionally on the basis of your explicit consent after being informed of these risks (Art. 49(1)(a) GDPR). We share only what is needed for your treatment.
7. Other recipients
Where required for your trip: the hotel in Istanbul, the transfer service and interpreter organized by the clinic, payment providers and our bank, and our tax advisor. We do not sell your personal data and we do not share it for advertising.
8. Cookies and local storage
We use no cookies and no third-party tracking or advertising tools. No content is loaded from third-party servers.
Vercel Web Analytics: To see how often our pages are visited, we use Vercel Inc.'s audience measurement. It sets no cookies and stores nothing in your browser. Page views are counted using a daily-changing anonymized value that cannot identify you (legitimate interest, Art. 6(1)(f) GDPR). In the same way, we count how often our WhatsApp buttons are clicked – without cookies and without identifying you.
Your browser's local storage keeps up to four values: bht_lang (your language), bht_currency (the currency you selected for prices), bht_ref_id (a random reference number for your WhatsApp request) and bht_lead_source (only if you arrived via an ad or partner link: the name of that channel). If you have not selected a currency, it is preselected from your device's time zone and language settings; this happens only in your browser and nothing is sent to us or third parties. These values only leave your browser if you send us a WhatsApp message yourself. You can delete them at any time in your browser settings.
9. How long we keep your data
- Enquiries without booking: deleted no later than 12 months after our last contact.
- Health data: deleted from our systems once forwarded to the clinic and no longer needed for organization, at the latest 6 months after aftercare ends, or immediately if you withdraw consent.
- Contract and billing records: as required by German commercial and tax law (generally 8–10 years).
- The clinic keeps medical records in line with Turkish law.
10. Your rights
You can ask us at any time for access to your data, correction, deletion, restriction of processing, data portability, and you can object to processing based on legitimate interests. You can withdraw consent at any time, with effect for the future. A short message by WhatsApp or email is enough. We respond within one month (within 30 or 45 days where local law provides).
You also have the right to complain to a supervisory authority. Our lead authority is the Data Protection Commissioner of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. You may also contact the authority in your country.
11. No automated decisions
We do not make automated decisions or create profiles about you.
12. Country-specific information
United Kingdom
You have the rights described above under the UK GDPR. You can complain to the Information Commissioner's Office (ico.org.uk).
Switzerland
You have the rights under the Swiss Federal Act on Data Protection (FADP). You can contact the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
Turkey
The clinic processes your data under KVKK. See our Turkish information notice (Aydınlatma Metni): /tr/kvkk.
United States – including Consumer Health Data Notice
This section applies to residents of U.S. states with privacy or consumer health data laws, including California, Washington, Nevada, Colorado, Connecticut, Virginia, Texas, Oregon and others.
- Categories collected: identifiers (name, phone, email), location (country/state), and consumer health data (treatment interest, photos, medical reports, health history) as described in Section 2.
- Sources: directly from you.
- Purposes: responding to your request, coordinating your treatment and travel, and meeting legal obligations. We do not use health data for advertising.
- Consent: We collect and share consumer health data only with your consent and only as needed to provide the service you requested. We share it with BHT Clinic (Turkey) and, where needed, the hotel, transfer service and interpreter.
- No sale, no targeted advertising: We do not sell personal data or consumer health data. We do not share it for cross-context behavioral advertising. We do not use geofencing.
- Your rights: Depending on your state, you can confirm whether we process your data and request access, a copy, correction or deletion. You can withdraw consent and opt out of sale or targeted advertising (which we do not do). You will not be discriminated against for exercising your rights.
- How to make a request: Email support@bht-clinic.com with the subject "U.S. Privacy Request". We will verify your identity and respond within 45 days. An authorized agent may make a request on your behalf with written permission.
- Appeals: If we deny your request, you can appeal by replying to our decision with the subject "Appeal". If you are not satisfied, you can contact your state Attorney General.
- HIPAA: We are not a HIPAA-covered entity. Your data is protected as described in this policy.
Canada
We handle your information in line with PIPEDA principles. You can request access or correction and withdraw consent by contacting us. You can also contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Saudi Arabia, United Arab Emirates, Qatar, Kuwait and other Gulf states
We process health data only with your explicit consent and transfer it to Turkey only to provide the service you requested. You can request access, correction, deletion and a copy of your data, and you can withdraw consent at any time.
Australia and other countries
You can contact us at support@bht-clinic.com with any privacy request. We will respond within 30 days.
13. Children
Our services are intended for adults. Patients under 18 can only be supported with the consent of a parent or legal guardian.
14. Changes and language
We will update this policy if our services or the law change, for example when operations move to our company in Turkey. This policy is also available in German, Turkish, Spanish, French, Arabic and Russian. For individuals in the EU, the German version prevails in case of discrepancies.