Data Protection Notice

For your data, the data controller is the clinic you are writing to. The clinic’s name and contact details are given at the top of the notice page in the link the clinic sent you.

Eren Kutay (trading as “MedoraLab”; address: Maslak Mah. Eski Büyükdere Cad. Giz 2000 Plaza No: 7 D: 34, 34485 Sarıyer/İstanbul; e-mail: info@medoralab.com) is the data processor, acting on behalf of the clinic and on its instructions.

MedorAI is used in four specialties only: aesthetic and plastic surgery, medical aesthetics, hair transplant and dentistry. The assistant does not engage for a specialty that is not on this list; a request outside the scope is not answered but handed to a person at the clinic.

The type of institution (single practice, clinic, oral and dental health centre, polyclinic, medical centre, aesthetics centre or hospital) does not change this scope. Institutions with several departments confirm on the record that they will use MedorAI only in these specialties.

Identity: your name (the name shown on your WhatsApp profile or the name you give in the conversation); when you book an appointment for someone else, the name of the person who will attend.

Contact: your phone number or your Instagram account ID. These come from the message itself and are not asked for separately. On Instagram, if you give your number yourself so that you can be called back, it is processed too.

Customer transaction: the appointment date and time, the visit type (first examination, check-up, treatment), your preferred doctor and branch, the language you write in, and whether you attended the appointment.

Message content: the text of the messages you write, until the conversation is closed. Content such as voice messages, photos and locations is not opened or stored; only its type is recorded.

Marketing: if you came from one of the clinic’s adverts, which advert you came from.

Information that may qualify as health data: the name of the treatment you request an appointment for, and any complaint you write of your own accord in a price or call-back request. The assistant does not ask about your medical history or the details of your complaint.

Turkish ID numbers, medical history, insurance details, date of birth and e-mail address are not requested, and there is no field in which to store them. An ID number you write of your own accord is masked before it is saved.

Your data is collected electronically and by automated means, through the messages you write to the clinic’s WhatsApp or Instagram account.

When the clinic connects its WhatsApp account, the messages of the last 24 hours before the connection are also brought into the conversation. For people who wrote earlier and received no reply, a waiting record containing no message text is created; it is deleted within 30 days at the latest.

Meeting your appointment request, answering your questions, creating, changing and reminding you of the appointment, and enabling your communication with the clinic: being directly related to the formation or performance of a contract (Article 5(2)(c) of the Law).

Information that may qualify as health data: processed on behalf of the clinic, which is under a duty of confidentiality, for the purpose of carrying out medical diagnosis, treatment and care services (Article 6(3) of the Law).

Recording the advertising source: the clinic’s legitimate interest, provided that it does not harm your fundamental rights and freedoms (Article 5(2)(f) of the Law). This information is reported to the clinic as totals, not per person.

Your explicit consent is not requested for this processing. Asking you before the treatment name is written into the appointment record is a data minimisation choice; it is not the legal ground for the processing. If you do not agree, “General examination” is recorded.

Your messages are answered by MedorAI, the clinic’s artificial intelligence assistant. The assistant does not diagnose and does not make treatment decisions; it creates appointments according to the times and rules set by the clinic. Clinic staff see every conversation and can take over at any moment.

If you believe that an assessment made solely by automated means has produced a result against you (for example, your appointment not being created), you can object to it. It is enough to write in the conversation that you would like to speak to a member of clinic staff.

Message contents are permanently deleted the moment the conversation is closed. A conversation that receives no new message for 24 hours closes automatically.

Appointment records are deleted 30 days after the appointment date. A name and phone record with no appointment left is deleted after 30 days.

To recognise you when you write again, your name, the treatment you are interested in, your preferred doctor and the language you write in are kept for 30 days; the text of your messages is not kept.

Price and call-back requests are deleted after 30 days, whether they have been answered or not. The advert click ID is kept encrypted for 90 days.

Long-lived records hold neither your phone number nor your name; your contact identity is stored only as an irreversible cryptographic digest.

MedoraLab staff cannot see the content of patient messages, patient names or phone numbers, even while investigating a fault: the panel has no button, setting or record that opens them to support staff. What can be seen is the mechanics: which channel a message came through and when, whether it was delivered, and the error code.

Your data is processed through the providers below, and only to the extent needed to deliver the service.

As some of the providers are established in the United States, your data may be transferred abroad under Article 9 of the Law. In this context, the standard contract process is being carried out with the sub-processors. The transfer is not based on explicit consent.

Before your message is sent to the artificial intelligence provider, your name is replaced with a placeholder and phone numbers, e-mail addresses and ID numbers are masked. Screenshots the clinic uploads for training purposes fall outside this masking; covering the personal details in an image before uploading it is the clinic’s responsibility.

Under Article 11 of the Law you have the following rights:

To learn whether your personal data is processed.

To request information about it if your personal data has been processed.

To learn the purpose of processing and whether your data is used in accordance with that purpose.

To know the third parties in Türkiye or abroad to whom your data is transferred.

To request its correction if it has been processed incompletely or inaccurately.

To request its erasure or destruction under the conditions in Article 7 of the Law.

To request that the correction, erasure and destruction be notified to the third parties to whom your data has been transferred.

To object to a result against you arising from analysis exclusively by automated systems.

To claim compensation for damage you suffer due to unlawful processing.

To exercise your rights, you apply to the clinic, which is the data controller: in writing, through a registered electronic mail (KEP) address, with a secure electronic signature or a mobile signature, or from the e-mail address you previously gave the clinic and that is registered in the clinic’s system. The clinic concludes your request free of charge within 30 days at the latest; MedoraLab provides the clinic with the information and tools it needs to do so.

You can also ask for your data to be deleted by writing “Please delete my data” to the account you are writing to; the request is handled even while the assistant is switched off. If you cannot reach the clinic, you can write to info@medoralab.com; your request is forwarded to the clinic.

If your application is rejected, you find the response inadequate or no response is given in time, you may lodge a complaint with the Personal Data Protection Board within 30 days of learning of the response and, in any event, within 60 days of the date of your application.