Privacy Policy (Personal Data Policy)

VIMFAY International Health Services Tourism Industry and Trade Inc. (“VIMFAY”, the “Company”, “we”) acts as the data controller and is committed to protecting your personal data. This Privacy Notice explains how we process your personal data and special-category health data in the context of our marketing, promotional and informational activities — in particular the use of patient stories, testimonials, before-and-after images and similar content. It supplements our general Privacy Notice and is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”). It also reflects Directive 2011/24/EU on patients' rights in cross-border healthcare and rules on medical confidentiality.

1. Identity of the Controller

Data Controller	VIMFAY International Health Services Tourism Industry and Trade Inc. (VİMFAY Uluslararası Sağlık Hizmetleri Turizm Sanayi ve Ticaret A.Ş.)
Registered Address	İlkbahar Mah. Galip Erdem Cad. 617 Sokak No: 4/A, Çankaya/Ankara, Türkiye
Operations Address	Beştepe Mah. Dumlupınar Blv. No: 6/1, Interior Unit No: 22, Yenimahalle / Ankara, Türkiye (Armada Business Centre, Floor 14)
E-mail	info@vimfay.com
Telephone	+90 312 963 1400
Website	www.vimfay.com
Data Protection Officer	Av. Hilal Küreci · dpo@vimfay.com
Health-Tourism Authorisation	[International Health Tourism Authorisation Certificate No.]

The Company is established in Türkiye. As we offer services to patients located in the EU/EEA, the GDPR applies to this processing under Art. 3(2). We have designated (or will designate) an EU Representative under Art. 27 GDPR, whose details appear above.

2. Personal Data, Purposes and Lawful Bases

In the context of marketing and promotional activities, we may process the following categories of data:

Category	Examples	Purpose	Lawful Basis (GDPR)
Identity	Name, initials, age, nationality/country	Personalising the testimonial/story	Consent — Art. 6(1)(a)
Contact	E-mail, phone	Obtaining consent, verifying content, consent management	Consent — Art. 6(1)(a); legitimate interests — Art. 6(1)(f)
Health (special category)	Treatment/procedure type, treatment history, outcome	Testimonial, success story, informational content	Explicit consent — Art. 9(2)(a)
Image / Audio	Before-after photos, treatment footage, video, voice	Promotional material, social media / website	Explicit consent — Art. 9(2)(a)
Customer Interaction	Review, satisfaction/feedback text	Reference, promotion, demonstrating service quality	Consent — Art. 6(1)(a)

Health data and images linked to health are special-category data under Art. 9 GDPR and are processed for marketing purposes only on the basis of your explicit consent. Refusing or withdrawing consent does not affect the healthcare or intermediary services you receive.

3. Principles and Limits of Our Promotional Activities

We conduct marketing and informational activities in line with the GDPR principles in Art. 5 (lawfulness, fairness, transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality) and the following safeguards:

• Promotional content is not false, misleading, exaggerated, scientifically unproven or contrary to professional ethics.
• Health-related information is prepared by, or under the supervision of, qualified healthcare professionals.
• Patient stories and images are used only where patient confidentiality is respected, patients' rights are observed and documented consent has been obtained.
• Information published on our website (services, travel and partner-institution details) is kept up to date, with the date of last update indicated.

4. Recipients and Disclosure of Personal Data

Based on your consent, your data may be disclosed to the following recipients for the purposes described:

• Social media platforms and digital advertising/publishing service providers (e.g. Meta, Google/YouTube, LinkedIn, X, TikTok);
• Marketing, design, translation, production and agency partners and suppliers;
• Hosting, cloud and IT service providers;
• Competent public authorities, solely where required by a legal obligation.

4.1. International Transfers

Because promotional content is published to an international audience in foreign languages, your data may be transferred to recipients located outside your country of residence, including outside the EU/EEA (for example via social media and IT providers). We make such transfers under Chapter V GDPR, relying on an adequacy decision, appropriate safeguards (e.g. Standard Contractual Clauses) where available, or — where applicable — your explicit consent to the transfer under Art. 49(1)(a). You may request information about the safeguards in place and how to obtain a copy of them.

5. How We Collect Your Data

We collect your personal data in physical and/or electronic form — through in-person meetings, forms, e-mail, messaging applications, our website and social media channels, and during the treatment/service process. For marketing processing, the lawful basis is, as a rule, your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

6. Retention Period

• Data processed for marketing purposes are retained for as long as your consent remains valid or for as long as the relevant content remains published.
• If you withdraw your consent, the data will no longer be processed for the future and the relevant content will be removed from channels under our control as soon as technically possible; data we are required by law to keep will be retained for the applicable statutory period.

7. Your Rights as a Data Subject

Under the GDPR you have the right to: be informed about and obtain access to your personal data (Art. 15); request rectification (Art. 16); request erasure / 'right to be forgotten' (Art. 17); request restriction of processing (Art. 18); data portability (Art. 20); object to processing (Art. 21); and withdraw your consent at any time without affecting the lawfulness of prior processing (Art. 7(3)). Where decisions are based solely on automated processing, you have rights under Art. 22.

You also have the right to lodge a complaint with a data protection supervisory authority — in particular the authority in your EU Member State of residence, place of work or place of the alleged infringement (Art. 77 GDPR).

To exercise your rights, contact us in writing at our registered address, by e-mail at info@vimfay.com, or via our EU Representative. We will respond without undue delay and in any event within one month of receipt of the request (extendable by two further months for complex requests), free of charge save for the limited exceptions permitted by Art. 12 GDPR.

8. Acknowledgement and Consent

I have read and understood this Privacy Notice. I have been informed about how my personal data and special-category health data will be processed for marketing, promotional and informational purposes within the scope, purposes and limits described above.

I give my explicit consent to the processing of my special-category health data and health-related images for marketing/promotional purposes and to their international transfer within the scope I have approved. I consent.

Full Name	Date	Signature
__________________________	____ / ____ / 20____	__________________________