Privacy Policy

1. Who We Are

OFM Hospital ("we", "us", "our") is a Ministry of Health authorised private hospital located in Antalya, Türkiye. We operate the website ofmhospital.com and related landing pages to provide information about our medical services and facilitate health tourism enquiries from the United Kingdom and Europe.

Data Controller: Özel OFM Antalya Hastanesi
Yükseliş Mah. Mehmet Akif Cad. No:96, Kepez / Antalya / Türkiye
Email: info@ofmhospital.com

2. Data We Collect

We may collect the following categories of personal data:

• Identity Data: Full name, date of birth, gender.
• Contact Data: Email address, phone number, postal address.
• Health Data: Medical history, current conditions, BMI, medications, photographs you provide for assessment — collected only with your explicit consent.
• Technical Data: IP address, browser type, device information, pages visited, referral source.
• Communication Data: WhatsApp messages, emails, contact form submissions, and call records.

3. How We Use Your Data

We process your personal data for the following purposes:

• To respond to your medical enquiry and provide a personalised treatment plan.
• To schedule and manage consultations (online or in-person in the UK).
• To arrange travel, accommodation, and hospital admission logistics.
• To provide pre-operative and post-operative medical care.
• To comply with Turkish Ministry of Health regulations and health tourism requirements.
• To improve our website, services, and marketing effectiveness.

4. Legal Basis for Processing

We rely on the following legal bases under UK GDPR and Turkish KVKK (Law No. 6698):

• Consent: For health data processing, marketing communications, and cookie placement.
• Contractual necessity: To fulfil our obligations when you book a treatment.
• Legitimate interest: To improve services, respond to enquiries, and ensure security.
• Legal obligation: To comply with healthcare regulations in Türkiye and the UK.

5. International Data Transfers

As a hospital based in Türkiye serving UK and European patients, your data may be transferred to and processed in Türkiye. Türkiye has been granted a partial adequacy decision by the European Commission. We also implement appropriate safeguards including encryption, access controls, and data processing agreements to protect your information.

6. Data Sharing

We may share your personal data with:

• Our medical team (surgeons, anaesthetists, nurses) directly involved in your care.
• Transfer and accommodation partners for your travel arrangements.
• Turkish Ministry of Health as required by healthcare regulations.
• Technology providers (hosting, email, analytics) under data processing agreements.

We never sell your personal data to third parties.

7. Data Retention

Medical records are retained for a minimum of 20 years as required by Turkish healthcare regulations. Enquiry data is retained for up to 3 years from the date of last contact. Marketing consent records are retained for as long as you remain subscribed. Technical data (analytics, logs) is retained for up to 26 months.

8. Your Rights

Under UK GDPR and KVKK, you have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (subject to legal retention requirements).
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests or direct marketing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time without affecting prior processing.

To exercise any of these rights, contact us at info@ofmhospital.com. We will respond within 30 days.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including SSL/TLS encryption, access controls, regular security audits, and staff training. Our hospital holds ISO 9001:2015 certification covering our quality management processes.

10. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or the Turkish Personal Data Protection Authority (KVKK) at kvkk.gov.tr.

11. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.