PURE LINE CARE

Privacy & KVKK Disclosure Notice

Aydınlatma Metni · Last updated 25 July 2026

1. Who we are

This patient portal is operated by Pure Group Sağlık Turizm Ltd. Şti. ("we", "us", "Pure Line"), the data controller ("veri sorumlusu") for the personal data described below, under Turkey's Law on the Protection of Personal Data No. 6698 ("KVKK").

Registered company details Trade name: Pure Group Sağlık Turizmi Ticaret Limited Şirketi
Registered address: Zühtüpaşa Mah. Bağdat Cad. No: 19 İç Kapı No: 12, Kadıköy/İstanbul, Türkiye
Trade registry no: 397282-5
MERSİS no: 0733107881000001

2. What personal data we process

We only collect what your clinical team enters when setting up your portal, plus what you submit yourself (survey answers, consent/preference choices). We do not collect anything from third parties.

Category	Data
Identity	First name, last name, date of birth
Contact	Email address, country/timezone (used to time your reminder emails)
Account credentials	Username; password (stored as an irreversible cryptographic hash — we cannot read it back, even internally)
Treatment & health data	Procedure date, technique, duration, graft counts by area, prescribed medications and dosing schedule, first-wash date, surgeon's notes
Communication preferences	Whether you've agreed to recovery-reminder emails and when, whether you've paused/unsubscribed and when
Service records	Timestamps of which emails have been sent to you (welcome, review request, survey request)
Feedback (optional)	If you complete our experience survey: satisfaction ratings (pre-op communication, travel & hotel, doctor & planning, the operation team, and others shown on the form), how likely you are to recommend us, free-text comments, and how you found us

Your treatment and health data is a "special category" of personal data ("özel nitelikli kişisel veri") under KVKK Article 6.

3. Why we process it, and our legal basis under KVKK

To provide your treatment and the portal itself — your recovery plan, medication schedule, washing protocol and day-by-day guidance are built directly from this data. Your identity and contact data is processed under KVKK Article 5(2)(c) (necessary for the establishment or performance of the treatment agreement between you and the clinic). Your treatment and health data specifically is processed under KVKK Article 6(3)(e) — by clinical staff under a confidentiality obligation, for the purposes of medical diagnosis, treatment and care — which does not require separate explicit consent for this purpose.
To send you care-related emails — pre-operative preparation reminders, post-operative recovery milestones, your medication schedule becoming available, and (once a year) a birthday message. Unlike the treatment data above, this is a communication channel you can opt out of, so it is based on your explicit consent under KVKK Article 5(1), given the first time you sign in to your portal, and withdrawable at any time free of charge — see Section 6.
To ask for feedback — an experience survey and, separately, a request to leave a public review, sent only when a member of our team chooses to send them to you, and only if you choose to respond.

4. How we collect it

Your identity, contact and treatment data is entered by clinic staff when your account is created or your treatment plan is updated. Survey answers and your consent/preference choices are entered directly by you, in your own portal or via the links in our emails.

5. Who we share it with — including transfers outside Turkey

We do not sell or rent your data. It is processed by two service providers acting on our instructions ("veri işleyen"), each bound to process it only for the purpose stated and not for their own use:

Supabase — hosts our database and handles secure sign-in. Your data is stored on Supabase infrastructure located in the European Union (Ireland).
Resend — delivers the emails described in Section 3 on our behalf. Resend is based in the United States.

Both are a transfer of your personal data outside Turkey. Since 1 June 2024 (Law No. 7499), KVKK Article 9 requires one of, in order: (1) a Board ("Kurul") adequacy decision for the destination country — as of this notice, the Kurul has not yet issued an adequacy decision for any country; (2) an appropriate safeguard, most commonly the Kurul's own Standard Contract ("Veri Sorumlusundan Veri İşleyene Aktarım" standart sözleşmesi) signed with the recipient and notified to the Kurum within 5 business days of signing; or (3) one of the narrow, occasional-transfer exceptions in Article 9(6) (which explicit consent to the transfer itself can satisfy, but only for occasional, non-systematic transfers — not as the basis for an ongoing service like this one).

Action required Since our use of Supabase and Resend is routine and ongoing rather than occasional, Pure Group Sağlık Turizm Ltd. Şti. needs to execute the Kurul's Standard Contract with each of them (and notify the Kurum within 5 business days of signing) to have a durable Article 9 basis for these two transfers — this has not yet been confirmed as done and should be completed with KVKK counsel.

6. How long we keep it, and your consent for emails

Your portal data is kept for as long as your patient account exists, and for as long afterwards as applicable medical record-keeping or legal obligations require. You can ask us to delete your record at any time (Section 7).

Your consent to receive care-related emails is recorded the moment you agree to it in your portal, and you can withdraw it just as easily, at any time and free of charge:

the "Unsubscribe" link at the bottom of any email we send you, or
the "Pause emails" toggle on the Today page of your portal.

Withdrawing consent only stops the recovery-reminder emails — it does not delete your account or affect your treatment.

7. Your rights (KVKK Article 11)

You have the right to:

learn whether your personal data is being processed, and request information about it;
learn the purpose of processing and whether your data is used accordingly;
know the third parties, in Turkey or abroad, to whom your data is transferred;
request correction of incomplete or inaccurate data;
request deletion or destruction of your data, subject to legal retention requirements;
request that any correction or deletion also be communicated to the third parties your data was shared with;
object to a result that is to your detriment arising solely from automated analysis of your data;
claim compensation if you are harmed by unlawful processing of your data.

8. How to exercise these rights

WhatsApp: +90 544 575 55 90
Email: [email protected]

We will respond within the timeframes required by KVKK.

Back to Pure Line Care