Privacy Policy

&NewMe (andnewme.com) is operated by Yeniben Elektronik Hizmetler ve Ticaret A.Ş. ("&NewMe", "we", "us"), Esentepe Mah. Büyükdere Cd. Ecza Sk. Pol Center C Blok No:4 İç Kapı No:1 Ofis No: C10 (Galata Business Center), 34394 Şişli, Istanbul, Türkiye. Tax No. 9480462809 (Zincirlikuyu Tax Office), Trade Registry No. 20583-5, MERSIS No. 0948046280900011; TÜRSAB A-group travel agency licence No. 16021; International Health Tourism Authorization Certificate No. AK-0945 (verifiable at healthturkiye.gov.tr/tr/agency - search for "Yeniben", as the directory lists the legal entity name).

We are the data controller for the personal data described in this policy. This means we decide why and how your data is used on andnewme.com and in our own communications with you, under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where they apply to you, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the New Zealand Privacy Act 2020 and the Australian Privacy Act 1988. This policy is our privacy notice under Article 10 of KVKK (aydınlatma metni).

&NewMe is a marketplace. We list independent hospitals, clinics, surgeons and agencies ("Providers"), help you compare them and introduce you to the ones you choose. We do not provide medical treatment. Each Provider is a separate, independent data controller for the data it receives from you or from us, including your medical records, and handles it under its own privacy notice (see section 6).

Contact for all privacy questions: info@andnewme.com · +90 212 909 57 45 · the postal address above (please mark it "Data protection").

This policy applies when you visit andnewme.com, fill in a form, chat with us (website chat, WhatsApp, email, phone, social media), ask us for quotes or an introduction to a Provider, leave a review, or receive our messages. It also covers cookies (section 12).

It does not cover what a Provider does with your data after you contact it or after we introduce you, or the websites of Providers and other third parties we link to. Please read the Provider's own privacy notice and the consent documents it gives you.

Using our website does not mean you "consent" to everything in this policy. Where we need your consent (for example to share health information with a Provider, for WhatsApp group chats, marketing or non-essential cookies) we ask for it separately, and you can withdraw it at any time.

• Identity and contact data: name, age or date of birth, gender, nationality, email, phone / WhatsApp number, country and city, preferred language.
• Health data (special category / sensitive data): the treatment you are interested in, height, weight and BMI, medical history, conditions, medications, questionnaire answers and photos you send so that Providers can assess you and prepare a quote. We only collect this when you choose to share it.
• Enquiry and travel preferences: preferred dates, budget, Providers you are comparing, whether you plan to travel with a companion.
• Communications: messages, call notes and emails with our team, including in group chats you choose to join, and your reviews or feedback.
• Payment data (only if you pay through our payment pages, where we collect on behalf of the Provider as its payment collection agent; if you pay the Provider or an agency directly, they handle your payment data): amount, currency, payment status and billing details. Card details are entered on the payment provider's secure page (iyzico or İş Bankası İşPOS); we do not see or store full card numbers.
• Technical and usage data: IP address, device and browser type, pages visited, the ad or link that brought you to us (UTM / click IDs), collected through cookies and similar tools (section 12). Under Turkish Law No. 5651 we keep certain traffic data as a hosting provider.

We collect your data directly from you (web forms, WhatsApp, email, phone), from advertising platforms (for example a Meta lead form you filled in), from a companion or family member who contacts us for you, and from a Provider you have been introduced to (for example to confirm that a quote was sent). If you give us someone else's data, please make sure they know.

We may sort enquiries internally (for example by treatment and readiness) so our team can reply to the most urgent ones first. A person reviews every enquiry, and we do not make decisions about you based solely on automated processing.

Health data is a special category of personal data. We only use it to help you find suitable Providers and to pass it to the Providers you choose, so they can assess you and prepare a quote. Before we share any health information with a Provider, we ask for your consent - in our enquiry form, or in writing on WhatsApp or email - and tell you which Provider(s) will receive it.

Once a Provider receives your data, it decides how to use it for your assessment and treatment and is responsible for it as an independent data controller. Providers usually ask you to sign their own consent forms before treatment.

You can withdraw your consent at any time by emailing info@andnewme.com. Withdrawal does not affect sharing that already happened, and it does not withdraw consent you gave directly to a Provider - please contact the Provider for that. We never use your health data for advertising targeting or send it to analytics or advertising tools, and we never publish your photos, story or review without your separate permission.

• Providers you choose (hospitals, clinics, surgeons and agencies listed on andnewme.com), to assess you, send you a quote and, if you book, treat or look after you. They are independent data controllers.
• Service providers (processors) who work for us under contract: HubSpot (CRM, forms, website chat, email), Meta / WhatsApp Business (messaging), Google Workspace (email, documents), Google Analytics and Google Tag Manager (analytics), Hotjar (website behaviour analytics, only after consent), Meta (advertising measurement), iyzico and İş Bankası İşPOS (payments made through our pages), Paraşüt (invoicing and accounting), and IT and hosting providers.
• Authorities when the law requires, for example the Ministry of Health (HealthTürkiye) for reporting required of licensed intermediaries, tax authorities, or courts and prosecutors that formally request data (such as a court order). We do not disclose reviewers' or enquirers' identities to Providers, their lawyers or other private parties without your consent.
• Professional advisers (legal, tax, accounting, audit), where necessary.
• A buyer or successor if our business is reorganised or sold, under the same protections.

We do not sell or rent your personal data, and we do not share it with third parties for their own marketing without your separate, explicit consent.

We are based in Türkiye, and most Providers are too. Your data is transferred abroad when, for example, we communicate with you at an address outside Türkiye or a service provider processes data outside Türkiye: our CRM (HubSpot) stores data in the EU, Google and Meta process data in the EU and the USA, and WhatsApp messages (including group chats) may be processed outside Türkiye.

We make these transfers only as KVKK Article 9 allows - to countries with an adequacy decision, under appropriate safeguards such as the KVKK Board's standard contract, or, where required, with your explicit consent - and, where the GDPR or UK GDPR applies, under adequacy decisions, standard contractual clauses or because the transfer is necessary for the service you asked for. Joining a WhatsApp group chat is optional and needs your separate consent; please do not post other people's health information in these groups. You can ask us for a copy of the relevant safeguards.

• Enquiries that do not lead to a booking: up to 3 years after our last contact, then deleted or anonymised.
• Records of introductions and bookings, invoices and payment records: for as long as Turkish commercial, tax and health tourism law requires (generally 10 years from the end of the year of the transaction).
• Traffic data under Law No. 5651: for the period that law requires.
• Reviews: while they are published, or until you ask us to remove them.
• Marketing: until you unsubscribe or withdraw consent; we keep a suppression record so we do not contact you again.
• Cookies: for the periods shown in the cookie banner (section 12).

When the retention period ends we delete, destroy or anonymise the data in line with our retention and destruction policy.

We use technical and organisational measures to protect your data against unauthorised access, loss, misuse or alteration, including encrypted connections, access limited to staff who need it, two-factor authentication on our main systems, confidentiality obligations for staff and contracts with our service providers. Our agreements with Providers require them to keep patient information confidential and to follow data protection law. No system is completely secure; if a breach is likely to put you at risk we will tell you and the relevant authority as the law requires.

Under Article 11 of KVKK, and depending on where you live also under the GDPR, UK GDPR, NZ or Australian privacy law, you have the right to:

• learn whether we process your personal data, and request information about how it is processed (and get a copy);
• learn the purpose of processing and whether it is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom your data is transferred (including which Providers received it);
• ask us to correct incomplete or inaccurate data;
• ask us to delete or destroy your data (unless we must keep it by law);
• ask us to notify any correction, deletion or destruction to the third parties who received your data;
• object to a result against you that arises solely from automated analysis of your data;
• claim compensation for damage caused by unlawful processing;
• restrict or object to our processing, including objecting to direct marketing at any time, and receive your data in a portable format (GDPR / UK GDPR);
• withdraw consent at any time.

To use your rights, email info@andnewme.com or write to our address in section 1. We may ask you to confirm your identity. We reply free of charge within the time KVKK requires (at the latest 30 days; under the GDPR one month, extendable where the law allows). For data held by a Provider, please also contact the Provider; we will help you reach it.

Please contact us first, and we will try to resolve your concern. You also have the right to complain to a data protection authority:

• Türkiye: Personal Data Protection Authority (KVKK Board), kvkk.gov.tr, after first applying to us;
• United Kingdom: Information Commissioner's Office (ICO), ico.org.uk;
• Ireland: Data Protection Commission, dataprotection.ie; other EU/EEA countries: your local supervisory authority;
• New Zealand: Office of the Privacy Commissioner, privacy.org.nz;
• Australia: Office of the Australian Information Commissioner (OAIC), oaic.gov.au.

Cookies are small files stored on your device. We use:

• Strictly necessary: to run the site securely and remember your cookie choice (for example HubSpot's consent cookie). Always on.
• Analytics: Google Analytics 4, HubSpot analytics and Hotjar, to understand how visitors use the site and improve it.
• Advertising: the Meta pixel (and Meta Conversions API), to measure whether our ads lead to enquiries.
• Functional: website chat and embedded content such as YouTube videos (privacy-enhanced mode).

Your choice: in the EU, EEA, UK and Switzerland, non-essential cookies are off until you accept them in our banner. In other countries they are on by default and you can switch them off in the banner. You can change your choice at any time with the "Cookie settings" button below, and you can also block or delete cookies in your browser settings. Some features may not work without cookies.

Google Analytics data is kept for 14 months. The cookie banner lists each cookie and its lifetime.

We send newsletters and offers only with your consent (or where the law allows us to contact people who have used our service). Every email has an unsubscribe link, and you can reply "STOP" on WhatsApp or email us at any time. Messages about an enquiry or introduction you asked for are service messages, not marketing.

Our services are for adults (18+). We do not knowingly collect data from children. If a treatment is for someone under 18, a parent or legal guardian must contact us and give consent on their behalf, where the Provider accepts it.

Our site links to other websites (for example Providers, review platforms, payment pages). We are not responsible for their privacy practices; please read their policies.

We may update this policy when our services, tools or the law change. The "Last updated" date at the top shows the latest version. If a change is significant we will tell you by email or on the website before it applies.

Previous version: effective 10 January 2025.