Data Protection Notice

For patient data the controller is the clinic using the service. Medoraist acts as a processor, on the clinic's behalf and on its instructions.

To create an appointment only three items are processed: the patient's name, the treatment requested and the appointment time. The phone number comes from the message the patient sent; it is never asked for separately.

National ID numbers, medical history, insurance details and comparable special-category data are never requested by the system, and there is no field in which they could be stored.

Personal data is processed to fulfil the appointment request the patient started, and to enable communication between clinic and patient.

Processing serves the delivery of a service at the patient's own request and rests on the controller's legitimate interest, provided it does not harm the fundamental rights and freedoms of the data subject.

Long-lived records hold neither the patient's phone number nor their name; the contact identity is stored only as an irreversible cryptographic digest.

Message bodies are deleted permanently the moment a conversation is closed. Conversations that receive no new message for 24 hours close automatically.

Appointment records are deleted 30 days after the appointment date.

Data is processed in line with KVKK, in secure data centres held to GDPR standards. To deliver the service, data may be transferred to artificial intelligence and WhatsApp messaging providers.

Under Article 11 of the Law you have the right to learn whether your personal data is being processed, to request information about it, and to ask for its correction or deletion.

To exercise these rights, please contact the clinic providing your care first. The clinic will contact Medoraist in order to meet your request.