GDPR & your data

Scope

This page covers the General Data Protection Regulation (EU 2016/679) and, for visitors in Türkiye, the Personal Data Protection Law No. 6698 (KVKK). Where the two differ, we apply whichever gives you more.

The data controller is Üzeyir İsmail Bahtiyar, who operates ClinicPicker. For anything on this page, write to [email protected].

The Privacy Policy is the plain-language version. This page is the detail: the tables, the processors and the rights.

What we hold, and why

Nothing on this list is collected from someone who has not logged in, except the last row.

• Your account — the phone number you verified by SMS, the name you gave, and when you joined. Held because a review has to belong to somebody and because it is how you sign in. Legal basis: performance of a contract with you.
• Your reviews — the rating, the text, the language you wrote in, and the moderation status. Legal basis: your consent, given by pressing post; withdraw it by deleting the review.
• Clinic claims — your role, name, work email, phone and message, if you asked to claim a listing. Legal basis: performance of a contract, and our legitimate interest in checking that a claim is genuine.
• Clinics you opened while logged in — one row per clinic, with the time you last opened it. Held so we can show it back to you on your profile. Legal basis: legitimate interest in providing that feature; it stops the moment you log out, and deleting your account deletes it.
• Server logs — ordinary request logs including IP address, kept for security and debugging.

We do not hold health data. We never ask what you are being treated for, and we ask you not to put it in a review either.

Who else processes it

The full list, and when each one is contacted.

• Google — Firebase Authentication. Verifies your phone number by SMS. Your number and IP go to Google. Contacted only when you open the login dialog. Transfers to the United States.
• Google — reCAPTCHA. Loaded by Firebase as part of the same login step to stop automated abuse. Sets a _GRECAPTCHA cookie. Not loaded on any page until you open the login dialog.
• Google — Cloud Translation. Used when you press "Translate" on a review. The review text is sent; you are not — the call is made by our server, so Google does not receive your IP address.
• CARTO and OpenStreetMap. Map tiles. Your IP address reaches CARTO whenever a page with a map is rendered.
• Google — image hosting. Clinic photographs and the avatars on Google reviews are served from Google's servers, so loading a clinic page reveals your IP to Google. We set referrerpolicy="no-referrer" on those images so the page you are on is not sent with the request.
• Google — AdSense. Supplies the adverts on the site. Loaded on every page, but it places nothing in your browser until you have answered the consent notice and said yes. What it receives is what your browser sends: the page you are on, your IP address, your device. Transfers to the United States.
• Google — Tag Manager. A container that loads whatever measurement tags are configured for the site. The container is on every page; what it carries is set outside this website's code.
• Our own infrastructure. The database and the site run on servers we control at clinicpicker.com and api.clinicpicker.com.

Advertising is the only thing on this list that exists to make money rather than to make a feature work, and it is the entire reason the site asks you anything. Everything else is either necessary for something you did, or — as with the maps and the clinic photographs — the cost of showing you what you came to see.

There is no data broker here. Nothing you have given us is sold or handed on: the number you verified, your reviews and your account stay inside the platform. That is a different question from what your browser tells an advertising network while you read, and the paragraph above is the answer to that one.

Fonts are served from our own domain rather than Google's, specifically so that reading a page does not disclose your IP address to a third party before you have done anything.

What is stored in your browser

Two lists, and the difference between them is the point. The first is set without asking, because all of it is either necessary for something you did or put there by you. The second is advertising, and none of it exists unless you have said yes.

• clinicpicker:contact (localStorage) — that you are logged in, plus the name and number you gave, so the gate does not ask again on every clinic. Cleared when you log out.
• cp:tr:… (sessionStorage) — translations of reviews you have already asked to translate, so pressing the button twice does not cost a second call. Gone when the tab closes.
• Firebase auth session (IndexedDB) — keeps you signed in between visits. Removed when you log out.
• _GRECAPTCHA (cookie, google.com) — set by reCAPTCHA, only after you have opened the login dialog.

Only once you have agreed to advertising cookies:

• __gads and __gpi (cookies, clinicpicker.com) — set by AdSense to choose which adverts you see, to stop you seeing the same one repeatedly, and to count them.
• Google advertising cookies on doubleclick.net and google.com, used for the same purposes across the sites that carry Google's adverts.
• Your answer to the consent notice itself, stored by Google's consent tool so you are not asked again on every page.

Say no and the adverts still appear — Google serves them without any of the above. You can reopen the notice and change your answer whenever you like.

How long we keep it

Your account and everything attached to it is kept while the account exists. Delete the account and it goes: reviews, claims and viewing history are removed with it, which is enforced by the database rather than by us remembering to do it.

A published review is the one thing worth thinking about before you ask. It is attached to your account, so deleting the account removes it — including reviews other patients may have found useful.

Server logs are kept for a short operational period and then discarded.

Your rights

Under the GDPR (Articles 15–22) and KVKK (Article 11) you can ask us to:

• Show you what we hold — a copy of your data, in a portable format.
• Correct it — you can change your name yourself on your profile, and edit your own reviews there too.
• Delete it — your account and everything attached to it.
• Restrict or object to processing — including our legitimate-interest basis for keeping your viewing history.
• Withdraw consent — at any time, without affecting what was lawful before you did.

Some of this you can do without asking: your profile lets you change your name, edit your reviews and log out. For the rest, write to [email protected]. We answer within 30 days, and there is no charge.

If you are not satisfied, you can complain to a supervisory authority: in Türkiye the Personal Data Protection Authority (KVKK Kurumu), and in the EU the authority for the country you live in.

Automated decisions

There are none. Nothing on this site profiles you, scores you or decides anything about you automatically. Clinic rankings are computed from ratings and review counts belonging to the clinics, not from anything about you.