Privacy and Cookie Policy
The protection of the privacy of users (“Data Subject”) of the website operated by Lotus Hospital and of the Private Lotus Hospital mobile app (Android/iOS) is one of our primary priorities.
Processing of Personal Data
Your personal data obtained while you use our website or our mobile app are processed by Private Lotus Hospital, in its capacity as data controller, within the scope of the Personal Data Protection Law No. 6698 (“KVKK”).
Your personal data are processed in accordance with the law and honesty rules, accurately and when necessary up-to-date, for specific, clear and legitimate purposes; connected, limited and proportionate to the purpose for which they are processed.
Purposes of Processing Personal Data
Your personal data obtained through your use of our website or our mobile app may be processed for the following purposes:
- Execution of website activities,
- Evaluation of user requests, questions and comments,
- Planning and development of service processes,
- Execution of marketing and communication activities,
- Fulfillment of legal obligations,
- Execution of information security processes.
Data processing activities are carried out in accordance with Articles 5 and 6 of the KVKK.
Transfer of Personal Data
Your collected personal data;
- To business partners and suppliers from whom we receive services,
- To legally authorized public institutions and organizations,
- To authorized private persons within the scope of legal obligation,
Can be transferred in accordance with the conditions specified in Articles 8 and 9 of the KVKK.
Transfer of Personal Data Abroad
The following services are provided through service providers whose servers are located abroad. Such transfers are made in accordance with Article 9 of the KVKK, on the condition that you have given explicit consent for the relevant service or that appropriate safeguards provided for in the Law (e.g. standard contractual clauses) are in place.
- Web analytics (Google Analytics, Google LLC): only if you consent to analytics cookies in the cookie notice; visit statistics, device/browser information and truncated IP address.
- Corporate e-mail and office infrastructure (Google Workspace): applications and correspondence you send by e-mail.
- Website live support assistant: if you additionally give explicit consent when starting a chat, your messages are transferred to an artificial intelligence service provider abroad to generate replies. If you do not consent, your messages are answered only by our staff and are not transferred to the AI service.
- WhatsApp (Meta Platforms): only if you choose this channel yourself to contact us; the message you send and your phone number.
- Hosting, infrastructure and information security service providers: technical data required for the website and services to operate.
You may withdraw your explicit consent at any time; withdrawal takes effect for processing after the date of withdrawal.
Method and Legal Reason for Collection of Personal Data
Your personal data;
- Website forms,
- The mobile app (account, appointments, results, live support and notifications),
- Communication channels,
- Cookies,
- Digital analysis tools
are collected through automatic or partially automatic methods.
Data processing activities are based on legal reasons of explicit consent, establishment/performance of the contract, fulfillment of legal obligations and legitimate interest of the data controller.
Rights of Data Subjects
As data subjects under Article 11 of the KVKK, you have the following rights:
- Learning whether your personal data is processed,
- Requesting information if processed,
- Learning the purpose of processing and whether it is used in accordance with its purpose,
- Knowing the third parties to whom it is transferred,
- Requesting correction of incomplete or incorrectly processed data,
- Requesting deletion or destruction if the reasons requiring processing disappear,
- Objecting to an adverse result through automatic systems,
- Requesting compensation for damage caused by unlawful processing.
You can submit your applications regarding your rights through the application channels (Data Subject Application Form) on our website or to bilgi@lotushastanesi.com address. Your requests will be finalized within 30 days at the latest.
Health Data and the Patient Portal
Services offered through our patient portal (registration, appointments, laboratory results) involve the processing of special categories of personal data, including your national ID number, contact details and health data. For detailed information on how this data is processed, please review the following document:
Account and Data Deletion Request
You may request the deletion of your patient portal account and the associated personal data. You can submit your request by e-mail to bilgi@lotushastanesi.com or via the Data Subject Application Form on our website. Requests are resolved within 30 days at the latest under applicable data protection law; data subject to a legal retention obligation is deleted at the end of the relevant period.
Mobile App
- For account, appointment, result and live support functions, the same data are processed for the same purposes as in the patient portal on our website.
- Session keys are stored in the secure storage of your device and are deleted when you sign out.
- If you allow notifications, a notification identifier specific to your device is created. Notifications are delivered via Expo, Google Firebase Cloud Messaging (Android) and Apple Push Notification Service (iOS); the servers of these service providers are located abroad. You can withdraw notification permission at any time in your device settings.
- If you enable the biometric lock (fingerprint/face recognition), verification is performed by your device’s operating system; your biometric data are not transmitted to the app or to our hospital.
- The app does not request camera, location or contacts access and contains no advertising or user-tracking tools.
- Taking screenshots is blocked on the test results screen to protect your data.
- You can request deletion of your account in the app via Profile > Delete My Account or at www.lotushastanesi.com/en/hesap-silme.
Cookie Policy
Our website uses cookies that are strictly necessary for the site to function, and analytics cookies that are activated only with your explicit consent. This section explains which cookies and similar browser storage technologies we use and why.
Cookies other than strictly necessary ones (e.g. analytics) are not activated unless you consent via "Accept All" or "Settings" in the cookie notice. Declining or choosing "Reject All" does not affect the core functions of the site. You can withdraw your consent at any time via the "Cookie Preferences" link at the bottom of the page.
What is a Cookie?
Cookies are small text files recorded on your device by the websites you visit through your browser.
Purposes of Using Cookies
- To ensure the technical operation of the website,
- To increase performance,
- To remember user preferences,
- To perform analytical measurement,
- To develop and personalize services.
Types of Cookies Used
- Strictly necessary cookies: Required for core functions such as security, language preference, remembering your cookie choice, online appointments and the patient portal session; used without consent under Art. 5(2) of the KVKK.
- Functional storage: Records stored in your browser to keep your live support chat session when you use the chat.
- Analytics cookies: Produce visit statistics (Google Analytics and first-party visit measurement). Active only with your explicit consent.
- Marketing cookies: Our website currently does not use advertising/marketing cookies.
Cookies and Browser Storage Used
| Name | Purpose | Duration | Provider | Type |
|---|---|---|---|---|
| kvkk-consent | Remembers your cookie choices (accept/reject) | 1 year | Lotus Hospital (first party) | Strictly necessary |
| NEXT_LOCALE | Remembers your selected language | Session | Lotus Hospital (first party) | Strictly necessary |
| csp-nonce | Page security (content security policy) | Session | Lotus Hospital (first party) | Strictly necessary |
| bimed_vid | Completing online appointment steps within the same session | 1 hour | Lotus Hospital (first party) | Strictly necessary |
| patient_token, patient_refresh_token | Patient portal session (only for signed-in users) | 4 hours / 7 days | Lotus Hospital (first party) | Strictly necessary |
| chat_session_id, chat_visitor_id, chat_locale (local storage) | Live support chat session and language (only if you use the chat) | Until you delete it | Lotus Hospital (first party) | Functional |
| dv:*, hc:* (session storage) | Prevents counting a doctor profile/announcement view twice in the same session (no personal data) | Until the tab is closed | Lotus Hospital (first party) | Functional |
| crm_visitor_id (local storage), crm_session_id (session storage) | First-party visit statistics | Until you delete it / until the tab is closed | Lotus Hospital (first party) | Analytics (with consent) |
| _ga | Google Analytics: distinguishing visitors | 2 years | Google (third party, abroad) | Analytics (with consent) |
| _ga_PDB6X3Z3V9 | Google Analytics: maintaining session state | 2 years | Google (third party, abroad) | Analytics (with consent) |
Cookie Management
You can change your consent preferences at any time via the "Cookie Preferences" link at the bottom of the page. You can also delete or block cookies in your browser settings; blocking strictly necessary cookies may prevent functions such as appointments and the patient portal from working.
Enforcement of the Policy
This Policy enters into force on the date of its publication. Private Lotus Hospital reserves the right to make changes to the Policy in cases where it deems necessary.
The current text will be valid from the date it is published at www.lotushastanesi.com address.