Visitor Privacy Policy

This Policy covers ONLY the personal data of individuals who visit the NGS Advisory website. A patient's clinical data, NGS/genetic sequencing data, and artificial intelligence (AI) assessments fall outside the scope of this document and are governed by a separate, standalone document. In the event of a conflict, the separate patient document takes precedence with respect to patient/clinical/genetic data.

The data controller is İMSA Sağlık Hizmetleri; requests are received at [email protected].

Under this Policy, your personal data is processed by İMSA Sağlık Hizmetleri Sanayi ve Ticaret (Halkalı Tax Office 474 060 3681) as data controller, in accordance with applicable Turkish data protection legislation and, to the extent applicable, the EU General Data Protection Regulation ("GDPR").

For any questions, requests, or applications, our contact address is: [email protected]. This document does not publish a corporate mailing address; requests are received through the email address above.

Four matters fall outside this Policy; only the separate patient document applies to them.

This Policy covers ONLY personal data relating to individuals who visit our website. The following matters are OUTSIDE the scope of this Policy and are governed by a separate document, the "Patient and Genetic Data Notice and Explicit Consent Statement":

• Patients' clinical/medical data,
• NGS/genetic sequencing and variant data (special category health data),
• Assessment and reporting processes carried out using artificial intelligence (AI),
• Explicit consent statements relating to these processes.

Important technical notes

No patient account or membership is created through our website. Our website makes no calls to any artificial intelligence engine (such as Amazon Bedrock); AI assessments are carried out on a separate system outside the Site, solely within the scope of the relevant patient document / explicit consent.

For data of this nature, only that separate document applies: the Patient and Genetic Data Notice. In the event of a conflict, that separate document takes precedence with respect to patient/clinical/genetic data.

Three categories: form data, server/access logs, and cookie-based usage data.

The following visitor data may be collected during your visit to our website:

(a) Contact/Inquiry Form Data

Information you voluntarily provide to submit a preliminary request, such as your full name, email address, telephone number (if given), institution/company name (if given), and the content of your message/request.

(b) Server/Access Logs and IP

Technical connection information such as IP address, date/time of access, the page/URL requested, referrer, browser type and version, and operating system, which is automatically recorded when you access the site.

(c) Cookie-Based Site Usage Data

Data collected through cookies and similar technologies, such as pages visited, session information, and site preferences (see B.2).

Only strictly necessary technical cookies are used; there are currently no analytics cookies.

Our website uses cookies and similar technologies. We address cookies in two categories:

(1) Strictly necessary (technical) cookies

Required for the site's core functions, session management, and security (e.g., WAF/bot protection). These are used on the basis of our legitimate interest in providing the service and maintaining system security (applicable Turkish data protection legislation; GDPR Art. 6(1)(f)) and do not require consent.

(2) Optional (analytics) cookies

Because the analytics tool we use (Cloudflare Web Analytics) does not use cookies, our site currently uses no optional/analytics cookies whatsoever. If an optional cookie is used in the future, it will be placed only on the basis of the consent you provide through the cookie notice shown on your first visit (applicable Turkish data protection legislation; GDPR Art. 6(1)(a)), and you will be able to withdraw your consent at any time.

You may also manage or delete cookies through your browser settings; blocking strictly necessary cookies may limit some site functions. See the Cookie Policy for a detailed list of cookies and their durations.

A single, cookie-free analytics tool that does not fingerprint; Google Analytics is not used.

To measure visit trends and usage, our website uses only the Cloudflare Web Analytics tool; no other analytics tool (such as Google Analytics) is used.

Cloudflare Web Analytics is a privacy-conscious tool that does not use cookies:

• It does not place cookies to identify visitors and does not perform device fingerprinting,
• It does not track visitors across sites or build personal profiles,
• It generates only aggregate page-view and performance statistics.

Because this tool uses no cookies and collects no identified or identifiable personal data, its use does not require separate cookie consent.

No automated decision-making or profiling is carried out regarding visitors.

Our website does not carry out any decision-making (profiling) regarding visitors based solely on automated processing that produces legal effects concerning them or similarly significantly affects them.

Because the site does not track visitors, these signals do not require any additional action.

Browsers may send certain signals that automatically communicate your privacy preference to the sites you visit:

Do-Not-Track (DNT)

When enabled in your browser settings, this communicates to the sites you visit a preference that you "do not want my online activity tracked."

Global Privacy Control (GPC)

A newer browser/extension signal that works similarly, automatically communicating that you do not want your personal data sold/shared or that you do not want to be tracked.

There is not yet a common industry standard on how these signals should be interpreted. Because our website does not track visitors, does not use advertising/tracking cookies, and does not sell or share personal data (see C.1 and D.1), no additional action is currently required in response to these signals. In any case, you can manage your cookie and privacy preferences through your browser settings.

Five providers; none may use the data for its own purposes. Visitor data is not sent to AI.

In operating our website, we use the following service providers (sub-processors). These providers process personal data solely to provide services to us, in accordance with our instructions and under contractual confidentiality obligations; they may not use the data for their own purposes:

Cloudflare, Inc.

Content delivery network (CDN), DNS, and web application firewall (WAF) / bot protection. Technical data (such as IP address) is processed in this context.

Hosting provider

Hosting of the site's server infrastructure.

Mailjet (Sinch)

Transactional/operational email delivery (e.g., forwarding your form request to us or responding to your request). NOT used for marketing email delivery (see D.1).

PayTR

PayTR Ödeme ve Elektronik Para Hizmetleri A.Ş. · Payment services.

Artificial intelligence

Our website makes no direct calls to any artificial intelligence provider (such as Amazon Bedrock); accordingly, under this Policy your visitor data is not transferred to any AI/LLM provider.

Only technical data (e.g., IP) may be processed abroad, to a limited extent.

Some of our infrastructure providers (in particular Cloudflare, which provides CDN/security and cookie-free web analytics) may operate their servers or edge network nodes abroad. Accordingly, technical data generated during your visit (such as your IP address) may be processed abroad to a limited extent.

Such transfers are carried out with appropriate safeguards under applicable Turkish data protection legislation and GDPR Chapter V. The cross-border transfer of clinical/genetic patient data is not within the scope of this Policy; that matter is governed by the relevant separate patient document.

Form data for 1 year after the request is closed; access logs for 90 days.

We retain your visitor data only for as long as required by the purpose of processing, subject to the periods required under applicable legislation:

Contact/Inquiry Form Data

For as long as necessary to respond to your request and complete the relevant process; retained for 1 year after the request is closed.

Server/Access Logs and IP

90 days. In the event of a security incident (such as an attack or misuse), the relevant logs may be retained for as long as necessary.

Cookie Data

Depends on the type of cookie; session cookies are deleted when the browser is closed, and persistent cookies are retained for the period specified in the Cookie Policy.

At the end of the period, the data is deleted, destroyed, or anonymized.

TLS encryption, WAF/DDoS protection, the principle of least privilege, and regular review.

To protect your visitor data, we implement appropriate technical and administrative measures in accordance with applicable Turkish data protection legislation and GDPR Art. 32. These include:

• TLS/SSL encryption for data in transit,
• Cloudflare WAF / bot protection and DDoS prevention,
• Access to systems on a need-to-know (least-privilege) basis,
• Maintenance of access logs and regular review of security measures.

We remind you that no data transmission or storage over the internet is 100% secure; nevertheless, we are committed to taking reasonable and up-to-date measures to protect your data.

Legitimate interest, contract, legal obligation; explicit consent if you provide health information.

Your visitor data is processed for the following purposes and on the following legal bases:

• Receiving and responding to your contact/inquiry request: legitimate interest (applicable Turkish data protection legislation; GDPR Art. 6(1)(f)) and/or, where your request is based on a contractual relationship, the establishment/performance of a contract (GDPR Art. 6(1)(b)). Where you voluntarily provide health information in the form: explicit consent (applicable Turkish data protection legislation; GDPR Art. 9(2)(a)).
• Operation and security of the site and prevention of misuse (logs/IP, WAF): legitimate interest (applicable Turkish data protection legislation; GDPR Art. 6(1)(f)).
• Compliance with legal obligations: where required by law (applicable Turkish data protection legislation; GDPR Art. 6(1)(c)).
• Optional/analytics cookies: explicit consent (applicable Turkish data protection legislation; GDPR Art. 6(1)(a)).

We do not send marketing email; data is not sold or rented.

We do NOT send marketing or promotional email (commercial electronic communications) to visitors of our website. Data you submit through the contact/inquiry form is used solely to evaluate and respond to your request; it is not processed for marketing purposes and is not sold or rented to third parties.

Future marketing

If marketing communications are implemented in the future, they will be carried out only on the basis of your separate and explicit consent, and every communication will offer an easy opt-out.

[email protected]; no later than 30 days under Turkish legislation, generally one month under the GDPR.

Under applicable Turkish data protection legislation and the GDPR, you have the right to learn whether your personal data is being processed, to request information, to learn the purpose of processing, to request rectification/erasure/destruction, to object to processing, to withdraw your consent where processing is based on consent, and (under the GDPR) rights to data portability and to restriction of processing.

To exercise your rights, you may send your application to [email protected]. We will finalize your application within no later than 30 days under applicable Turkish data protection legislation, and generally within one month under the GDPR. We may need to verify your identity in order to evaluate your request.

You also retain the right to lodge a complaint with the competent data protection authority if your request is refused.

The current version is always published on this page, together with the last-updated date.

We may update this Policy from time to time. The current version is always published on this page and shown with a "last updated" date. Where material changes are made, a prominent notice will be provided on this page whenever possible. We recommend that you review this Policy regularly before continuing to use our site.