Data Protection Notice

This Notice explains how we process the special category data involved in a molecular second opinion. In the event of a conflict with the Privacy Policy regarding patient/clinical/genetic data, this Notice takes precedence.

The data controller is İMSA Sağlık Hizmetleri; requests to [email protected].

Your data is processed by İMSA Sağlık Hizmetleri Sanayi ve Ticaret (Halkalı Tax Office 474 060 3681) as data controller, in accordance with applicable Turkish data protection legislation and, to the extent applicable, the GDPR. For any questions or to exercise your rights, contact [email protected].

Applies when you submit a report for a second opinion; does not replace physician or laboratory consents.

This Notice applies when you submit a molecular (NGS) report and related clinical information for second-opinion evaluation. It covers the clinical, genetic, and artificial intelligence assessment data described below. It does not replace the consent forms or information you have received from your treating physician or your testing laboratory.

Four categories; clinical and molecular data are special category health data.

Identity and contact data

The name and contact details of the person submitting the case and, where provided, the referring physician.

Clinical data (special category)

Diagnosis, tumor type and stage, prior treatments, and other medical information necessary to interpret the report.

Molecular / genetic data (special category)

The NGS / molecular report itself, variants, biomarkers, and related sequencing results.

Assessment data

The structured analysis and second-opinion report generated for your case.

Special category data is processed solely on the basis of your explicit consent.

We process this data to prepare and deliver the molecular second-opinion consultation you have requested, to communicate with you and any physician you designate, and to keep records required by law.

• Special category (health/genetic) data: processed solely on the basis of your explicit consent (applicable Turkish data protection legislation; GDPR Art. 9(2)(a)).
• Performance of the service: the establishment and performance of our consultation relationship (GDPR Art. 6(1)(b)).
• Legal obligations: record-keeping and other obligations required by law (GDPR Art. 6(1)(c)).

Our analysis is AI-assisted and physician-led. Large language models running on AWS Bedrock (EU / Frankfurt region) help structure and analyze the case, and every report is reviewed, corrected, and signed off by a physician before delivery. Artificial intelligence is a support tool; it does not make the clinical decision.

Not used for model training

Your clinical and genetic data is processed solely to produce your report. It is not used to train foundation models and is not shared for any AI provider's own purposes.

Shared only to the extent necessary; data is not sold or shared for marketing.

We share your data only to the extent necessary to deliver the consultation: with the physician reviewing your case, with any physician you designate, and with carefully selected sub-processors who process data solely under our instructions and confidentiality obligations (such as secure cloud infrastructure and the AI platform described above). We do not sell your data and do not share it for marketing purposes.

Processing takes place in the EU (Frankfurt) region; special category data is transferred only under explicit consent.

Our artificial intelligence processing runs in the EU (Frankfurt) region. Where any processing involves a cross-border transfer, it is carried out with appropriate safeguards under applicable Turkish data protection legislation and GDPR Chapter V, and special category data is transferred only within the scope of your explicit consent.

For as long as the purpose and legal requirements dictate; if consent is withdrawn, processing stops and data is deleted.

We retain your clinical, genetic, and assessment data only for as long as necessary for the purposes above and for the periods required by applicable law; it is then deleted, destroyed, or anonymized. If you withdraw your consent, we will stop processing and delete the data, unless we are required by law to retain certain records.

Encryption in transit, the principle of least privilege, and secure processing environments.

To protect special category data, we implement appropriate technical and administrative measures, including encryption in transit, access on a least-privilege basis, and processing within the secure environments described above. No method of transmission or storage is entirely secure, but we take reasonable and up-to-date measures appropriate to the sensitivity of the data.

Access, rectification, erasure, objection, portability, and withdrawal of consent.

You have the right to learn whether your data is being processed, to request information and access, to request rectification, erasure, or destruction, to object to processing or request its restriction, to data portability where applicable, and to withdraw your explicit consent at any time — without affecting the lawfulness of processing carried out before the withdrawal. To exercise any right, contact [email protected]. You may also lodge a complaint with the competent data protection authority.

The consent given on the case-submission form covers the processing described in this Notice.

Where you have given explicit consent (for example, on the case-submission form), you confirm that you have read and understood this Notice and that you give your explicit consent to the processing of your special category clinical and molecular (NGS) / genetic data for the purposes described above, including AI-assisted assessment in the EU (Frankfurt) region and the limited cross-border transfers described in B.4.

Withdrawing consent

You may withdraw your explicit consent at any time by writing to the contact address above; upon withdrawal, we will stop processing and delete your special category data, unless retention is required by law.