Global Medical AG (“GMC”, “we”, “us”) respects your privacy. This policy explains what personal data we collect, why, how we use it, and your rights. It covers visitors to our websites and people who enquire about or use our facilitation services. The English version prevails over any translation.

GMC is a facilitator: we arrange and coordinate treatment with independent clinics and doctors. We are not a clinic and do not provide medical treatment, diagnosis, or advice.

This policy reflects the Swiss Federal Act on Data Protection (FADP), as applicable.

1. Who we are and how to contact us

Controller: Global Medical AG, Dorfstrasse 49, 8037 Zurich, Switzerland.

Data protection contact: [email protected].

2. The data we collect

Depending on how you interact with us, we may collect:

• Identity and contact data: name, age, phone number, email.
• Enquiry data: the treatment you are interested in and the information you choose to provide.
• Health data (sensitive / special-category data): medical history, existing conditions, treatment goals, height and weight, and photographs of your body or head, where relevant to the treatment you are exploring.
• Technical data: IP address, browser and device information, and how you use our site (via cookies — see our Cookie Policy).

You do not have to provide your data, but without the data needed to arrange treatment, we cannot provide the service.

3. Why we use it, and our lawful basis

You can withdraw any consent at any time by emailing [email protected]. Withdrawal does not affect processing already carried out and may mean we can no longer arrange your treatment.

4. Sharing your data, and sending it abroad

To arrange your treatment, we share the necessary data with the independent clinic(s) and doctor(s) in Türkiye selected for your case, so they can assess your suitability and treat you. The clinic network is arranged through a partner organisation that determines which clinic and what information apply to your case; that organisation does not itself receive your data.

Where we review your photographs with a treating doctor, we do so by screen-sharing during a secure video call wherever possible, so that a copy is not transmitted to the doctor.

Türkiye is outside Switzerland, and does not have an equivalent data-protection “adequacy” status. We make this transfer on the basis of your explicit consent, and we also rely on data-protection safeguards applied across the clinic network. This means your data may not be protected to the same legal standard, and you may have more limited rights or remedies than at home.

We also use trusted service providers who process data on our behalf under data processing agreements (for example our CRM and communication tools). We do not sell or rent your personal data. We may disclose data where required by law, to protect rights or safety, or in connection with a sale of our business.

5. How we protect your data

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption, restricted access, and keeping health data in controlled systems rather than consumer messaging. No transmission or storage is ever completely secure, but we take reasonable steps to protect your data.

6. How long we keep it

We keep personal data only as long as necessary for the purpose for which it was collected:

• enquiries that do not proceed to a service: a shorter period, then deletion;
• client case data: retained for the period necessary to provide the service and to meet our legal and accounting obligations;
• longer where the law, a regulatory obligation, or legal proceedings require us to retain it.

After the applicable period, data is securely deleted.

7. Your rights

Depending on your location, you have the right to: access your data; correct it; delete it; restrict or object to processing; data portability; and to withdraw consent at any time. You can exercise these by emailing [email protected]; we will respond within the time required by law.

You also have the right to complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC). We also operate our own complaints process — contact us first and we will acknowledge and respond.

8. Cookies

We use cookies and similar technologies. Strictly necessary cookies are always on. Non-essential cookies (including analytics and advertising) are used only with your consent, which you give or refuse through our cookie banner and can change at any time. See our Cookie Policy for details.

9. Children

Our services are for adults aged 18 and over. We do not knowingly process the data of children.

10. Changes

We may update this policy and will post changes on this page with a revised date.

Last updated: 1.2.26.