Privacy Policy

1. Introduction

HSM Health Institute, operated by HSM İleri Görüntüleme ve Tanı Merkezi A.Ş. (Turkey) and HSM Global Inc. (United States), is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, how long we retain it, and what rights you have.

This policy applies to all users of our website at www.hsmhealthinstitute.com and to all individuals who contact us through our booking forms, WhatsApp, telephone, or any other communication channel.

2. Who We Are

HSM Global Inc. operates solely as a patient coordination and appointment liaison office in the United States. No clinical services or payment processing occur in the United States. All medical services are provided exclusively in Istanbul, Turkey by HSM İleri Görüntüleme ve Tanı Merkezi A.Ş.

3. What Personal Data We Collect

3.1 Data You Provide Directly

When you complete our contact or appointment request form, contact us via WhatsApp or telephone, or communicate with us by email, we may collect:

• Full name
• Email address
• Telephone number
• Country of residence
• Nature of your health inquiry or the service you are interested in
• Preferred appointment date and time

We do not collect sensitive health or medical record data through our website forms. Any clinical data arising from your treatment is handled separately under applicable health data regulations.

3.2 Data Collected Automatically

When you visit our website, the following data may be collected automatically through cookies and analytics tools:

• IP address
• Browser type and version
• Pages visited and time spent
• Referring website
• Device type

Please refer to our Cookie Policy for full details on how we use cookies and your options.

4. How We Use Your Personal Data

We use the personal data you provide for the following purposes:

• To respond to your inquiry and arrange your appointment
• To provide you with information about our services
• To communicate with you before, during, and after your appointment
• To improve our website and services based on usage analytics
• To comply with our legal obligations under Turkish law and, where applicable, California law

We do not use your personal data for automated decision-making or profiling. We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Your consent, where you have provided it (e.g., by submitting a contact form)
• Performance of a contract or pre-contractual steps at your request (e.g., booking coordination)
• Our legitimate interests in operating and improving our services
• Compliance with legal obligations applicable to us under Turkish law (KVKK) and US law (CCPA/CPRA)

6. Data Retention

We retain personal data collected through our website contact and appointment request forms for a maximum period of 2 years from the date of collection. Data is deleted as soon as it is no longer necessary for the purposes for which it was collected, and in any event no later than 2 years.

Clinical health records, if applicable, are retained in accordance with the Turkish Ministry of Health regulations, which require a minimum retention period of 10 years.

7. Data Sharing & Third Parties

We share personal data only with:

• Our internal staff who require access to respond to your inquiry or coordinate your appointment
• Google LLC (Google Analytics 4) — for website usage analytics. Google Analytics is configured with IP anonymization enabled.
• Meta Platforms Inc. (Facebook Pixel) — for website analytics and marketing performance measurement
• CookieYes Limited — for cookie consent management

All third-party service providers are contractually required to handle your data in compliance with applicable privacy law. We do not transfer your personal data to countries outside Turkey without appropriate safeguards in place.

8. Your Rights

Depending on your country of residence, you may have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data
• Right to restriction — request that we restrict processing of your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on our legitimate interests

To exercise any of these rights, please contact us at info@hsmhealthinstitute.com. We will respond to your request within 30 days.

9. California Residents — CCPA / CPRA Rights

If you are a resident of California, you have the following additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know

You have the right to request that we disclose what personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties with whom we share it.

Right to Delete

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.

Right to Correct

You have the right to request correction of inaccurate personal information we maintain about you.

Right to Opt Out of Sale or Sharing

HSM Health Institute does not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising. You have the right to opt out of any such sale or sharing, should it ever occur.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive a different level of service or price as a result of exercising your rights.

How to Submit a California Privacy Request

California residents may submit privacy requests by:

• Email: info@hsmhealthinstitute.com — subject line: “California Privacy Request”
• US Phone / WhatsApp: +1 949 406 1705

We will verify your identity before processing your request and will respond within 45 days as required by CCPA/CPRA.

10. Security

We take reasonable and appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration. Our website uses HTTPS encryption. Access to personal data is restricted to authorized staff only.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated policy on this page with a revised effective date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or the way we handle your personal data, please contact us: