Skip to content
SALUVIA
Legal

Privacy Policy

Last updated: July 30, 2026

This Privacy Policy explains how Saluvia ("Saluvia", "we", "us") collects, uses, and protects your personal data when you use our website and request information about treatment at our partner hospitals. We process your data in accordance with the EU General Data Protection Regulation (GDPR).

Saluvia provides healthcare facilitation and travel-guidance services only. We are not a medical provider and do not offer medical advice; all medical assessment and treatment come from the partner hospitals' own doctors.

1. Who we are (data controller)

Saluvia is the controller of your personal data.

2. What data we collect

When you submit the assessment form, we collect:

  • Full name
  • Email address
  • Phone number
  • Country of residence
  • Your treatment area of interest, your preferred hospital, and any details you choose to include in the message field
  • Any medical records you choose to upload (optional) — for example scans, test results, or reports
  • Your consent choice, with the date and time it was given

Your treatment area of interest, your preferred hospital, and any health details or records you choose to share may reveal information about your health. Under the GDPR this is a special category of personal data, which we only process on the basis of your explicit consent (see section 4). If you wish to share medical records, please use the secure upload field on the form rather than pasting detailed health information into the free-text message field; uploaded records are stored encrypted and shared only with the partner hospital handling your referral (see sections 5 and 8).

We also collect limited technical data (such as cookie preferences) as described in section 9. If you reach our enquiry form after clicking one of our adverts, we record the campaign details the advert added to the web address — together with the page you first arrived on and the site you came from — so we can tell which adverts lead to genuine enquiries. These details include a click identifier that the advertising provider can match back to your click. They are held only in your browser for the duration of your visit, are never used to track you across other websites, and are stored with your enquiry if you choose to submit one.

3. How we use your data

  • To respond to your request and coordinate your enquiry;
  • To prepare and send a referral to the appropriate partner hospital so their team can assess your request and prepare a treatment plan and cost estimate;
  • To communicate with you about your enquiry, in English or in the language you used;
  • To keep our own records of referrals we have made;
  • To comply with our legal and contractual obligations.

4. Legal basis for processing

We rely on your consent (GDPR Article 6(1)(a)) to process your contact details for the purposes above, and on your explicit consent (GDPR Article 9(2)(a)) to process any health-related information and to transfer it to a partner hospital. You may withdraw your consent at any time (see section 7); this does not affect processing carried out before withdrawal.

5. Who we share your data with

We share your data with:

  • The partner hospital you are referred to — American Hospital (Istanbul), Koç University Hospital (Istanbul), or Antalya Amerikan Hospital (Antalya), all part of the Koç Healthcare network — so their international patient team can respond to your request;
  • Service providers (processors) who help us run the service, each acting on our instructions under a data processing agreement:
    • Supabase — database and encrypted storage of your enquiry and any medical records you upload (hosted in the EU);
    • Google (Google Workspace / Gmail) — email delivery and our support inbox;
    • Anthropic — the AI language model used to help draft communications (see section 10);
    • Vercel — website hosting and privacy-friendly analytics;
    • PostHog — product analytics and session replay (hosted in the EU; see section 9).
    • Meta (Facebook/Instagram) — advertising measurement, only if you arrived via a Meta ad and only after you accept cookies (see section 9).

Some of these providers (Google, Anthropic, and Meta) are based in the United States. Where your data reaches them, the transfer is governed by a data processing agreement and Standard Contractual Clauses. We do not sell your personal data, and we do not share it for third-party marketing.

6. International transfers

To arrange your treatment, your data is transferred to a partner hospital in Turkey, which is outside the European Economic Area (EEA). We make this transfer on the basis of your explicit consent and, where applicable, appropriate safeguards. Details of the safeguards we rely on are available on request at info@saluviaglobal.com.

7. Your rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you;
  • Have inaccurate data corrected;
  • Have your data erased;
  • Restrict or object to our processing;
  • Receive your data in a portable format;
  • Withdraw your consent at any time;
  • Lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); in Belgium, the Gegevensbeschermingsautoriteit.

To exercise any of these rights, contact us at info@saluviaglobal.com.

8. How long we keep your data

We keep your data only as long as necessary for the purposes above and to meet our legal and contractual obligations, after which it is deleted or anonymised:

  • Medical records you upload are the most sensitive data we hold, so we keep them for the shortest time: if your enquiry does not proceed, they are deleted within 6 months of submission; once your referral has been forwarded to the hospital, we delete our copy within 30 days (the hospital then holds the clinical record).
  • Enquiries that do not proceed (contact details and enquiry information) are deleted or anonymised within 12 months of our last contact with you.
  • Enquiries that lead to treatment are kept for 7 years to meet Dutch legal record-keeping (bewaarplicht) and contractual obligations, after any medical records have been removed as above.

You can ask us to delete your data sooner at any time (see section 7), unless we are legally required to keep it.

9. Cookies & analytics

We use essential cookies to make the site work. With your consent, we also use analytics, advertising-measurement, and product-improvement tools to understand how the site is used — for example, which pages people view, how they move through the page, whether they start or complete the form, and whether an advertisement led you here:

  • Vercel Web Analytics — privacy-friendly, cookieless, aggregate usage statistics;
  • PostHog (hosted in the EU) — product analytics and session replay (anonymous heatmaps and recordings of page interactions) that help us improve usability. Replay masks all form inputs and does not record the form, so we never capture what you type, and we do not use it to identify you. Session replay runs only if you accept. Basic, anonymous usage counting — which page was viewed, which button was clicked, how far down a page was scrolled — runs from the moment the page loads, in a mode that sets no cookie and stores nothing at all on your device. We need it to know how many people our adverts actually bring to the site; it records no identifier, so it cannot recognise you across visits or link your activity to you. It never carries your name, contact details, treatment interest, or any health-related detail.
  • Google Ads conversion tracking (Google Ireland Ltd. / Google LLC) — measures whether clicking one of our advertisements led to a completed request, so we can tell whether our advertising works. It uses cookies and may transfer data to Google in the United States (see section 6). We record only that a form was submitted; we do not send Google your name, email, phone, treatment interest, or any health-related detail, and we do not enable Enhanced Conversions.
  • Meta Pixel (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) — measures whether clicking one of our advertisements on Facebook or Instagram led to a completed request, and helps us show our ads to people likely to be interested. It uses cookies and may transfer data to Meta in the United States (see section 6). We record page views and whether a form was submitted; we do not send Meta your name, email, phone, treatment interest, or any health-related detail, and we do not use Advanced Matching (hashed personal data).

Vercel Web Analytics, Google Ads conversion tracking, the Meta Pixel and PostHog session replay load only after you select "Accept" on the cookie banner; if you decline, they are not loaded. The one exception is the anonymous, storage-free usage counting described under PostHog above, which runs either way — because it places nothing on your device and holds no identifier for you, it does not require your consent. Vercel and PostHog act as our processors under an appropriate agreement; Google Ads conversion tracking and the Meta Pixel each involve a transfer to the United States under their respective data-processing terms and Standard Contractual Clauses.

10. Automated processing & AI-assisted communication

Saluvia uses AI-assisted tools to help process and respond to patient enquiries. When we receive an email from a patient, an AI language model provided by Anthropic(our processor, under a data processing agreement and Standard Contractual Clauses) may be used to draft an initial response or referral summary. Your input is not used to train Anthropic's models. All AI-drafted content is reviewed and approved by a human team member before it is sent to you or to a hospital. No fully automated decisions with significant consequences are made about your enquiry.

AI is never used to provide medical advice, clinical diagnosis, or treatment recommendations. All medical assessment is carried out exclusively by the doctors at our partner hospitals.

This processing is covered by the same legal bases described in section 4. You may contact us at info@saluviaglobal.com to request that your enquiry be handled without AI-assisted tools.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent version.

12. Contact us

For any question about this policy or your personal data, contact info@saluviaglobal.com.