Privacy Policy & Personal Data Protection

Last Modified: October 4, 2026

At Netrobit Software (“Netrobit”, “Company”, “We”), we attach the highest priority to the privacy, security, and confidentiality of personal data belonging to healthcare tourism agencies, hair transplant clinics, dental centers, plastic surgery practices, and healthcare facilities. This Privacy Policy and Personal Data Protection Notice, has been prepared by us as a Data Controller in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”) and the European Union General Data Protection Regulation (“GDPR”).

1. Data Controller Information

Your personal data is processed in full compliance with legal regulations by the data controller detailed below:

2. Which Personal Data Do We Process?

Through the Netrobit CRM cloud platform and our website, the following categories of data may be collected:

  • Identity Information: Full name, professional title.
  • Contact Information: Phone number, WhatsApp number, business email address, clinic location.
  • Patient & Lead Data: Inbound patient lead information submitted to Netrobit CRM via ad pixels or website forms, including country, language preference, and booking details.
  • Special Categories of Data (Health Data): Photos, treatment plan notes, and surgical consultation records (Hair transplant, plastic surgery, dental, bariatrics, etc.) uploaded by clinics. Such data is stored Data Processor strictly under the instructions of the respective clinic and with end-to-end encryption.
  • Financial & Billing Information: Tax ID, billing address, multi-currency deposit logs, and surgical package payment records.
  • Technical & Operational Logs: IP address, browser user-agent, session logs, API access keys, and hashed credentials.

3. Purposes of Data Processing

Your personal data is processed for the following purposes in accordance with KVKK Articles 5 & 6 and GDPR Article 6:

  1. Provisioning, licensing, and managing Netrobit CRM SaaS user accounts.
  2. Ensuring seamless integration with WhatsApp Business Cloud API, Google Ads, Meta Lead Ads, and virtual PBX systems.
  3. Responding to live demo requests and providing customer support.
  4. Facilitating clinic workflows, doctor consultation schedules, and international patient transfers.
  5. Maintaining platform infrastructure security and preventing unauthorized access or data breaches.
  6. Fulfilling statutory and regulatory compliance obligations.

4. Data Security & Infrastructure Safeguards

Netrobit enforces industry-leading cybersecurity measures to protect all hosted data:

  • 256-bit SSL/TLS Encryption: All client-to-server data transmissions are fully encrypted in transit.
  • Multi-Tenant Data Isolation: Each clinic's database records are logically isolated; no client can ever access another organization's records.
  • Role-Based Access Control (RBAC): Granular roles (Agent, Physician, Accountant, Super Admin) restrict sensitive data access with immutable audit logging.
  • Official Meta Cloud API: WhatsApp conversations stream directly through official Meta Cloud infrastructure via encrypted webhooks without unofficial scrapers.
  • Automated Backups & Web Application Firewall: Automated daily encrypted backups and DDoS-protected WAF layers are actively enforced.

5. Transfer of Personal Data

Your data is never sold or rented to third-party ad brokers. Data is only shared with essential infrastructure providers (cloud hosting, official WhatsApp API) and legally authorized regulatory bodies.

6. Data Subject Rights

Under KVKK and GDPR regulations, data subjects possess the following statutory rights:

  • Learn whether personal data is being processed,
  • Request information regarding processing details,
  • Verify the legitimate purpose of data processing,
  • Know third parties to whom data is transferred,
  • Request rectification of incomplete or inaccurate data,
  • Request erasure or anonymization of records under statutory conditions,
  • Demand notification of rectification or erasure to third-party recipients,
  • Object to automated profiling and seek statutory remedies.

7. Contact & Inquiries

To exercise your statutory rights or submit questions regarding this Privacy Policy, please contact our Data Protection Officer at [email protected] Requests will be reviewed and answered within 30 business days without fee.

Ask on WhatsApp Call Us