Privacy Policy | PatientPort

What's included

This policy covers two situations: (1) your visit to this website and your contact with us, and (2) clinics using the PatientPort platform.

Website

The site does not use advertising or marketing cookies. We use Google Analytics to see how many people visit and which pages they read; it only runs if you click "Accept" in the cookie notice (details: Cookie Policy). Fonts load from the site's own server. The demo form sends your details directly to our server and delivers them to our team by email; if that delivery fails, a draft opens in your email app as a backup.

Clinic and patient data on the platform

For the patient data that clinics enter into the platform, the clinic is the data controller. PatientPort processes this data only on behalf of the clinic and only to provide the service. We do not use it for any other purpose, sell it or share it for advertising.

Each clinic's data is kept separate at the database level (Row Level Security).
Staff see only the information their role allows; permissions are checked on the server.
Patients log in to the patient portal with their phone number and access code together, with a bot check.
Doctor notes and internal clinic information are never shown to the patient.
When technical errors in the app are logged, e-mail addresses, phone numbers and link data are removed; the app uses no advertising or analytics cookies.

Infrastructure

Data is stored on Supabase (PostgreSQL) infrastructure in the European Union (Frankfurt, Germany); server processing runs in Vercel's Frankfurt region. Some of our service providers are based in the US. The full list of providers and the legal basis for transfers abroad are in the Data Processing Agreement (Annex E).

Data processing agreement

Clinics conclude a data processing agreement compliant with KVKK Article 12 and GDPR Article 28, accepted electronically with a separate checkbox at sign-up: Data Processing Agreement. Patients give separate explicit consent for health data in the patient portal: Patient Privacy Notice.

Data ownership and deletion

Clinic data belongs to the clinic. When the subscription ends, the clinic can export its data within 30 days or request a bulk delivery in writing; after that period the data, including backups, is deleted or anonymised within 30 days at the latest.

Contact

For privacy questions: info@patientport.com.tr. All contracts and policies: Legal Documents.

Effective and last updated: 13 October 2026