Privacy Policy

1. Who we are

MedMatch Global Advisory (operating as Suleyman MedMatch Global Advisory) is an independent patient advisory service based in Toronto, Ontario, Canada. We are responsible for the personal information described in this policy.

We are not a hospital, clinic, or healthcare provider. We are not a health information custodian under Ontario's Personal Health Information Protection Act. We do not diagnose, treat, or give medical advice. Every clinical decision is made by licensed physicians at the hospitals you choose.

Contact for anything in this policy:

• Email — medmatchglobal@gmail.com
• WhatsApp — +1 437 595 1735
• Post — we are a small Toronto-based service without a public counter. If you need to write to us by post, email us and we will give you a postal address.

2. What we collect

When you request a quote

Our quote form asks for your full name, email address, phone or WhatsApp number, and the treatment you are interested in. There is an optional free-text box where you can tell us about your timeline, questions, or medical history.

Only the name, email and treatment fields are required. Please do not put more detail about your health in that box than you need to. A sentence about what you are considering is enough for us to help. You can always tell us more later, on a call, once you know who you are talking to.

When you book a call

Our booking page uses Google Calendar's appointment scheduler, embedded from Google. When you book, you give your details to Google directly and Google passes us the booking. Google's handling of that is covered by Google's privacy policy.

When you apply to become an advisor

Our advisor application form collects your name, email, and the information you enter about your background. This is separate from patient enquiries and is never mixed with them.

When you message us

If you email us, or message us on WhatsApp at +1 437 595 1735, we keep that correspondence so we can help you.

Many of these conversations now begin from an ad. Some of our Facebook and Instagram ads carry a "Send message" button that opens WhatsApp with us already in it instead of opening this website. If you arrive that way, Meta tells us which ad you tapped. It does not tell us your name or hand us your Facebook or Instagram profile — we see the phone number you message from, exactly as in any other WhatsApp chat.

People often describe their treatment, their existing quotes and their medical history in these chats. That is sensitive information and section 3 below applies to it in full. WhatsApp messages are carried by Meta under WhatsApp's privacy policy. If you would rather not use WhatsApp, email works just as well and reaches the same person.

When you use the photo preview tool

Automatically, when you visit

Standard web information: IP address, browser type, device type, pages viewed, and how you arrived. See section 6 on cookies and tracking.

On our enquiry pages we also count how far people get: that the page was opened, that a treatment was chosen, that someone reached the contact boxes, and whether sending worked. Each count carries a random number that lasts only until you close the tab, the treatment you tapped, and which advert brought you — so we can tell where a page is losing people. It never contains your name, your email, anything you typed, or anything that identifies you, and it is not shared with anyone.

3. Information about your health

4. Why we use it

We do not sell your personal information. We do not share it with data brokers. We do not upload patient enquiry data to advertising platforms to build audiences.

5. Who we share it with

Partner hospitals and clinics in Türkiye

This is the core of what we do. When you ask us to get you a quote or arrange treatment, we send the relevant details to the partner hospital. They need your name, contact details, and enough clinical context to give a real answer. We ask for your agreement before we send anything, and we tell you which hospital.

Once a hospital has your information, they hold it as an independent healthcare provider under Turkish law, including Türkiye's Personal Data Protection Law (KVKK). We are not able to delete information from their systems on your behalf, though we will pass on your request.

Service providers who run our tools

Otherwise

We disclose personal information only where the law requires it, or to establish or defend a legal claim. If our business is ever sold or transferred, information may transfer with it, and we will tell you first.

6. Cookies and tracking

We keep this deliberately small.

• Your language preference is stored in your browser so the site opens in the language you picked. Nothing is sent to us.
• Google Fonts load from Google's servers, which means Google sees your IP address when a page loads.
• The Meta Pixel — a small piece of Meta code that tells us how many people arrived from an ad and how many filled in the form.
• Microsoft Clarity — shows us where people click, how far down a page they read, and can replay the mouse movements, clicks and scrolling of a visit. We use it to find the places where this site is confusing, and for nothing else.

The Pixel reports actions like "someone viewed this page" or "someone submitted the form". It does not receive the contents of the form — not your name, not your email, not what you wrote about your health. We have configured it that way deliberately.

Ads that open a WhatsApp chat instead of this website. When you tap "Send message" on one of those ads, Meta reports back to our advertising account that that particular ad led to a conversation. That report is a count, not a transcript. It does not carry your name, your phone number, or a single word of what you go on to tell us. Nothing you say about your health is ever sent back to Meta, used to target further ads at you, or used to build an audience of people like you. We have never done that and this policy commits us not to start.

What a Clarity session replay does not contain. A replay is a reconstruction of a page, not a video of your screen, and we have deliberately cut the sensitive parts out of it. Anything typed into a box on this site — your name, your email address, your phone number, and everything you write about your health — is blanked out before it ever leaves your browser, and that cannot be switched back on from our side. We have separately blanked out the parts of the site that would otherwise show your medical information back to you on screen: the nine questions on the Before You Book page along with the answers you pick, the readiness answer you are given at the end, and the treatment you select on the Ask a question page. We do not record keystrokes, and we cannot see your screen.

How to switch this off. We honour Global Privacy Control and browser Do Not Track signals. If either is switched on in your browser, neither Clarity nor the Meta Pixel is loaded at all — not in a reduced form, not at all. Global Privacy Control is built into some browsers and available as an extension for others. We treat that signal as your decision and it needs no account, no form and no email to us.

We do not show a cookie banner. We would rather write plainly here, honour the signal your browser already sends, and keep what we collect small enough that a banner would be the least useful part of this page. If you would prefer we held nothing at all about your visit, switching on Global Privacy Control achieves exactly that.

7. Where your information goes

We are in Canada. Our service providers are mostly in the United States. Our partner hospitals are in Türkiye. Your information will be stored and processed outside Canada.

This matters: while your information is in another country, it is subject to that country's laws, and courts or authorities there may be able to access it under their own legal processes. Those protections are not identical to Canadian ones. We use contractual protections with our providers, but we want you to know this before you send us anything.

8. How long we keep it

You can ask us to delete your information sooner. See section 10.

9. How we protect it

Access to enquiry records is limited to the people who need it to help you. Our accounts use strong authentication. Our website is served over HTTPS. Partner hospital names and pricing sit behind a login rather than in public.

We will be straight with you: we are a small business, not a bank. No system is perfectly secure. If a breach ever occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada, as the law requires.

10. Your rights

Wherever you live, you can ask us to:

• Show you what personal information we hold about you
• Give you a copy in a portable format
• Correct anything that is wrong
• Delete it, unless we are legally required to keep it
• Stop using it, or withdraw a consent you gave earlier
• Stop contacting you — permanently, at any time

Email us and we will respond within 30 days. We will not charge you and we will not make the service worse because you asked.

If you are in Canada

These rights come from PIPEDA. If you are not satisfied with how we handle your request, you can complain to the Office of the Privacy Commissioner of Canada. We would rather you told us first, but it is your right either way.

If you are in the United States

Residents of California and other states with privacy laws have rights to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those laws define it, and we do not process it for cross-context behavioural advertising. The rights above are available to you regardless of your state.

11. Children

This website is for adults. We do not knowingly collect information from anyone under 18. If a minor may need treatment, a parent or guardian must contact us directly. If we learn we have collected a child's information without that, we delete it.

12. Changes

If we change this policy we will update the date at the top. If the change is significant — a new category of sharing, for example — we will tell people who have contacted us, by email.