Privacy policy

GrandClinicReviews (clinicgrandreview.com) is published and operated by Grand Clinic, Istanbul. Grand Clinic decides why and how personal information is used on this site. We are not an independent review body; our Editorial policy explains how submissions are handled.

This policy covers this site only. It does not cover information you give the clinic outside this site, for example when you contact the clinic or become a patient.

We collect only what is listed here.

• Browsing. You can read the site without an account. Our web server records your IP address, the date and time, the page requested (without any search or query text), the response status and your browser's user-agent text. We use these records to keep the site secure and to find faults.
• Sign-in. If you choose Continue with Google, we receive your name, your email address (which Google must have verified) and a unique Google account identifier.
• What you send us. Your star rating and review; how your name should be shown (for example a first name and initial); the phone number and country you enter so the team can contact you about your submission; and, if you choose to add them, a longer story with a title, treatment and country, up to four photos, and a video you record or upload.
• Your choices. When you confirm that you have read how your information is handled, agree to publication, or opt in to news and offers, we record that choice and when you made it.
• A hashed IP address. For rate limiting and with each submission, the database holds a one-way hash of your IP address rather than the address itself. It helps us stop abuse and repeated submissions.

Reviews, photos and videos can reveal information about your health, treatment or appearance. Share only what you are comfortable with, and do not include information about other people.

Sign-in uses Google's OpenID Connect with the openid, email and profile scopes. Google tells us who you are; we never see your Google password.

• We keep your name, verified email address and Google account identifier so that what you send is linked to you and you can follow its status on your account page.
• We do not keep your Google profile picture. We do not request or access your contacts, files, calendar, location or any other Google data.
• Signing in with Google confirms that a real person is writing. It does not mark you as a verified patient.

We use Google user data only to identify the author of a submission and to contact them about it. We do not sell it, use it for advertising, or transfer it to other parties except as set out in this policy. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can stop this site's access at any time in the security settings of your Google Account. If you do, you will need to sign in again to send a review.

• To let you sign in and follow the status of what you have sent.
• To read every submission before anything is published, and to publish what you have agreed to.
• To contact you about your submission.
• To send news and offers, only if you ticked the optional box.
• To keep the site secure, prevent abuse and fix faults.
• To answer your requests and meet legal obligations.

A person reads every submission. We do not use your information for advertising, and we do not make decisions about you by automated profiling.

Where the law requires a legal ground, we rely on your consent (for publishing your content and for optional news and offers), our legitimate interest in running and securing the site, and legal obligations.

• Nothing is published without your consent. A review appears only after a person has read it, and only with the name style you agreed to.
• Your email address and phone number are never published.
• Photos and videos you send stay private until your review is published. If you agreed on the form, they are then published together with it, in one decision. We can take the review, with its photos and video, off the site at any time, and you can ask us to.
• Once published, content can be read, copied or shared by anyone and may be indexed by search engines. We can remove it from this site on request, but we cannot recall copies made by others.

• Grand Clinic's team. Staff with an account in the site's management area can see submissions and contact details. Roles limit what each account can do.
• Google, when you sign in.
• Our hosting provider, which supplies the server the site runs on and handles data on our behalf as part of providing that infrastructure.
• WhatsApp and YouTube. The WhatsApp link opens WhatsApp only if you use it. A story page can include an embedded YouTube video (in YouTube's privacy-enhanced mode); viewing such a page contacts YouTube. Both services then handle your data under their own policies.
• Authorities or professional advisers, where the law requires it or to protect our rights.

We do not sell personal information.

Account and submission data are stored in a database on the server that runs the site, and uploaded files are kept on that server's disk.

• Connections to the site use HTTPS.
• Photos and videos you send are not publicly accessible. They are shown to the public only if they are published.
• Staff passwords are stored in hashed form, staff sessions use secure, HTTP-only cookies that expire after eight hours, and repeated failed sign-in attempts are temporarily blocked.
• The database and uploaded files are backed up daily on the server. Each backup is kept for 14 days.

No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If a breach affecting your information occurs, we will act as the law requires.

• Account details and submissions. We do not delete these automatically. We keep them for as long as they are needed for the purposes in this policy, or until you ask us to remove them.
• Web server access records are kept for about 14 days, and application logs for up to 30 days.
• When we remove content or delete your details, copies in the daily backups remain until those backups expire, within 14 days.
• We keep a short record that a request was received and how it was handled.

You can ask us to tell you what we hold about you, to correct it, to remove a review, story, photo or video, to delete your account details, or to stop contacting you with news and offers. You can withdraw your consent to publication at any time.

To make a request, contact us using the details below. A member of the team records and handles each request, and we may ask you to confirm who you are, usually by signing in with the same Google account. We aim to respond within the time the law requires. You can follow the status of what you have sent on your account page.

Some information may have to be kept where the law requires it. If you are unhappy with how we handle your information, you can complain to the data protection authority in your country.

We use only what is needed to run the site. We do not use advertising or analytics cookies, and we do not load advertising or analytics scripts.

• gcr_patient_flow keeps the Google sign-in secure while you move between this site and Google. It lasts up to 10 minutes.
• gcr_patient keeps you signed in after Google sign-in so you can send a review and see your submissions. It lasts up to 7 days, or until you sign out.
• gcr_session is used only by staff signing in to the management area. It lasts up to 8 hours.
• Session storage in your browser, cleared when you close the tab, remembers that the opening animation has played and keeps a draft of an unsent review so a refresh does not lose it. Nothing in it is sent to us until you submit.

This site is intended for adults. We do not knowingly collect information from anyone under 18. If you believe a child has sent us information, contact us and we will remove it.

We may update this policy. When we do, we change the date at the top of this page, and we will say so here if a change is significant.

For questions or requests about your information, contact Grand Clinic, Istanbul, through the contact options in the footer of this page.