Cuba Health Assist · Legal information

Information Notice on the Processing of Personal and Medical Data

Last updated: 1 November 2026

Purpose of this notice

In the course of its international healthcare coordination services, Cuba Health Assist may process personal data belonging to patients and applicants.

In addition to identity and contact details, this data may include special categories of health data such as diagnoses, treatment history, and pathology, laboratory and imaging reports.

This notice has been prepared to explain for what purposes and under what legal conditions your personal and medical data is processed, with whom it may be shared, and the rights you have in relation to it.

Important

The Data Processing Notice is not a separate declaration of explicit consent.

Filling in a form or sending medical documents is not, on its own, accepted as valid approval for operations that require explicit consent.

1. Data controller

Cuba Health Assist is a healthcare coordination brand operating within MYDN GROUP.

Depending on the nature of the relevant data processing activity, the responsible entity may be:

MYDN GROUP Sağlık Turizm Ticaret Limited Şirketi (Türkiye)
MYDN GROUP LLC (United States of America)

The data controller for your application, and the roles of any other companies, are determined according to their actual responsibilities in the relevant application and service relationship.

Contact: info@cubahealthassist.com

2. Data that may be processed

Depending on the nature of the service, the following information may be collected or processed.

Type of data	Scope
Identity details	First name, surname, date of birth, nationality and, where necessary, passport and identity details.
Contact details	E-mail address, phone number, country and city of residence, preferred language and communication preferences.
Health information	Diagnosis, medical history, current state of health, treatments, surgical history, medicines used, allergies, pathology reports, laboratory results, imaging reports, physician assessments and related clinical documents.
Application details	File number, application date, file status, services requested, missing documents, coordination notes.
Payment details	Transaction amount, payment method, payment outcome, bank transfer receipt and accounting records.
Technical details	Patient portal sessions, access and security logs, IP address and necessary technical identifiers.
Communication records	E-mail, WhatsApp, contact form, patient portal messages and conversations with Cubi.

Not all of this information is requested for every application. Data is processed to the extent necessary for the relevant service.

3. How the data is obtained

Personal data may be obtained:

From online application forms.
From documents uploaded to the patient portal.
From e-mail, WhatsApp and other communication channels.
From records sent by the patient or an authorised representative.
From assessments prepared by the relevant physicians and healthcare institutions.
From payment institutions and financial transaction records.
From security and session management systems.

Where a patient's data is shared by a third party, that person's authority and the applicable conditions for processing the data are assessed separately.

4. Purposes of processing

Your personal data may be processed for the following purposes:

Application and file management

Recording the application, creating the patient file, determining the necessary documents and following up the coordination process.

Preparation of medical documents

Organising health records, checking their legibility, translating the necessary documents and preparing the file for the relevant specialist physician.

Coordination of the specialist assessment

Communicating with the relevant specialist physicians, sharing documents securely, managing requests for additional information and communicating the outcome of the assessment.

Treatment and travel coordination

Where the patient requests the relevant service, planning hospital appointments, the treatment schedule, accommodation, transfers and other logistical processes.

Payments and legal records

Verifying payments, carrying out invoicing and accounting operations, and fulfilling legal obligations.

Communication with patients

Reporting missing documents, explaining the status of the file, sending the necessary reminders and responding to support requests.

System security

Preventing unauthorised access, protecting accounts, investigating technical issues and keeping the necessary security logs.

5. Legal grounds for processing

For the processing of identity, contact, payment and operational data, legal grounds such as the conclusion or performance of a contract, legal obligations, the establishment or protection of a right, or a legitimate interest that meets the relevant conditions may be relied on, in accordance with the applicable legislation.

Health data, however, is subject to stricter protection requirements.

As regards Türkiye, special categories of personal data may be processed if one of the conditions in Article 6 of KVKK is met.

Where GDPR applies, in addition to an appropriate legal basis under Article 6, one of the conditions in Article 9 permitting the processing of health data must also be met.

Where the relevant operation is based on explicit consent, the consent is obtained in relation to specific purposes, explicitly, on an informed basis and through a separate action.

Not every data processing activity is automatically based on explicit consent. Where another valid legal ground for processing exists, that ground may be relied on.

6. Special protection for health data

Your health information is used only for the coordination and assessment operations necessary given the nature of your application.

Access to medical documents is restricted to assigned staff and authorised healthcare professionals.

Health files are not used for advertising targeting or commercial marketing purposes.

Your medical information is not sold to third parties.

Where health data is processed during AI-supported preliminary checks or translation, these operations are also subject to an appropriate legal basis, the principle of data minimisation and the relevant security conditions.

Where the service requires it, personal data may be shared with the following groups of recipients:

The relevant specialist physicians and healthcare institutions in Cuba.
Authorised medical coordination and documentation teams.
Translators and document preparation staff providing the necessary service.
Cloud hosting, database, communication and artificial intelligence service providers.
Payment institutions and banks.
Booking and logistics providers connected with the travel services requested.
Public authorities and bodies with legal competence.

The scope of the information shared is determined according to the role of each recipient and the purpose of processing.

The complete health file is not automatically transferred to recipients who have no connection with the file.

Details of the service providers used are set out in the Privacy and Personal Data Protection notice.

8. International data transfers

Cuba Health Assist's service model may require the relevant health documents to be shared with specialist physicians in Cuba.

Because of technical infrastructure and communication services, personal data may also be processed in the USA or in other countries where the service providers used are located.

Transfers abroad are subject to the valid transfer conditions under the applicable data protection legislation.

For transfers from Türkiye, the adequacy decisions, appropriate safeguards and exceptional transfer mechanisms, subject to their conditions, set out in Article 9 of KVKK are taken into account.

For transfers under GDPR, the relevant adequacy decisions, appropriate safeguards or, in limited cases, the exceptional transfer conditions that may be used are assessed.

The transfer of the messages you send to Cubi to our AI service provider in the United States is based on the consent you give by writing to Cubi and continuing after the notice, and on appropriate safeguards in our contract with the provider.

Ticking a general consent box does not mean that it replaces the necessary transfer mechanisms.

Personal data protection rules may differ in the countries to which your data is transferred. You may request information about the legal basis of the relevant transfer and the necessary safeguards.

9. AI-supported operations

Cuba Health Assist may make use of artificial intelligence systems in certain document preparation and user communication processes.

These operations may cover:

A preliminary check of the legibility of documents.
The classification of the necessary document types.
The preparation of draft Spanish translations.
Answering general process questions, helping with the application and passing messages to the right team through Cubi · AI-powered Digital Patient Coordinator.

The use of artificial intelligence does not replace the independent clinical assessments of physicians.

Cubi does not diagnose, does not interpret medical documents or reports, does not give personal treatment recommendations and does not decide on medicines or doses. You can speak to a member of our team at any time.

When you write to a channel where Cubi is active, Cubi replies straight away. Just before its first reply on that channel, it sends a short notice, once only, with fixed wording that is not generated by AI: "Hi, I'm Cubi, Cuba Health Assist's AI-assisted assistant. Privacy: cubahealthassist.com/privacy-policy/" By writing to Cubi and continuing the conversation after this notice, you agree to your messages being processed through our AI service provider. If you do not want AI processing, you can write STOP, "I don't want Cubi" or "I don't want AI" on the same channel at any time, even in your first message, or e-mail info@cubahealthassist.com; from then on, your messages on that channel are not sent to the provider and our team answers your questions during working hours. People who declined our earlier consent message or withdrew their consent remain excluded from AI processing. Applying does not depend on using Cubi; your application proceeds in the same way.

On the channels where Cubi is active, your messages are processed by an AI service provider (United States) as a processor, on our instructions. Sensitive details such as card, identity and bank account numbers, and unnecessary direct identifiers, are masked before sending; medical content is not masked.

Conversations with Cubi are kept for 90 days and then deleted or anonymised; content formally added to your application file follows the file's retention period. For details, see section 7 of the Privacy and Personal Data Protection notice.

The data processing conditions of the providers used and the related transfers of personal data are subject to the applicable legislation and the relevant service configurations.

10. Retention of data

Your personal data is kept only for as long as necessary for the purposes for which it is processed and for the applicable legal obligations.

Incomplete applications, patient files, payment records, communication history and approval records may be subject to different retention conditions.

The closure of a file does not mean that all records are deleted at the same time.

The periods required for the legal retention of medical files and for possible legal claims are taken into account.

Data whose retention period has ended and which does not need to be kept on any other legal ground is deleted, destroyed or anonymised.

For more detailed retention information by category of data, please see the Privacy and Personal Data Protection notice.

11. Applications made by a patient's relative

A person applying on behalf of a patient must have the authority to share the relevant health data and to act on the patient's behalf.

Being a relative of the patient does not, on its own, give authority to give the patient's explicit consent.

Where necessary, the patient's direct approval or documents showing legal authority of representation may be requested.

For patients under 18, the conditions relating to parents or legal representatives apply.

If the authority cannot be verified, the assessment of the application may be suspended.

12. Your rights

Under the conditions laid down by the applicable legislation, you can:

Find out whether your personal data is being processed.
Request access to the data processed.
Ask for incomplete or inaccurate information to be corrected.
Request, where the necessary conditions are met, that the data be deleted or destroyed.
Withdraw your consent for operations based on explicit consent.
Object to processing or request that processing be restricted, in the cases recognised by the relevant legislation.
Request information about data sharing and international transfers.
Exercise your right to apply to the relevant supervisory authorities.

The scope and outcome of your request are determined according to the applicable legislation and any mandatory retention obligations.

13. Requests and contact

You can send your requests concerning your personal data to the following address:

info@cubahealthassist.com

Stating your request as clearly as possible and sharing your file number, if you have one, can make the process easier.

Where necessary, additional information may be requested to verify your identity or your authority of representation.

Requests are assessed in accordance with the procedures and time limits laid down in the relevant legislation.

This notice should be read together with the Privacy and Personal Data Protection, Medical Data Consent and Terms of Use texts.