Privacy and Personal Data Protection
- Last updated
- 1 November 2026
- Scope
- The cubahealthassist.com website, the patient portal, online application forms, Cubi · AI-powered Digital Patient Coordinator, WhatsApp, Instagram, Messenger and other communication channels.
About this notice
At Cuba Health Assist, we care about the privacy of your personal data and, in particular, of your health information.
This Privacy and Personal Data Protection Notice has been prepared to explain the purposes for which we collect your personal data, how we process it, with whom we may share it, how long we keep it and the rights you have over your data.
This notice has been prepared taking into account, to the extent applicable, the provisions of Türkiye's Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).
Cuba Health Assist is not a hospital, clinic, doctor or direct provider of treatment. It provides a healthcare coordination service and, where needed, may help coordinate travel and other operational services. Medical assessments, diagnoses and treatment decisions are made solely by the relevant authorised physicians and healthcare institutions.
In short: how do we use your data?
We collect only the information that is necessary.
We process the personal data needed to assess your application, deliver your medical documents to the relevant specialist physicians, provide our coordination service and communicate with you.
We give your health data special protection.
We process your health information within the applicable legal requirements and, where necessary, on the basis of your explicit consent. We restrict access to this information to authorised persons.
Your data may be transferred abroad.
To carry out the medical assessment process, the necessary documents are shared with specialist physicians in Cuba. In addition, some of the technical service providers we use operate in other countries.
We do not collect your card details directly.
Card payments are carried out through the secure payment infrastructure of the relevant payment institution. Your card number and security code are not stored in Cuba Health Assist systems.
We do not sell your data.
We do not sell your personal data to third parties for commercial purposes or transfer your application details to marketing lists.
You have rights over your data.
Under the conditions laid down by the applicable legislation, you can access your data, ask for incorrect information to be corrected or, where the conditions are met, deleted, and withdraw any explicit consent you have given.
Contact: info@cubahealthassist.com
1. Who is the data controller?
Cuba Health Assist is an international healthcare coordination brand operating within MYDN GROUP.
The company responsible for processing personal data, depending on the country where the applicant lives and the relevant service relationship, is set out below.
Applicants living in Türkiye
MYDN GROUP Sağlık Turizm Ticaret Limited Şirketi
Address: Yeniköy, Köybaşı Caddesi No:72, 34464 Sarıyer / İstanbul, Türkiye
E-mail: info@cubahealthassist.com
Phone: +90 533 950 89 96
Applicants living in other countries
MYDN GROUP LLC
Country: United States of America
Contact address: 28 W Flagler Street, Suite 300B, #474, Miami, FL 33130, USA
E-mail: info@cubahealthassist.com
Phone: +53 636 971 53
The two companies may make use of shared operational teams and technical systems in delivering the services. Responsibilities relating to personal data are determined according to the role of the relevant company in the data processing activity and the applicable legislation.
In this notice, the terms "we", "us" and "Cuba Health Assist" refer to the responsible entity that processes your personal data in connection with the relevant service, or to the authorised team acting on its behalf.
2. What personal data do we process?
The following categories of data may be processed in the application, health assessment, travel coordination, payment and communication processes.
Not all of these categories are collected for every application. The amount of data processed varies according to the nature of the service requested.
| Data category | Information that may be processed | Source of data |
|---|---|---|
| Applicant details | First name, surname, e-mail address, phone number, country, city, relationship to the patient, preferred language | Applicant |
| Patient identity details | First name, surname, date of birth, sex, nationality, country and city of residence, passport or identity details where necessary | Patient or authorised applicant |
| Health data | Diagnosis, date of diagnosis, medical history, current state of health, allergies, surgical history, treatments received, pathology results, imaging and laboratory reports, clinical photographs | Patient, authorised applicant and relevant physicians |
| Approval and consent records | Approvals given, first name and surname entered at the time of approval, approval date, text version, IP address and browser information; for the record that the Cubi notice was sent and of any objection to AI processing, a pseudonymous identifier, the channel, the date and time, the version of the notice text and, where applicable, the date of the objection | Application, approval and messaging systems |
| Payment and billing details | Payment method, transaction amount, payment status, receipt and transaction details provided by the payment institution | Applicant, banks and payment institutions |
| Communication records | E-mails, contact forms, WhatsApp conversations, Instagram and Facebook messages, conversations with Cubi | The person who initiates the communication |
| Travel details | Passenger identity details, passport details, travel dates and booking details required for coordinating treatment or travel | Patient or authorised applicant |
| Account and security data | Portal login details, login attempts, IP address, browser and session information, security logs | Automatically by the system |
| Website usage data | Pages visited, language preferences, cookie identifiers, interactions and certain button clicks | Website and analytics systems |
Your personal data may be obtained directly from you, from persons authorised to act on your behalf, from the relevant healthcare professionals or from the systems used to deliver the service.
The full number and security code of your payment card are not directly collected or stored by Cuba Health Assist.
3. For what purposes and on what legal bases do we process your personal data?
We process your personal data for specified, explicit and legitimate purposes, and only to the extent those purposes require.
The legal basis for a processing activity may vary according to the type of data, the data subject, the service requested and the applicable legislation.
| Purpose of processing | Legal basis considered under KVKK | Legal basis considered under GDPR |
|---|---|---|
| Receiving your application, creating the patient file and managing the application process | Conclusion or performance of a contract (Art. 5(2)(c)) | Contract or pre-contractual steps (Art. 6(1)(b)) |
| Checking your medical documents, preparing the necessary translations and delivering them to the relevant physicians | Explicit consent for health data, or other applicable conditions for processing special categories of data (Art. 6) | An appropriate legal basis under Art. 6 and the conditions under Art. 9 for health data |
| Communicating the physician's assessment, presenting treatment options and preparing a pro forma | Performance of a contract (Art. 5(2)(c)); for health data, the conditions under Art. 6 | Contract (Art. 6(1)(b)); for health data, the conditions under Art. 9 |
| Verifying payments, issuing receipts and invoices, keeping accounting records | Performance of a contract (Art. 5(2)(c)) and legal obligation (Art. 5(2)(ç)) | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Keeping you informed about your application by e-mail and WhatsApp | Performance of a contract; explicit consent for optional communications that require consent | Contract or, where appropriate, consent (Art. 6(1)(b) and (a)) |
| Helping to coordinate visas, flights, accommodation, transfers and healthcare institution appointments | Conclusion or performance of a contract (Art. 5(2)(c)) | Contract (Art. 6(1)(b)) |
| Our team answering questions sent through contact forms, WhatsApp and social media messages | Pre-contractual steps or legitimate interest (Art. 5(2)(c) and (f)) | Pre-contractual steps or legitimate interest (Art. 6(1)(b) and (f)) |
| Processing the messages you send to Cubi, including any health information they contain, through our AI service provider in order to answer your questions | Consent you give by writing to Cubi and continuing after the notice (Art. 6); for the transfer abroad, appropriate contractual safeguards (Art. 9) | Consent you give by writing to Cubi and continuing after the notice (Art. 6(1)(a) and Art. 9(2)(a)); for the transfer, appropriate contractual safeguards under Chapter V |
| Sending no more than one neutral reminder after an application link has been sent | Pre-contractual steps or legitimate interest (Art. 5(2)(c) and (f)) | Pre-contractual steps or legitimate interest (Art. 6(1)(b) and (f)) |
| Keeping a record that the Cubi notice was sent and of any objection to AI processing | Legal obligation and the establishment, exercise or protection of a right (Art. 5(2)(ç) and (e)) | Legal obligation; demonstrating consent (Art. 6(1)(c) and Art. 7(1)) |
| Protecting user accounts, the patient portal and technical systems | Legitimate interest or legal obligation (Art. 5(2)(f) and (ç)) | Legitimate interest or legal obligation (Art. 6(1)(f) and (c)) |
| Assessing legal claims and protecting our rights | Establishment, exercise or protection of a right (Art. 5(2)(e) and, where applicable, Art. 6) | Legitimate interest and, where necessary, the exceptions relating to legal claims (Art. 6(1)(f) and 9(2)(f)) |
| Analysing website performance and measuring the effectiveness of advertising | Explicit consent where required for the relevant operation | Consent where required (Art. 6(1)(a)) |
The legal bases listed in this table are not automatically deemed to apply to every data subject. In particular, where an application is made by a third party on behalf of a patient, an appropriate legal basis must also exist for processing the patient's data.
We use personal data only for the stated purposes. We do not sell the personal and health data you share during the application to third parties.
We do not send bulk marketing messages.
4. Health data and explicit consent
Health data is one of the categories of personal data that require special protection under KVKK and GDPR.
In order to deliver its healthcare coordination service, Cuba Health Assist collects and organises the necessary medical documents, translates them where necessary and submits them to the relevant specialist physicians for assessment.
These operations are carried out on the basis of the legal conditions laid down in the applicable legislation and, where necessary, the patient's explicit consent.
When is explicit consent required?
Where your explicit consent is required for your medical documents to be processed or shared with the relevant healthcare professionals, a separate approval is obtained from you during the application process.
We cannot proceed with the medical assessment process unless the legal conditions required for processing your health data are met.
Who can access your health information?
Access to health data is restricted on the basis of role and authorisation.
Coordination staff responsible for managing your file, and the relevant physicians and healthcare institutions, can access only the information they need to perform their duties.
Data processing by technical service providers is assessed in light of the nature of the relevant service, access permissions and the applicable data protection conditions.
Documents shared with physicians are limited to the content needed for the assessment and are transmitted using secure access methods.
Can you withdraw your explicit consent?
Yes. For operations based on explicit consent, you can withdraw your consent at any time.
Withdrawing your consent does not invalidate operations lawfully carried out before the date of withdrawal.
However, if after withdrawal there is no other valid legal basis for processing the relevant health data, those operations will be stopped. This may mean that the ongoing application or healthcare coordination service cannot be continued.
Some data may need to continue to be kept in accordance with legal obligations.
For details, please see the Medical Data Consent and Data Processing Notice pages.
5. Who do we share your personal data with?
We share your personal data only to the extent necessary to provide the service requested, operate the technical infrastructure, carry out payment transactions or comply with legal obligations.
The recipients and service providers with whom data may be shared are as follows:
| Recipient or service provider | Purpose of sharing | Country or region |
|---|---|---|
| Specialist physicians and healthcare institutions in Cuba | Reviewing medical files, preparing specialist opinions and assessing treatment options | Cuba |
| Accommodation, transport and travel service providers in Cuba | Helping to coordinate treatment and travel; sharing only the necessary booking and operational details | Cuba |
| Cloud hosting and database service providers | Hosting and operating the website and application infrastructure and storing data | USA and other infrastructure regions in which the service is provided |
| AI service provider (processor) | Supporting the preliminary check of medical documents for legibility and suitability, and Spanish translation processes; processing messages sent to Cubi on the channels where Cubi is active | USA |
| E-mail service provider | Sending and receiving e-mail and related communication infrastructure | The service provider's server regions |
| WhatsApp (Meta) and the server service provider we use for WhatsApp messaging | User messaging, application notifications and sending secure file access links to authorised persons | Global infrastructure regions |
| Customer message management software provider | Managing messages received via Instagram and Facebook | The server infrastructure used |
| TropiPay | Carrying out card payments and verifying payment status | The payment provider's operating and processing regions |
| Banks and financial institutions | Bank transfers, payment verification and accounting requirements | Türkiye and the relevant countries of the transaction |
| Google Analytics and Google Ads | Analysing website performance and measuring advertising | USA and the relevant service regions |
| Competent public authorities and bodies | Sharing information and documents where required by law | The relevant country |
Use of data by service providers
Technical service providers that process data on our behalf are expected to process personal data only for the purposes for which they are authorised and to comply with the applicable data protection obligations.
Some recipients, such as healthcare institutions, banks and public authorities, may act as independent data controllers in respect of the activities they carry out. Their own legal obligations and privacy rules may also apply to their data processing activities.
Sharing of payment information
For payments made through TropiPay, information needed to complete the transaction, such as first name, surname, contact details, address, country and payment amount, may be transferred to the relevant payment institution.
The card number and security code are processed through the payment institution's secure system; this information is not stored in the Cuba Health Assist database.
Advertising and analytics data
Google Analytics and Google Ads may be used to evaluate website usage and to measure the results of advertising activities.
Health files, diagnoses, medical reports and direct identity details are not used for transfer to advertising measurement systems.
Nevertheless, cookies, online identifiers and usage data may constitute personal data under the relevant legislation. The processing of such data is subject to the relevant legal conditions and, where necessary, to the user's choice.
6. Transfer of personal data abroad
One of the core elements of the healthcare coordination service provided by Cuba Health Assist is submitting the necessary medical documents to specialist physicians in Cuba for assessment.
For this reason, part of the personal data processed in connection with your application may be transferred to Cuba.
In addition, some of the website, patient portal, database, AI systems, payment and communication services are provided by service providers located abroad.
This may require your personal data to be transferred to the countries in which the relevant service providers operate, in particular Cuba and the USA.
Transfers from Türkiye
Transfers of personal data from Türkiye abroad are subject to the conditions set out in Article 9 of KVKK.
Accordingly, for such transfers, the adequacy decisions or appropriate safeguards provided for in the relevant legislation are considered first.
Appropriate safeguards may include standard contracts and other lawful transfer mechanisms, provided that the necessary conditions are met.
The exceptional grounds for transfer set out in the Law may be relied on only in occasional cases where the relevant conditions are met.
Explicit consent or the performance of a contract does not, on its own, constitute a general transfer authorisation for regular and continuous transfers of data abroad.
Transfers under GDPR
For transfers of personal data to which GDPR applies, the transfer mechanisms provided for in the relevant legislation are taken into account for operations outside the European Economic Area.
These mechanisms include adequacy decisions, the Standard Contractual Clauses adopted by the European Commission and, in limited cases, the exceptional transfer provisions that may apply.
There is no general adequacy decision issued by the European Commission for Cuba.
For transfers to the USA, the EU-US Data Privacy Framework can be used only in respect of organisations that are duly certified under that framework and fall within the scope of the relevant transfer.
Transfers in connection with Cubi
On the channels where Cubi is active, the messages you send to Cubi are transferred to our AI service provider in the United States. Because your messages may contain health information, this transfer is based on the consent you give by writing to Cubi and continuing after the notice, and on appropriate safeguards set out in our contract with the provider.
For transfers from Türkiye, the conditions of Article 9 of the KVKK are taken into account; where the GDPR applies, the conditions of Chapter V of the GDPR are taken into account. If you tell us that you do not want AI processing, your messages on that channel are no longer transferred to this provider.
Possible risks of transfers abroad
In the countries to which personal data is transferred, data protection legislation, supervisory mechanisms and the rights granted to data subjects may differ from the rules in Türkiye or the European Union.
For this reason, necessity, data minimisation, authorisation, secure communication and appropriate transfer safeguards are taken into account in data transfers.
You can send any request for information about the legal mechanism used for a given transfer and the applicable safeguards to info@cubahealthassist.com.
7. Use of artificial intelligence
Cuba Health Assist makes use of AI-supported technologies in some communication and document preparation processes.
The use of artificial intelligence does not replace the medical decision-making authority of healthcare professionals.
Cubi · AI-powered Digital Patient Coordinator
Cubi is our AI-powered Digital Patient Coordinator. Through our website and messaging channels (such as WhatsApp, Instagram and Messenger), Cubi answers general questions about the application process, required documents, services, the preliminary review fee, payment methods and coordination stages, and helps you with your application.
Cubi may not be active on every channel at the same time. When you write to a channel where Cubi is active, a short automatic notice sent just before Cubi's first reply on that channel tells you so. Cubi's main task is to provide information, help with your application and, where needed, pass your message to the right member of our team.
Cubi:
- Does not diagnose illnesses.
- Does not carry out clinical assessments of medical reports.
- Does not give personal treatment recommendations.
- Does not decide on or recommend medicines or doses.
- Does not make treatment decisions or take the place of physicians.
- Does not guarantee the success or suitability of any treatment.
Assessments on medical matters are carried out solely by authorised physicians.
You can ask to speak to a member of our team at any time; your message is then passed on to the team. Our team replies every day from 09:00 to 21:00, Türkiye time (UTC+3), through our website and messaging channels; you can also reach us on WhatsApp at +53 636 971 53 or at info@cubahealthassist.com. Outside these hours, Cubi may answer general questions on the channels where it is active; matters that need our team are dealt with during working hours.
The Cubi notice and your right to refuse AI processing
When you write to a channel where Cubi is active, Cubi replies straight away. Just before its first reply on that channel, it sends this short notice, once only: "Hi, I'm Cubi, Cuba Health Assist's AI-assisted assistant. Privacy: cubahealthassist.com/privacy-policy/" This notice is not generated by AI; it is an automatic message whose wording never changes.
Your messages may contain health information. By writing to Cubi and continuing the conversation after this notice, you agree to your messages being processed through our AI service provider as described here. We keep a record that the notice was sent, as described below.
If you do not want AI processing, write STOP, "I don't want Cubi" or "I don't want AI" on the same channel at any time, even in your first message, or send an e-mail to info@cubahealthassist.com. From then on, your messages on that channel are not sent to the AI service provider, and our team answers your questions during working hours (every day from 09:00 to 21:00, Türkiye time). This does not affect processing lawfully carried out before it.
People who received our earlier consent message and declined it, or later withdrew their consent, remain excluded: their messages are not processed with AI, and our team answers them.
Applying does not depend on using Cubi; if you do not want AI processing, your application proceeds in exactly the same way.
How are your messages processed?
On the channels where Cubi is active, your messages are processed by our AI service provider (United States). In doing so, the provider acts as a processor on our behalf and only on our instructions, and is bound by its contract with us. The provider keeps the data we send it under this service for a limited period only.
Before your messages are sent to the provider, card numbers, identity and passport numbers, IBAN and bank account numbers, password-like secrets and direct identifiers that are not needed to answer your question are automatically masked. Medical content in your messages is not masked, so that your question can be understood correctly.
We only process the information needed to answer your question. Cubi does not review or interpret medical documents, reports or imaging results. If you share such a document in the chat, Cubi confirms that it has arrived and directs you to the secure application form. Your medical documents are processed only as part of your application file, as described under "AI support for medical documents" below.
While Cubi is in a trial phase on a channel, our team may write the replies; in this phase too, the notice and your right to refuse AI processing described above apply in the same way.
Application link and reminder
If you do not reply or complete your application after we have sent you an application link, we may send you one short, neutral reminder 24 hours later, and no more. This reminder contains no health information. If you write STOP, "I don't want this" or something similar, you will receive no further automatic messages.
Retention of conversations and notice records
Conversations with Cubi are kept for 90 days and then deleted or anonymised. If information or a document from a conversation has been formally added to your application file, that content follows the file's retention period.
The record we keep to prove that the Cubi notice was sent and, where applicable, that you objected to AI processing (including answers to our earlier consent message) is kept for 3 years from your last relevant contact with us. It contains only a pseudonymous identifier, the channel, the date and time, the version of the notice or consent text and, where applicable, the date of the objection; it does not contain the content of your messages. If you ask for erasure, the trace that links the record to you is deleted and only a record showing that AI processing was refused remains.
AI support for medical documents
AI systems may be used in the preliminary check of documents uploaded during the application for legibility and for conformity with the required document types.
In addition, AI-supported translation tools may be used when translating medical documents into Spanish.
These operations are carried out under the supervision of the coordination team.
Translations or document edits produced by artificial intelligence do not replace the independent medical assessments of the relevant physicians.
Data security in AI systems
Please do not type payment card details, passwords, full identity numbers or unnecessary sensitive information into messages you send to Cubi or our other channels. Such information is automatically masked before it is sent to the provider, but no automatic check can catch every case.
The conditions under which AI service providers process and retain data depend on the technical configuration of the service used and the relevant contracts.
No automated medical decisions
No final decision on a patient's suitability for treatment options in Cuba is made automatically by artificial intelligence alone.
The assessment of medical suitability is carried out by the relevant healthcare professionals and authorised healthcare institutions.
8. How long do we keep your personal data?
We keep your personal data for as long as the purposes for which it was collected require, and within the retention obligations laid down by the applicable legislation.
Data whose retention period has ended and for which there is no other valid ground for processing is deleted, destroyed or anonymised in accordance with the relevant procedures.
| Type of data or record | Retention period or rule applied |
|---|---|
| Incomplete or unpaid applications | Application records are subject to a 24-hour automatic deletion rule. Applications with a bank transfer receipt that could not be reviewed because of a weekend or public holiday may be kept until the payment check is completed. |
| Patient files, medical documents and physician reports | For as long as the service continues and, after the file is closed, for as long as necessary in view of applicable legal obligations, possible objections or legal claims |
| Payment, billing and accounting records | For the mandatory retention periods laid down by the tax, commercial and accounting legislation of the relevant country |
| Explicit consent and approval records | For as long as necessary to manage the file and, where required, to prove the approval given |
| Conversations with Cubi | 90 days, then deleted or anonymised; content formally added to an application file follows the file's retention period |
| Records of the Cubi notice and of objections to AI processing | 3 years from the last relevant contact; only a pseudonymous identifier, the channel, the date and time, the text version and the date of any objection are kept, never message content |
| Access authorisation for the file package sent to the physician | A short, limited period (a few days) |
| Short-lived access links created to open documents | A very short period (minutes) |
| Patient portal sessions | Inactive sessions expire after a short time |
| Contact forms, e-mails and messages | For as long as needed to resolve the request and carry out the necessary follow-up |
Retention of patient files
Your medical documents may be kept for the continuation of the service and in accordance with the necessary legal obligations.
The closure of your application does not mean that all records will be deleted at the same time.
You may request the deletion, destruction or anonymisation of data for which there is no retention obligation or for which the legal conditions requiring processing have ended.
Time-limited physician access
Access authorisation for the file package sent to physicians is limited to a short, fixed period (a few days).
Short-lived access links created for the documents in the package are valid only for a very short period of a few minutes.
These periods refer to the validity of the relevant access permissions, not to the period after which the documents are completely deleted from the system.
9. How do we protect your personal data?
We apply technical and administrative security measures to protect your personal data against the risks of unauthorised access, loss, alteration, disclosure or unlawful processing.
Depending on the nature of the system and the data processed, these measures may include the following practices.
Secure connections
Encrypted, secure connection technologies are used for website and application communication.
Encrypted connections are also used for data communication between systems.
Authorised access
Access to patient files is restricted according to the role and permissions of the staff member concerned.
Not all staff have unrestricted access to areas containing personal data.
Time-limited document links
Time-limited access methods are used for documents shared for physician assessment.
User permissions and the scope of duties are checked for document access; the relevant access operations may be logged for security purposes.
Account security
Additional authentication measures are used on authorised team accounts.
Alert mechanisms are used for unusual logins and certain security events.
Communication via WhatsApp
WhatsApp messages sent to patients and applicants mainly concern file status, missing documents, payments and process updates.
Rather than routinely sharing medical reports or detailed health data as WhatsApp messages, appropriate secure document access methods are preferred.
Where users share health information over WhatsApp of their own accord, that information is also handled under the applicable data protection rules.
Managing security breaches
If a breach affecting the security of personal data is detected, the necessary investigation, response and notification processes are carried out, taking into account the nature of the incident and the applicable legislation.
Where required by legislation, the competent authorities and affected persons are notified within the prescribed time limits.
No digital system can be guaranteed to be completely free of all security risks. For this reason, security measures and access controls should be reviewed regularly.
10. Cookies and browser storage
Cookies and similar technologies may be used on the Cuba Health Assist website to run core functions, remember user preferences, ensure security and evaluate website performance.
Strictly necessary cookies
These cookies are required for the website to work securely and with its core functions.
Session management, authentication, security checks and necessary service sessions may fall within this category.
Functional cookies
These may be used for functions such as remembering your language preference and personalising the user experience.
Analytics cookies
Tools such as Google Analytics may be used to obtain statistical information about pages visited, user interactions and website performance.
Advertising and measurement technologies
Systems such as Google Ads may be used to evaluate the results of advertising campaigns and to measure advertising interactions.
Non-essential cookies and similar technologies are subject to user consent where required by the relevant legislation.
Information stored in the browser
In addition to cookies, some features of the website may also use the browser's local storage.
Records such as language preferences, temporary draft details of the application form and ad click identifiers may be stored in this way.
The maximum retention period set for ad click identifiers is 30 days.
For details of the technologies used, retention periods and how to manage your preferences, please see the Cookie Policy page.
11. Your rights regarding your personal data
Under Article 11 of KVKK and the applicable provisions of GDPR, you may have a number of rights over your personal data.
The scope of these rights and the conditions for exercising them may vary according to the relevant legislation.
Right to be informedYou can find out whether your personal data is being processed, for what purposes it is used and the legal bases for the processing activities.
Right of accessYou can request access to the personal data processed about you and, under the applicable legislation, a copy of that data.
Right to rectificationYou can ask for incomplete, inaccurate or out-of-date personal data to be corrected.
Right to erasure or destructionWhere the relevant legal conditions are met, you can request that your personal data be erased or destroyed. Statutory retention requirements and other valid legal grounds may limit the scope of this right.
Right to withdraw explicit consentFor personal data processing activities based on your explicit consent, you can withdraw your consent at any time. This does not affect lawful processing carried out before consent was withdrawn.
Right to objectUnder the conditions laid down by the applicable legislation, you can object to certain personal data processing activities.
Right to request restriction of processingWhere GDPR applies and the relevant conditions are met, you can request that the processing of your personal data be restricted.
Right to data portabilityUnder GDPR, where the necessary conditions are met, you can ask to receive certain personal data you have provided to us in a structured, commonly used and machine-readable format, or request that it be transmitted to another data controller.
Right to information about data transfersYou can request information about the third parties or categories of recipients to whom your personal data has been transferred. Where the necessary legal conditions are met, you can also ask for your rectification or erasure requests to be notified to the relevant recipients.
Rights relating to automated decision-makingUnder the applicable legislation, you can exercise your rights in relation to decisions based solely on automated processing that produce legal or similarly significant effects concerning you. Cuba Health Assist does not make final decisions on suitability for medical treatment based solely on automated systems.
Right to claim compensation for damageIf you believe you have suffered damage as a result of the unlawful processing of your personal data, you can exercise your rights to legal recourse and compensation under the relevant legislation.
12. How can you exercise your rights?
You can send your requests concerning your personal data to the following e-mail address:
info@cubahealthassist.com
So that your request can be assessed correctly, please state your request clearly in your message.
If possible, please write from the e-mail address you used during the application.
If you have a file number, you can also share it.
Not having a file number does not prevent you from making a request concerning your personal data.
Where necessary, additional identity or authority verification may be requested to confirm that the request is made by an authorised person.
Response times for requests
Under KVKK: Requests are concluded as soon as possible depending on the nature of the request, and within 30 days at the latest.
Under GDPR: Requests are answered without undue delay and, as a rule, within one month at the latest. This period may be extended where the conditions laid down in the legislation are met; in that case, the person concerned is informed accordingly.
As a rule, requests are handled free of charge. In exceptional cases permitted by legislation, a fee or costs may apply.
If you want to delete your account
You can also request the closure or deletion of your patient portal account via the Account Deletion page.
Closing an account does not mean that all records that must be kept by law will be deleted automatically.
Your right to complain
If you believe your request has not been adequately addressed or that your personal data has been processed unlawfully, you may have the right to apply to the relevant data protection authority.
In Türkiye, after applying to the data controller, a complaint may be lodged with the Personal Data Protection Board within the conditions and time limits laid down under KVKK.
Where GDPR applies, a complaint may be lodged with the competent data protection authority of the relevant European Economic Area country.
13. If you are applying as a patient's relative or legal representative
Some applications for Cuba Health Assist services are made by patients' family members or authorised representatives.
If you are applying on behalf of a patient, you must make sure that the necessary authority or consent exists to protect the personal and medical information you share.
Being a relative of the patient does not, by itself, give authority to permit the sharing or processing of all of the patient's health data.
Authority to apply on behalf of a patient
The person acting on behalf of the patient must have valid authority of representation, or the necessary consent of the patient, under the applicable legislation.
Depending on the nature of the application, Cuba Health Assist may request additional information and documents to verify this authority or the patient's consent.
We kindly ask you to share this Privacy and Personal Data Protection Notice with the patient.
Applicant's contact details
Where the application is made by a patient's relative, the applicant's contact details may be linked to the patient file.
Notifications concerning the operational management of the file may be sent through the communication channels specified by the authorised applicant.
Nevertheless, the patient's rights regarding their personal data and the confidentiality requirements remain separately protected.
Patients under 18
For patients under 18, the application must be made by a parent or legal representative in accordance with the conditions required by the relevant legislation.
For such applications, it may be required that the necessary representation and consent conditions are met.
14. Changes to this notice
Cuba Health Assist may update this notice if the scope of the service, the technical infrastructure, the service providers used or the applicable legislation change.
The current version is published on the relevant web page.
If significant changes affect ongoing applications or the conditions under which personal data is processed, the additional information and consent procedures required by the applicable legislation will be carried out.
Where necessary, applicants with an active file may also be notified separately.
15. Contact
You can contact us with any questions about the protection of your personal data, your requests, your rights or this notice.
Contact
Cuba Health Assist — MYDN GROUP
E-mail: info@cubahealthassist.com
Türkiye: +90 533 950 89 96
International: +53 636 971 53
Website: https://cubahealthassist.com
Important information
This notice is intended to inform you about the processing of your personal data.
For the commercial terms of the coordination services provided by Cuba Health Assist, the rights and obligations of the parties and other provisions relating to the service, please see the Terms of Use page.
The Medical Data Consent and Data Processing Notice pages also apply to the specific explanations and necessary approvals concerning the processing of your medical data.
Version note (1 November 2026): For security reasons, internal system and infrastructure details were removed from the text; service providers are now described by type.