Privacy Policy

Astramedica LLC ("Astramedica," "we," "us," or "our") operates the website astramedica.com (the "Platform"). We are a medical-tourism coordination company that connects prospective patients with vetted partner clinics and healthcare facilities in Turkey.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have regarding your data. By using the Platform you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Platform immediately.

The responsible data controller for processing carried out via this Platform is:

For any questions regarding data protection or to exercise your rights, please contact us at info@astramedica.com.

Astramedica is a medical-tourism coordination platform. We are not a hospital, clinic, or licensed healthcare provider. We do not provide medical advice, diagnosis, or program recommendations. We facilitate introductions between you and qualified partner clinics in Turkey and assist with logistics such as travel planning, scheduling, and concierge services.

Any medical decisions, programs, or procedures are between you and the partner clinic. Partner clinics operate under their own licenses, data-protection policies, and applicable Turkish healthcare regulations.

Our services are intended exclusively for individuals aged 18 years and older. We do not knowingly collect personal data from anyone under the age of 18. If you are under 18, do not use this Platform or submit any forms.

If we become aware that we have collected personal data from a person under 18, we will promptly delete that data and terminate the associated account or session. If you believe a minor has provided us with personal data, please contact us immediately at info@astramedica.com.

We collect personal data that you voluntarily provide and data collected automatically when you use the Platform.

6.1 Data You Provide

• Consultation Request Form: First name, last name, email address, phone number, service of interest, and an optional free-text message. Some noindex landing pages may instead ask non-medical planning questions such as preferred timing, communication channel, contact window, timezone, and program priorities.
• Follow-Up Communications: Information you share when replying to our team by email or other approved contact channels after submitting an enquiry.
• Payment Information: If you pay a coordination fee, your card details are collected and processed directly by our payment processor (Stripe). Astramedica does not receive or store your full card number. We retain limited transaction records — such as amount, date, card brand and last four digits, and billing name and email — for accounting, tax, and fraud-prevention purposes.
• Consent Records: Records of your acceptance of this Privacy Policy, Terms & Conditions, age confirmation, health-data processing consent (VCDPA), cookie preferences, and communication consents that apply to your chosen contact channel (including SMS, WhatsApp, or phone consent where required).
• Email Communications: Any information you provide when you email us directly.
• Messaging Channels: If you write to us on Facebook Messenger, Instagram Direct or WhatsApp — including by tapping a message button on one of our advertisements — we receive the display name and the platform-scoped identifier that Meta assigns to you for our account, the content of the messages you send, and any images you choose to attach. We do not receive your password, your friends or followers, or any other part of your profile. The text of those conversations is also processed by the automated assistant that answers on those channels, and by the language-model provider behind it; see Section 10 for how that works and Section 9.2 for the provider involved.

6.2 Data Collected Automatically

• Usage Analytics & Advertising Measurement: Page views, referral sources, device type, browser type, operating system, country-level geolocation, session duration, campaign attribution, and conversion measurement signals collected through tools such as Google Tag Manager, Google Analytics, Google Ads, Vercel Analytics, and Speed Insights, subject to your cookie consent choices.
• Cookies & Browser Storage: Functional browser storage for cookie-consent preferences plus session-level campaign attribution parameters used to connect ad clicks with subsequent enquiry flows. These session-level attribution values may be stored before you make a cookie choice so the current visit can be matched with a later enquiry submission, while Google analytics and advertising storage remain subject to your consent settings. See Section 12 for details.
• Server Logs: IP address, request timestamps, request path, and HTTP status codes retained by our hosting provider.

We process your personal data for the following purposes:

• Consultation Processing: To receive, review, and respond to your consultation requests; to match you with appropriate partner clinics; and to facilitate scheduling, contact-window preferences, and logistics.
• Operations & Planning: To coordinate appointments, travel arrangements, cost estimates, and post-procedure follow-up with partner clinics on your behalf.
• Enquiry Follow-Up: To reply to your website enquiries and coordinate appropriate next steps.
• Automated Replies on Messaging Channels: To read your messages, pick a reply from our reviewed library and send it to you, to record what you tell us, to rate the enquiry for internal prioritisation, and to refer the conversation to a member of our patient care team. This is limited to the Facebook Messenger, Instagram Direct and WhatsApp channels.
• Payment Processing: To charge, record, and reconcile coordination fees through our payment processor, and to maintain the associated transaction records.
• Communication: To respond to your inquiry, coordinate follow-up, and share relevant information you have requested.
• Fraud & Abuse Prevention: To detect and prevent fraudulent, abusive, or unauthorized use of the Platform.
• Site Improvement: To analyze aggregated, anonymized usage data to improve Platform performance, user experience, and service offerings.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Consent (Art. 6(1)(a) GDPR): Where you have given explicit consent, such as by submitting a consultation form or accepting cookies.
• Contract Performance (Art. 6(1)(b) GDPR): Where processing is necessary to fulfill a service you have requested, such as coordinating your medical-tourism consultation.
• Legitimate Interests (Art. 6(1)(f) GDPR): Where processing is necessary for our legitimate business interests (e.g., fraud prevention, platform security, service improvement), provided these interests are not overridden by your rights and freedoms.
• Legal Obligation (Art. 6(1)(c) GDPR): Where processing is required to comply with a legal obligation to which we are subject.

You may withdraw your consent at any time by contacting us at info@astramedica.com. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

We may share your personal data with the following categories of recipients:

9.1 Partner Clinics

When you submit a consultation request, your name, contact details, service interest, and message may be shared with one or more partner clinics and healthcare facilities in Turkey that offer the services you are interested in. These clinics are independent entities and process your data under their own privacy policies and applicable Turkish law.

9.2 Service Providers & Processors

We engage trusted third-party service providers who process data on our behalf, under our instructions and subject to contractual obligations of confidentiality and security. These include, but are not limited to:

The language-model provider behind the messaging assistant processes conversation text only to produce the reply we send, on our instructions, and is engaged on settings under which the content sent to it is not retained and is not used to train its models. If you would like to know which provider is engaged at the time of your enquiry, ask us at info@astramedica.com and we will tell you.

We may use limited additional business tools for scheduling, invoicing, and internal operations. These tools process data under our instructions and their respective privacy policies.

9.3 Legal & Safety Disclosures

We may disclose personal data if required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect the rights, safety, or property of Astramedica, our users, or the public.

9.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred as part of that transaction. We will notify affected users before their data becomes subject to a different privacy policy.

We accept public enquiries through website forms, email, the contact methods listed on the Platform, and the messaging channels we operate on Facebook Messenger, Instagram Direct and WhatsApp. This website itself carries no live or automated chat widget.

• Public Channels Only: Use the consultation form, email, or other approved contact methods shown on the Platform for first contact.
• No PHI in Public Channels: Do not send Protected Health Information, medical records, lab results, or imaging through public forms, ordinary email, or the messaging channels. Facebook Messenger, Instagram Direct and WhatsApp are consumer services operated by Meta and are not HIPAA-compliant channels; the AI assistance described above does not change that.
• Where the Conversation Goes: To read what you wrote and pick the reply that is sent to you, the text of your conversation is processed by the language-model provider described in Section 9.2, acting as our processor, under a written agreement, on our instructions, and for no other purpose. It is not used to train that provider's models. See Section 9.2.
• Operational Logging: We may log and store enquiry submissions and follow-up correspondence for service delivery, fraud prevention, and recordkeeping.
• Secure Follow-Up When Needed: If a partner clinic needs detailed medical information, our team will arrange a more appropriate sharing workflow.

Astramedica is based in the United States. Your personal data may be transferred to, stored in, and processed in the United States and other countries where our service providers operate, including Turkey (for partner-clinic communications) and Singapore (where part of the language-model infrastructure behind the messaging assistant is located). Text you send us on Facebook Messenger, Instagram Direct or WhatsApp is transmitted to that infrastructure so a reply can be produced.

For transfers from the EEA/UK to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms under GDPR. By using the Platform, you acknowledge and consent to the transfer of your data to jurisdictions that may have different data-protection standards than your own.

We use a limited number of cookies and browser-storage items on the Platform:

Opting Out: When you first visit the Platform, a cookie-consent banner will appear. You may accept or decline non-essential cookies. If you decline, Google analytics and advertising-measurement storage remain disabled. However, we may still keep session-level campaign attribution values in browser session storage for the current visit so ad clicks and later enquiry submissions can be matched correctly without turning on full analytics or advertising storage. Even after acceptance, we may continue suppressing analytics and advertising measurement on clinically sensitive routes, except where a noindex landing page has been configured for consent-based campaign attribution and conversion measurement. You can change your cookie preference at any time by clearing your browser's local storage and cookie storage for this site.

If you accept non-essential cookies, we may use Google Tag Manager, Google Analytics, Google Ads attribution, and similar consent-based tools for performance analysis and conversion measurement on permitted routes. We do not use health-related landing-page activity to build advertiser-curated remarketing audiences, we do not use social-media tracking plugins, and we aim to keep measurement disabled on clinically sensitive non-landing routes.

Enhanced conversion measurement: On active ad landing pages, and only after you accept non-essential cookies, we may use Google's enhanced conversion measurement for leads. If you submit an enquiry, contact details you provide (such as your email address or phone number) are hashed, that is, irreversibly transformed into a coded value, in your browser and shared with Google solely to measure whether an advertisement click led to your enquiry. This hashed data is used for conversion measurement and ad-performance reporting only. It is not used to personalize ads to you or to build remarketing audiences, and we do not enable advertising personalization on these health-related routes.

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Upon expiration of the applicable retention period, personal data is securely deleted or anonymized. If you request deletion earlier, we will comply within 30 days, subject to any legal obligations to retain certain data.

We implement appropriate technical and organizational measures to protect your personal data, including:

• TLS/SSL encryption for all data transmitted between your browser and our servers.
• Encrypted database connections and role-based access controls.
• Regular security reviews of our service providers and infrastructure.
• Content Security Policy (CSP) headers to mitigate cross-site scripting and injection attacks.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot ensure absolute security.

15.1 Rights for All Users

Regardless of your location, you may:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Withdraw Consent: Withdraw previously given consent at any time.

To exercise any of these rights, email us at info@astramedica.com with your full name and email address associated with your inquiry. We may request additional information to verify your identity before processing your request. We will respond within 30 days.

Automated decision-making and profiling. The assistant described in Section 10 replies to you directly on the messaging channels, and it gives each conversation an internal priority rating and an interest label so our patient care team knows which enquiries to answer first. Giving a conversation that rating is profiling within the meaning of Article 4(4) GDPR, and we would rather state it than leave it unsaid. It is not a decision taken about you by automated means alone under Article 22 GDPR: it does not determine whether we reply to you, what you are offered, or on what terms, and it produces no legal or similarly significant effect. Judgements of that kind are made by a member of our team. You may ask what rating an enquiry carries, and object to the processing under Article 21 GDPR.

15.2 Additional Rights for EEA/UK Residents (GDPR)

If you are located in the EEA or UK, you additionally have the right to:

• Restriction: Request restriction of processing under certain circumstances (Art. 18 GDPR).
• Data Portability: Receive your data in a structured, commonly used, machine-readable format (Art. 20 GDPR).
• Object: Object to processing based on legitimate interests or for direct marketing purposes (Art. 21 GDPR).
• Supervisory Authority: Lodge a complaint with your local data-protection supervisory authority (Art. 77 GDPR).

15.3 Additional Rights for Virginia Residents (VCDPA)

If you are a Virginia resident, you have the following rights under the Virginia Consumer Data Protection Act (VCDPA):

• Right to Know: Confirm whether we are processing your personal data and access that data.
• Right to Correct: Request correction of inaccuracies in your personal data.
• Right to Delete: Request deletion of personal data you have provided to us.
• Right to Data Portability: Obtain a copy of your personal data in a portable, readily usable format.
• Right to Opt Out: Opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling. Astramedica does not sell personal data and does not engage in targeted advertising. We do rate messaging enquiries for internal prioritisation, as described in Section 15.1; under the VCDPA that rating is profiling. It is not used for targeted advertising, it does not decide whether or how we respond to you, and it produces no legal or similarly significant effect. You may opt out of it by emailing info@astramedica.com with the subject line "VCDPA Request."
• Sensitive Data: Under the VCDPA, health-related information is classified as "sensitive data." We collect health-related data (such as your medical service interest) only with your explicit opt-in consent via the health-data consent checkbox on our consultation form.

To exercise your VCDPA rights, email info@astramedica.com with the subject line "VCDPA Request." We will verify your identity and respond within 45 days. If we decline your request, you may appeal by contacting us. If you are not satisfied with the outcome of an appeal, you may file a complaint with the Virginia Attorney General.

15.4 Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information or share it for cross-context behavioral advertising purposes.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To submit a CCPA/CPRA request, email info@astramedica.com with the subject line "CCPA Request." We will verify your identity and respond within 45 days.

Do Not Sell or Share My Personal Information: Astramedica does not sell personal information and does not share personal information for cross-context behavioral advertising as defined under the CCPA/CPRA.

The Platform may contain links to third-party websites or services (e.g., partner-clinic websites). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal data.

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required by law, notify you via email or a prominent notice on the Platform. Your continued use of the Platform after any changes constitutes acceptance of the updated Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: