Privacy Policy
Last updated: 2026-11-09
DrBrander (“we”, “us”) provides medical advertising, direct patient contact, and enquiry management to physicians and clinic principals (“clients”). This policy explains what personal data we collect through this website and the direct-contact tool, why, and what rights you have.
1. Who this applies to
Two different people may read this policy: a physician or clinic principal enquiring about our services, and a patient writing to a clinic through the direct-contact tool we operate for that clinic. Both are covered below; the section on the direct-contact tool applies specifically to patients.
2. What we collect
Through the correspondence form: name, clinic name, email, phone number (optional), and the message you write.
Through the direct-contact tool, on behalf of a clinic: your messages, the language you write in, and, if you choose to share them, your name and a phone number or email so the clinic can reach you. The tool is told not to ask for or record diagnoses, medication names, or other sensitive health details beyond what you volunteer in your own words.
Automatically: standard web request data (IP address, browser type, pages visited) for security and to keep the site working, and, if you arrive from an advert, the advertising platform's click identifier so the enquiry can be attributed to that campaign.
3. Why we process it (legal basis)
To respond to your enquiry or pass it to the relevant clinic (performance of a contract or a step toward one). To keep the service secure and working correctly (legitimate interest). To measure which advertising campaign an enquiry came from (legitimate interest / consent, where required by local law). Where you are a patient writing to a clinic, the clinic is responsible for that data as the entity providing you care; we process it on the clinic's behalf as a processor.
4. Who we share it with
The clinic you are writing to, so a member of its staff can follow up with you. Service providers strictly necessary to run this site (hosting, the AI model used to draft replies, email delivery) under confidentiality obligations. We do not sell personal data, and patient correspondence is never used to train any AI model, shared between clinics, or shown publicly as a testimonial or case study without your separate, written consent.
5. International transfer
Our infrastructure may process data outside your country. Where this involves the European Economic Area or the United Kingdom, we rely on adequacy decisions or standard contractual clauses. Where it involves Türkiye, we process personal data in line with Law No. 6698 (KVKK) — see the dedicated notice below.
6. How long we keep it
Correspondence and enquiry records are kept for as long as needed to handle the enquiry and for a limited period afterward for legitimate business and legal record-keeping, then deleted or anonymised. A clinic may keep its own patient records for longer, under its own retention obligations as a healthcare provider — ask that clinic directly for its own retention period.
7. Your rights
Depending on where you are, you may have the right to access, correct, delete, or export your personal data, to object to or restrict its processing, and to withdraw consent at any time. To exercise any of these rights, write to us using the contact details below. If you are a patient, you may also contact the clinic directly, since it holds your clinical relationship.
8. Cookies
This site uses no advertising, analytics or third-party cookies. It sets a single technical cookie, site_session. For visitors it remembers your chosen language, the clinic selected in the direct-contact tool and, if you came from an advert, the advertising click identifier, and it is deleted when you close your browser. For signed-in clients it also keeps you signed in to the client portal, for up to 30 days. The site also keeps a conversation identifier in your browser's local storage, named drb_sid_<clinic> (one per clinic), so you can return to the same conversation; it is never sent to any other clinic and never used for advertising or tracking. It stays until you use the "Start a new conversation" button or clear this site's data in your browser. The exact list, with durations, is in the Cookie Policy section below.
9. Children
This service is directed at physicians and clinic principals, and at adult patients contacting a clinic on their own behalf. It is not directed at children.
10. Contact
For any question about this policy or to exercise your rights, write to us through the correspondence page on this site.
GDPR information (EU/EEA visitors)
If you are located in the European Economic Area, the Regulation (EU) 2016/679 (GDPR) applies to our processing of your personal data. The legal bases, retention periods, and rights described above are the ones GDPR requires us to state. You may lodge a complaint with your local data protection authority at any time.
KVKK Aydınlatma Metni (Türkiye)
6698 sayılı Kişisel Verilerin Korunması Kanunu ('KVKK') uyarınca, Türkiye'den yazışan kişilerin kişisel verileri; hizmet talebinin yönetilmesi, ilgili kliniğe iletilmesi ve yasal yükümlülüklerin yerine getirilmesi amaçlarıyla, açık rıza veya sözleşmenin kurulması/ifası için gerekli olma hukuki sebeplerine dayanılarak işlenir. Kanun kapsamındaki haklarınızı (verinizin işlenip işlenmediğini öğrenme, düzeltme, silme, itiraz etme dahil) kullanmak için bu sitedeki yazışma sayfasından bize ulaşabilirsiniz.
Data retention and deletion
Correspondence-form submissions are retained for up to 24 months from the last contact, then deleted. Direct-contact conversations are retained for as long as the clinic remains our client plus 12 months, then deleted or anonymised, unless a longer period is required by the clinic's own regulatory obligations as a healthcare provider. You may request earlier deletion at any time via the contact page, subject to any legal obligation to retain a record.
Cookie Policy
This site uses no advertising, analytics or third-party cookies. It sets a single technical cookie, site_session, and keeps one identifier in your browser's local storage. What they hold depends on whether you are simply visiting or signed in to the client portal.
Cookies and storage used
- site_session — visitors (not signed in): a signed, HttpOnly technical cookie that remembers your chosen language, the clinic selected in the direct-contact tool and, if you arrived from an advert, the advertising click identifier and campaign tags of that first visit, so an enquiry can be attributed to the right campaign. It is a browser-session cookie: deleted when you close your browser.
- site_session — signed-in clients (client portal): the same cookie also holds your sign-in token and the time of your last activity. While you are signed in it is kept for up to 30 days. You are signed out automatically after 20 minutes without activity in the portal, and the sign-in token is removed as soon as you sign out.
- drb_sid_<clinic> (browser local storage, not a cookie) — identifies your conversation with a specific clinic's bot so you can leave and return to it. One per clinic; never shared between clinics. It has no automatic expiry: it stays until you use the "Start a new conversation" button (which replaces it immediately) or clear this site's data in your browser.