Privacy Policy

Last updated: 2026-09-24

DrBrander (“we”, “us”) provides medical advertising, direct patient contact, and enquiry management to physicians and clinic principals (“clients”). This policy explains what personal data we collect through this website and the direct-contact tool, why, and what rights you have.

1. Who this applies to

Two different people may read this policy: a physician or clinic principal enquiring about our services, and a patient writing to a clinic through the direct-contact tool we operate for that clinic. Both are covered below; the section on the direct-contact tool applies specifically to patients.

2. What we collect

Through the correspondence form: name, clinic name, email, phone number (optional), and the message you write.

Through the direct-contact tool, on behalf of a clinic: your messages, the language you write in, and, if you choose to share them, your name and a phone number or email so the clinic can reach you. The tool is told not to ask for or record diagnoses, medication names, or other sensitive health details beyond what you volunteer in your own words.

Automatically: standard web request data (IP address, browser type, pages visited) for security and to keep the site working, and, if you arrive from an advert, the advertising platform's click identifier so the enquiry can be attributed to that campaign.

3. Why we process it (legal basis)

To respond to your enquiry or pass it to the relevant clinic (performance of a contract or a step toward one). To keep the service secure and working correctly (legitimate interest). To measure which advertising campaign an enquiry came from (legitimate interest / consent, where required by local law). Where you are a patient writing to a clinic, the clinic is responsible for that data as the entity providing you care; we process it on the clinic's behalf as a processor.

4. Who we share it with

The clinic you are writing to, so a member of its staff can follow up with you. Service providers strictly necessary to run this site (hosting, the AI model used to draft replies, email delivery) under confidentiality obligations. We do not sell personal data, and patient correspondence is never used to train any AI model, shared between clinics, or shown publicly as a testimonial or case study without your separate, written consent.

5. International transfer

Our infrastructure may process data outside your country. Where this involves the European Economic Area or the United Kingdom, we rely on adequacy decisions or standard contractual clauses. Where it involves Türkiye, we process personal data in line with Law No. 6698 (KVKK) — see the dedicated notice below.

6. How long we keep it

Correspondence and enquiry records are kept for as long as needed to handle the enquiry and for a limited period afterward for legitimate business and legal record-keeping, then deleted or anonymised. A clinic may keep its own patient records for longer, under its own retention obligations as a healthcare provider — ask that clinic directly for its own retention period.

7. Your rights

Depending on where you are, you may have the right to access, correct, delete, or export your personal data, to object to or restrict its processing, and to withdraw consent at any time. To exercise any of these rights, write to us using the contact details below. If you are a patient, you may also contact the clinic directly, since it holds your clinical relationship.

8. Cookies

This site uses only the technical cookies necessary for it to function: keeping you signed in to the client portal, remembering your chosen language, and remembering an advertising click identifier so an enquiry can be attributed to the campaign that produced it. We do not use third-party advertising or tracking cookies. See the Cookie Policy section below for the exact list. This site also stores a small conversation identifier in your browser's local storage, named drb_sid_<clinic> (one per clinic, e.g. drb_sid_example_clinic) — it lets you leave and return to the same conversation, and is never sent to any clinic other than the one it is named for. It is kept until you clear your browser's site data, use the "Start a new conversation" button (which replaces it immediately), or 12 months of inactivity pass. It is never used for advertising or tracking.

9. Children

This service is directed at physicians and clinic principals, and at adult patients contacting a clinic on their own behalf. It is not directed at children.

10. Contact

For any question about this policy or to exercise your rights, write to us through the correspondence page on this site.

GDPR information (EU/EEA visitors)

If you are located in the European Economic Area, the Regulation (EU) 2016/679 (GDPR) applies to our processing of your personal data. The legal bases, retention periods, and rights described above are the ones GDPR requires us to state. You may lodge a complaint with your local data protection authority at any time.

KVKK Aydınlatma Metni (Türkiye)

6698 sayılı Kişisel Verilerin Korunması Kanunu ('KVKK') uyarınca, Türkiye'den yazışan kişilerin kişisel verileri; hizmet talebinin yönetilmesi, ilgili kliniğe iletilmesi ve yasal yükümlülüklerin yerine getirilmesi amaçlarıyla, açık rıza veya sözleşmenin kurulması/ifası için gerekli olma hukuki sebeplerine dayanılarak işlenir. Kanun kapsamındaki haklarınızı (verinizin işlenip işlenmediğini öğrenme, düzeltme, silme, itiraz etme dahil) kullanmak için bu sitedeki yazışma sayfasından bize ulaşabilirsiniz.

Data retention and deletion

Correspondence-form submissions are retained for up to 24 months from the last contact, then deleted. Direct-contact conversations are retained for as long as the clinic remains our client plus 12 months, then deleted or anonymised, unless a longer period is required by the clinic's own regulatory obligations as a healthcare provider. You may request earlier deletion at any time via the contact page, subject to any legal obligation to retain a record.

Cookies used

• site_session — keeps you signed in to the client portal. Deleted when you sign out or after 30 days.
• drb_crm_lang — remembers your chosen interface language. Kept for 1 year.
• Ad click identifier (session only) — remembers which advertising campaign brought you here, so an enquiry you submit can be attributed correctly. Cleared when the browser session ends.
• drb_sid_<clinic> (browser local storage, not a cookie) — identifies your ongoing conversation with a specific clinic's bot, so you can leave and return to it. One per clinic; never shared across clinics. Cleared by "Start a new conversation", by clearing browser data, or automatically after 12 months of inactivity.