1. Introduction
1.1. Scope
This Privacy Notice applies to all the products, services, websites and apps offered by Topuz & Partners Ltd, except where otherwise noted. The services include Global Doctor Review subscriptions. We refer to these products, services, websites, and apps collectively as the “services” in this Privacy Notice. Unless otherwise noted in our contract, our services are provided by Topuz & Partners Ltd inside the United Kingdom. This Privacy Notice does not apply to personal information we collect from our employees or job applicants in their capacity as employees or candidates. Employees and candidates should refer to our Employee Privacy Notice or Candidate Privacy Notice, respectively.
2. Personal Data We Collect and the Sources
2.1. What Do We Mean By “Personal Data”
References in this Privacy Notice to data, personal information, or information, are all references to Personal Data. Personal Data means information relating to a natural person (a “Data Subject”) who is, or can be, reasonably identified from the information, either alone or in conjunction with other information.
2.2. Who Do We Collect Data About?
Participating Organisations:Organisations that hold an account with a Topuz & Partners service (e.g., Global Doctor Review). Such organisations participate in our research by uploading submissions containing recent work highlights and a list of patients, peers, or clients (collectively “Referees”) we can contact to gather feedback on the quality of their services.
Referees:Referees are individuals who receive surveys from Topuz & Partners or invitations to participate in an interview to provide feedback on the Participating Organisation(s) that referred them.
Visitor: You are just visiting one of our websites.
2.3. Types of Personal Data We Collect
(a) Contact Information— You might provide us with your contact information (for example: name or email address), whether through use of our services, a form on our website, an interaction with our sales or customer support team, or a response to one of Topuz & Partners' own surveys or forms.
(b) Cookie Information — We use first party and third party cookies and tracking services that employ cookies to collect data about visitors to our websites. This data includes usage and user statistics. We provide more information on cookies in our Cookie Policy.
(c) Customer Support Information — We collect information submitted through our Customer Support portal, such as name, email, and message text. We also record the content of Customer Support, Customer Success, and Sales calls.
(d) Usage Information — We collect usage information about you whenever you interact with our websites and services. This includes which webpages you visit, what you click on, when you perform those actions, what language preference you have, what you buy and so on.
(e) Device and Browser Data — We collect information from the device and application you use to access our services. Device data mainly means your IP address, operating system version, device type, device ID/MAC address, system and performance information, browser type, and other device, network and browser signals. If you are on a mobile device we also collect the UUID for that device. We also infer your geographic location based on your IP address.
(f) Event Data — Like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses, internet service providers, the files viewed on our site (e.g., HTML pages, graphics, etc.), operating system versions, device type and timestamps.
(g) Referral Information— If you arrive at a Topuz & Partners website from an external source (such as a link on another website or in an email) or have been invited to review a survey as a guest, we record information about the source that referred you to us.
(h) Integration Data— We collect information from third parties with whom Topuz & Partners enables integrations in order to allow you to use both services.
(i) Account Information
Registration information:You need an account before you can use Topuz & Partners' services. When you register for an account, we collect your first and last name, username, password and email address.
Billing information:If you make a payment to Topuz & Partners, we require you to provide your billing details, a name, address, email address and financial information corresponding to your selected method of payment (e.g., a credit card number and expiration date or a bank account number). If you provide a billing address, we will regard that as the location of the account holder to determine the Topuz & Partners entity with whom you contract and the sales tax, if applicable, to be applied to your purchase.
Account settings:You can set various preferences and personal details on pages like your account settings page (or on your account settings page for our other products as applicable). These may include, for example, your default language, time zone and communication preferences (e.g., opting in or out of receiving marketing communications from Topuz & Partners).
(j) Address Book Information — We may allow you to import email addresses and other contact information into an Address Book so you can easily invite people to take your surveys or fill in your form via our collectors. We do not use this data for our own purposes or to contact anyone, except at your direction.
(k) Survey/Form/Application/Interview Data — We store survey/form/application data (questions and responses) to provide and develop our services and products.
(l) First Party Profile Information — When you sign up for our services you are asked to provide us with information about yourself and to give us more detailed insights into who you are.
(m) Third Party Profile Information — We may combine information about you from third party sources (such as LinkedIn, ZoomInfo, and other data brokers) with information we hold about you to create a user profile.
(n) WhatsApp Communications— Our website includes a WhatsApp contact button. If you choose to contact us via WhatsApp, WhatsApp (owned by Meta Platforms Inc.) will process your phone number, profile information, and the content of any messages you send, in accordance with WhatsApp's own privacy policy. We use WhatsApp solely to respond to enquiries made through this channel.
3. How We Use the Personal Data We Collect
(a) Purposes
When personal information is provided to us, we may use it for any of the purposes described below, or as stated at the point we collect it from you (or as may be obvious to you from the context of collection), including to:
- Contact doctors and their organisations or hospitals, other medical professionals, insurance professionals, medical tourism professionals and patients to follow up on submissions made to us by Participating Organisations to seek information from identified referees;
- Review and organise personal information relating to individual medical private practitioners, doctors, medical professionals and other medical service providers, insurance providers as well as medical tourism service providers;
- Interview and/or survey private practice medical professionals, representatives of organisations providing medical care, representatives of medical tourism providers and representatives of insurance providers to provide an accurate assessment of the medical care, medical tourism and medical insurance markets;
- Rank doctors and their organisations, medical tourism agencies, and insurance providers based on several factors and considerations;
- Send research participants a link to our website where the new Global Doctor Review Guide is available free of charge;
- Contact doctors and organisations we have ranked, their business development professionals and others to explore marketing opportunities we think may be of interest to them;
- Conduct our activities as researchers and analysts of Topuz & Partners, website and other publications;
- Provide users of publications and other customers with the services or information that they have requested from us;
- Promote, manage and administer our research and other business activities;
- Deal with requests and/or enquiries we receive from individuals or organisations;
- Provide information about us or our services when requested;
- Perform contracts and keep a record of any communications and agreements with individuals;
- Administer and manage our website;
- And for any other purposes for which personal information has been provided to us.
3.1. Participating Organisations
(A) Legal Grounds for Processing Personal Information
3.1.1. Consent
We rely on your consent to process the following data elements:
(a) Cookies and Similar Technology— We use strictly necessary cookies to operate our services and, where you have consented, functional cookies to enable embedded map features, analytics cookies and similar technologies (including Google Analytics) to measure site usage, and marketing cookies and similar technologies (including Meta Pixel) to measure advertising effectiveness and optimise our ads. When you consent to analytics cookies, we load Google Analytics (gtag.js) to collect page views and aggregate traffic data. When you consent to marketing cookies, we also send corresponding server-side conversion events to Meta via the Conversions API, which may include hashed identifiers (such as email or phone where available), IP address, browser user agent, page URL, and information about your interactions with our services (for example contact button clicks or care advisor completions). Google Analytics, Meta Pixel, and consent-gated Conversions API events are not loaded or sent until you grant the relevant consent. Retention of data processed by Meta through these tools is governed by Meta's Business Tools Terms: hashed contact information is deleted by Meta following the matching process, and Event Data is retained for a maximum of two years. You can withdraw your consent at any time using our cookie banner or the button in the footer. For more information, please see our Cookie Policy.
(b) Contact Information — We use contact information to respond to your inquiries, send you information as part of the services, and send you marketing information. In jurisdictions where opt-in is required, we will only send you marketing materials based on your consent.
3.1.2. Contract
We collect and use the following data elements on the basis that we have to use this information in order to fulfil our contract with you:
(a) Account Information — We need to use your account information to run your account, provide you with services, bill you for our services, resolve disputes such as chargebacks and refund requests, provide you with customer support, and contact you or your organization about your service or account. These communications are of a transactional nature (e.g., service-related announcements, billing-related matters, changes to our services or policies, a welcome email when you first register). You cannot opt out of these communications since they are required to provide our services to you. We may also use billing information in aggregate to adjust or manage pricing at the individual level or across all service users.
(b) Customer Support Information — We will use information submitted through our Customer Support emails, chats, or phone calls, such as name, email, and message content, in order to provide you with customer support.
(c) Usage Information— We use data about how you use our services and how our services are performing to ensure that we're meeting our service-level agreements (SLAs) or other contractual obligations to you.
(d) Device and Browser Data — We use device data both to troubleshoot problems with our service and to make improvements to it. We will also use this data to facilitate account verification and sign in and to enforce our password sharing and security policies.
(e) Integration Data — We collect and use information from third parties and integration partners, where applicable to one of our services, to ensure you can sign up to our service from a third party integration such as Microsoft Azure AD, Google, or Apple Sign In.
(f) Survey/Interview Questions and Responses — We use professional tools provided by our partners (Microsoft, Zoho) and machine learning techniques on survey data in order to provide users with useful statistics and more relevant insights from the data they have collected using our services.
(g) Aggregated or De-Identified Survey/Interview Questions and Responses — We use aggregated or de-identified information to provide users with useful benchmarking statistics and more relevant insights from the data they have collected using our services. We also use this data to enforce our agreements, where applicable.
3.1.3. Legitimate Interests
We process your personal information in the following categories of data for legitimate interests pursued by us. We have undertaken to ensure that we place clear limitations on each of these uses so that your privacy is respected and only the information necessary to achieve these legitimate aims is used.
(a) Contact Information— Where consent is not required, we use contact information to send you marketing information based on our legitimate interests for as long as you do not opt out. You can opt out of marketing communications at any time by clicking on the “unsubscribe” link in emails or changing the relevant setting in your account page.
(b) Customer Support Information — We may use information provided to our Customer Support, Customer Success, and Sales teams such as name, email, and message content to train machine learning models to better predict customer support question type, provide answers, generate insights about customer support trends, and to improve our Customer Support for you. This data is de-identified where possible.
(c) Usage Information — We use information about how you use our services to improve our services for you and all users and to make recommendations to you and your organisation about our other services.
(d) Event Data — We use events contained in log data for many different business purposes including: to create new services, features, content or make recommendations; to track behaviour at the aggregate/de-identified level to identify and understand trends in the various interactions with our services; to fix bugs and troubleshoot product functionality; and to investigate security issues.
(e) First Party Information — We process other aspects of your account information (like the personal information you provide about your job, your job title, and your marketing preferences) as well as information obtained from public sources, to provide you with a personalized experience and relevant and useful marketing information as well as to make other product, feature and service recommendations to you and your organisation to optimize the use of the services we offer (where permitted by law).
(f) Third Party Information — We combine information about you from third party sources (such as LinkedIn or your company webpage) with information we hold about you to create a user profile, which will help us to make our sales and marketing efforts more relevant to you and to personalize and improve your service experience.
(g) De-Identified Device Data — We use aggregated or de-identified Device Data to extract usage patterns and to improve our services.
3.1.4. Legal Obligation
To respond to legal requests, we may need to disclose information we hold about you. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.
We may also use usage data, event data, and aggregated or de-identified survey questions and responses to enforce our agreements where applicable; to investigate security issues; to prevent or address potentially unlawful activities; and to screen for and prevent undesirable or abusive activity.
3.2. Respondents/Referees
(A) Legal Grounds for Processing Personal Information
We Process Personal Data about you as a Respondent/Referee where: (a) We have your consent; (b) We need to fulfil our contractual responsibility to deliver services to the person or entity that referred you to us; (c) We have legitimate interests; (d) We have a legal obligation.
3.2.1. Consent
We rely on your consent to process the following data elements:
(a) Special Category Personal Data — As part of our research activities through surveys and interviews, we collect the following types of special category personal data under the GDPR: (i) Personal data relating to health; (ii) Personal data relating to ethnicity and nationality. When we reach out to you via one of our surveys, we will ask for your valid, specific and informed consent before we let you proceed with filling out the survey. When our analysts arrange an interview with you, they will not start the interview prior to asking for your valid, specific and informed consent.
(b) Personal Data relating to your Sex and Age — We use personal data relating to sex and age in our surveys and phone calls for statistical analysis, demographic segmentation, and identifying healthcare disparities. However, given that such data may allow us to infer special category personal data even if it is not our intention (e.g., gender identity), we will ask for your explicit consent prior to collecting such data.
3.2.2. Contract
(a) Contact Information — We only use contact information (telephone numbers and email address): (i) To reach out to you to participate in our research following a referral from a Participating Organisation. This is necessary for us to realise our contractual obligations with Customers (Participating Organisations) to conduct market research; (ii) To respond to an inquiry on behalf of a Participating Organisation if you, as a Respondent/Referee, contact us.
(b) Cookies — We use Zoho to collect responses to our surveys. When you visit a survey page hosted by Zoho, Zoho may use cookies in accordance with their own Privacy Policy and Cookie Policy. We do not set cookies as part of this process. We use Microsoft Teams to conduct interviews. When you join a Teams meeting, Microsoft may collect cookies or other technical data in accordance with their own Privacy Statement. We do not set or access any cookies during this process.
(c) Device and Browser Data — We use device data both to troubleshoot problems with our service and to make improvements to it. We use your device and browser data to provide our services to Participating Organisations. For example: your IP address is used to ensure that you do not complete the same survey form, application or questionnaire twice to avoid ballot stuffing. We use Calendly to schedule appointments. When you visit our Calendly booking page, Calendly may collect cookies and technical data in accordance with their own Cookie Policy. We do not set or access any cookies on Calendly-hosted pages.
(d) Inferred Geographic Location — We also may infer your geographic location based on your IP address. We use this feature to: filter or analyse reviews based on country/regions to understand referee/respondent experiences across different regions; identify regional trends, disparities or issues with organisations and individuals we research for the rankings; compile regional insights and location-based segmentation; and to prevent fraud and maintain the integrity of our research.
(e) Event Data — We use event data for many different business purposes including the following: to create and improve services, features, content or make recommendations; to track behaviour at the aggregate/de-identified level to identify and understand trends in the various interactions with our services; and to fix bugs and troubleshoot product functionality.
(f) Survey Response Data— We use Zoho to send out surveys. Zoho may use first party machine learning or third party artificial intelligence tools on data around the type of survey we have sent you, the question type, survey responses (at an aggregated and de-identified/pseudonymised level only where possible), and device and event data associated with responses to fulfil their contract with us and provide us with useful and relevant insights from the data we have collected using Zoho's services.
3.2.3. Legitimate Interests
We process your personal information in the following categories of data for legitimate interests pursued by us.
(a) Usage Information: We use information about how you use our services to improve our services for you and all users and to make recommendations to our customers about usage of our services.
(b) Responses (in aggregated and/or de-identified form): We use your responses to research the market, maintain our professional service offerings, and develop new features or services/products.
(c) Inferred geographic location: We may infer your geographic location based on your IP address to produce aggregated data around Respondent location trends.
3.2.4. Legal Obligation
To respond to legal requests, we may need to disclose information we hold about you. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond. We may also use usage data, event data, and aggregated or de-identified survey questions and responses to enforce our agreements; to investigate security issues; to prevent or address potentially unlawful activities; and to screen for and prevent undesirable or abusive activity.
3.3. Visitors
(A) Legal Grounds for Processing Personal Information
We rely on one or more of the following processing conditions: (i) Perform our contractual obligations; and/or (ii) Satisfy any legal and regulatory obligations to which we are subject; and/or (iii) Satisfy our legitimate interests in the effective delivery of information and services and in the effective and lawful operation of our businesses; and/or (iv) When we have consent to process personal information.
In some cases, as a former website visitor, we may not have any personal information about you (for example if you have not interacted with our site or have cleared your cookies).
3.3.1. Consent
We rely on your consent to process the following data elements:
(a) Contact Information — We use contact information to respond to your inquiries or send you information about our services, either where you have agreed to this at the point of providing your information or where you operate in a business which may be interested in our services and for as long as you do not opt-out.
(b) Cookies and similar technology— We use strictly necessary cookies to operate our website and, where you have consented, functional cookies to enable embedded map features, analytics cookies and similar technologies (including Google Analytics) to measure site usage, and marketing cookies and similar technologies (including Meta Pixel) to measure advertising effectiveness and optimise our ads. When you consent to analytics cookies, we load Google Analytics (gtag.js) to collect page views and aggregate traffic data. When you consent to marketing cookies, we also send corresponding server-side conversion events to Meta via the Conversions API, which may include hashed identifiers (such as email or phone where available), IP address, browser user agent, page URL, and information about your interactions with our site (for example contact button clicks or care advisor completions). Google Analytics, Meta Pixel, and consent-gated Conversions API events are not loaded or sent until you grant the relevant consent. Retention of data processed by Meta through these tools is governed by Meta's Business Tools Terms: hashed contact information is deleted by Meta following the matching process, and Event Data is retained for a maximum of two years. Our website is built using Next.js and hosted on Vercel. You can withdraw your consent at any time using our cookie banner or the button in the footer. For full details of the cookies and technologies we use, see our Cookie Policy.
3.3.2. Contract
(a) Device and Event Data — We use device data to fix bugs and troubleshoot problems with our service and to make improvements to it.
3.3.3. Legitimate Interests
We also carry out the following processing for legitimate business interests pursued by us.
(a) Third party profile information: Where permitted by law, we combine information about you from third party sources with information we hold about you to create a user profile, which will help us to make our sales and marketing efforts more relevant to you and to personalize and improve our marketing/sales campaigns and website experience.
(b) Usage information: We use information about how you have interacted with our websites to improve our website services for you and all users.
(c) Event data: We use event data for many different business purposes including the following: (i) To monitor abuse and troubleshoot; (ii) To track your preferences and create new services, features, content or make recommendations personalized for you; (iii) To track behaviour at the aggregate/de-identified level to identify and understand trends in the various interactions with our services; and (iv) To fix bugs and troubleshoot product functionality.
(d) Customer Support information: We may use information provided to our Customer Support, Customer Success, and Sales teams such as name, email, and message content to train machine learning models to better predict customer support question type, provide answers, generate insights about customer support trends, and to improve our Customer Support. This data is de-identified where possible.
(e) Referral information: We use referral information to track the success of our integrations and referral processes.
3.3.4. Legal Obligation
To respond to legal requests, we may need to disclose information we hold about you. We may also use event data: (i) To enforce our agreements where applicable; (ii) To prevent potentially illegal activities; and (iii) To screen for and prevent undesirable or abusive activity.
4. How We Share or Disclose Personal Data
4.1. Information You Share
Many of our services let you share information with others. Remember that when you share information publicly, it can be indexable by search engines. Our services provide you with different options on sharing and deleting your content but we cannot delete content from search engines so you need to be careful about information you make public.
4.2. Information We Share
We do not share your information or data with third parties outside Topuz & Partners except in the following limited circumstances.
(a) If you are a Participating Organisation with several user accounts your account information and data will be shared with the primary administrator(s).
(b)If you are part of a plan held by your organisation, your plan's administrator(s) can transfer your account data to, or share them with, other members in your team. Your plan's administrator(s) can also delete data held on your account.
(c) If your organisation has purchased a new plan and you are using an email address on a domain owned by your employer or organisation, you may be asked to migrate to the new account.
(d) To help us provide certain aspects of our services we use our affiliates and trusted key partners, in particular:
- For email delivery, we use Zoho and Resend; for text/SMS services we use Microsoft Teams; for surveys we use Zoho;
- We use Calendly to schedule appointments;
- We use Stripe to facilitate payments by Participating Organisations;
- We use NextAuth together with Microsoft Azure AD, Google OAuth, and Apple Sign In to manage account authentication;
- We use Turso (a libSQL database hosted in the EU — Dublin, Ireland) to store account data and consent audit records;
- Our website is hosted on Vercel and our DNS is managed via Cloudflare;
- If you contact us via the WhatsApp button on our website, your message is processed by Meta Platforms Inc. (WhatsApp) in accordance with their privacy policy.
- When you consent to analytics cookies, we use Google LLC (Google Analytics 4) to measure site usage in accordance with Google's privacy policy.
- When you consent to marketing cookies, we use Meta Platforms Inc. (Meta Pixel and Conversions API) for advertising measurement and ad optimisation in accordance with Meta's Business Tools Terms.
We enter into confidentiality and data processing agreements (DPAs) with partners where possible to ensure they comply with high levels of confidentiality and best practices in privacy and security standards and we regularly review these standards and practices.
5. Data Processors and Sub-processors
The following table lists the key processors and sub-processors we engage in delivering our services.
| Processor / Service | Country | Purpose | Legal Basis | Privacy Policy |
|---|---|---|---|---|
| Vercel Inc. | USA (SCCs) | Website hosting and infrastructure | Contract | vercel.com/legal/privacy-policy |
| Cloudflare Inc. | USA (SCCs) | DNS, security, performance proxy | Legitimate Interests | cloudflare.com/privacypolicy/ |
| Turso (ChiselStrike Inc.) | EU — Dublin, Ireland | Database: member accounts, consent audit log | Contract | turso.tech/legal/privacy |
| Stripe Inc. | USA (SCCs) | Payment processing | Contract | stripe.com/gb/privacy |
| Resend Inc. | USA (SCCs) | Transactional email delivery | Contract | resend.com/legal/privacy-policy |
| Microsoft Corporation (NextAuth / Azure AD) | USA (SCCs) | Authentication: member sign-in via Microsoft OAuth | Contract | privacy.microsoft.com |
| Google LLC (OAuth) | USA (SCCs) | Authentication: member sign-in via Google OAuth | Contract | policies.google.com/privacy |
| Apple Inc. (Sign in with Apple) | USA (SCCs) | Authentication: member sign-in via Apple | Contract | apple.com/legal/privacy/ |
| Zoho Corporation | EU — Amsterdam, Netherlands | Survey delivery, CRM, email | Contract | zoho.com/privacy.html |
| Microsoft Corporation (Teams) | USA (SCCs) | Interview and communication platform | Contract | privacy.microsoft.com |
| Calendly LLC | USA (SCCs) | Appointment scheduling | Contract | calendly.com/legal/privacy-notice |
| Meta Platforms Inc. (WhatsApp) | USA (SCCs) | WhatsApp contact button: processes messages sent via WhatsApp | Consent | whatsapp.com/legal/privacy-policy |
| Meta Platforms Inc. (Pixel + Conversions API) | USA (SCCs) | Advertising measurement and ad optimisation: Meta Pixel (browser) and Conversions API (server) for event matching. We send hashed email/phone where available (deleted by Meta following the matching process, per Meta's Business Tools Terms), plus Event Data (IP address, user agent, page URL, and interaction data such as contact button clicks or care advisor completions), which Meta retains for a maximum of two years per their Business Tools Terms. | Consent | facebook.com/legal/technology_terms |
| Google LLC (Google Analytics 4) | USA (SCCs) | Website usage statistics (analytics cookies, consent required): page views and aggregate traffic measurement via gtag.js / Google Analytics 4 | Consent | policies.google.com/privacy |
| Google LLC (Maps API) | USA (SCCs) | Embedded directory map (functional cookies, consent required) | Consent | policies.google.com/privacy |
| OpenStreetMap Foundation / unpkg CDN | UK / USA (SCCs) | Embedded location maps on profile pages (functional cookies, consent required) | Consent | osmfoundation.org/wiki/Privacy_Policy |
SCCs = Standard Contractual Clauses approved by the UK ICO or European Commission for international data transfers.
6. Exercising Your Rights
6.1. UK Data Protection Officer
We have appointed a Data Protection Officer (DPO). If you wish to contact our DPO you can do so via: privacy@globaldoctorreview.com
6.2. Making a Complaint to the ICO
We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact us and we'll respond. If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Information Commissioner's Office (ICO), the UK supervisory authority.
Please follow this link to see how to do that.
6.3. Data Controller Representative (Turkey)
We have appointed a Data Controller Representative in Turkey to comply with our obligations under the KVKK. You can reach out to the Data Controller Representative via:
6.4. Making a Complaint to the KVKK Board (Turkey)
We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact us and we'll respond. If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Kişisel Verileri Koruma Kurumu (KVKK Board), the Turkish supervisory authority.
You can access our VERBIS record here: verbis.kvkk.gov.tr
To make complaints to the KVKK Board, please follow the steps outlined here: kvkk.gov.tr/Icerik/5362/Veri-Ihlali-Bildirimi
Questions about your data?
Contact our team for privacy enquiries at privacy@globaldoctorreview.com.