Privacy Policy

1. Who we are (Data Controller)

Nexwell Global Solutions FZCO(“NexWell”, “we”, “us”) is the controller of the personal data described in this policy.

• Registered entity: NEXWELL GLOBAL SOLUTIONS FZCO
• Licence: Dubai Integrated Economic Zones Authority (IFZA), Licence No. 53266
• Registered address: IFZA Properties, Dubai Silicon Oasis, Dubai, UAE
• Contact: info@thenexwell.com

Our role.NexWell (Nexwell Global Solutions FZCO) is a medical tourism company and is the data controller for the enquiry and coordination data you give us before treatment — your identity, contact details, treatment interest, and any records you share with your coordinator. Your treatment itself is carried out by a contracted, independent clinic in Türkiye. That clinic is a separate legal entity and acts as its own, independent data controller for the clinical data it records when it treats you (diagnosis, treatment notes, imaging taken at the facility). Where NexWell passes your enquiry data to that clinic so it can prepare your treatment, this is a disclosure to a separate controller, not an internal transfer within one company.

2. What data we collect

Data you give us (enquiry / quote forms):

• Identity & contact: name, email address, phone number, country of residence.
• Health-related information (special category): the treatment or procedure you are interested in, and any medical details you choose to share in your message or supporting documents.

Payment data: where a deposit or payment is processed, it is handled by our payment processor Stripe; NexWell does not store full card numbers.

Data collected automatically: IP address, device / browser information, pages viewed, and cookie / analytics identifiers (see Section 8).

3. Why we use it, and our legal basis

How we rely on the law for health data depends on how you share it. When you upload documents for a clinical assessment, we ask for your explicit consent, which you may withdraw at any time (Section 6). When you mention health information in our AI chat, we handle it as described in Section 4A.

4. Who we share data with

When you proceed toward treatment, we share your enquiry and coordination data with the contracted clinic that will perform your treatment, so it can prepare your case as an independent data controller. We also share data with the following external recipients:

• The contracted clinic that performs your treatment — an independent data controller for the clinical data it records.
• GoHighLevel / LeadConnector — enquiry and CRM management.
• Stripe — payment processing.
• Google Analytics (GA4) & Google Tag Manager — website analytics (with consent).
• Meta (Facebook) Pixel — advertising measurement (with consent).
• Cookiebot — cookie-consent management.
• Sentry — application error monitoring.
• Anthropic — AI provider that generates the chat assistant's replies (Section 4A).
• Google Ads — advertising conversion measurement for chat enquiries that came from a Google ad (click identifier only; Section 4A).

We put data-processing agreements in place with our other processors.

4A. Our AI chat assistant

The chat window on thenexwell.com (“NexWell AI Assistant”) is run by an AI system, not by a person. It answers general questions about treatment, travel and next steps. This section explains what happens to what you type in it.

It is not medical advice. The assistant cannot examine you, diagnose you or decide whether a treatment is right for you. Its answers are general information. Only a clinician who has reviewed your case can give you a treatment recommendation. If you have an urgent health problem, contact a local doctor or emergency service, not the chat.

Please share only what you need. You can ask most questions without giving any health details, your name or your contact details. If you do share health information, we treat it as sensitive (special category) data.

What we collect in the chat

• Your messagesand the assistant's replies, which may include health information if you choose to write it.
• Contact details, only if you give them: name, email address and/or phone number, for example when you ask our team to contact you.
• Photos or X-rays, only if you upload them. Before an upload we ask for your separate permission.
• Technical data: IP address, browser/device information (user agent) and a session identifier. If you arrived by clicking a Google ad, the chat also receives the Google click identifier (gclid) from the page.

Why we use it

• To answer your questions in the chat.
• If you leave your contact details: to create an enquiry in our patient system so our team can follow up with you, with a summary of your conversation.
• If you arrived from a Google ad and leave your contact details: to tell Google Ads that the ad led to an enquiry, so we can measure our advertising (details below).
• To improve the assistant: our staff may periodically use the AI provider to review recent chat questions and identify information the assistant is missing. Suggestions from this process are checked by a person before anything is added to the assistant's knowledge.
• To keep the service secure and prevent misuse (for example, rate limiting and security logs).

Legal basis

We do not ask you to tick a consent box to use the chat. We process your messages because you asked us to answer you and, where relevant, to take steps before a possible treatment at your request (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). Security and service improvement rely on our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). Where you choose to share health information, we rely on GDPR Art. 9(2)(h) (assessment for health care, handled under professional confidentiality) and KVKK Art. 6(3). Photo and X-ray uploads are handled only with your explicit consent, which you give at the time of upload.

Who receives it

• Our AI provider, Anthropic.Anthropic processes your messages on our behalf to generate the assistant's replies.
• Our patient-management system, operated by NexWell, stores the conversation and any contact details you leave.
• Google Ads, only if you arrived from a Google ad and you leave your contact details. In that case we send Google the click identifier (gclid), an internal reference number and a conversion value. We do not send Google your name, email, phone number or messages.

Transfers outside Türkiye and the EU/UK

Anthropic processes chat messages on servers in the United States. The United States does not have an adequacy decision under KVKK.

How long we keep it

• Chats where you left no contact details: deleted automatically 90 days after the last message.
• Chats that became an enquiry (you left contact details): the chat and your contact details are kept for 5 years from your last contact with us, then deleted or anonymised.
• Uploaded photos and X-rays: deleted automatically 600 days after upload, or earlier if the chat itself is deleted.
• Google click identifier (gclid): held only in temporary memory, for up to 48 hours, to send the single advertising report. It is not saved to our database.

No automated decisions about you

The assistant does not decide whether you are eligible for treatment, what treatment you need, or what price you pay. These are decided by people on our team after reviewing your case. If you ask to speak with a person, or leave your contact details, a member of our team will follow up.

Your rights

You have the same rights over your chat data as over any other data we hold: access, correction, deletion, objection and the others listed in Section 6. For example, you can ask us to delete a chat before the 90-day period ends. Write to us at the address in Section 1. Include the date and approximate time of your chat, and the email or phone you used if you left one, so we can find it.

5. International data transfers

Your data — including health data — may be transferred between the United Arab Emirates (where NexWell is established), Türkiye (where our contracted clinics deliver treatment) and the EU / UK (where many patients are located). Where we transfer EU / UK personal data to these countries, we rely on appropriate safeguards, namely Standard Contractual Clauses (SCCs). Messages you write in our AI chat are also processed by our AI provider in the United States— see Section 4A.

6. Your rights

Under GDPR / UK GDPR you have the right to access; rectification; erasure; restriction; data portability; to object; to withdraw consent at any time; and not to be subject to solely automated decisions (see Section 4A for our AI chat). Under KVKK (Türkiye) you have equivalent rights.

To exercise any right, contact info@thenexwell.com. We respond within the legal timeframe (one month under GDPR / 30 days under KVKK).

7. How long we keep your data

We keep personal data only as long as necessary for the purposes described above and as required by law. Enquiry and coordination data is minimised and deleted or anonymised once your case is closed, unless a longer period is legally required (for example, statutory accounting retention for payment records) or a different period applies, as set out below. Clinical records created at the Türkiye facility where treatment takes place are kept for the period required by Turkish health regulations for medical records, after which they are deleted or anonymised. Chat conversations follow the specific periods in Section 4A: chats without contact details are deleted after 90 days; uploaded photos and X-rays after 600 days. Chats that became an enquiry, and the contact details left in them, are kept for 5 years from your last contact with us, then deleted or anonymised.

8. Cookies

We use strictly necessary, analytics and marketing cookies. Non-essential cookies are set only with your consent, managed through our cookie banner (Cookiebot). You can change your preferences at any time via the cookie settings.

9. Data security

We apply appropriate technical and organisational measures (encryption in transit, access controls, HTTPS / HSTS, vetted processors). No method of transmission is 100% secure; we work to protect your data and to notify you and the relevant authority of a breach where legally required.

10. Complaints

If you believe we have mishandled your data you may complain to a supervisory authority — the ICO (UK), your local Data Protection Authority (EU), or the Kişisel Verileri Koruma Kurumu (KVKK, Türkiye). We ask that you contact us first at info@thenexwell.com so we can try to resolve it.

11. Changes to this policy

We may update this policy; the “Last updated” date above shows the latest version. Material changes affecting how we use health data will be notified where required.