Privacy policy

This policy covers medicalbaazar.com and the quote requests, messages and orders you send through it. It applies to visitors, customers and the people who contact us on behalf of hospitals, clinics and other organisations.

Who is responsible for your data

The company below runs this website. It is the controller of your personal data, which means it decides why and how your data is used.

You can reach us about any privacy question by email at .

What data we collect

We collect the data you give us and some technical data your browser sends. We ask only for what we need for each purpose.

Quote requests

When you send a quote request, we collect the name of your institution, your name, email address, phone number (optional), country, city (optional) and your notes. We also store the products, quantities and accessories in your request, the language of the site and the page you sent it from.

Contact messages

When you use the contact form, we collect your name, email address, phone number (optional), the subject and your message. If you write from a product page, we also store which product you asked about.

Both forms ask you to confirm that we may use your details to answer you. Please do not include health information about patients or yourself in the forms.

Accounts and orders

If you create an account or place an order, we collect your name, company name, billing and delivery address, email address and phone number, the products you order, the payment status and any notes you add. With each order the shop software also stores the IP address and browser details used to place it.

For an account we also store your login details. Your password is kept only as a hash, never in readable form.

If you paid by bank transfer and we refund money to you, we ask for the bank account the refund should go to. We need the name of the account holder and the IBAN, or the other account details the transfer needs where IBAN is not used. We use these details only to pay the refund.

Emails and phone calls

If you write to us or call us, we keep your contact details and the content of the conversation for as long as we need them to deal with your matter.

Server logs and security

Our web server records technical data each time a page is loaded: IP address, date and time, the page requested, the referring page and browser details. We use these records only to keep the site running and secure. They are deleted after a limited time.

To block automated spam, our forms keep a short-lived counter linked to a hashed form of your IP address, not the address itself.

Cookies and order source

We use cookies the site needs to work, for example to remember your language, your cart and your quote list. With your consent, the shop also records how you reached the site (the referring site and the campaign details in the link), the first page you visited and when your visit started, how many pages you viewed, how many times you have visited and your browser and device type. If you then place an order or create an account, this information is saved with the order or the account.

We do not use advertising or analytics tools. Details are in our cookie policy.

Why we use your data

We use personal data only for the purposes below. The legal bases are those of the EU General Data Protection Regulation (GDPR). The sections for your country explain the grounds under other laws.

Some form fields are required. Without them we cannot answer your request or deliver your order. All other fields are optional.

We do not sell your personal data. We do not use it for advertising and we do not send you marketing emails without your consent. We do not make decisions about you based only on automated processing.

Who receives your data

Inside our company, only the people who need your data for their work can see it. We share data outside the company only in these cases:

• Hosting provider. The website and its data are stored on servers run by a hosting company.
• Email service. Emails between you and us, and notifications from the site, pass through an email service provider.
• Banks and payment providers, when you pay for an order or when we send you a refund.
• Carriers, freight forwarders and customs agents, when we deliver an order. They receive your name, delivery address, phone number and the shipment details. For a delivery to another country, customs authorities receive the data the customs declaration requires.
• Professional advisers such as accountants, auditors and lawyers, when we need their help.
• Courts, tax offices and other authorities, when the law requires us to share data or when we need to defend our rights.

Service providers that process data for us may use it only on our instructions and only for the service they provide to us. Banks, payment providers and carriers may also use your data for their own legal obligations, under their own privacy policies.

Transfers to other countries

We serve customers in many countries, and our service providers may be in a different country from you. So your data may be processed outside the country where you live. This can include countries whose laws protect personal data less than the laws of your own country.

When we send data from the EU, the EEA, the UK or Türkiye to a country outside these areas, the transfer rests on a basis the law accepts. Examples are an adequacy decision (Article 45 GDPR), standard contractual clauses (Article 46 GDPR) and the standard contract under Article 9 of Turkish Law No. 6698. Some transfers are needed to answer your request or perform a contract with you, for example when you ask us for a quote from another country (Article 49(1)(b) GDPR). You can ask us for details of the safeguards we use.

How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it for. Then we delete it or make it anonymous. These rules apply:

• Quote requests and messages: until your request is dealt with and any follow-up is complete. If an order follows, we keep them with the order records.
• Orders, invoices and accounting records: for the period that tax and commercial law in our country of registration requires.
• Bank details for a refund: until the refund is paid. The record of the refund payment, which shows the account, stays with our accounting records for as long as those must be kept.
• Customer accounts: as long as the account is open. When it is closed, we delete the account data, except order records we must keep by law.
• Server logs and security records: for a limited time, then they are deleted automatically.
• Backups: they are overwritten in rotation after a limited time.
• Cookies: for the periods listed in our cookie policy.

We keep data longer only if we need it to establish, exercise or defend a legal claim, and only for that purpose.

Your rights

Depending on the law that applies to you, you have these rights:

• Access. Ask whether we process your data and get a copy of it.
• Correction. Ask us to correct wrong or incomplete data.
• Deletion. Ask us to delete your data, for example when we no longer need it. We may keep data that the law requires us to keep.
• Restriction. Ask us to limit how we use your data, for example while we check whether it is correct.
• Portability. Get the data you gave us in a common machine-readable format, or ask us to send it to another company where this is technically possible.
• Objection. Object to processing based on our legitimate interests. We then stop, unless we have compelling legitimate grounds or need the data for legal claims.
• Withdrawing consent. Withdraw your consent at any time. This does not affect processing before the withdrawal. You can change your cookie choice with the Cookie settings link at the bottom of every page.
• Complaint. Complain to a data protection authority. The sections below name the authority for your country.

How to make a request

Send your request by email to or through our contact page. You can also write to us at the address in the first section.

Tell us which right you want to use and how we can reach you. We may ask for information to confirm your identity before we act. This keeps your data away from people who are not you.

Requests are free of charge. If a request is clearly unfounded or excessive, the law may allow us to charge a reasonable fee or to refuse it. We answer within the time limit set by the law that applies to you. The sections below list these limits for the EU, the UK, Türkiye and Russia.

How we protect your data

The whole site uses an encrypted connection (HTTPS). Access to customer data is limited to the people who need it for their work and is protected by passwords. We back up the site regularly so that data is not lost.

No system is completely secure. If a data breach is likely to put your rights at risk, we inform you and the authorities as the law requires.

Children

Our products and this site are meant for organisations and adults. We do not knowingly collect personal data from children. If you think a child has sent us personal data, contact us and we will delete it.

If you are in the EU, the EEA or the UK

The GDPR applies to your data. In the UK, the UK GDPR and the Data Protection Act 2018 apply.

We answer your request within one month. If a request is complex or we receive many, we can extend this by two further months. If we need more time, we tell you within the first month and explain why.

You can complain to the data protection authority in the country where you live or work, or where you think the breach happened. The European Data Protection Board keeps a list of the national data protection authorities.

In the UK, you can first complain to us. We acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner’s Office (ICO).

If you are in Türkiye

This section is our information notice under Article 10 of the Personal Data Protection Law No. 6698 (KVKK).

• Controller: the company named in the first section of this policy.
• Purposes: those in the section on why we use your data.
• Recipients: those in the section on who receives your data, for the purposes stated there. Transfers abroad follow Article 9 of the law.
• Method of collection: electronically, through the forms on this site, by email, by phone and through cookies.
• Legal reasons: the establishment and performance of a contract (Article 5(2)(c)), our legal obligations (Article 5(2)(ç)), the establishment, exercise or protection of a right (Article 5(2)(e)) and our legitimate interests (Article 5(2)(f)). For order source cookies, your explicit consent (Article 5(1)).

Under Article 11 you have the right to:

• learn whether your personal data is processed
• request information about the processing
• learn the purpose of the processing and whether the data is used for that purpose
• know the third parties in Türkiye or abroad to whom your data is transferred
• ask for correction if the data is incomplete or wrong
• ask for deletion or destruction under the conditions in Article 7
• ask that third parties who received your data are told about a correction, deletion or destruction
• object to a result against you that comes only from automated analysis of your data
• claim compensation if you suffer damage because your data was processed unlawfully

Send your application in Turkish. You can send it in writing to our address, or by registered email (KEP), secure electronic signature, mobile signature or from an email address you have given us before and that is registered in our system. Include your name and surname, your Turkish ID number (for foreign nationals, your nationality and passport or ID number), your address for notices, your email address or phone number if you have one, and your request. Sign it if you send it on paper.

We answer within 30 days at the latest and free of charge. If the action has a separate cost, we may charge the fee in the tariff set by the Personal Data Protection Board.

If we reject your application, if you find our answer insufficient or if we do not answer in time, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). You can do this within 30 days of learning our answer, and in any case within 60 days of your application. You must apply to us before you complain to the Board. More information is on the website of the Personal Data Protection Authority.

If you are in Russia

If Federal Law No. 152-FZ “On Personal Data” applies to your data, you have these rights:

• Get information about the processing. This covers confirmation that we process your data, the legal grounds, purposes and methods, our name and location, the data we hold and its source, how long we process and store it, how to use your rights, any cross-border transfer and who processes data on our behalf.
• Require us to clarify, block or destroy your data if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose.
• Withdraw your consent at any time where we process data based on it. After that we may continue only where the law allows processing without consent.
• Appeal our actions or inaction to Roskomnadzor, the authority that protects the rights of data subjects, or to a court. You can also claim compensation for losses and moral harm in court.

Your request should include the number of your identity document, its date of issue and the issuing authority, information that confirms your relationship with us (for example the date of your quote request or your order number) and your signature. An electronic request must carry an electronic signature.

We answer within 10 working days of receiving your request. We may extend this by up to 5 working days if we send you a notice with the reasons.

If you are in the United Arab Emirates or Saudi Arabia

United Arab Emirates

If Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies to your data, you can, in the cases and under the conditions that law sets:

• get information about how we process your data
• ask us to transfer your data
• ask us to correct or erase your data
• ask us to restrict the processing
• ask us to stop the processing
• withdraw your consent at any time

You can file a complaint with the UAE Data Office.

Saudi Arabia

The Personal Data Protection Law (Royal Decree No. M/19 of 9/2/1443 AH) gives you the right to:

• be told the legal basis and purpose of collecting your data
• access the data we hold about you
• obtain a copy of your data in a readable and clear format
• ask us to correct, complete or update your data
• ask us to destroy your data when it is no longer needed, unless the law allows us to keep it
• withdraw your consent at any time

You can submit a complaint to the competent authority under that law, the Saudi Data and AI Authority (SDAIA).

Changes to this policy

We change this policy when our services or the law change. The date at the end of this page shows when we last changed it. If a change affects how we use data you have already given us, we tell you before it applies, where we have a way to reach you.

Last updated October 21, 2026