Last updated: 01.08.2026
1. Who we are
Websens CRM is a customer relationship management (CRM) software built for healthcare organizations and health tourism agencies. This policy is published by the entity operating the service ("Websens", "we").
- Address: Antalya
- Email:
2. The most important distinction: whose data, whose responsibility
Clinics, hospitals and agencies using Websens CRM (the "Customer") enter their own patient candidate data into the system. In this relationship:
- The Customer is the data controller. The Customer decides which data is collected, for what purpose it is processed, and how long it is stored.
- Websens is the data processor. We process the data only on the Customer's instructions and to provide the service. We do not use Customer data for our own commercial purposes, do not sell it, and do not transfer it to third parties for marketing purposes.
If you are a patient candidate and want your data deleted, you must first contact the clinic you received services from. If you contact us directly, we will forward the request to the relevant Customer and inform you.
The only area where Websens is its own data controller is the Customer's account information (authorized person's name, email, phone, billing information, session records).
3. What data we process
3.1 Customer account data (data controller: Websens)
- Full name, email, phone, organization name, organization type
- Password (stored in irreversibly encrypted form)
- Billing and subscription records
- Login time, IP address, browser information
- In-panel transaction records (audit log)
3.2 Patient candidate data (data controller: Customer)
Data entered by the Customer into the system or coming from connected channels:
- Full name, phone, WhatsApp number, email
- Country, city, language, gender, date of birth
- Treatment of interest, treatment notes, budget information
- Messaging content (Messenger, Instagram, WhatsApp, TikTok, email, website chat)
- Uploaded files and images
- Appointment, quote and payment records
- Ad campaign and form information (Meta Lead Ads, UTM parameters)
3.3 Health data notice
Treatment preference, treatment notes and messages sent by the patient are within the scope of KVKK special category personal data can be counted. This data:
- Can only be viewed by users authorized by the Customer
- Technically isolated between accounts; one Customer can under no circumstances access another's data
- Kept under access control on the database and file server
Obtaining explicit consent from the data subject before entering such data into the system is the Customer's responsibility.
4. Data from Meta platforms
The Customer may connect their Facebook Messenger, Instagram Direct or WhatsApp Business account to Websens CRM. This connection is established through Meta's own permission screen; Websens never sees or stores the Customer's Meta or WhatsApp password.
Data we receive from Meta platforms and the purposes of use:
| Data | Purpose |
|---|---|
| Incoming and outgoing messages | To display and reply to messages in the CRM inbox |
| Sender's name and platform ID | To match the conversation with the correct patient record |
| Page / WhatsApp Business account information | Connecting the channel to the correct Customer account |
| Ad form (Lead Ads) responses | Saving the person who filled out the form as a prospective patient |
| Access token | Receiving and sending messages on behalf of the Customer |
This data:
- Is visible only in the relevant Customer's account
- Is not used for advertising purposes and is not sold to third parties
- Is deleted when the Customer removes the channel or closes their account
Data received from Meta is processed in accordance with the Meta Platform Terms and Developer Policies.
5. Use of artificial intelligence
If the Customer wishes, they can enable the AI-powered automatic reply (chatbot) feature. Unless it is enabled, no messages are sent to an AI provider.
When enabled, the conversation text is transmitted to the selected provider to generate a reply. Supported providers: OpenAI, Anthropic, Google Gemini, Groq.
The Customer may use their own API key; in this case, data flows directly between the Customer and the provider. When credit provided by Websens is used, the request is made through the Websens account.
A Customer who enables this feature is expected to inform the relevant individuals that patient data will be transferred to an AI provider abroad and to obtain the necessary consent.
6. Third parties we receive services from
We use the following providers to deliver the service:
| Provider | Purpose | Data transferred |
|---|---|---|
| Hostinger | Server and email infrastructure | All system data (hosting) |
| Meta Platforms | Messenger, Instagram, WhatsApp, ad forms | Message and form data |
| TikTok | Ad form integration | Form responses |
| PayTR | Subscription collection | Name, email, phone, amount |
| NetGSM | SMS sending (if enabled by the Customer) | Phone number, message text |
| OpenAI / Anthropic / Google / Groq | AI response (if enabled by the Customer) | Conversation text |
Card details never enter our system; payment is completed on PayTR's own secure page.
7. Where data is stored
System data is kept on servers hosted in data centers in Europe. The third-party services listed above (Meta, AI providers, etc.) operate their own infrastructure abroad; when these services are used, the relevant data is transferred abroad.
8. Retention period and deletion
- Data is stored for as long as the Customer's account remains active.
- When the Customer closes their account, the data is made inaccessible.
- When requested by the Customer or an authorized person, the account is permanently deleted together with all its data: including patient records, messages, files, quotes, collections and user accounts. This action cannot be undone.
- Before closing their account, the Customer Account & Brand → Export data screen, you can download all your data.
- Invoice records subject to legal retention obligations are stored for the period required by the relevant legislation.
- System backups are taken regularly; deleted data is removed from backups within 30 days at the latest.
9. Data security
- All traffic is encrypted with HTTPS
- Passwords are stored in an irreversible form
- Two-step verification is supported and can be enforced by the Customer
- Each Customer account is isolated at the database level
- Critical actions within the panel are recorded in the audit log
- User permissions can be restricted on a role basis
No system can promise absolute security. If you notice a security vulnerability, report it to this address.
10. Cookies
We only use cookies necessary for the service to function: session cookie, security (CSRF) cookie and language preference. We do not use third-party cookies for advertising or profiling purposes.
11. Your rights
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed, to request information, to request its correction or deletion, to object to processing and to claim compensation if you suffer damage.
You can send your applications to this address. Requests are concluded within 30 days at the latest.
If you are a prospective patient and a clinic has entered your data, we remind you that you must direct your request primarily to that clinic (see Article 2).
12. Changes
This policy may be updated. In case of significant changes, Customers are informed by email and the date at the top of the page is updated.
13. Contact
Email: