BAO HEALTH / bao-2026-11-03-privacy
Data Processing and Privacy Policy
DATA PROCESSING AND PRIVACY POLICY
As Barış Akın Organisation; (“BAO”), we care about your personal information.
While trying to provide you with the best service, we need to process certain personal information of yours. We have prepared this Data Processing and Privacy Policy (“Policy”) to explain how we handle your personal information.
Processed data categories: We may process the following data categories directly or via our AI based analytical platform (“PIN” or “Platform”);
| Category | Processed Data | Storage Location |
| Identity and Contact | Full name, date of birth, phone, email, address | Only in BAO files and pre-application records. Not entered into matching platform. |
| Demographic | Birth year, gender, country | Platform under anonymous code |
| Health - Immunological | Blood type and Rh, HLA tissue typing (A, B, C, DR, DQ, DP), anti-HLA antibody panel and MFI values, PRA percentage, unacceptable antigens | Platform under anonymous code |
| Health - Clinical | Dialysis start date, comorbidities, previous transplant history, priority status, clinical notes | Platform under anonymous code |
| Donor Information | Donor's birth year, gender, blood type, HLA typing, degree of relationship, health status | Platform under anonymous code |
| Documents | HLA and antibody lab reports (Image / PDF) | Uploaded by BAO with identity fields redacted |
Processing purposes
Evaluation of blood type, HLA, and antibody compatibility and creation of paired exchange proposals.
Transmission of match proposals to Participating Partners under anonymous codes and ensuring clinical coordination.
Fulfilling legal obligations arising from organ transplantation legislation.
Generating statistics regarding program performance using de-identified data and conducting scientific research if permitted.
Platform: We may only process certain personal information as part of your visit to our platform. This personal information includes information about your visit, such as browser type, operating system, actions you take on the site, and the IP address you use to access pages on the sites.
Communication: As BAO, we may contact you for your requests, inquiries and suggestions during the provision of services. We care about your feedback regarding the services it offers and take it into account to improve its services. These processes are carried out within our legitimate interests.
Execution of legal processes: We process your personal information in order to protect your rights in case of a potential dispute. In addition, there may be situations where BAO requires to disclose the information to the governmental authorities and agencies in order to perform its legal obligations.
Ensuring the platform security: During the processing of your personal information, we and PIN take serious precautions to ensure compliance with the relevant legislation, identify violations and prevent any crime.
Security measures provided by PIN:
Anonymous coding: Names, ID numbers, or exact birth dates are not stored on the platform. The link between code and identity exists only in your Participating Partner’s own records; no platform user, including the operator, can match a code to an individual.
Hosting: Data is stored in ISO 27001 certified data centers within the European Union (Germany) and does not leave the EU.
Encryption: All connections are encrypted via TLS; database and backups are stored encrypted using AES-256.
Center-based access: As BAO we can only see our own records. Other medical centers can only view medical parameters under an anonymous code within the scope of a match proposal.
Audit log: Every login and record change (who, what, when, from which address) is recorded immutably.
Communication: Clinical data is not shared via email; inter-center coordination is conducted via secure messaging within the platform.
Data transfers:
To PIN: Only within the scope of a match proposal; via anonymous codes and required medical parameters..
Cloud infrastructure provider of PIN: Hetzner (Germany, EU) - encrypted hosting and backup.
AI-assisted analysis (optional): PIN uses various AI models like Anthropic Claude - strictly with anonymous medical parameters over encrypted connections; data is not used for model training. You may decline and opt-out from this feature any time by giving us a notice via email or in any written form.
Authorized public institutions: Ministries of Health, National Coordination Systems, and authorized judicial/administrative authorities in case of legal obligation.
International Transfers: Some of our third-party service providers and business partners may operate in different countries. This means that we may process your personal information in any of these countries. However, please note that we have taken all the necessary measures in accordance with the applicable data protection requirements to ensure the protection of your personal information during these transfers.
Retention period:
We are aware that your personal information belongs only to you. For this reason, we do not keep the personal information you share with us for longer than necessary.
However, there may be certain legal periods during which we are required to keep your personal information. These periods are specified in applicable laws. If such a period is determined, we comply with this period and delete, destroy or anonymize your personal data in the first periodic destruction process after the expiry of this period.
If you would like us not to retain your personal information further, we respect your request. If we are not bound for a legal period, we will try to honor your request promptly. However, if there is a legal period to which we are bound, we inform you that we will continue to store your personal information.
Therefore, in line with the aforementioned principle your data is processed whilst you remain on the program. If you withdraw consent, your record is removed from the active list and deleted from the platform. The deletion shall be recorded for legal and audit purposes. If transplantation takes place, procedure-related medical records are retained by your transplant center and may be by BAO for the period required by law.
Your rights:
| Right to Access | You have the right to know how your personal information has been collected and processed, what information exists in our systems, and for what purposes it has been processed. This information may be accompanied by a copy of the requested data. |
| Right to Correction (Rectification) | You have the right to request a correction on incorrect or incomplete personal information of yours. |
| Right to Erasure (Right to Be Forgotten) | You have the right to have your personal information permanently deleted. But this is not an absolute right to require all personal information to be deleted. We will consider each erasure request in accordance with the requirements of applicable laws. |
| Right to Restriction of Processing | You have the right to block or limit your personal information being processed. |
| Right to Data Portability | You have the right to move, copy, or transfer personal information from one data controller to another, in a safe and secure way, in a commonly used and machine-readable format. |
| Right to Object to Processing | You have the right to object to being subject to processing your information based upon the lawful basis of legitimate interest. You also have the right to stop your personal information from being included in direct marketing databases. |
| Right to Not Be Subject to Automated Decision Making | You have the right not to be subject to a decision which is based on automated processing where the decision will produce a legal effect or a similarly significant effect on you. |
You also have the right to complain to a Data Protection Authority about our use and collection of your personal data. For more information, please contact the relevant Data Protection Authority in your country.
You may contact us at any time when you have a question about how we collect, store and use your personal information or when you wish to exercise your rights about your personal information.