Уведомление за защита на данните (KVKK)

Who is processing your data

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 (the "Law"), which requires a data controller to inform you at the moment your data is collected. The controller is Op. Dr. Mehmet Akbalık.

Address: Abdi İpekçi Caddesi No:15 Daire:5, Harbiye, Şişli, 34360 İstanbul, Türkiye

Telephone: 0541 298 17 77

The practice is in Türkiye, so the Law applies to your data wherever you are writing from. If you are in the EU or the UK, the GDPR applies in parallel and the privacy policy sets out your rights under it.

What we process

Identity and contact data: your name, telephone number, email address, and the country you are writing from.

Health data: the procedure you say you are interested in, and anything you write in your message. Under Article 6 of the Law this is special-category data.

Transaction security data: the address of the page you submitted from, the site that referred you, any advertising campaign parameters in the link, your browser's user agent, the country code of your connection, and an irreversible hash of your IP address. The IP address itself is not stored.

Record of your request: the exact wording you consented to, and when.

Why we process it

To receive and assess your consultation request, to contact you, to plan an examination and treatment where appropriate, and to organise treatment if you are travelling from abroad.

If your request becomes treatment: to carry out diagnosis, treatment and care, and to plan and manage that care.

To protect the form against automated submissions and abuse, and to maintain information security.

To meet retention, disclosure and record-keeping obligations imposed by law.

Only if you accept cookies: to measure the site and our advertising.

The legal grounds

Your health data is processed on the basis of your explicit consent under Article 6(3) of the Law. Once treatment begins, the ground in the same paragraph applies - diagnosis, treatment and care carried out by health personnel under a duty of confidentiality.

Your identity and contact data are processed under Article 5(2)(c), being directly related to the formation or performance of a contract.

Transaction security data is processed under Article 5(2)(f), the controller's legitimate interests.

Obligations imposed by law are covered by Article 5(2)(ç).

Measurement through cookies rests on your explicit consent alone.

Who your data is shared with

Your data is shared only with the technology providers needed to run the site and its database, and only for the purposes above. Their servers are in the European Union, in Frankfurt, Germany.

This means your data is transferred abroad, and that transfer rests on your explicit consent under Article 9 of the Law. If you do not consent you cannot send a request through the form; you are welcome to telephone the clinic or visit instead.

The providers and what each does: hosting the site, running the database, rate limiting that protects the form, and delivering your enquiry to the practice by email.

If you accept cookies, advertising and analytics providers are also involved. Data may be disclosed to competent public authorities where the law requires it. Your data is never sold or passed to third parties for their own marketing.

How your data is collected

Through the consultation form on this website, electronically, by wholly or partly automated means.

If you contact the clinic by telephone or WhatsApp instead, your data is collected through those channels.

How long it is kept

Requests that do not lead to a consultation or treatment: 24 months from our last contact, then deleted.

Records where treatment took place: these become part of the patient file and are kept for the period health legislation requires, which is 20 years for patient records.

Consent records: kept for the limitation period after the processing ends, as evidence that consent was given.

Transaction security data and the hashed IP: 12 months.

What you are consenting to

When you tick the box on the consultation form, you give explicit consent to two things:

The processing of your health data for the purposes set out above (Article 6(3) of the Law).

The transfer of your personal data abroad through the technology providers named above (Article 9 of the Law).

That consent is informed by this notice and given freely. You may withdraw it at any time without giving a reason. Withdrawal does not undo processing lawfully carried out before it.

Consent for cookies is separate, and is taken through the cookie notice shown when you first open the site.

Your rights under Article 11

To learn whether your personal data is processed; to request information if it has been; to learn the purpose and whether it is used accordingly; to know the third parties it has been transferred to in Türkiye or abroad.

To have incomplete or inaccurate data corrected; to have it deleted or destroyed under Article 7; and to have any correction, deletion or destruction notified to the third parties it was transferred to.

To object to a result reached against you solely by automated analysis of your data.

To claim compensation for loss suffered because your data was processed unlawfully.

How to make a request

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may make a request in one of the following ways:

In writing, signed by hand, delivered in person or through a notary to: Abdi İpekçi Caddesi No:15 Daire:5, Harbiye, Şişli, 34360 İstanbul, Türkiye

Or signed with a secure electronic signature or mobile signature and sent to the clinic's registered electronic mail (KEP) address. This notice will be updated when the clinic begins using one.

State which right your request concerns and include information establishing your identity. For questions about how to apply, telephone the clinic on 0541 298 17 77.

Your request is answered free of charge as soon as possible and in any event within thirty days. Where answering it carries a separate cost, a fee from the tariff set by the Board may be charged.

If your request is refused, the answer is inadequate, or no answer arrives in time, you may complain to the Personal Data Protection Board within thirty days of learning the answer and in any event within sixty days of your original request.

Updates

This notice is updated when it needs to be, and the current version is always published at this address. The date at the top of the page is when it was last revised.

The Turkish version of this notice is the authoritative one.