Datenschutzerklärung

1. Who is responsible for your data

This website is operated by Op. Dr. Mehmet Akbalık, who is the data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, for visitors in the European Union and the United Kingdom, under the General Data Protection Regulation ("GDPR").

Address: Abdi İpekçi Caddesi No:15 Daire:5, Harbiye, Şişli, 34360 İstanbul, Türkiye

Contact: 0541 298 17 77

The practice is established in Türkiye. If you are in the EU, the UK, or elsewhere, this policy describes how your data is handled under both regimes.

2. What we collect

When you complete the consultation form: your name, email address, telephone number, the country you are writing from (optional), the procedure you say you are interested in (optional), the message you write to us, the language you would like to be contacted in, the exact wording of the consent you agreed to, and the moment you agreed to it.

The procedure you name and anything you write in your message are health data - a special category under GDPR Article 9 and KVKK Article 6. We do not process them without your explicit consent, and the tick box on the form is that consent.

Submitted with the form, automatically: the address of the page you submitted from, the site that referred you, any advertising campaign parameters present in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid, ttclid, msclkid), your browser's user agent string, and the two-letter code of the country you are connecting from.

Your IP address is not stored. Only an irreversible salted hash of it is kept, so that abuse can be investigated without retaining an identifier - and if no salt is configured, nothing is stored at all.

If you only read the site and never submit the form, nothing is recorded about you beyond the cookies described in the cookie policy.

3. Why we process it, and on what legal basis

To answer your enquiry, contact you, arrange a consultation where appropriate, and coordinate treatment if you are travelling to Istanbul. Legal basis: your explicit consent for the health data (GDPR Art. 9(2)(a); KVKK Art. 6(3)), and steps taken at your request prior to a contract for your contact details (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

If a consultation takes place and treatment begins, processing from that point rests on the provision of health care and medical diagnosis: GDPR Art. 9(2)(h) and the corresponding ground in KVKK Art. 6(3).

To prevent automated submissions, abuse and attacks on the form. Legal basis: legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

To measure the site and our advertising through analytics and advertising cookies. Legal basis: your consent alone (GDPR Art. 6(1)(a)). Decline, and none of those tools ever load.

To meet record-keeping, accounting and other legal obligations. Legal basis: GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç).

We do not sell, rent or trade your personal data, and we do not pass it to third parties for their own marketing.

4. Where your data goes

The site and its database run on infrastructure located in the European Union (Frankfurt, Germany). For visitors in Türkiye this is a transfer abroad and rests on your explicit consent under KVKK Article 9; the consent you give on the form covers it.

The processors involved and what each does: Vercel Inc. (hosting), Neon Inc. (database), Upstash Inc. (rate limiting that protects the form), Resend (delivering your enquiry to the practice by email).

Only if you accept cookies: Google Ireland Ltd. (Google Tag Manager, Google Analytics, Google Ads) and Meta Platforms Ireland Ltd. (Meta Pixel). The map on the contact page is loaded from Google when you open that page.

Where a transfer leaves the EEA, it is made under the European Commission's Standard Contractual Clauses (GDPR Art. 46). You can ask us for the current list of processors and the safeguards in place using the contact details above.

5. How long we keep it

Enquiries that do not lead to a consultation or treatment: 24 months from our last contact with you, then deleted.

Records where treatment took place: these become part of your medical file and are kept for the period Turkish health legislation requires, which is 20 years for patient records.

Consent records (the wording you agreed to and when): kept for the limitation period after the processing ends, as evidence that consent was given.

Technical records and the hashed IP: 12 months.

Cookie lifetimes are listed individually in the cookie policy.

6. Your rights

Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict how it is processed, to receive it in a portable form, and to object to processing based on legitimate interests.

Under the KVKK you have the right to learn whether your data is processed, to be informed about it, to learn the purpose and whether it is used accordingly, to know the third parties it has been transferred to in Türkiye or abroad, to have incomplete or inaccurate data corrected, to have it deleted or destroyed, to have any correction or deletion notified to those third parties, to object to a decision produced solely by automated analysis, and to claim compensation for loss caused by unlawful processing.

Wherever processing rests on your consent, you can withdraw that consent at any time. Withdrawal does not affect processing carried out before it.

Write to 0541 298 17 77, or to the postal address above. We answer within 30 days.

7. Complaints

If we refuse your request, answer it inadequately, or fail to answer in time, you may complain to the Turkish Personal Data Protection Board at kvkk.gov.tr.

If you are in the EU or the UK, you may also complain to the supervisory authority in the country where you live or work, or where you believe the problem occurred.

8. Security

The site and the form are served over HTTPS only. Enquiries are stored in a database inside the European Union over an encrypted connection, reachable only by the clinic's team, and there is no interface on this website through which they can be read.

The form is protected by rate limiting and bot detection. Your IP address is never stored in plain form.

If you choose to send us personal details yourself over email or WhatsApp instead, the security of those channels is a matter for the provider of the channel.

9. Children

This site is not directed at children. Some procedures - ear reconstruction in particular - concern children, and an enquiry on behalf of a child may only be made by a parent or legal guardian. If we learn that a child's health data reached us without that authority, we delete it.

10. Changes

When this policy changes, the date at the top of the page changes with it. If a change is material and processing rests on consent, we ask for your consent again.

The Turkish version of this document is the authoritative one. Where this English text and the Turkish text differ, the Turkish text prevails.