KVKK Privacy Notice

Draft content: This text is a draft prepared to provide a general framework. It should be reviewed by a legal advisor according to the clinic's actual data processing procedures before publication.

Identity of the Data Controller

In accordance with the Personal Data Protection Law No. 6698 (KVKK), your personal data is processed by [To be filled by the clinic: trade name or business name of the data controller] as the data controller within the scope explained below. The full address of the data controller is [To be filled by the clinic: full address], and the contact information is [To be filled by the clinic: phone and email address]. If there is a registration in the Data Controllers Registry Information System (VERBİS), the registration number is: [To be filled by the clinic].

Categories of Personal Data Processed

Depending on your application and the nature of the service received, the following categories of data may be processed:

• Identity information: name, surname, date of birth, and T.R. identity number when required by legislation.
• Contact information: phone number, email address, and mailing address when necessary.
• Health information: complaints and medical history, examination findings, diagnosis, laboratory and imaging results, treatment applied, and prescription records.
• Appointment and transaction information: appointment date and time, reason for application, cancellation and postponement records.
• Financial information: invoice details and, if any, private health insurance policy information.
• Transaction security information: IP address, browser information, and transaction timestamp related to applications made through the website.

Health data is considered special category personal data under KVKK. These data are processed only by healthcare personnel under confidentiality obligations, to the extent required by the service, and under separate security measures.

Purposes of Processing Personal Data

• Receiving, planning, and confirming appointment requests.
• Conducting diagnosis, treatment, and follow-up processes and creating medical records.
• Communicating with the patient, providing results and follow-up reminders.
• Managing billing, collection, and if applicable, insurance and financial reconciliation processes.
• Fulfilling record-keeping, notification, and archiving obligations arising from health legislation.
• Evaluating service quality and addressing requests and complaints.
• Ensuring information security and exercising the right of defense in possible legal disputes.

Method of Collection and Legal Basis

Your personal data is collected partially by automatic and non-automatic methods through verbal and written applications to the clinic, appointment and contact forms on the website, conversations conducted via phone and messaging applications, and transmission of test results to us.

The processing activity is based on the legal grounds of legitimate interest under Article 5/2 of the KVKK; provided that it is explicitly stipulated by laws, necessary for the establishment or performance of the contract, the data controller fulfills its legal obligations, and it does not harm your fundamental rights and freedoms. Regarding health data, pursuant to Article 6/3 of the KVKK; processing by persons under confidentiality obligation for the purpose of preventive medicine, medical diagnosis, treatment, and care services is based on a legal ground. For processing outside this scope, your explicit consent is obtained separately; you can withdraw your given explicit consent at any time.

Transfer of Personal Data

Your data may be transferred to the following parties, limited to the purpose of processing and with necessary security measures taken:

• The Ministry of Health and other public institutions and organizations authorized by legislation, as well as judicial authorities.
• Laboratories, imaging centers, and pathology units where tests are conducted.
• Healthcare institutions and physicians referred to for consultation or advanced treatment.
• Your private health insurance company for payment and reimbursement processes upon your request.
• Suppliers providing appointment, communication, hosting, and accounting services: [To be filled by the Clinic: list of service providers].

Whether data transfer abroad is performed and, if so, the legal basis under Article 9 of the KVKK: [To be filled by the Clinic].

Retention Period

Your personal data is retained for the periods stipulated in the relevant legislation and for the duration required by the processing purpose. Minimum retention periods in health legislation apply to medical records, and periods in tax legislation apply to financial records. Periods determined in the clinic's retention and destruction policy: [To be filled by the Clinic: retention periods by data category]. Upon expiration of the period, your data is deleted, destroyed, or anonymized.

Your Rights as the Data Subject (Article 11 of the KVKK)

• To learn whether your personal data is processed.
• If processed, to request information about it.
• To learn the purpose of processing and whether it is used in accordance with its purpose.
• To know the third parties to whom data is transferred domestically or abroad.
• To request correction if data is incomplete or inaccurately processed.
• To request deletion or destruction within the conditions prescribed by law.
• To request notification of correction, deletion, or destruction to third parties to whom data is transferred.
• To object to a result against you arising solely from automatic system analysis.
• To request compensation for damages in case of harm due to unlawful processing.

Application Method

You can submit your requests regarding the above rights in writing in accordance with the Communiqué on Procedures and Principles of Application to the Data Controller to the address [To be filled by the Clinic: application address] or send them via [To be filled by the Clinic: registered electronic mail / e-mail address]. Your application must clearly include information that identifies your identity and the subject of your request. Your request will be concluded free of charge as soon as possible and in any case within thirty days; if the process requires an additional cost, a fee determined by the Board may be charged. If your application is rejected or not answered within the period, you have the right to complain to the Personal Data Protection Board.

Text Update

This information text may be updated in accordance with changes in regulations and updates in data processing procedures. The current text is always published on this page; if deemed necessary, additional notifications will be made for significant changes. Last update date: [To be filled in by the Clinic].