PRIVACY NOTICE ON THE PROTECTION AND PROCESSING OF PERSONAL DATA UNDER THE TURKISH PERSONAL DATA PROTECTION LAW NO. 6698
Dear Visitor,
The purpose of this Privacy Notice on the Protection and Processing of Personal Data is to inform all natural persons associated with our medical practice, including those who benefit or intend to benefit from its services, our employees, job applicants and business partners, that their personal data are processed in accordance with the applicable laws and regulations. In this context, in our capacity as data controller and in line with Article 12 of the Personal Data Protection Law (the “Law” or “KVKK”), we take administrative and technical measures to ensure the level of security necessary to prevent the unlawful disclosure of, unlawful access to and unlawful transfer of personal data, and any data security breaches that may occur in any manner, and we carry out or commission audits accordingly. This notice has been prepared to fulfil the obligation to inform under Article 10 of the Law.
1. Data Controller
Pursuant to the Turkish Personal Data Protection Law No. 6698, the data controller responsible for the processing of your personal data is Prof. Dr. Şadıman Kıykaç Altınbaş, located at “Kızılırmak Mah. Dumlupınar Bulv. No: 3, Next Level Ofis, A Blok, Kat: 14, No: 69, 06510 Çankaya/Ankara, Türkiye”.
In our capacity as data controller, we hereby declare that your personal data shared with us directly and/or indirectly — when you visit our medical practice and/or our website, contact us by telephone or through our WhatsApp line, or are called by us — may, in a manner connected, limited and proportionate to the purpose of processing, be recorded, stored, retained, reorganised, shared with institutions legally authorised to request such data, transferred to third parties in Türkiye or abroad in the cases and under the conditions provided for in the Law, assigned, classified, erased upon the data subject’s request, and otherwise processed in the ways listed in the Law.
2. Personal Data to Be Processed
The personal data to be processed by the data controller are your data meaning “any information relating to an identified or identifiable natural person” as defined in the KVKK. Under the same Law, special categories of personal data refer to “data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data”.
Our medical practice may, within the conditions set out in the Law, obtain wholly or partly, classify and record the personal or special categories of personal data of patients/visitors, and retain them in accordance with the purpose for which they were obtained or for the period stipulated by the relevant legislation.
Accordingly, the categories of your personal data processed, including but not limited to the following, and their content are as follows:
Identity data: Name and surname, Turkish identification number, Social Security registration number, signature, marital status, identity card serial and sequence number, date of birth, place of birth, copy of identity card, driving licence or passport, occupation.
Contact data: Telephone number, e-mail address, residential address.
Financial data: Your bank account number, IBAN and billing information.
Insurance data: Your private health insurance data and Social Security Institution data for the financing and planning of healthcare services.
Special categories of personal data (your health data): All kinds of personal data relating to your health and sexual life obtained during or as a result of the provision of medical diagnosis, treatment and care services, including but not limited to your laboratory results, test results, examination data, appointment details, check-up details, measurements and prescription details.
Visual and audio recordings: Two- and three-dimensional photographs and video recordings taken before, during and after procedures. These recordings are used solely for medical follow-up; their use in promotional and informational channels such as the website or social media is subject to obtaining your separate written explicit consent pursuant to the Regulation on Promotion and Information Activities in Healthcare Services.
Family and relative data: Names and contact details of patient relatives and, where necessary for the patient’s medical history, family health information.
Physical premises security: Camera footage.
Transaction security and website data: IP address, website entry and exit information, data obtained through cookies (for details, please see our Cookie Policy).
3. Purposes of Processing Personal Data
Your personal data and special categories of personal data are processed by the data controller for the purposes and on the legal grounds set out below and, where necessary, for similar purposes and reasons, within the personal data processing conditions set out in Articles 5 and 6 of the KVKK and in a limited manner in accordance with the general principles in Article 4 of the Law.
Accordingly, your personal data are processed for the following purposes:
Fulfilling our legal obligations;
Verifying your identity as a requirement of the services provided by our medical practice;
Protection of public health, preventive medicine, conducting medical diagnosis, treatment and care services, and planning and managing healthcare services and their financing;
Sharing information requested by the Ministry of Health and other public institutions and organisations under the relevant legislation;
Planning and managing the internal workings and daily operations of the medical practice;
Measuring, improving and researching patient satisfaction;
Procuring medicines and medical devices;
Informing you about your appointments;
Conducting analyses and research to improve healthcare services;
Participation in campaigns organised by our medical practice and providing information about them;
Designing and delivering content on web and social media channels;
Invoicing.
4. Method and Legal Grounds for Collecting Personal Data
Your personal data may be collected orally, in writing or electronically, in person at our medical practice and through channels such as our telephone and WhatsApp line, e-mail, our website (www.drsadimankiykac.com) and our social media accounts.
Personal data are processed, in line with the purposes of processing, on the basis of and limited to at least one of the personal data processing conditions set out in Articles 5 and 6 of the Law, and in accordance with the general principles set out in Article 4 of the Law and the retention periods stipulated in the relevant legislation.
Principles to Be Observed in Processing Personal Data
Processing in accordance with the law and the principle of good faith;
Ensuring that personal data are accurate and, where necessary, kept up to date;
Processing for specific, explicit and legitimate purposes;
Being connected, limited and proportionate to the purposes for which they are processed;
Retaining personal data for the period stipulated in the relevant legislation or required for the purpose for which they are processed.
Conditions for Processing Personal Data
Pursuant to Article 5 of the Law, personal data cannot be processed without the explicit consent of the data subject. Explicit consent must relate to a specific matter, be based on information and be given freely. Personal data may be processed without the data subject’s explicit consent if one of the following conditions exists:
It is expressly provided for by law;
It is necessary to protect the life or bodily integrity of a person, or of another person, who is unable to express consent due to actual impossibility;
It is directly related to the conclusion or performance of a contract;
It is necessary for the data controller to fulfil its legal obligation;
The data have been made public by the data subject;
It is necessary for the establishment, exercise or protection of a right;
Provided that it does not harm the fundamental rights and freedoms of the data subject, it is necessary for the legitimate interests of the data controller.
Processing of Special Categories of Personal Data
Article 6 of the Law defines as special categories of personal data the data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. The processing of special categories of personal data is prohibited as a rule. However, pursuant to Article 6(3) of the Law, they may be processed if one of the following conditions exists:
The data subject has given explicit consent;
It is expressly provided for by law;
It is necessary to protect the life or bodily integrity of a person, or of another person, who is unable to express consent due to actual impossibility or whose consent is not legally valid;
The data have been made public by the data subject and processing is in line with the data subject’s intention to make them public;
It is necessary for the establishment, exercise or protection of a right;
It is carried out by persons under a duty of confidentiality or by authorised institutions and organisations for the purposes of protecting public health, preventive medicine, conducting medical diagnosis, treatment and care services, and planning and managing healthcare services and their financing;
It is necessary to fulfil legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance.
At our medical practice, your health data are processed mainly by the physician, under a duty of confidentiality, for the purpose of conducting medical diagnosis, treatment and care services. In this context, Law No. 6698, the Basic Law on Health Services No. 3359, the Regulation on Personal Health Data and other relevant legislation are complied with. Electronic medical records and electronic health records also fall within this scope. Where none of the above conditions applies, your explicit consent is obtained for the processing of your special categories of personal data.
In processing special categories of personal data, the adequate measures determined by the Personal Data Protection Board (the “Board”) are also taken.
Erasure, Destruction or Anonymisation of Personal Data
Pursuant to Article 7 of the Law, even if processed in accordance with the provisions of the Law and other relevant laws, personal data are erased, destroyed or anonymised by the data controller ex officio or upon the request of the data subject when the reasons requiring their processing cease to exist. Accordingly, our medical practice retains personal data only for the period stipulated in the relevant legislation or as necessary for the purposes for which they are processed. Upon expiry of this period or when the reasons requiring processing cease to exist, personal data will be disposed of using the designated disposal methods (erasure, destruction and/or anonymisation) in accordance with the periodic disposal intervals or the data subject’s application.
5. Transfer of Personal Data
Pursuant to Article 8 of the Law, personal data cannot be transferred without the explicit consent of the data subject. However, even without explicit consent, personal data may be transferred to third parties by our medical practice, with due care and by taking the security measures prescribed by the Board, if one or more of the following conditions exist:
The transfer is expressly provided for by law;
The transfer is directly related to and necessary for the conclusion or performance of a contract;
The transfer is necessary for our medical practice to fulfil its legal obligation;
The personal data have been made public by the data subject, provided that the transfer is limited to the purpose of making them public;
The transfer is necessary for the establishment, exercise or protection of the rights of our medical practice, the data subject or third parties;
Provided that it does not harm the fundamental rights and freedoms of the data subject, the transfer is necessary for the legitimate interests of our medical practice;
The transfer is necessary to protect the life or bodily integrity of a person, or of another person, who is unable to express consent due to actual impossibility or whose consent is not legally valid.
Special categories of personal data may only be transferred where one of the conditions listed in Article 6(3) of the Law exists and the adequate measures determined by the Board are taken.
Transfer of Personal Data Abroad
Pursuant to Article 9 of the Law, personal data may be transferred abroad where one of the conditions in Articles 5 and 6 of the Law exists and on the basis of one of the following mechanisms:
Adequacy decision: The Board has issued an adequacy decision regarding the country, sector or international organisation to which the data will be transferred;
Appropriate safeguards: In the absence of an adequacy decision, one of the appropriate safeguards — such as the standard contractual clauses announced by the Board, binding corporate rules, or a written undertaking approved by the Board — is provided, and data subjects are able to exercise their rights and seek effective legal remedies;
Occasional transfer: In the absence of both an adequacy decision and appropriate safeguards, and only on an occasional basis, your explicit consent given after you have been informed of the possible risks, or the existence of one of the other cases listed in the Law.
Since the servers of services used on our website such as Google Analytics, Google Ads and Meta Pixel are located abroad, data collected through these services may be transferred abroad in accordance with the mechanisms above. Your health data are not transferred abroad through these services. For further details, please see our Cookie Policy.
6. Rights of the Data Subject
Under Article 11 of the KVKK, as a data subject you have the right to:
learn whether your personal data are being processed;
request information if your personal data have been processed;
learn the purpose of processing your personal data and whether they are used in accordance with that purpose;
know the third parties, in Türkiye or abroad, to whom your personal data are transferred;
request the rectification of your personal data if they are incomplete or inaccurately processed, and request that the third parties to whom your personal data have been transferred be notified of the action taken;
request the erasure or destruction of your personal data if the reasons requiring their processing cease to exist, even though they have been processed in accordance with Law No. 6698 and other relevant laws, and request that the third parties to whom your personal data have been transferred be notified of the action taken;
object to any result against you arising from the analysis of the processed data exclusively by automated systems;
claim compensation for damages if you suffer loss due to the unlawful processing of your personal data.
Pursuant to Article 13(1) of the KVKK, you may submit your requests regarding your rights to our medical practice in writing or by other methods determined by the Personal Data Protection Board. You may request from us the application information notice and the application form, which explain the channels and procedures for submitting your application.
If a data subject submits a request regarding their rights in accordance with the procedure, the request will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on its nature. However, if the action requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board. If your application is rejected, if you find our response insufficient, or if your application is not answered in due time, you may lodge a complaint with the Personal Data Protection Board within thirty days from the date you learn of our response and, in any event, within sixty days from the date of your application.
7. Contact
Data Controller: Prof. Dr. Şadıman Kıykaç Altınbaş
Address: Kızılırmak Mah. Dumlupınar Bulv. No: 3, Next Level Ofis, A Blok, Kat: 14, No: 69, 06510 Çankaya/Ankara, Türkiye
E-mail: [email protected]
Phone: +90 538 430 32 10
Website: www.drsadimankiykac.com
Last updated: October 2026
This Privacy Notice on the Processing of Personal Data, prepared in accordance with Law No. 6698 and other relevant legislation in force as of the date of publication, is submitted for your information.
Kind regards,
Prof. Dr. Şadıman Kıykaç Altınbaş
This document is an English translation of the original Turkish text, provided for information purposes. In case of any discrepancy between the English and Turkish versions, the Turkish version shall prevail.
