KVKK

Op. Dr. Tolga Oğuzhan – Personal Data Protection Disclosure Text

Effective Date: April 6, 2025

  1. Data Controller

Within the scope of this privacy policy, your personal data is processed in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”) by Op. Dr. Tolga Oğuzhan (“Data Controller” or “Clinic”), located at Fener Mahallesi, Tekelioğlu Caddesi, Filo Apt, D:51/B No:4, 07160 Muratpaşa/Antalya.

  1. Personal Data Processed and Purposes of Processing

Our clinic may process the following personal data to provide you with healthcare services, manage appointments, communicate with you, fulfill legal obligations, and improve service quality:

  • identity Information: Name, surname, Turkish ID number (or passport number/temporary ID number), place and date of birth, gender.
  • Contact Information: Address, phone number, email address.
  • Health Information: Medical history, diagnoses, treatment processes, test results, prescription details, appointment details, examination findings, and all kinds of health data required for the provision of healthcare services (Special Category Personal Data).
  • Financial Information: Invoice and payment details, insurance information (if necessary).
  • Visual and Audio Records: CCTV recordings in certain areas of the clinic for security purposes (if available and properly disclosed), and photographic or video records required for medical processes (with your explicit consent).
  • Website and Online Service Usage Data (if any): IP address, cookie data, and usage habits collected when visiting our website (anonymized or with explicit consent).

Your personal data is processed for the following purposes:

  • Conducting medical diagnosis, treatment, and care services
  • Creating, reminding, and managing appointments
  • Communicating with you (notifications, appointment changes, etc.)
  • Protecting public health and carrying out preventive healthcare activities
  • Managing healthcare financing, billing, and payment processes
  • Complying with legal and regulatory requirements (requests from the Ministry of Health and other public institutions)
  • Planning and managing internal operations of the clinic
  • Measuring patient satisfaction and improving service quality
  • Detecting and preventing misuse or unauthorized activities
  • Ensuring security (with CCTV where applicable)
  • Executing services offered via the website (e.g., booking appointments, information requests – if applicable)
  1. Legal Grounds for Processing Personal Data

Your personal data is processed based on the legal grounds specified in Articles 5 and 6 of KVKK:

  • Explicit Consent (Art. 5/1, 6/2): Especially for special category personal data such as health information, your explicit consent is obtained where legal grounds are not otherwise available. Medical diagnosis and treatment processes generally require explicit consent.
  • Clearly Provided by Law (Art. 5/2-a): Processing required by legal regulations such as health legislation.
  • Directly Related to the Establishment or Performance of a Contract (Art. 5/2-c): Processing necessary for establishing and performing the healthcare service contract (doctor-patient relationship).
  • Legal Obligation of the Data Controller (Art. 5/2-ç): Processing required for legal notifications, reports, etc.
  • Data Made Public by the Data Subject (Art. 5/2-d): Data that you have made publicly available may be processed in a limited manner.
  • Necessary for the Establishment, Use, or Protection of a Right (Art. 5/2-e): Data may be retained for proof or defense in potential legal disputes.
  • Legitimate Interests of the Data Controller (Art. 5/2-f): Data processing necessary for the legitimate interests of the clinic, provided that it does not harm the fundamental rights and freedoms of the data subject.
  • Processing of Special Category Personal Data (Art. 6): Special category personal data, such as health data, may be processed without your explicit consent for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing healthcare services and financing, by persons or organizations under confidentiality obligations (Op. Dr. Tolga Oğuzhan and authorized staff). Explicit consent is required for processing other types of special category data.
  1. Transfer of Personal Data

Your personal data may be transferred to the following parties within the scope of the above-mentioned purposes and under the conditions specified in Articles 8 and 9 of KVKK:

  • Other doctors, healthcare institutions, laboratories, or ambulance companies involved in your ongoing treatment
  • Social Security Institution (SGK)
  • Private insurance companies (with your consent, for authorization and payment procedures)
  • Ministry of Health and its sub-institutions and other authorized public bodies
  • Lawyers and judicial authorities for resolving legal disputes
  • Third-party service providers (e.g., IT support firms, accounting firms – under confidentiality agreements)
  • Authorized authorities as required by legal regulations
  1. Method of Personal Data Collection

Your personal data is collected through verbal, written, or electronic means when you apply to our clinic; via appointment forms, patient registration forms, information obtained during examination, diagnosis and treatment, through our website (if any), email, phone calls, and other communication channels.

  1. Personal Data Retention Period

Your personal data is retained for the duration specified in relevant legal regulations (e.g., retention periods in Health Legislation) or for as long as required to fulfill the purpose of processing. Upon expiration of this period or when the purpose of processing ceases to exist, your data is deleted, destroyed, or anonymized in accordance with KVKK provisions.

  1. Data Security Measures

Our clinic takes appropriate technical and administrative measures to prevent unlawful processing or access to your personal data and to ensure its protection. These measures include preventing unauthorized access, data encryption (where necessary), physical security precautions, staff training, and confidentiality agreements.

  1. Your Rights as a Data Subject (KVKK Article 11)

As the data subject, you have the following rights under Article 11 of KVKK:

  • To learn whether your personal data is being processed
  • If processed, to request information regarding such processing
  • To learn the purpose of the processing and whether your data is used accordingly
  • To know the third parties to whom your data is transferred domestically or abroad
  • To request correction of incomplete or incorrect data
  • To request deletion or destruction of your data under Article 7 of KVKK
  • To request that the operations carried out as per (d) and (e) above be notified to third parties to whom your data was transferred
  • To object to any outcome arising to your detriment as a result of automated data processing
  • To request compensation if you suffer damage due to unlawful processing of your data
  1. Exercising Your Rights and Application

To exercise your rights mentioned above, you may submit your requests along with documents verifying your identity to Op. Dr. Tolga Oğuzhan, the Data Controller, via the following methods:

  • In writing: You may deliver a signed petition in person or send it via notary to the address: Fener Mahallesi, Tekelioğlu Caddesi, Filo Apt, D:51/B No:4, 07160 Muratpaşa/Antalya
  • Via Registered Electronic Mail (KEP): You may send a digitally signed petition to the KEP address (to be specified)
  • Via email: You may send your request from the email address previously submitted to our clinic and registered in our system to: drtolgaoguzhan@gmail.com
  • Other Methods: By other means to be determined by KVKK

Your application must include your name, surname, Turkish ID number (or nationality, passport number, or identity number for foreigners), residential or workplace address for notification, email address (if any), phone number, and a clear description of your request.

Requests will be answered as soon as possible and within no more than thirty (30) days, free of charge. However, if the process incurs additional cost, the fees determined by the Personal Data Protection Board may be charged.

  1. Policy Updates

This Privacy Policy may be updated in accordance with changes in legal regulations and clinic policies. Updates will be announced on our website (if available) or at our clinic.