LEGAL
KVKK Information Notice
Information notice under Turkish Personal Data Protection Law No. 6698 (KVKK).
This notice concerns the processing of personal data in connection with visiting this website and contacting the practice by the telephone number published on it. Medical records kept during consultations are outside the scope of this website and are held at the practice as required by law. This English page is an information translation of the Turkish KVKK notice (KVKK Aydınlatma Metni) provided for convenience; the Turkish text is authoritative.
Data Controller
The data controller is Prof. Dr. İsmail Semih Öncel (a private medical practice operating in İzmir).
Address for written applications: 1437. Sok. No: 17/3, Alsancak/İzmir. Telephone for general contact and for reaching the site editor: +90 232 421 54 26.
Personal Data Processed
This website has no membership area. It provides a contact form (full name, e-mail, telephone, message and optional document attachments) and a published e-mail contact channel. The site offers no other web channel intended for submitting health data.
So that the site can be displayed, the hosting infrastructure processes the technical connection data of every request (such as IP address, request time, requested address and browser information). This processing is limited to serving and securing the site; there is no application database building visitor profiles.
If you contact the practice by the telephone number published on the site, the identity and contact details you provide and the content of your request may be processed to the extent required by the nature of that communication.
Purposes of Processing
Personal data are processed for the purposes of (a) providing and securing the website, (b) responding to contact requests made by telephone and providing information about consultations and appointments, (c) fulfilling obligations arising from legislation, and (ç) where necessary, establishing, exercising or protecting a legal right.
No processing is carried out for marketing, profiling, behavioural analysis or automated decision-making.
Legal Basis
The technical processing required to provide and secure the website is based on the legitimate-interest ground in Article 5/2-(f) of Law No. 6698; it is carried out in the minimum scope needed for the site to function and without harming the fundamental rights and freedoms of the data subject.
Responding to requests made by telephone is based on the legitimate-interest ground in Article 5/2-(f); where the request is directed at establishing a consultation relationship, it is additionally based on Article 5/2-(c), being directly related to the establishment or performance of a contract.
Fulfilling obligations arising from legislation is based on the legal-obligation ground in Article 5/2-(ç); retaining the relevant records in the event of a dispute is based on Article 5/2-(e), the establishment, exercise or protection of a right.
For each purpose, only the legal ground appropriate to that purpose is relied on; no single blanket ground is applied to all activities.
For the name, e-mail address, telephone number and message submitted through the contact form, responding to the request relies on the legitimate-interest ground in Article 5/2-(f), and additionally on Article 5/2-(c) where the request concerns establishing a treatment relationship. The limited technical data used for form security is processed under the legitimate-interest ground in Article 5/2-(f).
Method of Collection
Technical connection data are collected automatically by the hosting infrastructure while the site is being displayed.
Information you share during a telephone call is obtained verbally. No data are collected through a published e-mail channel.
Transfers and Recipient Groups
The site is published on the server of a hosting and technical service provider located in Türkiye; technical connection data are processed by this provider for the purpose of serving the site. The embedded Google Maps iframe on the contact pages may connect to Google without a separate user action when the map is displayed.
Personal data may additionally be transferred, only where legally required and limited to the scope of the request, to authorised public institutions and organisations; and, to the extent necessary for the establishment, exercise or protection of a right, to legal counsel. There is no ordinary or regular data flow to these recipients.
Apart from the embedded Google Maps iframe, the site application sends no visitor data to analytics, advertising, social-media plug-ins or similar third-party services. The website content is served directly from the hosting server in Türkiye; no data transfer takes place for advertising, marketing or analytics purposes.
Communication via WhatsApp: The WhatsApp links on the site redirect you to the WhatsApp/Meta service only after you deliberately click them; the site does not send data to this service in advance or in the background. If you choose to communicate via WhatsApp, personal data you share through this service may be processed by WhatsApp/Meta under its own service and privacy terms and may be transferred abroad. Use of WhatsApp is optional; telephone or e-mail can also be used for appointments and contact.
When the embedded map on the contact page is displayed, your browser may connect directly to Google and your connection data (such as your IP address) may be processed by Google; no further user action is required for this. The “Directions on Google Maps” link, by contrast, opens Google Maps in a separate tab only when you click it.
Cloudflare Turnstile is used for form security and abuse prevention. In this context limited technical data about your IP address, browser and connection may be processed by Cloudflare for security verification. The message you write in the form and the documents you upload are not transmitted to Cloudflare through Turnstile.
Special Categories of Personal Data
The content of the message you send through the contact form or the published e-mail address, and the documents you attach, may contain health data; it is not assumed that every submission contains health data.
Where processing by the physician is necessary for the conduct of medical diagnosis, treatment or care and the statutory conditions are met, health data may be processed on the relevant condition in Article 6(3) of the Law, including Article 6(3)(e). Where another condition in Article 6(3) is applicable to a particular processing activity, that condition applies. The applicable condition is determined according to the concrete processing purpose; no single blanket ground is asserted for every possible submission.
An information notice and explicit consent are separate concepts. Neither this notice nor the declaration boxes in the form constitutes explicit consent. One box is an operational acknowledgement about how the form is used; the other declares that you are authorised in respect of the information and documents you submit.
The telephone number published on the site is not a channel intended for transmitting health data. If health information is shared spontaneously during a telephone call, it is handled under the physician’s professional duty of confidentiality and only to the extent necessary for the purpose of the call; this does not, by itself, mean that explicit consent has been given to every kind of processing.
Contact Form and Document Submission
When the contact form is used, the following are processed: full name, e-mail address, telephone number and message content. Health information and documents voluntarily submitted by the person, together with limited technical and security data needed for the secure operation of the form and for abuse prevention, may also be processed. It is not assumed that every submission contains health data.
This data is processed in order to receive and respond to communication requests, to conduct appointment and healthcare-related communication, to allow the physician to evaluate information voluntarily submitted by the person and, where applicable, to carry out medical diagnosis, treatment and care, to ensure information security and prevent abuse, and to comply with legal obligations or to establish, exercise or protect a right. No processing is carried out for marketing purposes.
The legal bases are those set out in the “Legal Basis” and “Special Categories of Personal Data” sections above; the presence of health data in a submission does not by itself create a new legal basis.
Content submitted through the form is not published on the website. No ordinary persistent form database is maintained; submissions are delivered to the domain mailbox under the control of the practice. Uploaded documents are held temporarily outside the publicly accessible directory while being processed and are deleted once processing is complete.
For retention periods, see the “Retention” section below.
Please submit only personal or health information and documents that belong to you or that you are legally authorised to share.
Retention
Practice records relating to telephone contact are retained for as long as needed to deal with the request concerned, for the retention periods prescribed by legislation and for the period necessary to protect a legal right; at the end of these periods they are deleted, destroyed or anonymised.
The retention period of the technical logs kept for security purposes in the hosting infrastructure is determined by the provider; these logs are not used by the site for visitor profiling.
For ordinary messages and their attachments submitted through the contact form or by e-mail, the default maximum retention period applied in the practice mailbox is 90 days. This is an internal data-minimisation rule, not a retention period arising from the Law. Data is deleted earlier once it is no longer needed. If submitted information becomes part of a patient or healthcare record, that record is subject to its own healthcare retention regime. Where legislation requires a longer retention period, that period applies instead of the 90-day internal rule.
Rights of the Data Subject
Under Article 11 of the Law you have the right to learn whether your personal data are processed; to request information about such processing; to learn the purpose of the processing and whether the data are used in line with that purpose; to know the third parties to whom the data are transferred in Türkiye or abroad; to request correction where the data are incomplete or inaccurate; to request erasure or destruction; to request that these operations be notified to the third parties to whom the data have been transferred; to object to a result arising to your detriment through analysis exclusively by automated systems; and to claim compensation for damage caused by unlawful processing.
Application Procedure
Under Article 13 of the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your applications in writing, together with information verifying your identity, to 1437. Sok. No: 17/3, Alsancak/İzmir. This is the verified application route that is valid in every case.
The other electronic application routes envisaged in the Communiqué may be used only where the conditions set out there are met; no electronic applications are received through this site. The telephone number published on the site is for obtaining information; a telephone call does not, by itself, constitute a valid application under the Law.
Your application is concluded within the period prescribed by legislation.