Data Protection Act Information Notice

Identity of the Data Controller

Under the Law on the Protection of Personal Data No. 6698 (“KVKK”), Dr. Yunus Keser Yılmaz Clinic (“Clinic”) processes your personal data in its capacity as the data controller. This privacy notice has been prepared to transparently explain to you which of your personal data is processed, for what purposes, and on what legal basis.

Categories of Personal Data Processed

Our clinic processes personal data in the following categories:

• Personal Information: First name, last name, Turkish ID number, date of birth
• Contact Information: Phone number, email address, mailing address
• Health Data: Medical history, examination findings, diagnosis and treatment information, medication history
• Appointment Details: Appointment date, time, and complaint information
• Transaction Security Data: Website usage data, IP address, cookie information

Purposes and Legal Basis for the Processing of Your Personal Data

Your personal data is processed for the following purposes, in accordance with the legal grounds specified in Articles 5 and 6 of the Personal Data Protection Law:

• Provision of examination, diagnosis, and treatment services (informed consent / performance of a contract)
• Managing the appointment system and sending appointment reminders (legitimate interest)
• Compliance with legal requirements for health records and archiving (legal obligation)
• Ensuring patient safety (performance of the contract)
• Processing of data subject requests (legal obligation)
• Providing appropriate content to website visitors and ensuring site security (legitimate interest)

Transfer of Your Personal Data

Your personal data may be transferred to the Ministry of Health and its affiliated institutions in accordance with legal obligations; to financial advisory services as part of e-invoicing and accounting processes; and to cloud infrastructure and software service providers, in compliance with the transfer conditions set forth in Articles 8 and 9 of the Personal Data Protection Law (KVKK). Data transfers abroad are conducted only with your explicit consent or to countries where the Data Protection Board has determined an adequate level of protection.

Retention Period for Your Personal Data

Your personal data is retained for the periods specified by Turkish law (at least 20 years for health data under the Patient Rights Regulation) and is destroyed upon the expiration of these periods in accordance with the Personal Data Protection Law (KVKK) and relevant secondary regulations. Appointment and contact information is retained for 2 years following the conclusion of the relevant service.

Your Rights Under the KVKK

Under Article 11 of the KVKK, you have the following rights:

1. Finding out whether your personal data is being processed
2. If your personal data has been processed, you may request information regarding this
3. The right to know the purpose of the processing of your personal data and whether it is being used in accordance with that purpose
4. The right to know which third parties your personal data has been transferred to, whether within the country or abroad
5. If your personal data has been processed incompletely or incorrectly, you may request that it be corrected
6. Requesting the deletion or destruction of your personal data
7. If the processing is carried out by automated systems, you have the right to object to the outcome that affects you
8. If you suffer harm due to the unlawful processing of your personal data, you have the right to request compensation for such harm

Application Process

To exercise the rights listed above, you may submit your written request in person to our clinic with a handwritten signature, send it via a notary public, or submit it via certified email to info@yunuskeseryilmaz.com.