Privacy Policy

Data controller

The data controller is Prof. Dr. İlker Yazıcı, who runs his private practice under the registered name Prof. Dr. İlker Yazıcı Muayenehanesi.

• Address: Lotus Nişantaşı, Halaskargazi Mah. Halaskargazi Cad. No: 38-66 İç Kapı No: 134, 34371 Şişli/İstanbul, Türkiye
• E-mail: info@ilkeryazici.com
• Phone: +90 533 719 77 36

Personal data processed

The website has no contact form, no registration and no patient accounts. The practice processes the following data about people who visit the site or get in touch, and only as far as the purpose requires:

• Identity and contact details: name, phone number and e-mail address; once you are examined or treated, the identity details required by Turkish law.
• Enquiries and correspondence: questions, appointment requests and the content of messages sent by WhatsApp, phone or e-mail.
• Health data and images: photos you choose to send, your concerns, past illnesses and operations, medication and medical reports; and the medical records created during examination and treatment.
• Security and technical data: the IP address, browser and device information, pages visited and time stamps recorded in the hosting provider's server logs when you visit the site; cookieless visit statistics; and, when you play a video, the IP address and browser information passed to YouTube.
• Cookie and similar data: your cookie choice and, only if you consent, Google Analytics data. Details are in the Cookie Policy.

About your health data

Under Article 6 KVKK, health data is a special category of personal data. It is processed by a physician bound by medical confidentiality for diagnosis and treatment planning. Photos you send are used for assessment and treatment planning; they are not used for promotion or published unless you give separate explicit consent.

The website's admin panel is open only to site editors. Editors' e-mail addresses and session data are processed solely to sign them in and control access; no visitor or patient data is kept in that panel.

Purposes of processing

• Answering your questions and appointment requests and staying in touch with you
• Carrying out a pre-assessment based on the photos and information you send
• Examination, diagnosis, treatment planning, surgery and post-operative follow-up
• Scheduling examinations, surgery and check-ups, and organising the visit programme of patients who travel to Istanbul
• Keeping and storing medical records as required by Turkish health legislation
• Answering requests from competent public authorities and meeting financial and legal obligations
• Establishing, exercising or defending legal claims
• Keeping the website secure and running, and detecting technical problems
• If you consent, measuring how the website is used and improving its content
• Answering applications you make under KVKK

Legal bases

Personal data is processed on the following legal bases set out in Article 5 KVKK:

• Entering into or performing a contract (Art. 5(2)(c)): answering your enquiry or appointment request, and setting up and carrying out the examination and treatment relationship.
• An express provision of law and a legal obligation (Art. 5(2)(a) and (ç)): record-keeping, retention and reporting duties under health, tax and other legislation.
• Establishing, exercising or defending a right (Art. 5(2)(e)): using records in a possible dispute.
• Legitimate interest, without harming your fundamental rights and freedoms (Art. 5(2)(f)): website security, server logs, cookieless visit statistics, showing the videos you choose to play, remembering your cookie choice, and admin panel sessions.
• Your explicit consent (Art. 5(1)): Google Analytics cookies only. You can withdraw it at any time with the Cookie settings button at the bottom of the website.

Legal bases for health data

Under Article 6(3) KVKK, health data is processed by persons bound by confidentiality for medical diagnosis, treatment and care (Art. 6(3)(e)), where expressly provided for by law (Art. 6(3)(b)), and where necessary to establish, exercise or defend a right (Art. 6(3)(d)). Uses beyond diagnosis and treatment, such as using your photos for promotion, rely only on your separate explicit consent (Art. 6(3)(a)). The adequate measures set by the Personal Data Protection Board are applied when this data is processed (Art. 6(4)).

How data is collected

Personal data is collected partly by automated and partly by non-automated means: through your messages by WhatsApp, phone and e-mail, through consultations and examinations at the practice, and through the forms and medical documents completed during that process. Technical data about the use of the website is collected automatically through server logs, cookies and similar technologies.

WhatsApp is a service provided by Meta, and using it is optional. When you write by WhatsApp, your messages are carried over WhatsApp's infrastructure, and WhatsApp also processes data about your account and use of the service under its own privacy policy.

Recipients

Personal data may be shared with the following groups of recipients, only for the purposes above and in line with Articles 8 and 9 KVKK:

• For your treatment: the partner hospital where your surgery takes place and, where your treatment requires it, laboratories and imaging centres
• For legal obligations: competent public authorities, in particular the Turkish Ministry of Health, and courts, where the law entitles them to request information
• For legal and financial advice: lawyers and accountants bound by professional secrecy
• For the technical provision of the service: providers acting as data processors for website hosting, visit statistics, e-mail and IT services

Transfers outside Türkiye

The servers of the following services are located outside Türkiye, so the related personal data is processed abroad when they are used:

• Vercel (website hosting and cookieless visit statistics): the IP address, browser and device information, pages visited and time stamps in the server logs, and the aggregated statistics of Vercel Web Analytics. Purpose: running and securing the website and measuring visits.
• Google (e-mail service): e-mails and attachments you send to info@ilkeryazici.com and the practice's replies. Purpose: handling correspondence.
• Google Analytics 4 (only with your consent): if you choose Accept in the cookie banner, page view and usage data and cookie identifiers. Purpose: statistical measurement of how the website is used.
• YouTube (Google): only when you play a video, your IP address and browser information; video thumbnails are served from the website's own server. Purpose: showing the video you play.
• WhatsApp (Meta): if you choose this channel, your phone number, your messages and the photos you send. Purpose: communicating with you.
• Supabase (site editors only): the e-mail address and session data of editors who sign in to the admin panel. It holds no visitor or patient data.

Legal framework for transfers abroad

Transfers made by the practice to these providers are subject to Article 9 KVKK. As of the date of this policy, the Personal Data Protection Board has not issued an adequacy decision for any country. In that situation the law makes regular transfers like those above conditional on an appropriate safeguard (Art. 9(4)); the safeguard available for providers of this kind is the standard contract published by the Board (Art. 9(4)(c)). A standard contract must be notified to the Turkish Personal Data Protection Authority within five business days of signature (Art. 9(5)). Under the law, explicit consent can be relied on only for occasional, non-regular transfers (Art. 9(6)(a)); your consent in the cookie banner therefore concerns the use of analytics cookies and does not replace a transfer safeguard. You can find out which safeguard applies to which recipient by applying under Article 11 KVKK.

If you choose WhatsApp, you send your messages and photos through the WhatsApp service yourself, and the practice's replies are carried by the same service. If you prefer that your health information is not carried over an infrastructure abroad, you can call the practice or share it in person at your examination.

Retention and security

Personal data is kept for as long as the purpose requires and for the periods set by the relevant legislation. Patient records created during examination and treatment are kept for the period required by Turkish health legislation. Correspondence about enquiries that do not lead to an examination or treatment is erased, destroyed or anonymised once the purpose has ended, taking into account the limitation periods for possible disputes.

Google Analytics data is deleted at the end of the retention period set in the account. The value Vercel Web Analytics uses to tell visits apart is discarded after 24 hours. Server logs are kept for a limited period under the hosting provider's logging policy. Under Article 12 KVKK, the practice takes appropriate technical and organisational measures to prevent unlawful processing of and unauthorised access to personal data.

Your rights under KVKK

Under Article 11 KVKK, you may apply to the data controller to find out whether your personal data is processed and, if so, for what purpose and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to have incomplete or inaccurate data corrected, to have your data erased or destroyed under the conditions of Article 7 KVKK, and to have recipients notified of these steps; to object to a result that is to your detriment and arises exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

Scope of your rights

You may withdraw any consent at any time; withdrawal does not affect processing carried out before it. Medical records that must be kept under health legislation may not be erasable before the legal retention period ends; if so, you will be told why.

How to apply

Under the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller, applications are made in Turkish, in one of the following ways:

• A written application with your handwritten signature, delivered in person or by post to the practice address
• An application signed with a secure electronic signature or mobile signature, sent by e-mail to info@ilkeryazici.com
• By e-mail to info@ilkeryazici.com from an e-mail address you have previously given to the practice and that is held in its records

What to include and response time

Your application must state your full name; your signature if it is a written application; for Turkish citizens, the Turkish identity number, and for foreign nationals, nationality and passport number or identity number if any; your residential or business address for notifications; your e-mail address and phone number if any; and the subject of your request. Any documents relating to the request should be attached.

Your request will be concluded as soon as possible according to its nature, and within 30 days at the latest (Art. 13(2) KVKK). Under the law, applications are as a rule concluded without a fee; only where the request involves an additional cost does the tariff in the Communiqué apply. No fee is charged for a written reply of up to ten pages; for each page beyond ten, a processing fee of 1 Turkish lira may be charged; and where the reply is given on a storage medium such as a CD or USB stick, the fee may not exceed the cost of that medium. If the application arose from an error by the practice, any fee is refunded.

If your application is rejected, you find the answer insufficient or you receive no answer in time, you may complain to the Personal Data Protection Board within 30 days of learning of the answer, and in any case within 60 days of your application (Art. 14 KVKK). You must apply to the data controller before you can complain to the Board.

Visitors from the European Union

The practice is established in Türkiye and this policy is based on Turkish law. If you are in the European Union or the European Economic Area and the EU General Data Protection Regulation (GDPR) applies to the processing of your data, you also have the rights it gives you: access to your data, rectification, erasure, restriction of processing, receiving your data in a portable format, objecting to processing and withdrawing consent. You can send such requests to info@ilkeryazici.com. You also have the right to lodge a complaint with the data protection supervisory authority in the EU country where you live or work, or where you believe the infringement took place.

Cookies and other policies

The cookies used on this website, their purposes and durations, and how to change your choice are explained in the Cookie Policy. The rules for using the website are set out in the Terms of Use.

Changes to this policy

This policy may be updated when the law or the practice's data processing changes. The current version is always published on this page, with the date of the last update.