1. Purpose and Identity of the Data Controller

This Visitor Privacy Notice has been prepared by Assoc. Prof. Dr. Andaç Aykan Clinic, acting as the data controller, in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 (“Law”) and the Communiqué on the Principles and Procedures to be Followed in Fulfillment of the Obligation to Inform, in order to fulfill the obligation to inform regarding the processing of your personal data.

Your personal data may be processed by Assoc. Prof. Dr. Andaç Aykan Clinic, located at Abdi İpekçi Street No: 2/14, Nişantaşı, Istanbul, in compliance with the Law, within the purposes listed below, in a manner that is relevant, limited, and proportionate, and by preserving the accuracy and up-to-date nature of the data as provided to us.

2. Purposes of Processing Personal Data

Your collected personal data may be processed in accordance with the fundamental principles set forth in the Law and within the conditions specified in Articles 5 and 6 of the Law for the following purposes:

• Ensuring legal, technical, commercial, and occupational safety of individuals related to the Clinic
• Taking necessary measures for the health of the Clinic and its employees (including pandemic-related precautions such as COVID-19)
• Informing individuals showing symptoms of infectious diseases
• Creating and tracking visitor records
• Fulfilling legal obligations
• Performing identity verification
• Managing emergency situations
• Providing information to authorized public institutions and organizations when required

Additionally, in case visitors use the Clinic’s Wi-Fi network, traffic data may be processed to fulfill obligations under Law No. 5651 as a hosting provider.

3. Categories of Personal Data Processed

Special Categories of Personal Data (Health Data)

• Body temperature measurement
• Health status indicators (e.g., pandemic-related data)

Collection Method: Obtained directly from the individual via health or security personnel.

Purpose: Public health protection, occupational safety, emergency management, compliance with legal obligations, and pandemic measures.

Identity Information

• Name and surname

Collection Method: Visitor registration or Wi-Fi access forms

Purpose: Visitor tracking, legal compliance, communication, security, and operational management.

Contact Information

• Phone number

Collection Method: Visitor records or Wi-Fi connection forms

Purpose: Communication, complaint/request tracking, visitor record management, and security processes.

Physical Space Security Data

• Entry/exit logs
• Building access records

Collection Method: Visitor logs

Purpose: Ensuring physical security, emergency management, and operational monitoring.

Audio and Visual Records

• CCTV recordings
• Entry/exit camera records

Collection Method: Camera systems at Clinic premises

Purpose: Security, compliance, and monitoring activities.

Transaction Security Data

• Internet access logs
• IP address
• Website login records
• System/user account data

Collection Method: Wi-Fi usage and digital systems

Purpose: Information security, audit processes, access authorization, and legal compliance.

4. Transfer of Personal Data

Your personal data may be transferred, in accordance with Articles 8 and 9 of the Law and relevant legislation, to:

• Shareholders
• Business partners
• Suppliers
• Legally authorized public and private institutions

Such transfers are limited to purposes such as ensuring physical security, managing organizational activities, and maintaining visitor records.

5. Method and Legal Basis for Data Collection

Your personal data is collected through:

• Visiting the Clinic premises
• Visitor registration systems
• Wi-Fi access connections
• Security camera systems

Legal bases include:

• Explicit provisions of the law
• Legitimate interests of the data controller
• Fulfillment of legal obligations

Personal data will be deleted, destroyed, or anonymized once the purpose of processing ceases or legal retention periods expire.

6. Rights of Data Subjects

In accordance with Article 11 of the Law, you have the right to:

• Learn whether your personal data is processed
• Request information if your data has been processed
• Learn the purpose of processing and whether it is used appropriately
• Know third parties to whom data is transferred
• Request correction of incomplete or inaccurate data
• Request deletion or destruction of personal data
• Object to automated processing results
• Request compensation for damages due to unlawful processing

7. Exercising Your Rights

You may submit your requests via:

• Written application with a wet signature to:
  Abdi İpekçi Street No: 2/14, Nişantaşı, Istanbul
• Notary notification
• Email via your registered email address to:
  doc.dr.andac.aykan@gmail.com

You can also access the application form on the official website:
https://andacaykan.com/

‍