Personal Data Protection & Privacy Notice

Information Notice on the Protection of Personal Data Pursuant to Law No. 6698

As Assoc. Prof. Dr. Andaç Aykan Private Practice (Aykan Clinic), we attach great importance to the protection and security of your personal data. We process and store all personal data belonging to you with the highest level of care, in compliance with applicable legislation and professional confidentiality obligations.

In accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”) and relevant regulations, Aykan Clinic acts as the Data Controller and processes your personal data within the framework explained below.

1. Data Controller

Pursuant to Law No. 6698, the Data Controller is:

Assoc. Prof. Dr. Andaç Aykan Private Practice (Aykan Clinic)

Within the scope of our professional and commercial activities, your personal data may be:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Limited, proportionate, and relevant to the purposes for which they are processed
• Kept accurate and up to date
• Recorded, stored, preserved, classified, updated
• Shared or transferred to third parties only when permitted by law and limited to the purpose of processing

2. Categories of Personal Data Processed

Identity Data

Name, surname, Turkish ID number, signature, parents’ names, place and date of birth, civil status, nationality, gender, social security number, tax number, identity card, passport, driver’s license copies, license documents, employee card, and similar identification data.

Contact Data

Phone number, address, email address, and other communication details.

Health Data

Medical history, diagnosis, treatment records, prescriptions, laboratory results, imaging, physician evaluations, reports, genetic health information, medication usage, pregnancy status, disability information, anamnesis, epicrisis, and similar health-related data.

Visual and Audio Data

Photographs, video recordings, audio recordings, camera footage, scanned identification documents.

Financial Data

Bank account details, IBAN, payment and billing information, invoices, current account records.

Signature Data

Wet signature, electronic signature, signature samples.

Professional Data

Occupation, workplace, position.

Education Data

Educational background, certificates, training records.

Employment Data

Employer, department, position details.

Legal Transaction Data

Correspondence with official institutions, court and enforcement records.

Other Data

Job applications, CVs, military service status (if shared), application-related data.

Website Data

Log records, browser data, session cookies, IP-related access data.

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes, including but not limited to:

• Compliance with legal and regulatory obligations
• Provision of medical diagnosis, treatment, preventive healthcare, and patient care services
• Planning and management of healthcare services and financing
• Appointment scheduling, reminders, and patient communication
• Billing, payment processing, and legal financial obligations
• Measurement and improvement of patient satisfaction
• Medical research and scientific studies (in anonymized form where applicable)
• Risk management, quality improvement, and audit processes
• Fulfillment of obligations under healthcare legislation
• Archiving and storage obligations under applicable laws
• Corporate communication and administrative operations
• Management of complaints and requests
• Information security and operational safety
• Website performance improvement and personalization
• Marketing, promotional, and informational activities (subject to consent where required)
• Legal proceedings and defense of legal rights

4. Domestic Transfer of Personal Data

Your personal data may be shared, in compliance with Articles 8 and 9 of KVKK and with appropriate security measures, with:

• Ministry of Health, Social Security Institution, Provincial Health Directorates
• Courts, public prosecutors’ offices, enforcement authorities
• Contracted laboratories and healthcare providers
• Authorized physicians and affiliated institutions
• Online service providers required for service delivery
• Public authorities where legally required

5. Transfer of Personal Data Abroad

Personal data may be transferred abroad:

• To countries declared by the Personal Data Protection Board as having adequate protection
• Or, where adequate protection is not available, based on your explicit consent

Transfers are limited to the purposes stated in this notice and carried out with appropriate safeguards.

6. Method and Legal Basis of Data Collection

Your personal data is collected:

• Directly from you
• Through our website, phone, email, or online platforms
• Via forms, appointment systems, and service interactions

Data is collected based on:

• Legal obligations
• Performance of contracts
• Legitimate interests of the clinic
• Provision of healthcare services
• Explicit consent where required

Processing is conducted in accordance with Articles 5 and 6 of KVKK.

7. Rights of the Data Subject (Article 11 of KVKK)

You have the right to:

• Learn whether your personal data is processed
• Request information if your data has been processed
• Learn the purpose of processing and whether it is used accordingly
• Know third parties to whom data is transferred domestically or abroad
• Request correction of incomplete or inaccurate data
• Request deletion or destruction of personal data under legal conditions
• Object to automated processing results that may adversely affect you
• Request compensation for damages arising from unlawful processing

Requests will be answered within 30 days, free of charge, unless a fee is required by law.

8. Data Retention Period

Personal data is retained for the period required by processing purposes and legal obligations.
Once these purposes cease, data is deleted, destroyed, or anonymized in accordance with applicable legislation.

9. Updating Your Information

To ensure accuracy, you may notify us of any changes to your personal data by contacting the clinic.