This policy explains how your personal data is processed when you visit duzgunates.com and when you contact us through the site. It also serves as the privacy notice required by Article 10 of the Turkish Personal Data Protection Law (KVKK).
1. Data controller
The data controller for your personal data is Dr. Düzgün Ateş. Address, telephone and e-mail details are available on the Contact page.
2. What data is processed?
| Category | Examples | How it is obtained |
|---|---|---|
| Contact data | Name, telephone number, e-mail address | Contact form, phone, WhatsApp, e-mail |
| Contact form content | Treatment of interest, message text | When you fill in the form |
| Voluntarily shared health data | Your complaint, previous operations, photographs you send | Only when you share it yourself |
| Technical data | IP address, browser type, pages visited, time of visit | Automatically, through server logs |
| Cookie data | Strictly necessary cookies and any third-party cookies | Through your browser |
Note: This site has no registration, membership or payment function. Card and payment details are never collected.
A warning about health data: health data is special category personal data under the KVKK and the GDPR. The contact form and messaging channels (WhatsApp, e-mail, social media) are not secure medical record systems. We recommend sharing detailed health information, reports and clinical photographs during your examination rather than through these channels.
3. Contact form — privacy notice
When you fill in the contact form on this site, the following applies:
| Topic | Details |
|---|---|
| Fields collected | Name, e-mail, telephone (optional), treatment of interest (optional), message text, language of the form |
| Purpose | Receiving your appointment or information request and replying to you |
| Transfer | Your message is sent as an e-mail via SMTP to the practice's mailbox. The server hosting the site and the e-mail infrastructure process your data temporarily in the course of this. |
| Technical record | To prevent abuse, your IP address is stored in irreversibly hashed form for at most 24 hours for rate-limiting purposes. The raw IP address is not stored. |
| Retention | The form content is kept in the mailbox until your request has been dealt with, for at most 2 years. |
| Consent | You must tick the consent box to send the form. If you include health information in your message, it is processed solely to answer your request and on the basis of your explicit consent. |
Using the form is not compulsory; you can make the same request by phone or WhatsApp.
4. Purposes of processing
- Receiving and scheduling your appointment or information request
- Answering your questions and providing orientation
- Carrying out examination and treatment processes
- Meeting legal obligations, including the keeping of medical records
- Operating the site technically and keeping it secure
Your data is never sold or rented to third parties for marketing purposes.
5. Legal basis
Processing is carried out under the Turkish Personal Data Protection Law No. 6698 (KVKK). For visitors from the European Union and the United Kingdom, the GDPR (EU 2016/679) and UK GDPR are also taken into account.
| Data type | KVKK basis | GDPR equivalent |
|---|---|---|
| Contact data and form content | Art. 5/2-c — performance of a contract; Art. 5/2-f — legitimate interest | Art. 6(1)(b), 6(1)(f) |
| Health data | Art. 6/3 — medical diagnosis and treatment; otherwise explicit consent | Art. 9(2)(h), 9(2)(a) |
| Technical data / server logs | Art. 5/2-ç — legal obligation; Art. 5/2-f — legitimate interest | Art. 6(1)(c), 6(1)(f) |
6. Sharing with third parties
Your personal data is shared only in the following circumstances:
- Hosting and e-mail provider — to the extent technically necessary to host the site and deliver form messages
- Healthcare institutions and laboratories — where your treatment requires it
- Competent public authorities — where there is a legal obligation or a court order
- Messaging platforms — if you correspond via WhatsApp, your messages are also subject to that platform's own privacy policy
7. International transfers
The practice is located in Turkey; data you send from abroad is processed in Turkey. Correspondence conducted through WhatsApp and social media platforms may in addition pass through those platforms' servers in other countries. Using these channels is your choice; you may share sensitive information during your examination instead.
8. Retention periods
| Data | Retention period |
|---|---|
| Contact form messages and correspondence | Deleted once the purpose has ended; two years at most |
| Hashed IP record for rate limiting | 24 hours at most |
| Patient medical records | For the period required by applicable health legislation |
| Server logs | For the period required by law |
At the end of the period, data is deleted, destroyed or anonymised.
9. Your rights
Under Article 11 of the KVKK and under the GDPR, you may:
- Learn whether your personal data is being processed
- Request information about such processing
- Learn the purpose of processing and whether the data is used accordingly
- Know the third parties to whom the data is transferred, in Turkey or abroad
- Request correction if the data is incomplete or inaccurate
- Request erasure or destruction
- Request that any correction or erasure be notified to third parties to whom the data was transferred
- Object to an outcome adverse to you arising from automated analysis
- Claim compensation for loss suffered as a result of unlawful processing
You can send your requests to the e-mail address on the Contact page. Requests are answered within the period prescribed by law.
If you consider that your request has not been satisfied, you retain the right to complain to the Turkish Personal Data Protection Authority; EU residents may also contact their local supervisory authority.
10. Data security
The site is published over HTTPS. The contact form is protected against automated submissions by server-side validation and rate limiting. Access to personal data is limited to those who need it. That said, no transmission over the internet can be guaranteed to be entirely secure.
11. Children's data
This site is not directed at persons under 18. Applications on behalf of a minor must be made by a parent or legal guardian.
12. Changes
This policy may be updated from time to time. The date it took effect appears in the "last updated" line at the top of the page.