Last updated: 3 August 2026
1. Data Controller
Pursuant to the Turkish Personal Data Protection Law No. 6698, your personal data is processed by the following party acting as the data controller:
Data Controller: Prof. Dr. Evrim Erdemoğlu
Website: www.evrimerdemoglu.com
Address: [Full business or official notification address]
Telephone: [Telephone number]
Email: [Contact email address]
Data protection application email: [KVKK application email address]
Registered electronic mail address: [KEP address, if applicable]
Your personal data is processed within the scope and for the purposes described below.
Where the website, appointment system or healthcare services are operated by another healthcare institution or legal entity, the data controller details in this section must be replaced with the official name and contact details of the relevant organisation.
2. Categories of Personal Data Processed
Depending on your use of the website, contact form or appointment request system, the following categories of personal data may be processed:
Identity Information
- First name and surname,
- Age or date of birth,
- Information required for identity verification, where necessary.
Contact Information
- Telephone number,
- Email address,
- Country and city,
- Preferred communication method and language.
Enquiry and Appointment Information
- Subject of your enquiry or appointment request,
- Preferred appointment date,
- Messages and explanations submitted by you,
- Communication and appointment history,
- Records created during the assessment of your request.
Health Information
Where voluntarily provided by you:
- Health complaints and symptoms,
- Disease and diagnosis information,
- Previous treatments and surgical procedures,
- Medications used,
- Medical examinations, reports and images,
- Other health information relating to your treatment request.
Health information constitutes a special category of personal data. You are advised not to send health documents, identity documents or detailed patient records that are not necessary for the assessment of your request through the general contact form.
Website Usage and Information Security Data
- IP address,
- Website access and exit times,
- Browser, device and operating system information,
- Form submission and error records,
- Website traffic and security logs.
Legal Transaction Information
- Applications made under the Turkish Personal Data Protection Law,
- Correspondence with public authorities,
- Records relating to legal claims, disputes and applications.
3. Purposes of Processing Personal Data
Your personal data may be processed for the following purposes:
- Receiving your contact and appointment requests,
- Reviewing your request and responding to you,
- Arranging an appropriate consultation or examination date,
- Managing patient and applicant communications,
- Providing preliminary information and guidance based on your request,
- Planning medical assessment, diagnosis, treatment and care processes,
- Providing and managing healthcare services,
- Creating appointment and patient communication records,
- Ensuring the security of the website,
- Preventing unauthorised access, fraud and misuse,
- Detecting and resolving technical problems,
- Complying with legal obligations,
- Responding to lawful requests from authorised public authorities,
- Establishing, exercising or protecting legal rights,
- Receiving and responding to applications made under data protection legislation.
An application submitted through the website does not, by itself, constitute a definitive medical diagnosis or treatment service.
In a medical emergency, the website contact form must not be used. You should contact the 112 Emergency Call Centre or the nearest healthcare institution.
4. Legal Grounds for Processing Personal Data
Your identity, contact, enquiry and appointment information may be processed on the following legal grounds:
- Processing is necessary for the establishment or performance of a contract,
- Processing is necessary for compliance with the data controller’s legal obligations,
- Processing is necessary for the establishment, exercise or protection of a legal right,
- Processing is necessary for the legitimate interests of the data controller, provided that your fundamental rights and freedoms are not adversely affected.
Your website usage and information security data may be processed for the purposes of:
- Ensuring website security,
- Preventing unauthorised access,
- Protecting technical systems,
- Complying with legal obligations,
- Establishing, exercising or protecting legal rights.
Such processing is based on the data controller’s legal obligations and legitimate interests.
Your health information may be processed by a physician who is subject to a professional duty of confidentiality where such processing is necessary for:
- Preventive medicine,
- Medical diagnosis,
- Treatment and care services,
- Planning and management of healthcare services.
Such processing is carried out in accordance with the processing conditions for special categories of personal data set out in Article 6 of the Turkish Personal Data Protection Law No. 6698.
Where health information must be processed for a purpose outside this scope, you will be separately informed before processing begins and, where legally required, your explicit consent will be obtained through a separate consent statement.
5. Methods of Collecting Personal Data
Your personal data may be collected through wholly or partly automated means or through non-automated means forming part of a data filing system, including:
- Contact and appointment forms on www.evrimerdemoglu.com,
- Telephone conversations,
- Email correspondence,
- WhatsApp and similar messaging services,
- Online consultations,
- Face-to-face meetings,
- Medical reports, documents, photographs and files submitted by you,
- Appointment and patient communication systems,
- Website server and security logs,
- Cookies and similar internet technologies.
6. Transfer of Personal Data
Your personal data may be transferred to the following recipients where such transfer is necessary, proportionate and legally permitted:
- Employees and support personnel authorised by the data controller,
- The healthcare institution at which examination or treatment services are provided,
- Laboratories, medical imaging centres and other healthcare service providers where required for the provision of healthcare services,
- Appointment system, information technology, hosting, server, email, software, maintenance and security service providers,
- Legal advisers, accountants and professional consultants,
- Authorised public institutions, courts, public prosecutors and other judicial or administrative authorities.
Personal data transfers are limited to the purposes of:
- Performing the relevant transaction,
- Providing and managing healthcare services,
- Operating the technical infrastructure,
- Complying with legal obligations,
- Establishing, exercising or protecting legal rights.
Your personal data will not be disclosed to unauthorised third parties unless there is a legal obligation or another valid legal basis for processing.
7. International Transfer of Personal Data
Only the option that reflects the website’s actual technical infrastructure should be published.
Option A — Where No International Transfer Takes Place
Your personal data is not transferred outside Türkiye.
Option B — Where International Service Providers or Servers Are Used
Where the website uses hosting, cloud infrastructure, email, security, analytics, messaging or appointment services with servers located outside Türkiye, your personal data may be transferred internationally.
International transfers are carried out only where the conditions and appropriate safeguards set out in Article 9 of the Turkish Personal Data Protection Law No. 6698 are satisfied.
Where explicit consent is legally required for an international transfer, such consent will be obtained separately from this Privacy Notice.
8. Retention Period
Your personal data is retained for:
- The period required for the relevant processing purpose,
- The periods prescribed under applicable healthcare, tax, commercial and other legislation,
- The period necessary to comply with legal obligations,
- Applicable limitation periods for potential legal disputes.
When the applicable retention period expires and there is no other valid legal ground for processing, your personal data will be deleted, destroyed or anonymised in accordance with applicable legislation.
9. Rights of the Data Subject
Under Article 11 of the Turkish Personal Data Protection Law No. 6698, you have the right to apply to the data controller and:
- Learn whether your personal data is being processed,
- Request information where your personal data has been processed,
- Learn the purpose of processing and whether the data is used in accordance with that purpose,
- Learn the third parties to whom your personal data has been transferred,
- Request correction of incomplete or inaccurate personal data,
- Request deletion or destruction of personal data where the legal conditions are met,
- Request notification of correction, deletion or destruction to third parties to whom your data has been transferred,
- Object to a result arising against you through the exclusive analysis of your personal data by automated systems,
- Claim compensation where you suffer damage as a result of unlawful processing.
10. Application Procedure
You may submit requests concerning your personal data to the data controller using one of the following methods:
- By personally delivering or sending a signed written application to [full postal address],
- Through a notary public,
- Using a secure electronic signature or mobile signature,
- Through the registered electronic mail address [KEP address],
- By sending an email from an address previously registered in our systems and through which your identity can be verified to [data protection application email address].
Your application should include:
- Your first name and surname,
- Your contact details,
- The subject and details of your request,
- Information necessary to verify your identity.
Applications will be evaluated and concluded within the period prescribed by applicable legislation, depending on the nature of the request.
11. Updates to This Privacy Notice
This Privacy Notice may be updated where:
- Personal data processing activities change,
- The technical systems used on the website change,
- Applicable legislation is amended,
- Decisions or guidance issued by the Turkish Personal Data Protection Authority are updated.
The updated notice becomes effective on the date it is published on www.evrimerdemoglu.com.