Privacy Policy

PRIVACY POLICY ON THE PROCESSING OF PERSONAL DATA

1. Data Controller

Within the scope of Law No. 6698 on the Protection of Personal Data (“KVKK”), the data controller in relation to private practice and healthcare services is Prof. Dr. Halil Can Gemalmaz.

www.drcangemalmaz.com is one of the communication channels through which personal data may be collected; the website itself is not a separate data controller.

This Privacy Notice has been prepared to inform our patients, prospective patients, website visitors, and individuals who contact us regarding healthcare services about the purposes, methods and legal grounds for processing their personal data, the parties to whom such data may be transferred, and their rights regarding their personal data.

2. Personal Data That May Be Processed

Depending on the nature of the requested or provided service, the following categories of personal data may be processed:

Identity Information

Name, surname, date of birth, gender, Turkish ID number, passport or foreign identification details for non-Turkish nationals, patient or protocol number, and other information necessary to verify identity where required.

Contact Information

Telephone number, email address, residential or correspondence address, country of residence, preferred communication method, and information contained in communications with us.

Health Information

Medical history, current and previous illnesses, prior treatments and surgical procedures, examination findings, laboratory and test results, prescription and medication information, X-rays, CT scans, MRI scans and other medical images, medical reports, clinical photographs and videos, and other health-related information necessary for medical evaluation, diagnosis, treatment or care.

Health data are classified as special categories of personal data under the KVKK.

Financial and Insurance Information

Payment and invoicing information, private health insurance information and, where relevant, other information required for the financing of healthcare services.

Application and Appointment Information

The healthcare service requested, date and source of the application, appointment details, communication preferences, and information relating to the follow-up of the application.

Technical Data

Where necessary for the secure and proper operation of the website, IP address, connection and security logs, and technical information relating to strictly necessary cookies.

Non-essential cookies used for analytics, advertising, or tracking user behaviour are addressed separately under our Cookie Policy and cookie preference system.

3. Methods and Sources of Personal Data Collection

Depending on the nature of the healthcare service requested or provided, your personal data may be collected directly from you or from third-party platforms through which you have chosen to submit an application, by oral, written, visual or electronic means.

Your personal data may in particular be collected through:

  • face-to-face consultations and medical examinations,

  • telephone calls made via +90 544 405 29 01,

  • WhatsApp and similar messaging applications,

  • emails sent to [email protected], [email protected] and [email protected],

  • contact or application forms available on www.drcangemalmaz.com,

  • appointment scheduling through Calendly,

  • messages sent to our social media accounts and applications made through social media,

  • applications submitted through Bookimed, Medical Departures and similar medical tourism or patient-referral platforms,

  • patient application forms,

  • records generated during examination, treatment and follow-up,

  • X-rays, CT scans, MRI scans, laboratory results, medical reports, clinical photographs, videos and other medical documents provided to us.

The main server infrastructure of www.drcangemalmaz.com is hosted in a data centre located in Türkiye.

Calendly is used solely for appointment scheduling, and detailed medical information is not intended to be requested through this service.

4. Purposes of Processing Personal Data

Depending on the nature of your application and the services provided, your personal data may be processed for the following purposes:

  • verifying your identity,

  • assessing your request for healthcare services,

  • carrying out a preliminary assessment of your health condition,

  • providing medical opinions and evaluating suitable treatment options,

  • planning and providing examination, diagnosis, treatment, surgery, care and follow-up services,

  • managing appointment processes,

  • maintaining communication with patients and prospective patients,

  • assessing and coordinating healthcare services requested within the scope of medical tourism,

  • coordinating with hospitals and other healthcare providers involved in treatment,

  • arranging laboratory, imaging and other diagnostic services,

  • creating and maintaining patient files and medical records,

  • processing payments, invoicing and health insurance procedures,

  • fulfilling legal and professional obligations,

  • responding to lawful requests from authorised public institutions and authorities,

  • establishing, exercising or protecting legal rights,

  • ensuring the security of information systems, patient records and communication infrastructure,

  • assessing and improving the quality of healthcare services.

For statistical studies conducted to assess healthcare quality or performance, anonymised data or data that cannot be directly linked to an identifiable individual will be used wherever reasonably possible.

5. Legal Grounds for Processing Personal Data

Your general personal data may be processed on the basis of the applicable legal grounds set out under Article 5 of the KVKK, including where:

  • processing is expressly provided for by law,

  • processing is directly related to the establishment or performance of a contract,

  • processing is necessary for the data controller to comply with a legal obligation,

  • processing is necessary for the establishment, exercise or protection of a legal right,

  • processing is necessary for the legitimate interests of the data controller, provided that such processing does not prejudice your fundamental rights and freedoms.

Special categories of personal data, including health data, are processed in accordance with the applicable conditions set out under Article 6 of the KVKK.

In particular, health data required for preventive medicine, medical diagnosis, treatment and care, and for the planning, management and financing of healthcare services may be processed, subject to the applicable legal conditions, by persons who are under a duty of confidentiality.

In addition, under Law No. 3359 on Basic Health Services and other applicable healthcare legislation, personal data necessary for the provision of healthcare services may be processed when an individual applies to a healthcare professional for medical care.

6. Medical Images, Scientific Use and Promotional Activities

Clinical images that are necessary for medical documentation during treatment may be processed as part of your medical record for the provision of healthcare services.

However, the use of your personal data or any identifiable photographs, videos, images, patient testimonials or similar content for purposes such as:

  • social media,

  • websites,

  • promotional activities,

  • advertising,

  • patient experience sharing

is not a condition of receiving healthcare services.

Such use will, where required, be subject to a separate information and explicit consent process.

Likewise, the use of personal data for scientific research or publication beyond the ordinary scope of healthcare services will be assessed separately.

7. Domestic Transfer of Personal Data

Your personal data may be transferred, only to the extent necessary and limited to the relevant purpose, to:

  • healthcare professionals and support personnel involved in providing healthcare services,

  • hospitals and healthcare institutions where treatment is provided,

  • laboratories and diagnostic imaging centres where necessary,

  • other healthcare providers involved in your care,

  • private health insurance companies and relevant financing institutions,

  • accounting, legal and financial advisers,

  • website, server, patient management system and information technology service providers,

  • legally authorised public authorities and institutions,

  • courts and other authorised judicial or administrative bodies,

provided that the relevant requirements under the KVKK and applicable legislation are met.

Any transfer of personal data is carried out in accordance with the principles of being relevant, limited and proportionate to the purpose of processing.

8. Electronic Systems and International Transfers of Personal Data

The principal medical records of patients and prospective patients are, wherever possible, maintained in patient files and patient management systems used for the provision of healthcare services.

For the management of applications and communications, we may also use:

  • email and cloud-computing services,

  • WhatsApp and similar messaging services,

  • appointment scheduling systems,

  • customer relationship management systems,

  • automation and application-classification systems.

Some of these service providers or their technical infrastructures may be located outside Türkiye. As a result, certain personal data may be transferred internationally.

In customer relationship management, appointment scheduling and application tracking systems, we seek to process, wherever possible, only the limited identity, contact and application information necessary for managing the application rather than detailed clinical information.

Where personal data are transferred outside Türkiye, such transfers are carried out in accordance with Article 9 of the KVKK and the applicable legislation on international transfers of personal data, including the relevant conditions and appropriate safeguards.

9. Automation and Artificial Intelligence-Assisted Systems

Certain digital applications may be operationally classified using automation or artificial intelligence-assisted tools in order to manage the volume of applications and communications.

When such systems are used, data minimisation is applied wherever possible, and unnecessary transfer of detailed health information to unrelated systems is avoided.

Automated classification tools are not used to make medical diagnoses or independent treatment decisions concerning patients. Medical assessments and treatment decisions are made by healthcare professionals.

10. Retention of Personal Data

Your personal data are retained for as long as necessary, taking into account:

  • the provision of healthcare services,

  • legal requirements relating to patient files and medical records,

  • retention obligations arising from healthcare legislation,

  • financial and tax obligations,

  • limitation periods and potential legal disputes,

  • the purpose for which the relevant personal data were processed.

Where the grounds for processing personal data cease to exist and there is no other legal obligation requiring retention, the relevant personal data will be deleted, destroyed or anonymised in accordance with applicable legislation.

Records relating to prospective patients whose applications do not result in the provision of healthcare services will not be retained for longer than necessary in relation to the purpose for which they were collected.

11. Security of Personal Data

Appropriate technical and organisational measures are implemented, taking into account the nature of the personal data processed and the associated risks, in order to:

  • prevent unlawful processing of personal data,

  • prevent unauthorised access,

  • prevent loss, alteration or unlawful disclosure,

  • ensure the secure storage of personal data.

Additional safeguards are applied to special categories of personal data, including health information, having regard to their sensitive nature.

12. Your Rights Under the KVKK

Under Article 11 of the KVKK, you have the right to apply to the data controller and:

  • learn whether your personal data are being processed,

  • request information where your personal data have been processed,

  • learn the purpose of processing and whether your data are being used in accordance with that purpose,

  • know the third parties to whom your personal data have been transferred in Türkiye or abroad,

  • request correction of incomplete or inaccurate personal data,

  • request deletion or destruction of your personal data where the conditions set out under the KVKK are met,

  • request notification of correction, deletion or destruction to third parties to whom the data have been transferred,

  • object to a result arising against you through the analysis of processed data exclusively by automated systems,

  • request compensation for damages where you suffer loss as a result of unlawful processing of your personal data.

13. Applications and Contact

You may submit requests concerning your rights under the KVKK to the data controller, Prof. Dr. Halil Can Gemalmaz, through the methods permitted under applicable legislation.

Postal / In-person Applications:
Teşvikiye Mahallesi, Hakkı Yeten Caddesi No:17/7
Şişli, Istanbul, Türkiye

Email:
[email protected]

Your application should include:

  • your name and surname,

  • sufficient information to verify that the application belongs to you,

  • the subject matter of your request,

  • contact details through which you wish to receive our response.

Applications will be reviewed and concluded as soon as possible and within the time limits prescribed under the KVKK.

Version: 1_140926