Version: 2.1 · Effective from: 24 September 2026
This privacy notice explains, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR) and Turkish Law No. 6698 on the Protection of Personal Data (KVKK), which personal data we process, for what purposes and on what legal basis.
1. Scope
- For visitors from the European Union and the European Economic Area (for example Germany, Austria or the Netherlands), the GDPR applies (Art. 3(2) GDPR). For visitors from the United Kingdom, the UK GDPR applies in the same way; references to the GDPR in this notice also mean the UK GDPR.
- In addition, Turkish Law No. 6698 (KVKK) applies to all processing, because the controller is based in Turkey.
2. Controller
Prof. Dr. Emin Ersoy
Rüzgarlı Bahçe Mah., Cumhuriyet Cad. No: 24, 34805 Beykoz / Istanbul, Turkey
Email: eminersoy@yahoo.com · Phone: +90 533 300 35 75
If your appointment request leads to an examination or treatment, Kavacık Medikal Sağlık Hizmetleri ve Ürünleri Ticaret ve Sanayi A.Ş. (Medistate Kavacık Hastanesi), MERSİS 0528059740700018, is a separate and independent controller for the data processed in the hospital's own systems, and its own privacy notice applies there. This notice covers only this website and requests made through it.
3. What data we process
Through the request form and the pre-assessment tool (when you provide it):
| Category | Data |
|---|---|
| Identity | First name and surname |
| Contact | Phone number, email address, city / country |
| Health data (special category, Art. 9 GDPR) | Height, weight, body mass index; related conditions you tell us about; previous obesity surgery; health information in the free-text field |
| Health data: documents you send | Laboratory results, endoscopy and imaging reports, discharge summaries, medication list and documents about previous operations that you send by WhatsApp, email or through the form |
| Identity: international requests | Nationality, passport or identity card details, only when the examination is being planned and only if you send them |
| Request | Preferred timing of treatment, preferred contact channel, language, topic of interest |
| Marketing | Where your visit came from (UTM parameters, gclid, fbclid), your consent to information messages |
| Evidence | Date and time, IP address and text version of each consent you give |
When you visit the website (automatically):
| Category | Data |
|---|---|
| Security | IP address, browser and device information, date and time, pages viewed, error logs |
| Statistics and advertising | Usage data collected through cookies and similar technologies, only with your consent |
If you use the pre-assessment tool without submitting the form, your height and weight never leave your browser.
We do not ask for photographs of your body. No body photographs are needed to prepare for the examination; please do not send any. If any are sent, we will not use them and will delete them within 30 days at the latest.
Messaging and email. Health information and documents you send by WhatsApp or email are subject to the same rules as the form: only the doctor and the assigned secretarial staff have access; the information is transferred into the request system and is not additionally stored on devices. Because of end-to-end encryption, WhatsApp (Meta) cannot see the content of messages; however, your use of WhatsApp is also subject to WhatsApp's own privacy policy. You may choose to send your documents by email instead.
Telephone calls are not recorded. Information you give during a call is only recorded as a note in your request.
4. Purposes, legal bases and retention periods
| # | Purpose | Data | Legal basis (GDPR / KVKK) | Retention |
|---|---|---|---|---|
| A | Receiving and handling your appointment request and replying to you | Identity, contact, request | Art. 6(1)(b) and (f) GDPR / KVKK Art. 5(2)(c), (f) | 2 years from the last contact |
| B | Preparation before the examination | Health data | Explicit consent, Art. 9(2)(a) GDPR / KVKK Art. 6(3)(a) | 2 years from the last contact; if treatment follows, the statutory periods for patient records |
| C | Order in which we reply (internal prioritisation, priority score) | Request, contact; if you consent, height, weight and related conditions | Art. 6(1)(f) GDPR / KVKK Art. 5(2)(f); for health data explicit consent, Art. 9(2)(a) GDPR / KVKK Art. 6 | As for A |
| D | Website security and prevention of misuse | Security data | Art. 6(1)(c) and (f) GDPR / KVKK Art. 5(2)(ç), (f) | 2 years |
| E | Legal obligations, requests from authorities, evidence in disputes | The data concerned in each case | Art. 6(1)(c) and (f) GDPR, for health data Art. 9(2)(f) GDPR / KVKK Art. 5(2)(ç), (e) and Art. 6(3)(d) | For the limitation period, no more than 10 years |
| F | Evidence of consents given | Evidence data | Art. 6(1)(c) and Art. 7(1) GDPR / KVKK Art. 5(2)(ç), (e) | 10 years from withdrawal |
| G | Measuring use of the website | Statistics cookies | Consent, Art. 6(1)(a) GDPR and Art. 5(3) of the ePrivacy Directive as implemented in your country (in the UK, the Privacy and Electronic Communications Regulations 2003, PECR) / KVKK Art. 5(1) | As set out in the Cookie Policy |
| H | Measuring advertising performance | Marketing data; with separate consent, hashed email address and phone number | Consent, Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive (in the UK, PECR) / KVKK Art. 5(1) | Until withdrawal, no more than 2 years |
| I | Information and promotional messages | Contact | Consent, Art. 6(1)(a) GDPR / Turkish Law No. 6563 and KVKK Art. 5(1) | Until withdrawal; record of withdrawal 3 years |
| J | Improving quality, statistics, scientific analysis | Anonymised data | Anonymous data are not personal data; for the anonymisation itself, Art. 6(1)(f) GDPR / KVKK Art. 5(2)(f) | Indefinitely (anonymous) |
Important limits:
- Your health data are processed only for purposes B, C and E. They are not used for advertising, targeting, lookalike audiences or profiling, and are not passed to Meta, Google or any other company for advertising or measurement. (Google Sheets is used only as a processor to keep track of requests; see section 6.)
- If you do not consent to the processing of your health data, you can still make your request without health information, or contact us by phone or email.
- Under J, data are used only after they have been anonymised so that you cannot be identified, directly or indirectly.
Legitimate interests. Where we rely on Art. 6(1)(f) GDPR, our interest is to handle requests promptly and securely and to protect the website against misuse.
5. Prioritisation: no automated decision
Requests are put into an order for replies (priority score) based on the preferred timing you give and whether your contact details are valid. If you have consented to the processing of your health data, the height, weight and related conditions you give also affect this order, in line with the criteria for surgical assessment. This only affects the order in which we reply; no request is rejected as a result, and no medical assessment is made automatically. Medical decisions are made only by the doctor, after an examination. The priority score is not sent to advertising or measurement platforms. There is no automated decision-making within the meaning of Art. 22 GDPR.
6. Recipients
| Recipient | Role | Purpose | Location | Data disclosed |
|---|---|---|---|---|
| SiteGround (sub-processor: Google Cloud) | Processor (hosting) | Running the website; storing request and consent records; forwarding the content of the form | EU, Netherlands | Identity, contact, request and evidence data are stored; health data are not stored on the website, they only pass through the server during transmission |
| Kavacık Medikal Sağlık Hizmetleri ve Ürünleri Ticaret ve Sanayi A.Ş. (Medistate Kavacık Hastanesi), email system of the appointment office (medistate.com.tr) | Processor | Forwarding requests to the appointment office and scheduling | Turkey | All information given in the form; health data only with your consent |
| Yahoo EMEA Ltd. / Yahoo Inc. (the doctor's email service, eminersoy@yahoo.com) | Processor | Forwarding requests to the doctor | EU / USA | All information given in the form; health data only with your consent |
| Microsoft Ireland Operations Ltd. / Microsoft Corporation (email service of the website's technical administration, Outlook.com) | Processor | Checking delivery and technical follow-up of request notifications | EU / USA | All information given in the form; health data only with your consent |
| Google Ireland Ltd. / Google LLC (Google Sheets, request tracking sheet) | Processor | Keeping track of requests in order of reply | EU / USA | All information given in the form, priority score and reply status; health data only with your consent |
| Technical service providers | Processors (under contract) | Operation, maintenance, set-up of measurement and advertising tools | Turkey | Only what is necessary, acting on our instructions |
| Kavacık Medikal Sağlık Hizmetleri ve Ürünleri Ticaret ve Sanayi A.Ş. (Medistate Kavacık Hastanesi) | Independent controller | Examination and treatment | Turkey | Request and health data, only if an examination takes place |
| Google Ireland Ltd. / Google LLC | Independent controller / processor | Statistics (GA4), advertising measurement (Google Ads) | EU / USA | Only with your consent; no health data |
| Meta Platforms Ireland Ltd. / Meta Platforms Inc. | Independent controller / processor | Advertising measurement | EU / USA | Only with your consent; no health data |
| Meta Platforms Ireland Ltd. / Meta Platforms Inc. (Facebook and Instagram lead forms) | Processor | Receiving an appointment request you send through a lead form on Facebook or Instagram | EU / USA | Name, phone, email, preferred timing and whether you can attend an examination; no health questions are asked in the form |
| Authorities and courts | - | Legal obligations | Turkey | Data requested |
We do not sell or rent out your data, and we do not share it with others for their own advertising.
7. Transfers to third countries
- To Turkey: The controller is based in Turkey. If you send your data directly to us through the form, by email or by WhatsApp, this is not a transfer within the meaning of Chapter V GDPR, according to the European Data Protection Board (Guidelines 05/2021); the UK position is the same. We nevertheless inform you that your data are processed outside the EU and the UK, and that there is no adequacy decision of the European Commission (or of the UK Government) for Turkey.
- To the USA (Google, Meta): Only with your consent; the transfer relies on the adequacy decision for the EU-US Data Privacy Framework and, for visitors from the UK, on its UK Extension.
- To the USA (Yahoo, Microsoft, Google Sheets): Your request, and your health data if you have consented, are forwarded to the doctor's email service (Yahoo), the email service of the website's technical administration (Microsoft Outlook.com) and the request tracking sheet (Google Sheets), whose servers may be located in the USA. These transfers rely on the EU-US Data Privacy Framework (for the UK, its UK Extension) and, for health data, on your explicit consent (Art. 9(2)(a) and Art. 49(1)(a) GDPR).
- Under the KVKK (Art. 9): Routing through the server in the Netherlands and forwarding to the services above, including in the USA, rely on your explicit consent (KVKK Art. 9(6)(a)). Neither the Netherlands nor the USA is among the countries for which the Turkish Personal Data Protection Board has issued an adequacy decision; in the USA, access by public authorities may not be limited to the level of protection in Turkey, and it may be harder for you to exercise your rights there. Health data are not transferred to advertising providers.
8. Deletion
When the periods set out in section 4 expire, data are deleted, destroyed or anonymised, at the latest in the next periodic deletion cycle (at intervals of no more than six months). If there is a statutory retention obligation, a legal dispute or an official investigation, the data are kept, with processing restricted, until it has ended.
9. Security
Data are transmitted in encrypted form (HTTPS). Administrative access is protected by two-factor authentication and limited to authorised persons. Only the doctor and the assigned secretarial staff have access to health data, and access is logged. If a personal data breach occurs, we will notify the competent supervisory authority and, where required, you within 72 hours.
10. Your rights
Under the GDPR you have the right to
- access your data (Art. 15),
- rectification (Art. 16),
- erasure (Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing based on legitimate interests (Art. 21); you may object to direct marketing at any time without giving reasons,
- withdraw any consent with effect for the future (Art. 7(3)); this does not affect the lawfulness of processing carried out before the withdrawal.
Your rights under Art. 11 KVKK apply in addition.
Limits: If there is a statutory retention obligation or the data are needed to establish, exercise or defend legal claims, erasure can only take place once that reason no longer applies; until then processing is restricted and we will tell you why. For requests that are manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request (Art. 12(5) GDPR).
How to make a request: In writing to the address in section 2, or by email to eminersoy@yahoo.com. To protect your data, we may verify your identity. We will reply free of charge within one month, and in any event within the 30 days required by the KVKK.
Right to complain: You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work (Art. 77 GDPR). In the United Kingdom this is the Information Commissioner's Office (ICO). Under the KVKK, you may complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
11. Whether you must provide data
You are under no statutory or contractual obligation to provide data. Without contact details we cannot reply to you; without health information your request will be handled without preparation for the examination.
12. Changes
We will update this notice if our processing changes; the date and version are shown at the top. If a purpose changes materially, we will ask for your consent again for any processing based on consent.