Privacy Policy

Privacy Policy and Information Notice under the Turkish Personal Data Protection Law (KVKK)

Last updated: 8 October 2026

This notice explains how your personal data is processed when you visit the profdrercangurses.com website and when you contact us through the communication channels on the site. It has been prepared under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”). It does not replace the information provided to patients about the processing of their data during examination and treatment.

Reading this notice, visiting the site or contacting us does not mean that you have given explicit consent.

This is an English translation. If there is any difference between this text and the Turkish version, the Turkish version prevails.

1. Data controller

The data controller of your personal data is Prof. Dr. Ercan Lütfi Gürses, acting as a natural person.

Address: Park Yaşam Ofisleri, Yalı Mah. 6523 Sokak No: 32/B K: 3 D: 303, Mavişehir, Karşıyaka, 35550 İzmir, Türkiye
Email: profdrercangurses@gmail.com
Phone: +90 555 195 88 88

2. What data is collected, and how?

• Contact form: The name, email address and message you enter in the Contact Form 7 form are received electronically. Form messages are sent to the Gmail address given above.
• Email, phone and WhatsApp: Depending on the channel you choose, we receive your name, phone number, email address and the information you share with us. Information given by phone is obtained verbally; email and WhatsApp messages are obtained electronically.
• Site and security logs: When you access the site, technical data such as your IP address, browser and device information, the pages accessed and the time of access is collected automatically through server logs and security tools.
• Cookie preferences: The consents, refusals and preference changes you make through Complianz, and the related technical records, are processed.
• Usage data that depends on your consent: If you give consent, online identifiers, pages visited, time of visit, device and browser information, and site interactions such as clicks and scrolling are processed through cookies and similar technologies.

Google reCAPTCHA loads on pages that contain a contact form, regardless of your cookie choices. Even if you do not submit the form, a connection to Google is made when you open these pages. Your IP address, device and browser information and the interaction data used for spam checks may be processed by Google.

3. Purposes and legal grounds

• Answering your enquiries: Your name, contact details and message are processed to review your enquiry and reply to you. For general enquiries, the legal ground is our legitimate interest in handling communication, provided that it does not harm your fundamental rights and freedoms (KVKK Art. 5/2-f). If the enquiry is directly related to entering into or performing a healthcare service contract, the ordinary personal data needed for this is processed under Art. 5/2-c.
• Running the site and keeping it secure: Technical logs and spam-check data are processed to prevent misuse, identify technical problems and provide the site securely. The legal ground is our legitimate interest in operating the site securely, provided that it does not harm your fundamental rights and freedoms (KVKK Art. 5/2-f).
• Applying your cookie preferences: The records needed to remember your preferences and act on your choice are processed on the basis of legitimate interest (KVKK Art. 5/2-f). The records needed to document that consent was given or withdrawn are kept to fulfil legal obligations (KVKK Art. 5/2-ç).
• Visit and usage analysis: Google Analytics, Microsoft Clarity and Yandex Metrica run only with your explicit consent, to evaluate visit statistics and site usage (KVKK Art. 5/1).
• Advertising measurement: Google Ads runs only with your explicit consent, to measure the effect of advertising on site visits and interactions (KVKK Art. 5/1). Google Tag Manager is used to manage the measurement tools you have allowed and loads only after consent.
• Showing a map: Google Maps loads only with your explicit consent, to show the location of the practice on a map (KVKK Art. 5/1).
• Handling KVKK requests: The identity, contact and request details in your application are processed to review and answer it, in order to fulfil a legal obligation (KVKK Art. 5/2-ç and Art. 13).

4. When you share health information

Please do not send test results, medical reports, imaging results or detailed health information through the contact form, email or WhatsApp. Limit your message to what is needed for a general enquiry.

If your message contains health information, this is special category personal data. Health data that needs to be reviewed for your healthcare request may be processed by the physician, who is bound by professional confidentiality, to the extent necessary to plan or provide the healthcare service, under KVKK Art. 6/3-e. Sending health information on your own initiative does not mean that you allow it to be processed for every purpose or transferred abroad.

The adequate measures under KVKK Art. 6/4 and the related data security obligations apply to the processing of health data. Information that has no legal ground for processing, or is not needed for the purpose, is deleted or destroyed in line with the retention and destruction rules.

5. Service providers and data sharing

The following providers are used for the site and communication services. Data shared with them should be limited to what the service requires.

• Hosting provider: Used to host the site and provide server services. The server hosting the site is located in Türkiye.
• Google Gmail: Used to receive contact form messages and handle email correspondence. Your name, email address and message are processed through this service.
• Google reCAPTCHA: Used to protect the forms against spam and automated abuse. It loads on form pages regardless of consent.
• Google Analytics, Google Ads and Google Tag Manager: Used, within the scope of your consent, for visit analysis, advertising measurement and management of these tools.
• Microsoft Clarity and Yandex Metrica: Used, within the scope of your consent, to analyse site usage and interactions.
• Google Maps: Used to show the location of the practice if you give consent.
• WhatsApp/Meta: If you choose to use the WhatsApp link, communication takes place through this service. Your phone number, message content and the usage data needed for the service to work are processed according to the technical structure and privacy terms of the service.

You do not have to use WhatsApp. You can also contact us on the phone number given above.

6. Legal framework for transfers abroad

Using Gmail, Google reCAPTCHA, consent-based Google services, Microsoft Clarity, Yandex Metrica and WhatsApp may involve sending personal data to service providers abroad or making it accessible from abroad. Hosting the site in Türkiye does not remove the transfers abroad that arise from these services.

These transfers are subject to Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad dated 10 July 2024. For regular transfers, in addition to a processing condition suited to the type of data, there must be an adequacy decision covering the transfer. Without such a decision, one of the appropriate safeguards under KVKK Art. 9/4 must be in place, provided that the data subject can exercise their rights and has access to effective legal remedies. Standard contracts announced by the Personal Data Protection Board are one of these safeguards.

Where there is no adequacy decision and no appropriate safeguard, the exceptions in KVKK Art. 9/6 can apply only to incidental transfers. Accepting cookies or choosing to communicate through WhatsApp does not replace the legal mechanism required for regular transfers abroad.

7. How can you manage your cookie preferences?

Google Analytics, Google Ads, Google Tag Manager, Microsoft Clarity, Yandex Metrica and the embedded Google Maps do not load unless you give the related consent. Your preferences are managed through Complianz. Google reCAPTCHA, which runs on form pages, does not depend on consent.

You can refuse the consent-based tools, change your preferences or withdraw the consent you have given, using the cookie preferences panel on the site. Information on cookie names, purposes and durations is available on the Cookie Policy page (in Turkish).

Withdrawing consent does not affect lawful processing carried out before the withdrawal. This information notice does not replace the declaration of explicit consent for cookies.

8. Retention and deletion

Personal data is kept for the periods set out in the relevant legislation and for as long as the purpose of processing requires. For contact records, the nature and outcome of the request are taken into account; for technical logs, security needs; for application and consent records, the fulfilment of the related obligations. Data is not kept longer than necessary.

How long cookies stay on your device is explained on the Cookie Policy page. The period a cookie stays on your device may differ from the period the data collected through that tool is kept.

When all the reasons for processing no longer exist, personal data is deleted, destroyed or anonymised under KVKK Art. 7 and the related legislation, either on our own initiative or upon your valid request.

9. Your rights regarding your personal data

Under KVKK Art. 11, you can apply to the data controller to exercise the following rights:

• To learn whether your personal data is processed and, if so, to request information about it.
• To learn the purpose of processing and whether the data is used in line with that purpose.
• To learn the third parties in Türkiye or abroad to whom the data has been transferred.
• To ask for incomplete or incorrect data to be corrected.
• To ask for the data to be deleted or destroyed when the conditions in KVKK Art. 7 are met.
• To ask for the correction, deletion or destruction to be notified to the third parties to whom the data has been transferred.
• To object to a result against you that arises from analysis of the data exclusively by automated systems.
• To claim compensation for damage you suffer because of unlawful processing.

10. How to apply and how to complain

You can send your application, addressed to Prof. Dr. Ercan Lütfi Gürses, signed and in writing, by hand or by post to the practice address above. You can also apply from an email address that you have previously given us and that is registered in our records, to profdrercangurses@gmail.com. Applications made with a secure electronic signature or mobile signature can be sent to the same email address. Your rights regarding the other methods recognised in the Communiqué on the Procedures and Principles of Application to the Data Controller are reserved.

Your application must include your name and surname, your signature for written applications, your Turkish ID number if you are a citizen of Türkiye, or your nationality and passport number or, if any, your ID number if you are a foreign national. Please also state your residential or business address for notifications, your email address for notifications if any, your phone and fax numbers, and your request. Attach the related information and documents. Do not send documents that are not needed to verify your identity.

Applications are concluded as soon as possible depending on the nature of the request, and within 30 days at the latest. The answer is given in writing or electronically. If the request is refused, the reasons are explained. Applications are free of charge as a rule. If the action requires an additional cost, only the fee allowed under Article 7 of the Communiqué on the Procedures and Principles of Application to the Data Controller may be charged. If the application arises from an error of the data controller, the fee is refunded.

If your application is refused, if you find the answer insufficient, or if you do not receive an answer in time, you can file a complaint with the Personal Data Protection Board. The complaint period is 30 days from the date you learn of the answer, and in any case 60 days from the date of application. If no answer is given, you can file a complaint within 60 days from the date of application, after the 30-day answer period has ended.

11. Nature of the information on the site and updates

The health content on the site is for general information only. It does not replace examination, diagnosis or treatment.

This notice is updated when data processing activities or the legislation change. If a new processing purpose arises, separate information is given before processing for that purpose begins.