Personal Data Protection and Processing Policy

Data Controller: Op. Dr. Murat Polat (the “Clinic”)

Address: Konaklar, Akasyalı Sk. No:17, Beşiktaş, 34330 Istanbul, Türkiye

E-mail: info@drmuratpolat.com

Phone: +90 535 973 69 61

Location: Google Maps

Last updated: 20/10/2026

1. Introduction

The Clinic attaches great importance to the protection of the personal data of its patients, prospective patients, companions, visitors, employees and all other individuals with whom it has a relationship. Patient confidentiality is at the heart of our work, and we are committed to processing and storing personal data lawfully, transparently, carefully and with respect for individuals’ rights.

This Policy explains how the Clinic processes and protects personal data in accordance with the Law on the Protection of Personal Data No. 6698 (“PDPL” / “KVKK”) and related legislation. Individuals whose personal data are processed are referred to in this Policy as “data subjects”.

2. Purpose and Scope

The purpose of this Policy is to inform data subjects about the personal data processing activities carried out by the Clinic and the technical and administrative measures taken to protect that data. It applies to the personal data of:

• patients and prospective patients (including those who contact us through our website, social media, messaging applications or by phone);
• patient companions and relatives;
• visitors to the Clinic;
• job applicants and employees;
• employees, shareholders and officials of the institutions we cooperate with;
• other third parties.

3. Definitions

• Explicit consent: Consent relating to a specific matter, given freely and on an informed basis.
• Anonymization: Altering personal data so that it can no longer be associated with an identified or identifiable person, even when combined with other data, through techniques such as masking, aggregation or data distortion. The Clinic takes the necessary measures to ensure that anonymized data cannot be re-identified.
• Personal data: Any information relating to an identified or identifiable natural person, such as name and surname, ID or passport number, e-mail address, phone number, address, date of birth or bank account details.
• Special categories of personal data: Data on race, ethnic origin, political opinion, philosophical belief, religion or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
• Processing of personal data: Any operation performed on personal data, such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing its use, whether wholly or partly by automated means, or by non-automated means as part of a data recording system.
• Data controller: The person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
• Data processor: A natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by it (for example, an IT or software service provider).
• Institutions we cooperate with: Business partners, suppliers and other organizations with which the Clinic has a business relationship, including their employees, shareholders and officials.
• Third party: Natural persons other than the above who are connected with the Clinic’s activities, such as patient companions or employees of service providers.

4. Data Controller Status

The Clinic acts as data controller under the PDPL and [is registered with the Data Controllers’ Registry (VERBİS)]. A personal data team has been established within the Clinic. Where a decision is required, the team obtains the opinion of a lawyer specialized in data protection and implements the decision following management approval.

5. How Personal Data Is Collected

Personal data, including health data, is collected verbally, in writing or electronically through:

• face-to-face consultations and examinations at the Clinic;
• our physicians, healthcare staff and employees;
• our website, online consultation and contact forms;
• social media accounts and messaging applications (e.g. Instagram, WhatsApp);
• phone calls and e-mail;
• patient coordinators, interpreters and other service providers we work with;
• security cameras on the Clinic premises.

6. Purposes of Processing

Personal data is processed for the following purposes:

• carrying out medical diagnosis, treatment and care services;
• protecting public health and providing preventive medicine;
• planning, managing and financing healthcare services;
• evaluating online consultation requests, including photographs submitted for pre-assessment;
• scheduling appointments and sending appointment reminders;
• organizing travel-related services for international patients (e.g. airport transfers and accommodation), where requested;
• verifying identity;
• issuing invoices and carrying out financial reconciliation with banks, insurers and contracted institutions;
• sharing information requested by private insurance companies within the scope of financing healthcare services;
• responding to questions, requests and complaints;
• measuring and improving patient satisfaction;
• carrying out risk management, quality improvement and internal planning activities;
• ensuring information and physical security;
• fulfilling contractual obligations and legal and regulatory requirements, including reporting to the Ministry of Health and other public authorities;
• with separate explicit consent, using before/after photographs and patient testimonials in promotional materials.

7. Categories of Personal Data Processed

Category	Examples
Identity	Name and surname, ID card or passport details, date of birth, nationality
Contact	Phone number, e-mail address, home address, social media username
Health	Medical history, examination and test results, photographs taken for medical purposes, treatment and surgery records, prescriptions
Visual and audio records	Before/after photographs, CCTV footage
Financial	Invoice details, payment records, bank account information
Customer transaction	Appointment records, consultation requests, correspondence, complaints
Family and relatives	Contact details of companions or emergency contacts
Transaction security	IP address, website log records, passwords
Job applicant	CV information, interview notes
Employment	Payroll, social security (SGK) details, employment contract, performance and attendance records
Legal transaction	Information processed for following up legal claims and obligations

8. Principles of Processing

The Clinic processes personal data in accordance with the following principles:

• lawfulness and fairness;
• accuracy and, where necessary, keeping data up to date;
• processing for specified, explicit and legitimate purposes;
• being relevant, limited and proportionate to those purposes;
• retaining data only for the period required by legislation or by the purpose of processing.

9. Legal Grounds for Processing

Personal data (Article 5)

Explicit consent is only one of the legal grounds for processing. Personal data may also be processed without explicit consent where:

• processing is expressly provided for by law;
• processing is necessary to protect the life or physical integrity of a person who cannot give consent due to actual impossibility;
• processing is directly related to the conclusion or performance of a contract;
• processing is necessary for the Clinic to comply with a legal obligation;
• the data subject has made the data public;
• processing is necessary to establish, exercise or protect a right;
• processing is necessary for the Clinic’s legitimate interests, provided it does not harm the data subject’s fundamental rights and freedoms.

A processing activity may rely on one or more of these grounds.

Special categories of personal data (Article 6)

Following the amendments to the PDPL that entered into force on 1 June 2024, special categories of personal data may be processed where adequate measures determined by the Personal Data Protection Board are taken and:

• the data subject has given explicit consent;
• processing is expressly provided for by law;
• processing is necessary to protect the life or physical integrity of a person who cannot give consent due to actual impossibility;
• the data has been made public by the data subject, in line with their own will;
• processing is necessary to establish, exercise or protect a right;
• processing is necessary, by persons under a duty of confidentiality or by authorized institutions, for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of healthcare services;
• processing is necessary to fulfil legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance; or
• another ground set out in Article 6 applies.

Health data processed for diagnosis and treatment therefore does not require explicit consent. The Clinic seeks explicit consent where no other ground applies, for example for the use of before/after photographs in marketing materials.

10. Transfer of Personal Data

In accordance with Articles 8 and 9 of the PDPL and for the purposes set out above, personal data may be shared with:

• the Ministry of Health and its affiliated units, and other authorized public institutions;
• the Social Security Institution and private insurance companies;
• judicial authorities, public prosecutors, law enforcement and other competent authorities, where required by law;
• laboratories, imaging centres, hospitals and other healthcare providers we cooperate with for diagnosis and treatment, or to which a patient is referred;
• representatives duly authorized by the data subject;
• consultants, auditors and legal advisers;
• suppliers and service providers we work with, such as IT, software, cloud storage, patient coordination, interpreting, transfer and accommodation services.

Where personal data is transferred abroad (for example, when communicating with international patients or using cloud-based services), the Clinic complies with the conditions of Article 9 of the PDPL, such as adequacy decisions, appropriate safeguards including standard contracts, or the exceptions provided for occasional transfers.

11. Technical and Administrative Measures

In accordance with Article 12 of the PDPL, the Clinic takes the following measures in line with technological possibilities and implementation costs:

• Strong passwords and access authorizations are used on computers, software and e-mail accounts; access to patient data is limited to authorized staff.
• Staff receive training on data protection and patient confidentiality and sign confidentiality undertakings, which remain in force after they leave the Clinic.
• Regular data backups are performed, and backup media are protected.
• Patient files and records are shared only with the patient, persons authorized by the patient in writing, competent public authorities as required by law, and judicial authorities.
• Data subjects are informed before their data is processed, including through notices displayed at the Clinic and on our website.
• A personal data processing inventory is maintained and kept up to date.
• Agreements containing data protection obligations are concluded with data processors.

12. CCTV Monitoring

The Clinic uses security cameras at entrances, exits and common areas to ensure the safety of patients, visitors and staff, in accordance with the PDPL and security legislation. Cameras are not used in examination or treatment rooms. Recordings are accessible only to authorized staff and, where applicable, the employees of the security service provider, and are kept for [2 months] before being deleted.

13. Rights of Data Subjects

Under Article 11 of the PDPL, data subjects have the right to:

• learn whether their personal data is processed;
• request information about processing, if their data has been processed;
• learn the purpose of processing and whether data is used in line with that purpose;
• know the third parties, in Türkiye or abroad, to whom their data is transferred;
• request correction of incomplete or inaccurate data;
• request deletion or destruction of their data under the conditions set out in Article 7;
• request that corrections, deletions or destructions be notified to third parties to whom the data was transferred;
• object to a result to their detriment arising from analysis exclusively by automated systems;
• claim compensation for damages arising from unlawful processing.

These rights may be exercised by applying to the Clinic in writing, via registered electronic mail (KEP), with a secure electronic or mobile signature, or from an e-mail address previously registered with the Clinic, using the contact details above. Requests are answered free of charge within thirty (30) days at the latest; if the request involves an additional cost, a fee may be charged in line with the tariff set by the Personal Data Protection Board.

14. Retention and Disposal

Personal data is retained only for the period required by legislation or by the purpose of processing, and is then deleted, destroyed or anonymized in accordance with the Clinic’s Personal Data Retention and Disposal Policy.

15. Entry into Force

This Policy enters into force on the date it is published on www.drmuratpolat.com. The Clinic may update it when required by changes in legislation or in its processing activities.