Comprehensive information regarding the processing of personal data in the context of medical examinations, diagnosis, treatment, care, and patient records.
This privacy notice is provided by Assoc. Prof. Dr. Barış Çakır , a specialist in aesthetic, plastic, and reconstructive surgery, in his capacity as the data controller, pursuant to Article 10 of the Personal Data Protection Law No. 6698.
Address: Teşvikiye Street No. 3/2, Güneş Apartment Building, 1st Floor, 34367 Şişli / Istanbul
E -mail: [email protected]
Website: https://bariscakir.com
This document covers examinations, medical evaluations, diagnoses, treatments, preoperative preparations, care, and follow-up conducted within the context of the doctor-patient relationship, as well as the records and administrative procedures associated with these services. The specific information to be processed is determined based on the service you are seeking and medical necessity; not all of the information listed below is collected from every patient.
Health information is considered sensitive personal data. As a general rule, do not request information unrelated to the service, and do not include unnecessary documents in the file. If you need to share information about a family member or another person, limit it to what is strictly necessary for the care process.
Personal data may be collected through verbal statements made by you or your authorized representative, patient information and assessment forms, findings obtained during examinations, reports and test results you provide, medical records created as part of the service, telephone and email correspondence, and through physical or electronic record-keeping systems.
If necessary for diagnosis, treatment, or follow-up, and provided that the appropriate legal conditions are met, relevant information and documents may be obtained from the hospital, healthcare facility, laboratory, or other healthcare professionals participating in the service. The duty of confidentiality and the principle of purpose limitation are also observed in these procedures.
Data is processed to the extent necessary and in connection with the specified purposes. The maintenance of patient records does not constitute a general authorization for any other purpose, such as unsolicited advertising, promotion, social media sharing, or similar activities.
The portion of personal and contact information necessary for patient admission and the provision of services is processed pursuant to Article 5/2-c of the Law, to the extent that it is directly related to the conclusion or performance of the contract. With regard to obligations arising from legislation—such as record-keeping, reporting, invoicing, and similar requirements—Articles 5/2-a and 5/2-ç of the Law apply depending on the specific processing activity.
Article 5/2-e of the Law applies to the records required for legal claims and disputes; Article 5/2-f applies to necessary and proportionate information security measures, taking into account your fundamental rights and freedoms.
Health data may be processed, to the extent necessary, by persons subject to a duty of confidentiality or by authorized institutions and organizations, pursuant to Article 6/3-e of the Law, for the purposes of providing medical diagnosis, treatment, and care services; planning and managing health services and their financing; and protecting public health. It is not considered a requirement to obtain separate explicit consent for each individual procedure in order to provide health services within this scope.
If no other legal procedure is required for a specific action and the action is to be based on explicit consent, explicit consent is requested separately after explaining the subject matter and purpose. The Initial Consultation Explicit Consent Form, prepared for the voluntary sharing of medical history during an online initial consultation, pertains to this specific process; it is not a general authorization for all treatment records or all data transfers.
Data may be transferred to the following recipient groups, taking into account the nature of the service, its necessity, and the relevant legal requirements:
It is not the case that the entire patient record is sent to every recipient. The information to be disclosed is limited based on the specific purpose and the recipient’s role. Disclosing information to your relatives is also evaluated within the framework of authorization, patient preference, and applicable laws.
The provision of email, hosting, electronic record-keeping, or any other technical service via infrastructure located abroad may constitute a transfer of data abroad, depending on the actual data flow of the relevant service. The fact that a service provider is located abroad or operates under a foreign brand does not, in and of itself, mean that all patient information has been transferred; the specific data and access involved must be determined separately.
When it comes to cross-border transfers, a legal mechanism that complies with the current requirements of Article 9 of the Law must be established, and the data subject must be informed about the actual transfer process. Explicit consent given for a healthcare service or an initial consultation cannot be used as authorization covering all cross-border transfers to unspecified recipients.
Patient files and health care records are retained in accordance with the time periods specified in relevant health, financial, and other regulations, as well as the time periods necessary for monitoring the provision of services and protecting legal rights. There is no single, uniform retention period that applies to all patient data.
The default 90-day retention period set for web form submissions does not apply to the retention period for medical records created during an examination or treatment. A separate process is followed for transferring the information from the form to the patient’s medical record.
When all conditions for processing and retention no longer apply, the data is deleted, destroyed, or anonymized ex officio or upon a valid request, in accordance with applicable legislation. Electronic records, physical documents, emails, and backup copies are different media; retention and disposal procedures are managed with these media in mind.
Administrative and technical measures—such as limiting access privileges based on job requirements, the obligation to maintain confidentiality, technical access controls, and the protection of records—are considered part of data security. The relevant measures are implemented based on the records and service infrastructure in use.
Under Article 11 of the Law, you may inquire whether your data has been processed; if it has been processed, you may request information regarding such processing; you may inquire about the purpose of the processing and whether the data is being used in accordance with that purpose; you may inquire about third parties to whom your data has been transferred, whether within the country or abroad; and you may request that incomplete or incorrect data be corrected and, if the conditions are met, that it be deleted or destroyed.
You may request that relevant recipients be notified of any corrections, deletions, or erasures; you may object to any outcome that is detrimental to you resulting from the analysis of your data exclusively by automated systems; and if you have suffered damage due to unlawful processing, you may request compensation.
You may withdraw the consent you have provided for specific actions based on explicit consent. This request is evaluated on a case-by-case basis; it does not mean that patient records required to be retained due to other legal obligations will be deleted immediately in every instance.
You may submit your applications in writing to Assoc. Prof. Dr. Barış Çakır at the address Teşvikiye Caddesi No. 3A, Güneş Apartment, 1st Floor, 34367 Şişli / Istanbul, or via email to [email protected] using the email address you previously provided to us and which is registered in our system. Other application methods defined in the relevant legislation and the necessary information are explained on the KVKK Application page.
Applications are processed as soon as possible, depending on the nature of the request, and no later than 30 days. A response is provided stating whether the request has been approved or denied, along with the reasons for the decision. If the process involves additional costs, the fee provisions of the relevant legislation may apply.
Your request to exercise your rights should first be directed to the data controller. The fact that the privacy notice is available on the website does not, by itself, relieve the data controller of its obligation to provide you with appropriate information at the time your data is collected.