Privacy Notice (KVKK)

Pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) · Data controller: Dr. Nejmi Öztürk

Who is the data controller?

The data controller for the personal data processed through this website is Dr. Nejmi Öztürk, ophthalmologist and eye surgeon. Contact details are given below.

What does this privacy notice cover?

This notice covers only the personal data processed through the nejmiozturk.com website and the contact channels listed on it (contact form, telephone, WhatsApp, e-mail). The website is operated in Türkiye, and your personal data is processed under Turkish Law No. 6698 on the Protection of Personal Data (KVKK), referred to below as “the Law”; the article numbers in this notice refer to that Law.

Your health records relating to examinations, tests and treatments carried out at HG Hospital are kept in the hospital information system; for those records the data controller is HG Hospital, the hospital’s own privacy notice applies, and requests concerning those records should be addressed to the hospital.

Data controller for hospital records

Requests concerning your examinations, tests, surgery and hospital records must be addressed to the hospital directly. The hospital’s data controller details are below.

The details above are compiled from the hospital’s own published sources and are given for guidance only; the hospital’s published privacy notice and the application procedures set out in it prevail.

Which of your personal data is processed?

The data processed through the site is limited to the information you share and the records that are generated technically during your visit.

For what purposes and on what legal basis is your data processed?

Your personal data is processed for the purposes below and on the legal bases set out in Articles 5, 6 and 9 of the Law.

You may stop the processing operations based on explicit consent (health information you share in your message, use of WhatsApp and analytics cookies) at any time; withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw your consent to the analytics cookies through the link on the Cookie Policy page.

Who is your data shared with?

Your data may be transferred only for the purposes above, and only to the extent necessary, to the following recipients:

• Hosting and technical service providers: The companies that provide the site’s hosting, e-mail and technical maintenance services may access data only to the extent required by the service and in the capacity of data processors.
• WhatsApp (Meta Platforms): WhatsApp is not a mandatory channel; it is used only if you choose it, and only for appointment requests and general contact. No test result, report, image or other patient data is sent or requested through this channel and no medical assessment is made there; the data transferred is therefore limited to your name, telephone number and the content of your appointment request. If you do choose it, that information is transmitted through Meta Platforms’ servers abroad, as the application’s infrastructure requires. Possible risks: your data is processed in a country outside Türkiye; that country may not provide the level of protection required by the Law and exercising your rights there may be more difficult. This transfer is based on your explicit consent given after being informed of these risks, under Article 9(6) of the Law. If you do not want a transfer abroad, you can use the contact form, the telephone or e-mail; no transfer abroad takes place through those channels.
• Google (Google Ireland Limited): If you consent to the analytics cookies, usage data relating to your visit is processed on Google’s servers abroad through the Google Analytics 4 service. Possible risks: your data is processed outside Türkiye; that country may not provide the level of protection required by the Law and exercising your rights there may be more difficult. This transfer is based on your explicit consent given after being informed of these risks, under Article 9(6) of the Law. If you do not consent, no analytics cookie is set and this transfer does not take place.
• HG Hospital appointments unit: Where necessary to create your appointment in the hospital system, your name and telephone number may be shared with the hospital’s appointments unit.
• Competent public authorities and institutions: Upon duly made requests from legally authorised bodies (courts, public prosecutors’ offices, the Information and Communication Technologies Authority (BTK), etc.), data is shared to the extent required by the legislation.

Beyond this, your data is not sold or rented to third parties and is not shared for marketing purposes.

How long is your data kept?

Your data is kept for as long as the purpose of processing requires, taking into account the periods laid down in the relevant legislation; at the end of that period it is deleted, destroyed or anonymised. If there is a legal dispute or a request from a competent authority, the relevant data may be kept until the matter is concluded.

How is your data protected?

To prevent the unlawful processing of, and unlawful access to, your data, reasonable technical and organisational measures are taken under Article 12 of the Law:

• Data transmission between the site and your browser is encrypted with an SSL certificate (HTTPS).
• Form and message data can be accessed, with a password, only by the physician and a limited number of people he has authorised.
• The site software is updated and backed up regularly; messages containing health information are not copied unnecessarily and are deleted at the end of the retention period.

Transmission over the internet is never entirely free of risk; we recommend that you do not share more personal information in your messages than is necessary.

What are your rights under Article 11 of the Law?

By applying to the data controller, you can exercise the following rights in relation to your personal data:

• to learn whether your personal data is being processed,
• if it is, to request information about the processing,
• to learn the purpose of the processing and whether the data is used in line with that purpose,
• to know the third parties, within the country or abroad, to whom the data is transferred,
• to request correction if the data has been processed incompletely or inaccurately,
• to request erasure or destruction of the data under the conditions set out in Article 7 of the Law,
• to request that any correction, erasure or destruction be notified to the third parties to whom the data has been transferred,
• to object to a result that is to your detriment arising from the analysis of the processed data exclusively by automated systems,
• to claim compensation if you suffer damage because of the unlawful processing of your data.

How can you exercise your rights?

You can submit your application in one of the following ways, in accordance with the Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ (Communiqué on the Procedures and Principles for Applications to the Data Controller):

• In writing: You can deliver your signed application, together with a document verifying your identity, to the address given above (Dr. Nejmi Öztürk – HG Hospital, Onikişubat / Kahramanmaraş) in person or through a notary public.
• By e-mail: You can send it to info@nejmiozturk.com from an e-mail address you have previously notified to us and which is registered in our system, or by using a secure electronic signature or mobile signature.

Your application must include your name and surname, your signature for written applications, your Turkish ID number (for foreign nationals, nationality and passport number), your address for notifications, your e-mail address and telephone number if available, and the subject of your request; additional information may be requested where your identity cannot be verified.

Your application is concluded as soon as possible according to its nature, and within 30 days at the latest. No fee is charged for an application, except in the limited cases provided for in the Communiqué.

Right to lodge a complaint with the Personal Data Protection Board

If your application is rejected, if you find the answer insufficient or if no answer is given within the time limit, you may lodge a complaint with the Kişisel Verileri Koruma Kurulu (Personal Data Protection Board) within 30 days of learning of the answer and in any case within 60 days of the date of your application. An application to the data controller must be made before a complaint can be lodged. Information about the Authority is available at kvkk.gov.tr.

How is this notice updated?

This notice may be updated when the legislation, the services used on the site or the decisions of the Personal Data Protection Board change. The current version is published on this page, and the last update date is shown on the page. For detailed information about cookies, see the Cookie Policy page.

Related pages

• Cookie Policy
• Site Editor and Editorial Principles
• Contact and appointments

This page has been prepared for information purposes under Law No. 6698 on the Protection of Personal Data; it contains no medical information. For health problems, diagnosis and treatment decisions are made only after an examination.