Privacy Notice & Cookie Policy

Privacy Notice (KVKK & GDPR)

This privacy notice has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") by the private medical practice of Op. Dr. Yücel Sarıaltın (Op. Dr. Yücel Sarıaltın Muayenehanesi, the "Clinic"), acting as data controller, to inform visitors of our website, people who contact us through our forms or communication channels, and patients examined and treated at our clinic.

## Data Controller

The private medical practice of Op. Dr. Yücel Sarıaltın. Our contact details are provided at the end of this page.

## Personal Data We Process

• Identity: first and last name; during examination and treatment, identity details such as Turkish ID or passport number, date of birth and sex.
• Contact: phone number, email address and postal address.
• Request details: the treatment you are interested in, your message and your language preference as entered in our forms; messages you write in the live support (chat) window; and, if you consent to marketing cookies, the advertisement or campaign through which you reached our website (ad click identifier and campaign parameters).
• Health data: health information and photographs you choose to send us; health records created during examination, tests, treatment and surgery; and before-and-after images.
• Customer transactions: appointment, invoice and payment records.
• Transaction security: on our website, IP address, browser information, form submission records and cookie preference records.
• Physical premises security: camera recordings in clinic areas.

## Purposes of Processing

• Responding to your information, appointment and consultation requests and communicating with you,
• Planning and providing examination, diagnosis, treatment and care services, and organising appointments and surgery,
• Verifying your identity and issuing records, documents and invoices,
• Complying with retention, reporting and notification obligations under health, tax and other legislation, and responding to requests from competent authorities,
• Responding to your questions, suggestions and complaints,
• Keeping our website and information systems secure, preventing misuse and recording your cookie preferences,
• Establishing, exercising and defending legal claims.

## Legal Grounds

We process your personal data under Article 5(2) KVKK on the grounds that processing is directly related to the conclusion or performance of a contract, necessary to comply with our legal obligations, necessary to establish, exercise or protect a right, or necessary for our legitimate interests provided that your fundamental rights and freedoms are not harmed.

We process your health data under Article 6(3) KVKK for the protection of public health, preventive medicine, medical diagnosis, treatment and care, by persons bound by professional secrecy, or on the basis of your explicit consent. Health information you send through the forms on our website is processed on the basis of the explicit consent you give when submitting the form.

Non-essential cookies are used only with your explicit consent. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.

## How We Collect Data

We collect your personal data verbally, in writing and electronically, by automated, partly automated or non-automated means, through the forms and the live support (chat) window on our website, phone calls, WhatsApp, email and social media messages, forms completed at the clinic, examination and treatment processes, and cookies and similar technologies.

## Transfers

For the purposes above and in accordance with Articles 8 and 9 KVKK, your personal data may be transferred to the following groups of recipients:

• Public authorities authorised by law (such as the Ministry of Health and its units, the Social Security Institution, judicial and law-enforcement authorities and the tax administration),
• At your request, private insurance companies in connection with the financing of healthcare services,
• Healthcare institutions and business partners we work with to provide healthcare services,
• Lawyers, financial advisers and auditors who provide services to us,
• Our information technology service providers (website hosting and database, email, patient records software, customer relationship management (CRM) and live support software, and cloud services).

Our website hosting and database services are provided by Google (Google Cloud / Firebase) on servers located in the United States; the information you send through the forms on our website is stored on these servers. The cloud services of our patient records system and our customer relationship management (Zoho CRM) and live support (Zoho SalesIQ) services are also provided on servers located outside Türkiye. Transfers to these service providers are carried out in accordance with the conditions and safeguards set out in Article 9 KVKK.

If you contact us through WhatsApp or social media platforms, the privacy policy of the relevant platform also applies.

## Retention

We keep your personal data for as long as required by the purpose of processing and for the retention periods set out in applicable legislation. When these periods end or the conditions for processing no longer exist, the data is deleted, destroyed or anonymised, either on our own initiative or at your request.

## Individuals in the European Union (GDPR)

For individuals located in the European Union or the European Economic Area, the rights under the EU General Data Protection Regulation ("GDPR") are also reserved to the extent applicable. Details are provided in the section "Your Rights and How to Apply".

This notice is a translation of the Turkish original; in case of any discrepancy, the Turkish version prevails.

Cookie Policy

Our website uses cookies and similar technologies such as browser storage (localStorage). This policy has been prepared taking into account the KVKK and the guidelines of the Turkish Personal Data Protection Authority on cookie practices.

## Cookie Categories

• Strictly necessary: required for the website to function, for security and to remember your cookie preferences. These do not require consent and cannot be switched off.
• Functional and external media: third-party content on our pages such as YouTube videos and Google Maps. When this content loads, the provider may use its own cookies. It loads only if you consent.
• Analytics: helps us measure how the website is used (for example, Google Analytics). Enabled only if you consent.
• Marketing: used to measure and personalise advertising and for the live support (chat) window (for example, Google Ads, Meta, Zoho SalesIQ). If you consent, the advertisement or campaign through which you reached our website is also recorded with your form request. Enabled only if you consent.

## Managing Your Preferences

When you first visit the website, the notice lets you accept all cookies, reject non-essential cookies or choose by category. You can change your preferences or withdraw your consent at any time using the "Cookie Settings" link at the bottom of the page. Your choice is stored for 12 months and you will be asked again if this policy changes significantly. You can also delete or block cookies in your browser settings.

## Consent Records

To be able to demonstrate your consent, we record your cookie choice together with a randomly generated consent ID, the categories you selected, the date, language, policy version, browser information and a hash of your IP address created with a secret key. Your raw IP address is not stored in this record.

## Third-Party Providers

Google (YouTube, Google Maps, Google Analytics, Google Ads, Google Tag Manager) and Meta (Facebook, Instagram) are established outside Türkiye, mainly in the United States; our live support service, Zoho SalesIQ, runs on servers in the European Union. When content in the categories you have consented to loads, your IP address and browser information may be sent to these providers. Their processing is subject to their own privacy policies.

## Consent Mode and Advertising Measurement

• Google consent mode: Google Tag Manager loads regardless of your choice, but it does not run tags in categories you have not consented to. If you do not consent to analytics or marketing cookies, the related Google tags do not use cookies or store identifiers on your device; they send only cookieless signals containing the page address, time, browser information and your consent status, and your IP address reaches Google during this connection. These signals are used for aggregate measurement and statistical modelling without identifying you.
• Enhanced conversions: If you consent to marketing cookies, when you submit a form your email address and phone number are converted into an irreversible summary (SHA-256 hash) before being sent to Google Ads, and are used solely to measure advertising conversions. Your health information, message and photographs are not sent.
• Meta Pixel: runs only if you consent to marketing cookies; page view, contact and form submission events are sent without the name of the treatment you are interested in.
• The name of a treatment is never sent to advertising platforms; Google receives only a general category code, and no advertising audiences are built on the basis of health conditions.

Your Rights and How to Apply

Under Article 11 KVKK, you have the right to apply to the data controller to:

• Find out whether your personal data is processed,
• Request information if it has been processed,
• Find out the purpose of processing and whether the data is used in line with that purpose,
• Know the third parties in Türkiye or abroad to whom your data is transferred,
• Request correction if your data is incomplete or inaccurate,
• Request deletion or destruction of your data under the conditions of Article 7 KVKK,
• Request that corrections, deletions or destructions be notified to the third parties to whom the data was transferred,
• Object to a result against you arising exclusively from analysis by automated systems,
• Claim compensation if you suffer damage because of unlawful processing.

## How to Apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may send your application:

• In writing with a wet signature, or through a notary, to our address below,
• By secure electronic signature, mobile signature, or from an email address you have previously given us and that is registered in our system, to info@yucelsarialtin.com.

Your application must include your name and surname, your signature for written applications, your Turkish ID number (for foreign nationals, your nationality and passport or ID number), your residential or business address for notifications, your email address and phone number if any, and the subject of your request.

We will respond to your application as soon as possible and within 30 days at the latest, free of charge, depending on the nature of the request. If the process involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. If your application is rejected, you find the response insufficient, or we do not respond in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 KVKK.

## Your Rights under the GDPR

If you are located in the European Union or the European Economic Area, under the GDPR you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection; the right to withdraw your consent at any time; and the right to lodge a complaint with the data protection authority in your country. You can use the application methods above for these requests as well.