This policy explains how personal data collected through www.ersacanclinic.com is processed. It has been prepared to meet the duty to inform under the Turkish Personal Data Protection Law No. 6698 (KVKK). For visitors from the European Union and the European Economic Area (EU/EEA), the General Data Protection Regulation (GDPR) also applies.
Data controller
| Data controller | Özel Ersaçan Ağız ve Diş Sağlığı Polikliniği — Dt. Emre Ersaçan |
| Address | Tuna Mah. Cemal Gürsel Cad. No: 166 D: 3, Ozan Apt., 35600 Karşıyaka / Izmir, Türkiye |
| Phone | +90 232 369 09 19 |
| [email protected] |
Which data do we collect?
1. Information you provide via the contact form, e-mail or WhatsApp
| Data | Required? | Purpose |
|---|---|---|
| Full name | Yes | To address you correctly and match your request |
| E-mail address | Yes | To reply to you |
| Phone number | No | To call you back, if you prefer |
| Treatment of interest | No | To route your request to the right topic |
| Message | Yes | To understand and answer your request |
2. Health information you share voluntarily
When describing your complaint, you may share information about your health, for example in a message, an e-mail or a WhatsApp chat, or by sending previous X-rays or dental records. Health data is a special category of personal data (KVKK Art. 6; GDPR Art. 9). Such information is processed only to assess and answer your request and is not used for any other purpose.
Recommendation: Please do not send identity numbers, passport copies, full medical reports, laboratory results or insurance details by form, e-mail or message. If such information is needed, it will be collected at the clinic.
3. Technical data
Like every web server, the server hosting this website keeps access logs (IP address, date and time, requested page, browser information). These logs exist for security and troubleshooting purposes and are not used for marketing.
No script that tracks visitors (analytics) or measures advertising runs on this website. For details, please see the Cookie Policy.
Purposes of processing
- Receiving, assessing and answering appointment and information requests
- Giving appropriate guidance in response to the questions of patients or other enquirers
- Fulfilling legal obligations related to the provision of healthcare services
- Keeping the website secure and fixing technical faults
Your data is not used for automated decision-making or profiling.
Legal basis
| Situation | KVKK basis | GDPR equivalent |
|---|---|---|
| Identity and contact data sent via the contact form | Art. 5(2)(c) — directly related to establishing or performing a contract; Art. 5(2)(f) — legitimate interest | Art. 6(1)(b), 6(1)(f) |
| Health data shared voluntarily | Art. 6(2) — explicit consent (the consent checkbox on the form) | Art. 9(2)(a) |
| Server access logs | Art. 5(2)(f) — legitimate interest (security) | Art. 6(1)(f) |
| Statutory retention obligations | Art. 5(2)(a) — expressly provided for by law | Art. 6(1)(c) |
Where processing is based on your explicit consent, you can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
Sharing with third parties
Your personal data is not sold, rented or passed on to third parties for marketing purposes.
Data is shared only in the following cases and only to the minimum extent necessary:
- Hosting and e-mail service providers — technically necessary access in the course of operating the website and e-mail servers
- Competent public authorities — where required by law
- Legal advisers / accountants — only when necessary and under a duty of confidentiality
International transfers
The clinic is located in Türkiye. If you contact us from the EU/EEA or another country, the information you send is received and processed in Türkiye. This transfer takes place at your request and is necessary to answer your enquiry (GDPR Art. 49(1)(b)); for health data you share voluntarily, it is based on your explicit consent. Our service providers may process data on servers located outside Türkiye, within the scope described above.
Retention periods
| Type of data | Period |
|---|---|
| Contact form, e-mail and message correspondence | 2 years from the conclusion of the request |
| Records that lead to patient admission | For the mandatory retention periods under Turkish healthcare legislation |
| Server access logs | In line with the provider's technical policy, usually no more than 12 months |
When the period expires, the data is deleted, destroyed or anonymised.
Data security
- The website is served over HTTPS; form data is transmitted over an encrypted connection.
- Form messages are delivered only to the clinic's own e-mail inbox.
- Access to the e-mail accounts is restricted to a limited number of people.
- No persistent personal data is stored in your browser.
No method of transmission is completely secure; we therefore recommend not sharing sensitive information over the internet.
Your rights
Under KVKK Art. 11, you can apply to the data controller to:
- find out whether your personal data is being processed,
- request information about it if it has been processed,
- find out the purpose of processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom the data has been transferred,
- request correction if the data is incomplete or inaccurate,
- request deletion or destruction of the data,
- request that third parties to whom the data was transferred be notified of the correction or deletion,
- object to a result to your detriment arising exclusively from analysis by automated systems,
- claim compensation if you suffer damage due to unlawful processing.
If you are in the EU/EEA, you also have the following rights under the GDPR: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing (Art. 21) and withdrawal of consent at any time (Art. 7(3)).
You can send your requests to [email protected] or to the postal address above. Requests are answered within 30 days at the latest. If you are not satisfied with the outcome, you can lodge a complaint with the Turkish Personal Data Protection Authority (KVKK). Visitors from the EU/EEA can also lodge a complaint with the data protection supervisory authority in their country of residence or work (GDPR Art. 77).
Changes
This policy is updated when necessary. The effective date is shown by the "last updated" date at the top of this page.
For related information, please see our Cookie Policy, Medical Disclaimer and Terms of Use.