Privacy Notice (KVKK)

KAĞAN CİNGÖZ MEDICAL PRACTICE — PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA OF SERVICE RECIPIENTS (PATIENTS AND CLIENTS)

Data Controller: Dr. Kağan Cingöz, MD — Kağan Cingöz Medical Practice ("the Practice")

Address: İstasyon Mahallesi, Edirne Caddesi No:102, Merkez/Kırklareli, Türkiye

Telephone: +90 555 209 09 39

The Practice takes the utmost care regarding the confidentiality and security of the personal data of patients and clients who receive health, aesthetic and beauty services from it. This privacy notice has been prepared in accordance with Law No. 6698 on the Protection of Personal Data (as amended by Law No. 7499, "KVKK"), the Regulation on Personal Health Data and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, in order to inform adult patients, patients under 18 and their parents or legal representatives, relatives of patients who apply to the Practice for emergency services, and clients about the purposes for which their personal data will be processed, to whom and for what purposes it may be transferred, the method and legal grounds of collection, and the rights you have.

A. Definitions

In this notice:

Personal Data: any information relating to an identified or identifiable natural person;
Special Categories of Personal Data: data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sex life, criminal convictions and security measures, as well as biometric and genetic data;
Processing of Personal Data: any operation performed on data, including obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, classifying or preventing the use of personal data;
Data Subject: the natural person whose personal data is processed;
Explicit Consent: consent relating to a specific matter, based on information and expressed by free will;
Data Processor: the natural or legal person who processes personal data on behalf of the data controller under the authority granted by it (e.g. the patient-management software provider);
Data Controller: Kağan Cingöz Medical Practice, which determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

The Practice processes your personal data within the limits set by all relevant legislation, in particular the Constitution, the international conventions to which Türkiye is a party, the KVKK and the regulations of the Ministry of Health, and in accordance with the principles set out in Article 4 of the KVKK: lawfulness and fairness; accuracy and, where necessary, being kept up to date; processing for specific, explicit and legitimate purposes; being relevant, limited and proportionate to the purposes for which they are processed; and being retained for the period stipulated in the relevant legislation or required for the purpose of processing.

B. Personal Data Processed and Purposes of Processing

Identity Data (name and surname, Turkish ID number and/or passport number and/or temporary Turkish ID number for foreign patients, date of birth, gender, marital status, occupation, health insurance status, signature, patient protocol/ID number): identification and verification, creation of the patient record, conduct of operational activities in diagnosis and treatment processes, assessment of whether an occupational disease exists.
Contact Data (address, telephone number, e-mail address): creating, following up and reminding appointments; informing you where necessary; obtaining and storing legal consents; sending electronic commercial messages where you have given consent.
Financial Data (invoice and billing information, bank account/IBAN details, payment information, private health insurance and paying institution details): receiving and tracking payments, issuing invoices, preparing documents for your private health insurance claims and identity verification.
Health Data (special category) (medical reports, diagnosis and examination data, laboratory and test results, physician analyses and comments, appointment and prescription information, medications used, chronic health problems, history of illness and surgery, family history, pregnancy or breastfeeding status, biopsy samples and any other health data obtained in the course of medical diagnosis, treatment and care services): protection of public health, preventive medicine, conduct of medical diagnosis, treatment and care services; supply of treatment-specific medicines, medical supplies and devices; post-treatment care and follow-up; conduct of activities in compliance with legislation; management of our relationship with you.
Visual Data (before-and-after treatment photographs, in-practice camera recordings*): monitoring the course of treatment, requirements of diagnosis, ensuring the security of the physical premises, use as evidence in a possible legal dispute.
IT Data (device information, IP address, log records, connection/exit date and time, cookie data when you visit our website): ensuring that the site operates securely, efficiently and quickly, measuring visit statistics, fulfilling legal obligations and, subject to your explicit consent, marketing activities. Please see our Cookie Policy for details.

All data categories are also processed for the purposes of providing information to authorised persons, institutions and organisations upon request and within the scope of audits, fulfilling archiving and retention obligations, ensuring operational activities and security as data controller, and conducting contractual processes; they are stored, with the necessary technical and administrative measures, in physical archives at the Practice or in digital systems with restricted access.

* The layered privacy notice on camera recordings is available on the notice boards in the Practice's waiting room.

C. Method of Collection and Legal Grounds

Your data is collected fully or partly by automated means, or by non-automated means provided that it forms part of a data recording system, through patient registration and appointment procedures, examinations, medical test and analysis results, printed treatment follow-up forms and patient protocol book records, records kept by the Practice's physician and healthcare staff, camera recordings on the Practice's premises, our website, e-mail, telephone, social media channels and other online/offline communication platforms, and any documents you share with us, including past reports, surgical records, photographs, laboratory and test results.

Our processing activities are based on the following legal grounds:

for your identity, contact, financial and IT data, under Article 5/2 of the KVKK: being expressly provided for by law; being directly related to and necessary for the establishment or performance of the service contract between you and the Practice; fulfilment of our legal obligations; being necessary for the establishment, exercise or protection of a right; and being necessary for our legitimate interests, provided that this does not harm your fundamental rights and freedoms;
for your health data and treatment-related visual data, under the third paragraph of Article 6 of the KVKK (as amended by Law No. 7499): being necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services, by the Practice, which is under an obligation of professional secrecy; and, in cases outside this scope (e.g. sharing images on social media), your explicit consent.

Electronic commercial messages are additionally subject to the consent you give under Law No. 6563.

D. Domestic Transfer of Your Personal Data

Under Article 8 of the KVKK, your data may be transferred, limited to the stated purposes and to the extent necessary:

to the patient-management system used by the Practice (as data processor), for the purpose of creating the patient record and conducting treatment processes;
within the scope of our legal obligations, to authorised institutions and organisations, including the Ministry of Health, the Provincial/District Health Directorate and the Social Security Institution (SGK), and their automation systems (notifications to systems such as Medula and e-Nabız are made within the legal requirement and limited to the purpose of the visit, e.g. examination or check-up; complaint or diagnosis details are not included);
to the lawyer, financial advisor, auditor and contracted bank from whom we receive services;
where you have given explicit consent, to the Message Management System (İYS) so that appointment reminders and campaign information can be sent;
where requested by a court or competent authority, or where necessary to establish the material truth in a legal dispute, to judicial authorities, with the utmost care for your privacy, in a limited manner and to the extent necessary, requesting a confidentiality order where appropriate;
to attorneys and representatives specifically authorised by you.

Forms prepared for your private health insurance claims are handed to you personally; the Practice does not transfer data directly to insurance companies.

E. Transfer of Your Personal Data Abroad

As a rule, your personal data is not transferred abroad. However:

where you have given explicit consent, your before-and-after treatment images may be shared, using masking that prevents identification, on social media platforms whose servers are located abroad (e.g. Instagram/Meta) or on our website;
data collected through the analytics and marketing cookies on our website, which operate only subject to your explicit consent (Google, Meta), may be transferred to the servers of these service providers abroad.

These transfers are carried out within the conditions set out in Article 9 of the KVKK (as amended by Law No. 7499).

F. Retention Period

Your personal data is retained for the period stipulated in the relevant legislation or required for the purpose of processing; at the end of this period it is deleted, destroyed or anonymised. For details of retention periods, please see our Data Retention and Destruction Policy or request information from the Practice.

G. Your Rights and Applications

Under Article 11 of the KVKK, with regard to your personal data you have the right to:

a) learn whether your personal data is being processed;
b) request information if it has been processed;
c) learn the purpose of processing and whether the data is used in accordance with that purpose;
ç) know the third parties to whom the data is transferred, domestically or abroad;
d) request correction if the data is incomplete or inaccurately processed;
e) request deletion or destruction of the data within the conditions set out in Article 7 of the KVKK;
f) request that the operations carried out under (d) and (e) be notified to the third parties to whom the data has been transferred;
g) object to a result arising against you from the analysis of processed data exclusively through automated systems;
ğ) claim compensation for damage suffered as a result of unlawful processing.

You may submit your requests in writing by registered mail with return receipt, in person or through a notary, or by using the e-mail address registered in our system, to info@drkagancingoz.com. Your application will be concluded free of charge as soon as possible and within 30 days at the latest, depending on its nature; where the response is given in writing or on a recording medium, the fee schedule set out in the Communiqué on the Procedures and Principles of Application to the Data Controller may apply. The Practice may request verifying information solely to match the applicant with the data subject and to share the results with the correct person. In your requests for destruction and correction, you may ask that the third parties to whom the data was transferred be informed and that the reason for the destruction method chosen by the Practice be given. If your application is rejected, you find the response insufficient, or no response is given within the time limit, you retain the right to lodge a complaint with the Personal Data Protection Board.

H. Patients Resident in the European Union

For our patients resident in the European Union, the rights of access, rectification, erasure, restriction of processing, objection and data portability regarding the processing of their data under the EU General Data Protection Regulation (GDPR) are reserved. Applications regarding these rights may also be made through the channels stated above.

This privacy notice forms a whole with the Explicit Consent Form, the Cookie Policy, the Personal Data Processing Policy and the Data Retention and Destruction Policy. With regard to links to third-party sites on our website, the Practice's privacy principles apply only to our own digital platforms and we accept no responsibility for the linked sites.

EXPLICIT CONSENT FORM FOR SERVICE RECIPIENTS

I have read and understood the "Privacy Notice on the Processing of Personal Data of Service Recipients" prepared by the data controller, Kağan Cingöz Medical Practice.

I have been informed that the health data processing activities necessary for the conduct of medical diagnosis, treatment and care services (including creating the patient record, keeping diagnosis and treatment records, entering data into the patient-management system and making legal notifications to official institutions) are not subject to my explicit consent under Article 6 of the KVKK; that the matters below are entirely at my discretion; and that my receiving healthcare cannot be made conditional on giving these consents.

1. Sharing of images: to the sharing of my before-and-after treatment photographs, in a way that I cannot be recognised, using masking that prevents identification, on the Practice's social media accounts and website (and, in this context, to their transfer to platforms whose servers are located abroad):

☐ I consent ☐ I do not consent

2. Electronic commercial messages: to the transfer of my contact data to the Message Management System (İYS) and to the sending of electronic messages to me by SMS, e-mail or telephone call for the purpose of informing me about campaigns and reminding me of appointments and registration procedures:

☐ I consent ☐ I do not consent

I have been informed that all necessary administrative and technical measures have been taken to ensure the security of my health data; that I may withdraw my explicit consent at any time, without any adverse consequence for me, by sending an e-mail to info@drkagancingoz.com or by applying to the Practice in writing; and that, if I withdraw my consent, my personal data and special-category personal data whose processing does not require explicit consent will continue to be processed under the legal grounds listed in Articles 5/2 and 6/3 of the KVKK.

I declare that the privacy notice and the explicit consent form were presented to me before the processing activity, that I have read and understood them, and that I have given my consent of my own free will on the matters I have marked.

Name and Surname: _______________________ Date: ____ / ____ / ________ Signature: _______________________

COOKIE POLICY

Last updated: 30 August 2026

www.drkagancingoz.com (the "Site") is operated by the data controller Dr. Kağan Cingöz, MD — Kağan Cingöz Medical Practice (İstasyon Mah. Edirne Cad. No:102, Merkez/Kırklareli). Cookies are used on the Site within the scope of Law No. 6698 on the Protection of Personal Data (KVKK) and, for visitors resident in the European Union, the General Data Protection Regulation (GDPR).

What is a cookie? Cookies are small text files stored in your browser or on your device by the websites you visit; they enable the site to function, remember your preferences and measure visit statistics.

Types of Cookies Used

Essential cookies: required for the operation of the Site (the Wix infrastructure), security, session management and remembering your cookie preferences; they do not require explicit consent. Examples: XSRF-TOKEN (session), hs (session), bSession (approx. 30 minutes), svSession (approx. 2 years), consent-policy / consent record (6 months).
Functional cookies: remember your language preference.
Analytics cookies: measure visit statistics through Google Analytics (GA4). Examples: _ga and _ga_* (approx. 2 years).
Marketing cookies: Meta Pixel and Google Ads; used to measure advertising effectiveness. Examples: _fbp (approx. 3 months), _gcl_au (approx. 3 months).

The cookies used and their retention periods may be updated from time to time by the relevant service providers.

Legal Basis and Explicit Consent

Essential cookies are used on the legal ground of legitimate interest under Article 5/2-(f) of the KVKK. Non-essential cookies (functional, analytics and marketing) are not activated without your explicit consent obtained through the cookie notice on the Site (Article 5/1 of the KVKK; Article 6/1-a of the GDPR).

Transfer Abroad

Data collected through analytics and marketing cookies, which operate subject to your explicit consent, may be transferred to the servers abroad of service providers such as Google LLC and Meta Platforms Inc. These transfers take place within the conditions set out in Article 9 of the KVKK and only for the categories to which you have consented.

Managing Your Preferences

You can change your preferences or withdraw your consent at any time via the "Cookie settings" link in the bottom left corner of the page. Your consent record is stored on your device for 6 months; at the end of this period your preference is requested again. You can also delete or block cookies in your browser settings; if essential cookies are blocked, some parts of the Site may not work properly.

Your Rights and Contact

To exercise your rights under Article 11 of the KVKK (and Articles 15–21 of the GDPR if you are resident in the European Union), you may send your requests by e-mail to info@drkagancingoz.com or in writing to the postal address above. Applications are concluded within 30 days at the latest. For detailed information on your rights, please see the Privacy Notice on the Site.

This policy forms a whole with the Privacy Notice, the Explicit Consent Form, the Personal Data Processing Policy and the Data Retention and Destruction Policy.

+905552090939