Personal Data Protection and Processing Policy (KVKK)
Last Updated: January 15, 2026
As Op. Dr. Erkan Deniz, we are committed to protecting the security of your personal data at the highest level under Turkey’s Law No. 6698 on the Protection of Personal Data (“KVKK” — Kişisel Verilerin Korunması Kanunu). This policy explains how your personal data is collected, processed, stored and protected.
1. Data Controller
Data Controller Title: Op. Dr. Erkan Deniz
Field of Activity: Aesthetics and Plastic Surgery, Medical Aesthetic Applications
Address: İrsen Küçük Cd. Şenlik Sk. No:44, Batıkent, Nicosia, TRNC
Telephone: +90 548 899 7000
Email: bilgi@opdrerkandeniz.com
Website: www.opdrerkandeniz.com
2. Definition and Scope of Personal Data
Personal data refers to any information relating to an identified or identifiable natural person.
This definition covers data such as first and last name, national ID number, telephone number, email address,
and health information.
2.1. Categories of Personal Data We Process
First name, last name, national ID number, date of birth, gender, nationality
Telephone number, email address, address details
Medical history, diagnostic information, treatment plan, operation records, medications used, allergies, laboratory results, imaging records
Payment information, invoice details, bank account information (where necessary)
Photographs (before-and-after), video recordings, security camera footage
IP address, cookie records, site usage history, log records
Interests, preferences, requested services, communication preferences
3. Methods of Collecting Personal Data
Your personal data is collected through the following methods:
Appointment forms, contact forms, anamnesis forms, video consultation requests
Examination records, medical documents, patient files, operation records
Appointment requests, information requests, correspondence records
Messages and requests received via Instagram, Facebook, YouTube and TikTok
In-clinic security cameras, entry-exit records
Hospitals, laboratories, insurance companies (where legally required)
When you visit our website, certain information (IP address, browser information, pages visited)
is automatically collected through cookies and similar technologies.
4. Purposes of Processing Personal Data
Your personal data is processed for the following purposes:
- Creating and managing patient records
- Providing medical examination, diagnosis and treatment services
- Pre-operative preparation and planning
- Post-operative follow-up and care
- Fulfilling medical record-keeping and reporting obligations
- Evaluating and scheduling appointment requests
- Sending appointment reminders
- Answering your questions and providing information
- Providing video consultation services
- Invoicing and payment processing
- Installment planning and tracking
- Insurance transactions (if applicable)
- Financial record-keeping and reporting obligations
- Fulfilling medical record-keeping obligations
- Ministry of Health reporting obligations
- Compliance with tax and accounting legislation
- Providing information requested by judicial authorities
- Ensuring clinic and patient safety
- Measuring and improving service quality
- Risk management and prevention activities
- Evaluating and resolving complaints
- Informing you about new services and campaigns
- Offering personalized recommendations
- Sending newsletters and promotions
- Social media interactions (with your explicit consent)
- Analyzing user experience
- Measuring and optimizing site performance
- Improving content and services
- Detecting and resolving technical issues
5. Legal Grounds for Processing Personal Data
Your personal data is processed on the following legal grounds set out in Articles 5 and 6 of the KVKK:
Processing based on the explicit consent you provide through appointment forms, anamnesis forms and marketing permissions
Processing required by health legislation, tax legislation and other relevant laws
Processing necessary for the establishment and performance of the healthcare services agreement
Fulfilling medical record-keeping, reporting and notification obligations
Improving service quality, taking security measures, carrying out business processes
Your health data is processed pursuant to Article 6 of the KVKK where your explicit consent is given, or
where processing is necessary for the provision of preventive medicine, medical diagnosis, treatment and care services.
6. Transfer of Personal Data
In order to achieve the purposes stated above, your personal data may be transferred to the following recipient groups:
6.1. Domestic Transfers
Hospitals, anesthesiologists, laboratories, radiology centers, pathology laboratories
Medical device and supply providers, pharmaceutical companies, medical equipment providers
Web hosting company, cloud storage service providers, email services, appointment management systems,
data security and backup services
Banks, payment systems, credit card institutions (for payment transactions only)
The Ministry of Health, tax offices, courts, law enforcement authorities (where legally required)
Health insurance companies (for treatments covered by insurance)
6.2. International Transfers
In certain cases, your personal data may be transferred abroad:
- Cloud storage services (such as Google Cloud, AWS)
- Web analytics tools (Google Analytics)
- Social media platforms (Meta, Google, TikTok)
- Email services
International transfers are carried out, in accordance with Article 9 of the KVKK, to countries with an adequate
level of protection or in cases where an adequate level of protection is undertaken in writing.
For all data transfers, we ensure that recipients take appropriate security measures under the KVKK,
and obtain the necessary agreements and undertakings.
7. Data Retention Periods
Your personal data is retained for the period required by the purpose of processing and for the retention periods set out in relevant legislation:
A minimum of 10 years (as required by patient rights regulations and health legislation)
Operation records, examination notes, anamnesis forms, imaging records
Until you withdraw your explicit consent or a maximum of 10 years
Medical photographs, treatment process records
10 years (as required by the Tax Procedure Law)
Invoices, payment records, accounting documents
3 years (after completion of the procedure)
Appointment requests, appointment confirmations, reminder records
2 years (after the purpose of contact has ended)
Email correspondence, phone call records, messages
Until you withdraw your consent or a maximum of 5 years
Newsletter consents, campaign notifications, promotional materials
90 days (in accordance with Personal Data Protection Board decisions)
In-clinic security footage, entry-exit records
2 years
IP addresses, cookie records, site usage data, log records
Your personal data for which the retention period has ended is deleted, destroyed or anonymized in accordance with
Article 7 of the KVKK. These procedures are carried out in compliance with the Regulation on the Deletion, Destruction or
Anonymization of Personal Data.
8. Personal Data Security Measures
As Op. Dr. Erkan Deniz, we take all necessary technical and administrative measures required under Article 12 of the KVKK to ensure the security of your personal data:
8.1. Technical Security Measures
All data communication on the website is protected with 256-bit SSL encryption
Enterprise-grade firewall protection for our systems
Sensitive data stored in the database is kept encrypted
Regular vulnerability scans and penetration testing
Daily automatic backups and a disaster recovery plan
24/7 system monitoring and anomalous activity detection
Up-to-date anti-virus software and malware protection
8.2. Administrative Security Measures
Access to personal data limited to authorized personnel only, role-based authorization system,
strong password policies, multi-factor authentication
Regular KVKK and data security training for all staff, awareness programs,
confidentiality undertakings
Written data security policies, data processing procedures, incident response plans,
regular policy updates
Regular internal audits, keeping and analyzing log records, inventory of data processing
activities (VERBİS registration)
Confidentiality agreements with third-party data processors, regular security audits,
compliance monitoring
Emergency response protocols in the event of a data breach, notification procedures to the
Personal Data Protection Board, data subject notification processes
8.3. Physical Security Measures
Controlled access to the clinic and data storage areas, card-entry systems, visitor logging system
Camera surveillance in critical areas, secure storage of footage
Physical documents stored in locked cabinets, protected archive areas
Shredding/incineration of documents no longer in use, secure data deletion protocols
In the event of a data breach that could compromise the security of personal data, we undertake to notify the
Personal Data Protection Board within 72 hours and, where your rights may be adversely affected,
to notify you as well.
9. Your Rights as a Data Subject
Pursuant to Article 11 of the KVKK, as a data subject you have the following rights:
The right to learn whether your personal data is being processed, and if so, to request information about it
The right to learn the purpose for which your personal data is processed and whether it is used in accordance with that purpose
The right to know the third parties to whom your personal data is transferred, domestically or abroad
The right to request the rectification of your personal data if it has been processed incompletely or inaccurately
The right to request the erasure or destruction of your personal data under the conditions set out in Article 7 of the KVKK
The right to request that rectification, erasure or destruction be notified to the third parties to whom your personal data has been transferred
The right to object to a result that is to your detriment arising solely from analysis of your data through automated systems
The right to request compensation for damages arising from the unlawful processing of your personal data
You can apply to exercise the rights stated above through the following methods:
- Written Application: By a hand-signed petition sent to İrsen Küçük Cd. Şenlik Sk. No:44, Batıkent, Nicosia, TRNC
- Registered Electronic Mail (KEP): (Add your KEP address here if you have one)
- Secure Electronic Signature: By an email signed with a secure e-signature to bilgi@opdrerkandeniz.com
- Application Form: By completing the “KVKK Application Form” on our website
Response Time: After your application reaches us, it will be concluded free of charge within 30 days at the latest,
depending on the nature of the request. However, if the transaction requires an additional cost, the fee set out in the tariff
determined by the Personal Data Protection Board will be charged.
10. Application Methods and Processes
10.1. Content of the Application
Your application must include the following information:
- Your name, surname and current address at the time of application
- If applicable, the email address, telephone and fax number to be used for notification
- The subject of your request (which right you wish to exercise)
- National ID number or passport number
- The subject of the application
10.2. Identity Verification
Security Measure: Identity verification will be carried out to confirm that the application is made by you.
For this reason, you must attach a copy of your identity document to your application.
10.3. Application Evaluation Process
When your application reaches us, it is registered and a tracking number is assigned
It is confirmed that the application belongs to you
Your request is reviewed and evaluated by the relevant units
Your application is answered in writing or electronically within 30 days at the latest
If your application is rejected, the response given is found insufficient, or no response is given within the time limit,
you have the right to file a complaint with the Personal Data Protection Board. The reason for rejection
will be communicated to you in writing or electronically.
11. Explicit Consent Text
📋 Explicit Consent Declaration Regarding the Processing of Personal Data
Under Turkey’s Law No. 6698 on the Protection of Personal Data (“KVKK”), with regard to the processing of my personal data;
- I have read and understood this KVKK Disclosure Text
- I agree that my personal data be processed for the purposes stated above
- I give my explicit consent to the processing of my special category personal data (my health data)
- I allow my personal data to be shared with the persons and institutions stated above
- I know that I can withdraw this consent at any time
Note: If you do not consent to the processing of personal data necessary for the provision of healthcare
services, we may not be able to provide you with our services.
✅ Marketing Consent (Optional)
☐ I would like to be informed about new services, campaigns and special offers from Op. Dr. Erkan Deniz via
SMS, email and phone. (This consent is optional and does not affect your receipt of healthcare services.)
📸 Image Sharing Consent (Optional)
☐ I consent to my before-and-after treatment photographs being used for educational, scientific and promotional purposes,
with my identifying information kept confidential. (This consent is optional and does not affect your receipt of healthcare services.)
12. Contact Information
You can contact us through the following channels to exercise your rights under the KVKK, to submit questions, or for complaints:
Op. Dr. Erkan Deniz
İrsen Küçük Cd. Şenlik Sk. No:44, Batıkent, Nicosia, TRNC
bilgi@opdrerkandeniz.com
+90 548 899 7000
www.opdrerkandeniz.com
Monday – Friday: 09:00 – 18:00
Saturday: 10:00 – 16:00
Sunday: Closed
13. Policy Updates
This KVKK Policy may be updated in line with changes in legal regulations, technological developments, or changes in business processes.
When significant changes are made, the “Last Updated” date on our website will be revised, and where necessary
you will be notified at your registered email address.
By continuing to use our website, you are deemed to have accepted the updated KVKK Policy.
We therefore recommend that you review the policy regularly.