Privacy Notice (KVKK Clarification Text)

Under Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller is Op. Dr. Anıl Kaya, an ophthalmologist practising in Istanbul, Turkey.

• Address: Atalar Mah. Çanakkale Cad. Referans Kartal Loca, No: 13/O D:1, 34862 Kartal / İstanbul
• E-mail: destek@dranilkaya.com
• Telephone: +90 546 737 26 45

This notice covers the data processed when you browse dranilkaya.com, when you use the "Contact the doctor" form and the interactive tools, and when you reach us by WhatsApp, telephone or e-mail. Medical records created during an examination or treatment are additionally governed by Turkish health legislation.

This document is an information notice required by Article 10 of the KVKK. It is not a consent form. Where your explicit consent is needed, it is requested separately and is described on the Explicit Consent page.

There is no membership, account or login on this site. Measurement and advertising cookies are used only if you accept them in the cookie banner (details on the Privacy and Cookie Policy page). Personal data is processed only in the situations below:

Your complaint, your age, treatments you have had and any images or documents you send are special category personal data under the KVKK and under Article 9 of the GDPR. Sharing this information is entirely your choice; the form has no file upload field.

For an initial assessment we suggest you share only what is necessary. Test results and reports can always be reviewed together during the examination. Messages containing health information sent through services whose servers are located outside Turkey are covered separately on the Explicit Consent page.

• To answer your questions and to communicate with you
• To receive and plan your appointment request and to carry out an initial assessment
• To provide examination and treatment services
• To meet obligations arising from legislation and requests from competent authorities
• To establish, exercise or defend legal claims in the event of a dispute
• To keep the website secure and to prevent misuse
• If you accept cookies, to measure how the site is used and how well advertising campaigns perform

Your personal data is never sold. Unless you accept cookies, no cookies are used for advertising or profiling, and what you type into the form and tools is never used for advertising or marketing.

Personal data is collected electronically or verbally when you send it to us yourself (the WhatsApp message prepared by the form, telephone, e-mail), and automatically in the case of server logs.

Under Article 5(2) of the KVKK, processing is based on the following grounds:

• (c) it is directly related to the conclusion or performance of a contract: handling your appointment and assessment request
• (ç) it is mandatory for the controller to fulfil a legal obligation
• (e) it is mandatory for the establishment, exercise or protection of a right
• (f) it is necessary for the legitimate interests of the controller, provided that your fundamental rights and freedoms are not harmed: site security, server logs and loading the Google Tag Manager code

Measurement and advertising cookies, and the data processed through them, rely on your explicit consent under Article 5(1) of the KVKK. You give it in the cookie banner and can withdraw it at any time using the "Cookie Preferences" link at the bottom of every page.

Your health data is processed under Article 6(3)(e) of the KVKK for the purposes of medical diagnosis, treatment and care, by a physician bound by a duty of confidentiality. Your explicit consent is requested for any processing outside that purpose, and for transfers abroad.

Your personal data is shared only in the following situations and only to the extent required:

• Competent public authorities: where there is an obligation arising from legislation or a request from an authorised body
• Communication and infrastructure providers: WhatsApp, e-mail and hosting services, solely so that communication and the website can function
• Measurement and advertising provider: Google (services such as Google Tag Manager, Google Analytics and Google Ads), if you accept cookies, to measure site usage and advertising performance

Transfers abroad: when you choose to use a communication service whose servers are located outside Turkey, such as WhatsApp, your messages travel through that service's infrastructure. This may amount to a transfer abroad under Article 9 of the KVKK. If you would rather not use these channels, you can call us on +90 546 737 26 45; your access to care is not affected in any way.

When the Google Tag Manager code loads, your IP address and browser information reach Google's servers abroad. Transfers made through measurement and advertising cookies rely solely on the consent you give in the cookie banner, which you can withdraw at any time.

• Form and tool data: never stored on a server; a form message you send is kept in your browser only until the tab is closed.
• Correspondence: kept until the purpose of the communication has ended; deleted or anonymised when that purpose disappears or at your request.
• Enquiries that lead to examination or treatment: medical records are kept for the period required by Turkish health legislation.
• Server logs: kept by the hosting provider for the period set out in the applicable legislation.

Data whose retention period has expired is destroyed in accordance with the Turkish Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

By applying to the data controller you may:

• Learn whether your personal data is being processed
• Request information if it has been processed
• Learn the purpose of processing and whether the data is used in line with that purpose
• Know the third parties to whom the data has been transferred, in Turkey or abroad
• Request correction if the data is incomplete or inaccurate
• Request deletion or destruction within the conditions of Article 7 of the KVKK
• Request that correction, deletion and destruction be notified to third parties to whom the data was transferred
• Object to a result against you produced solely by automated analysis
• Claim compensation if you suffer damage because of unlawful processing

You can submit requests concerning your rights, in line with the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller, in one of these ways:

• In writing to the address above
• Using a registered electronic mail (KEP) address, a secure electronic signature or a mobile signature
• From an e-mail address you have previously given us and which is in our records, to destek@dranilkaya.com

Your request should state your name and surname (with a signature for written applications), your Turkish ID number (for foreign nationals, your nationality and passport number), an address for notification, your e-mail and telephone if any, and the subject of your request. Requests are concluded free of charge within 30 days at the latest, depending on their nature; where the process entails an additional cost, the fee set by the Turkish Personal Data Protection Board may be charged.

If your request is refused, if you find the response insufficient, or if you receive no response in time, you may complain to the Turkish Personal Data Protection Authority within 30 days of learning of the response and in any case within 60 days of the date of your application.

If you contact us from the European Union or the United Kingdom, the GDPR (and the UK GDPR) may also apply to this processing alongside Turkish law. This section sets out the information required by Article 13.

• Controller: Op. Dr. Anıl Kaya, at the address, e-mail (destek@dranilkaya.com) and telephone (+90 546 737 26 45) given above. No data protection officer is required or appointed.
• Representative in the EU/UK (Article 27): [to be confirmed] — no representative has been appointed at the date of this notice.
• Purposes and legal bases: to answer your enquiry and plan an appointment, Article 6(1)(b) (steps prior to a contract) and 6(1)(f) (our legitimate interest in responding to you and in site security); to meet legal obligations, Article 6(1)(c). For health data, Article 9(2)(a) explicit consent when you send us health information yourself, and Article 9(2)(h) where care is actually provided by a health professional bound by confidentiality.
• Cookies and measurement: analytics and advertising cookies set through Google Tag Manager are used only with your consent (Article 6(1)(a) GDPR, and Article 5(3) of the ePrivacy Directive or PECR in the UK). You can withdraw consent at any time via "Cookie Preferences" at the bottom of every page; withdrawal does not affect processing carried out before it.
• Where your data is processed: in Turkey, and — if you accept cookies — by Google for measurement. Turkey is not covered by a European Commission adequacy decision. When you send us your data from the EU or the UK, that transfer relies on your explicit consent within the meaning of Article 49(1)(a), given with knowledge of the possible risks; those risks are described on the Explicit Consent page. You can avoid the transfer by not sending health information in advance and by discussing it during the examination instead.
• Retention: as set out in the section above; the same periods apply.
• Your rights: access, rectification, erasure, restriction of processing, objection, and data portability, as well as the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Complaints: you may complain to the Turkish Personal Data Protection Authority and also to the supervisory authority of your own country — for example the Information Commissioner's Office (ICO) in the United Kingdom, or your national data protection authority in the EU.
• Is providing data required? No. Sending us a message is entirely voluntary; there is no statutory or contractual obligation to do so. If you prefer, contact us by telephone and share nothing in advance.
• Automated decision-making: none. The interactive tools on this site run in your browser, produce general guidance only, and never make a decision about you.

This notice is updated whenever the data processing described here changes, and the current version is always published on this page. The rules that apply to your use of the site are set out on the Terms of Use page.

Last updated: 14 September 2026.