1. Data controller
Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), the data controller is:
| Name / title | Dr. Özgür Akşan — Neurosurgery Specialist (private practice) |
| Address | Mi'Marin Medical, Mimar Sinan Mah. Ziya Gökalp Bulvarı No: 28 Daire: 1, 35220 Konak / İzmir, Türkiye |
| KEP (registered e-mail) | [email protected] |
| [email protected] | |
| Phone | +90 532 414 35 35 |
2. What personal data we process
- Identity: first name, last name, date of birth; where necessary, Turkish ID number.
- Contact: phone, e-mail, postal address.
- Health data (special category): radiological images you upload (MRI, CT, etc.), reports, your complaints, your medical history, and health information you write or tell us.
- Correspondence and conversation records: form messages, e-mails, WhatsApp / Messenger messages, chats and voice-call transcripts with the AI assistant.
- Appointment and payment: appointment dates, payment amount and status. Your card details do not reach us; they are processed by the bank.
- Digital trace: IP address, device and browser information, server logs. If you give permission, analytics and marketing cookie data are also processed (details: Cookie Policy).
3. How we collect data
- Forms on the website: contact, appointment, MRI/image upload, survey.
- WhatsApp, Messenger, e-mail and SMS correspondence.
- Written or voice conversations with the AI assistants (Ayşe, Atlas).
- Cookies and similar technologies: necessary ones always; analytics and marketing only if you give permission.
- In person at the practice or by phone.
4. Purposes
- Providing medical pre-assessment and second-opinion services.
- Giving, reminding and following up appointments.
- Patient–physician communication; answering your questions through the AI assistant and the physician.
- Taking payments and keeping financial records.
- Fulfilling legal obligations (health, tax and personal data legislation).
- Information security; preventing misuse and fake applications.
- If you give permission: measuring site visits and the effectiveness of advertising.
5. Legal grounds
- KVKK Art. 5:
- establishment and performance of a contract (appointment, assessment, payment);
- legal obligation;
- legitimate interest (security, prevention of misuse);
- explicit consent (analytics and marketing cookies, marketing messages).
- KVKK Art. 6 (health data):
- by a physician under a duty of confidentiality, for the purposes of medical diagnosis, treatment and care services;
- your explicit consent where necessary.
6. Who we share it with
Your data is shared only for the purposes below and only as far as necessary:
| Recipient | Purpose | Country |
|---|---|---|
| Ministry of Health and competent public authorities | legal obligation | Türkiye |
| Healthcare institutions you are referred to | continuity of treatment (with your knowledge) | Türkiye |
| Vercel Inc. | website hosting | USA |
| Cloudflare Inc. | content delivery, security, images/video, bot protection | USA (global network) |
| Supabase Inc. | database and file storage | servers in the EU (Germany, Ireland) |
| Anthropic PBC · Google LLC | AI assistant responses | USA |
| ElevenLabs | voice assistant (speech recognition / text-to-speech) | USA |
| Meta Platforms (WhatsApp, Messenger) | messaging | Ireland / USA |
| Resend | e-mail delivery | USA |
| Twilio Inc. · Netgsm | SMS delivery | USA · Türkiye |
| Cal.com | appointment calendar | USA |
| Yapı Kredi Bankası | card payment | Türkiye |
| Google (Analytics, Ads) · Meta Pixel | only with your permission: visit and advertising measurement | USA / Ireland |
7. Transfers abroad
Transfers to the service providers in the table above whose country is outside Türkiye are made in accordance with KVKK Art. 9 and only as far as the service requires. Encrypted connections are used for transfers.
8. About the AI assistant
Ayşe and Atlas on our website are AI assistants, not physicians.
- What you write and your voice conversation are sent to the providers above to generate responses. The conversation record is kept so that the physician can assess you.
- The assistant's answers are not a medical diagnosis; the final assessment is made by the physician.
- You do not have to share your health information with the assistant; if you prefer, you can contact the physician directly.
9. Retention period
| Data | Period |
|---|---|
| Health records (images, reports, assessments) | 20 years from your last application; if legislation requires longer, that period |
| Correspondence and AI conversation records | 3 years; those that become a health assessment are kept together with the health record |
| Financial records | 10 years |
| Server logs | 1 year |
| Marketing consent records | until consent is withdrawn + 3 years |
When the period ends, the data is deleted, destroyed or anonymised.
10. Your rights (KVKK Art. 11)
- To learn whether your personal data is processed; if so, to request information.
- To learn the purpose of processing and whether it is used in line with that purpose.
- To know the third parties to whom it is transferred in Türkiye or abroad.
- To request correction if it is incomplete or inaccurate.
- To request deletion or destruction under the conditions of KVKK Art. 7.
- To request that correction and deletion be notified to the third parties to whom the data was transferred.
- To object to a result against you arising from analysis by automated systems.
- To claim compensation if you suffer damage due to unlawful processing.
11. How to apply
- E-mail: [email protected]
- KEP: [email protected]
- Post: the address in section 1
Applications are answered free of charge within 30 days at the latest. If you find the answer insufficient or receive no answer within that time, you may lodge a complaint with the Personal Data Protection Board (KVKK Board).