Last updated: 27.10.2026
This privacy notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains how personal data of visitors to www.drgokhanpolat.com (the “Site”) and of people who use the Site's contact and appointment request forms are processed.
1. Data Controller
- Data controller: Prof. Dr. Gökhan Polat
- Address: Istanbul University Istanbul Faculty of Medicine, Department of Orthopaedics and Traumatology, Istanbul, Türkiye
- E-mail: [email protected]
- Phone: +90 (538) 894 00 91
Personal data processed at the healthcare institution where examinations and treatment take place (for example, patient records) are governed by that institution's own privacy notice and policies. This notice covers only data processed through the Site and the contact channels listed on it.
2. Categories of Personal Data
| Category | Examples |
|---|---|
| Identity | First name, surname |
| Contact | Phone number, e-mail address |
| Request details | Subject, message, the area of interest or treatment heading selected in the appointment form, date of the request |
| Special category data (health data) | Symptoms, diagnoses, treatments, medication or imaging details that you choose to write in the form, an e-mail or a WhatsApp message |
| Transaction security | IP address, browser and device information, time of form submission, server and security logs, session and security cookies |
| Cookie and usage data | Pages visited, time on site, referring source, approximate location (country/city level), device type; data collected through analytics cookies (see the Cookie Policy) |
Please do not share health information in the forms unless it is needed for your request. Any information required for an examination is collected separately during the physician's assessment.
3. Purposes of Processing
- Receiving, recording and responding to contact and appointment requests, and contacting you to arrange an appointment,
- Answering your questions and requests for information,
- Providing preliminary information about your request and planning the examination process,
- Keeping the Site and its contact channels secure and preventing misuse and unauthorised access,
- Complying with legal obligations and responding to requests from competent authorities,
- Establishing, exercising or defending legal claims,
- Where you have given explicit consent, analysing use of the Site statistically and improving its content.
4. Legal Bases
Your personal data are processed on the following legal bases under Article 5(2) KVKK:
- Art. 5(2)(c): processing is directly related to the formation or performance of a contract, such as your appointment request,
- Art. 5(2)(ç): processing is necessary to comply with a legal obligation of the data controller (e.g. records required under Law No. 5651),
- Art. 5(2)(e): processing is necessary to establish, exercise or protect a right,
- Art. 5(2)(f): processing is necessary for the legitimate interests of the data controller in answering requests and keeping the Site secure, provided that your fundamental rights and freedoms are not harmed.
Processing through analytics cookies, and the related transfer abroad, is based on your explicit consent under Articles 5(1) and 9.
Health data that you choose to share are processed under Article 6(3) KVKK by a physician bound by professional confidentiality for the purposes of medical diagnosis, treatment and care; in any other case they are processed on the basis of your explicit consent under Article 6(2) (see the Explicit Consent Form).
5. Transfers of Personal Data
- Hosting and IT service providers: providers of the server hosting the Site, e-mail, backup and technical support services, only to the extent required for their services,
- Google LLC / Google Ireland Ltd. (Google Analytics 4, Google Tag Manager): usage data collected through analytics cookies; as their servers are located outside Türkiye, this is a transfer abroad under Article 9 KVKK and is based on your explicit consent,
- Content delivery network (CDN) providers: when some Site components load, your IP address and browser information may technically be passed to these providers,
- Competent public authorities and courts: where required by law and upon request.
If you contact us via WhatsApp, phone or social media links, the data you send through those platforms are also subject to the platforms' own privacy terms.
6. Methods of Collection
Your personal data are collected electronically and partly by automated means through the contact and appointment forms on the Site and through contact channels such as e-mail, phone and WhatsApp. Transaction security and cookie data are collected automatically while you visit the Site.
7. Retention
Personal data are kept for as long as necessary for the purposes of processing and for the retention periods set out in the applicable legislation. Records required under Law No. 5651 are kept for the period prescribed by law. When the period expires or the conditions for processing no longer apply, the data are erased, destroyed or anonymised in line with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.
8. Your Rights under Article 11 KVKK
By applying to the data controller, you have the right to:
- learn whether your personal data are processed,
- request information about the processing if your data have been processed,
- learn the purpose of processing and whether the data are used in line with that purpose,
- know the third parties in Türkiye or abroad to whom your data are transferred,
- request rectification of incomplete or inaccurate data,
- request erasure or destruction of your data under the conditions set out in Article 7 KVKK,
- request that the actions under (e) and (f) be notified to third parties to whom your data have been transferred,
- object to a result against you arising from analysis of your data exclusively by automated systems,
- claim compensation for damage arising from unlawful processing of your data.
Where processing is based on your explicit consent, you may withdraw that consent at any time.
9. How to Apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request in Turkish:
- by a signed written petition delivered in person or through a notary public to the address above,
- signed with a secure electronic signature or mobile signature and sent to [email protected],
- from the e-mail address you have previously provided to us and that is in our records, to [email protected].
Your application must include your name, surname and, if written, your signature; your Turkish ID number (for Turkish citizens) or your nationality and passport or ID number (for foreign nationals); your residential or business address for notifications; your e-mail address and phone number, if any; and the subject of your request.
Applications are concluded as soon as possible and within thirty days at the latest, depending on the nature of the request. If the process involves an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board.