This policy explains how personal data is handled in connection with www.sunaycafer.com and the communication channels linked from it.
Data controller: Op. Dr. Sunay Cafer, Erzene Mah. 85. Sok. No: 10/A, 35040 Bornova / İzmir, Türkiye. Contact for data matters: [email protected] · +90 545 122 50 12
1. Applicable law
Personal data is processed in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK). For visitors located in the European Union or the European Economic Area, the General Data Protection Regulation (EU) 2016/679 (GDPR) also applies, and this policy is written to satisfy both.
2. What data is collected
| Category | Examples | How it reaches us |
|---|---|---|
| Contact data | Name, telephone number, e-mail address | You provide it when you write or call |
| Health data you choose to share | Symptoms, previous operations, photographs of your nose | You send it voluntarily in a message |
| Correspondence | The content of WhatsApp messages, e-mails, call records | Created by the exchange itself |
| Technical data | IP address, browser type, device type, pages visited, referring page | Recorded automatically by the hosting server |
| Cookie data | See the Cookie Policy | Set by this site or by embedded third-party content |
Health data is special-category data. It is collected only when you choose to send it, only to the extent needed to respond to your enquiry, and it is never requested through an unsecured public form.
This website has no user accounts, no newsletter and no e-commerce function.
3. Why the data is processed
- To answer your enquiry and give general information about treatments.
- To arrange, prepare for and follow up a consultation or a procedure.
- To meet legal obligations that apply to healthcare providers in Türkiye, including record-keeping obligations.
- To keep the website secure and functioning, and to understand in aggregate how it is used.
Personal data is not used for automated decision-making or profiling, and is not sold or rented to anyone.
4. Legal basis
| Purpose | KVKK (Law 6698) | GDPR |
|---|---|---|
| Responding to your enquiry | Art. 5/2(c) — necessary for a contract, or explicit consent | Art. 6(1)(b) / 6(1)(a) |
| Processing health data you send | Art. 6/3 — explicit consent, or protection of public health by a person under obligation of secrecy | Art. 9(2)(a) / 9(2)(h) |
| Legal record-keeping | Art. 5/2(a) — expressly permitted by law | Art. 6(1)(c) |
| Website security and technical logs | Art. 5/2(f) — legitimate interest | Art. 6(1)(f) |
Where processing rests on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Who the data is shared with
Personal data is disclosed only where necessary, and only to:
- the hospital and anaesthesia team involved in a planned procedure, and only for that purpose;
- service providers who host this website or provide the messaging and e-mail services used, acting on instructions;
- public authorities, where disclosure is required by law.
Messaging services such as WhatsApp and e-mail providers operate their own infrastructure, which may be located outside Türkiye and outside the EU/EEA. Choosing to contact the practice through those channels means your message passes through their systems, under their own terms and privacy policies. If you would prefer not to send sensitive information that way, telephone instead.
6. How long data is kept
- Enquiries that do not lead to treatment: kept only as long as needed to deal with the enquiry, then deleted.
- Patient records: kept for the periods required by Turkish health legislation.
- Technical server logs: kept for a short period for security purposes, then deleted or anonymised.
7. Data security
Reasonable technical and organisational measures are taken to protect personal data against loss, misuse and unauthorised access, including encrypted transmission (HTTPS) for this website and restricted access to patient information.
No transmission over the internet can be guaranteed to be completely secure. Please bear that in mind when deciding what to send through a messaging application.
8. Your rights
Under KVKK Article 11 and GDPR Articles 15–22 you have the right to:
- learn whether your personal data is being processed, and to request information about it;
- learn the purpose of processing and whether it is used accordingly;
- know the third parties to whom data has been transferred;
- have incomplete or inaccurate data corrected;
- request erasure or destruction of your data, within the limits set by law;
- have corrections or erasure notified to third parties to whom the data was transferred;
- object to a result produced solely by automated analysis (none is carried out here);
- claim compensation for damage caused by unlawful processing;
- and, under the GDPR where it applies, request restriction of processing and data portability.
To exercise any of these rights, write to [email protected] or to the practice address above. You will receive a reply within the period required by law. You also have the right to complain to the Turkish Personal Data Protection Authority (KVKK Kurumu) or, in the EU/EEA, to your local supervisory authority.
9. Children
This website is not directed at children and does not knowingly collect data from them. Where a patient is a minor, communication takes place with a parent or legal guardian.
10. Changes to this policy
This policy may be updated when practices or legal requirements change. The date at the top of the page always shows the current version.