Privacy Policy and Personal Data Protection Notice
Data controller: Op. Dr. Eda Çabuk Horoz, Beştepe Mah. Yaşam Cd. A Blok No:13 Kat:10 Daire:52 (Neorama Plaza), Çankaya / Ankara, Türkiye · info@edacabukhoroz.com · +90 552 828 24 28
This notice explains how personal data of patients, prospective patients, their companions and website visitors is processed under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for individuals in the European Union, the General Data Protection Regulation (GDPR).
1. What data we collect
- Identity and contact data: name, date of birth, nationality, passport details where required for hospital admission, telephone, e-mail, address, country.
- Health data (special category): medical history, previous operations and complications, medications, allergies, examination findings, photographs of the treatment area, test results, treatment and follow-up records.
- Travel and accommodation data where you ask us to assist with these arrangements.
- Communication data: messages sent via the website forms, e-mail, telephone or WhatsApp, and feedback or survey responses.
- Website data: the website does not use advertising or analytics cookies. Technical logs (IP address, browser, time of request) are kept by the hosting provider for security purposes.
2. Why we process it (purposes and legal basis)
- Assessing whether a treatment is suitable, planning and providing medical care and follow-up – legal basis: KVKK Art. 6(3) processing by persons under confidentiality obligation for the protection of public health, preventive medicine, diagnosis, treatment and care; and your explicit consent where required. GDPR Art. 9(2)(h) and Art. 6(1)(b)/(c).
- Answering your enquiries and communicating about appointments – legitimate interest / contract.
- Fulfilling legal obligations of healthcare providers in Türkiye (patient records, reporting, invoicing) – legal obligation.
- Arranging transfer and accommodation at your request – your request / consent.
- Collecting feedback and measuring patient satisfaction to improve our services – legitimate interest; responses may be given anonymously.
3. Who we share it with
Your data is shared only as far as necessary with: the hospital where your procedure is performed and its anaesthesia and laboratory teams; the medical travel agency that referred you, if any, and only for the coordination of your visit; transfer or accommodation providers you ask us to book; authorities where the law requires it (for example the Ministry of Health's international health tourism reporting system). We do not sell personal data and we do not use it for third-party marketing.
4. International transfers
Your data is stored in Türkiye. When you communicate with us through e-mail or messaging services (such as WhatsApp) or send us data from abroad, data is transferred through the servers of those service providers. By choosing these channels you consent to this transfer; if you prefer, you may send your documents through another channel agreed with us.
5. How long we keep it
Medical records are kept for the periods required by Turkish healthcare legislation. Enquiries that do not lead to treatment are deleted within 2 years. Feedback and survey responses are kept for 3 years in a form that allows service improvement, then anonymised.
6. Security
Access to patient information is limited to the members of the care team who need it, all of whom are bound by professional confidentiality. Records are kept in access-controlled systems; website forms are transmitted over encrypted (HTTPS) connections; feedback submissions are stored outside the publicly accessible area of the web server.
7. Your rights
Under KVKK Article 11 (and GDPR Articles 15–22 where applicable) you have the right to learn whether your data is processed, to request information, to ask for correction or deletion, to object to processing, to request restriction, to receive a copy of your data, and to withdraw consent for processing based on consent. To exercise these rights, write to info@edacabukhoroz.com or to the clinic address above. We respond within 30 days. You may also lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or, for EU residents, with your local supervisory authority.
8. Children
Treatment of patients under 18 requires the consent of a parent or legal guardian, whose identity and contact data are processed for that purpose.
9. Changes
This notice may be updated; the current version is always published on this page. Last updated: 29 August 2026.
