1. Data controller

Under Turkish Personal Data Protection Law No. 6698, the data controller for personal data processing activities carried out through the serdarborabayraktaroglu.com website is identified below.

This information notice has been prepared to inform website visitors, persons who contact us through the communication links, and data subjects whose images are published on the website about the processing of their personal data.

2. Nature of the website

The website is used solely for informational purposes.

• There is no online appointment or price quotation form.
• There is no contact form.
• There is no online payment system.
• There is no membership or user account system.
• There is no area for posting comments.
• There is no email newsletter subscription.
• There is no area for uploading files, photographs or health documents.

The content provided on the website is for general information only and does not replace an individual medical assessment, diagnosis or treatment recommendation.

3. Personal data that may be processed

3.1. Technical and transaction security data

The following technical information may be processed when you visit the website:

• IP address
• Date and time of visit
• Browser and device type
• Operating system
• Pages viewed
• Referring website address
• Error, security and server logs
• Approximate location or country information
• Technical interaction information on the website

3.2. Cookie and usage data

Depending on your cookie preferences, the following information may be processed:

• Your cookie acceptance and rejection preferences
• Pages visited
• Time spent on a page
• Session and user identifiers
• Website usage and performance statistics
• Information on interactions with video or map content

Non-essential analytics and functional cookies are not activated unless you make an explicit choice.

3.3. Communication data

Although the website does not contain a contact form, if you voluntarily contact us by telephone, email or the WhatsApp link, the following data may be processed:

• First and last name
• Telephone number
• Email address
• WhatsApp user and profile information
• Message and correspondence content
• Photographs, documents or other information you voluntarily send

Before sharing health information, a diagnosis, test results, an identity document or similar sensitive information through WhatsApp or email, you are advised to consider the security and privacy conditions of the relevant communication channel.

3.4. Patient images

Before-and-after images of certain patients may be published on the website. In some images, the person’s face or distinctive physical characteristics may be visible.

These images are processed in accordance with the following principles:

• Obtaining the data subject’s written permission for publication
• Explaining the purposes for which the image will be published
• Allowing the data subject to withdraw the permission granted
• Removing the image from publication within a reasonable period after permission is withdrawn

The publication of patient images and the retention of the related consent records are based on the data subject’s explicit consent. Additional safeguards applicable to special categories of personal data are implemented for images related to health or capable of identifying a person.

4. Purposes of processing personal data

• Operating the website
• Ensuring website and user security
• Detecting errors, attacks and unauthorised access
• Measuring website traffic and content performance
• Improving the user experience
• Recording cookie preferences
• Responding to messages voluntarily submitted by users
• Carrying out communication activities
• Publishing patient images for which written permission has been obtained
• Managing publication permissions and withdrawal requests
• Fulfilling legal obligations
• Establishing, exercising or protecting a right
• Responding to requests from authorised institutions and organisations

5. Legal grounds for processing personal data

Depending on the processing activity concerned, personal data may be processed on the following legal grounds:

• The data controller’s need to fulfil a legal obligation
• The establishment, exercise or protection of a right
• The legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed
• Carrying out communication initiated at the user’s own request
• Explicit consent for non-essential cookies and analytics tools
• Explicit consent for the publication of patient images

No explicit consent should be requested for an activity that does not legally require it. Activities based on explicit consent must be carried out on the basis of a specific, informed and freely given choice.

6. Methods of collecting personal data

Personal data may be collected through the following channels by automated or partly automated means, or by non-automated means provided that they form part of a data filing system:

• Website and server records
• Cookies and similar technologies
• Google Analytics and Google Tag Manager
• CookieYes cookie preference system
• Email
• Telephone
• WhatsApp
• Written image publication permission documents provided by the data subject

7. Transfer of personal data

Personal data may be shared with the following parties, limited to and proportionate with the relevant purpose:

• Hosting and server service providers such as LNW Servers
• Website maintenance, security and technical support service providers
• Google services such as Google Analytics, Google Tag Manager, Google Workspace, YouTube and Google Maps
• WhatsApp and Meta services where communication takes place through WhatsApp
• Legal, audit and consultancy service providers
• Courts, law-enforcement authorities and public institutions authorised by law

Instagram and Facebook are used on the website only as external links. Data processing activities that take place after a user clicks these links are subject to the privacy terms of the respective platforms.

The use of services connected to systems abroad, such as Google, YouTube, Google Maps, Google Workspace and WhatsApp, may result in personal data being transferred abroad or made accessible from abroad. Such transfers are carried out in accordance with the applicable adequacy decision, appropriate safeguards or other transfer conditions provided by the relevant legislation.

8. Retention periods

Personal data are retained only for the period necessary for the purposes for which they are processed:

• WhatsApp and email correspondence: for a maximum of two years from the date of the last communication.
• Records related to legal disputes: for the applicable limitation and legal retention periods.
• Cookie preference records: for the preference period specified in the CookieYes system; a one-year preference period is recommended.
• Patient images: until publication permission is withdrawn, the purpose of publication ends, or there is no longer a need to publish the image.
• Patient image permission documents: for the period during which the image is published and for the retention period necessary in relation to potential legal claims.
• Server and security logs: for the period necessary for security, error detection and legal obligations.
• Google Analytics data: for the data retention period selected in the Google Analytics account.

When the purpose of processing and the legal reason for retention cease to exist, personal data are deleted, destroyed or anonymised.

9. Rights of the data subject

Under Law No. 6698, you may exercise the following rights by applying to the data controller:

• To learn whether your personal data are being processed
• To request information if your personal data have been processed
• To learn the purpose of processing and whether the data are used in accordance with that purpose
• To learn the third parties to whom the data have been transferred
• To request correction of incomplete or inaccurate data
• To request deletion or destruction where the legal conditions are met
• To request notification of correction, deletion or destruction to the persons to whom the data have been transferred
• To object to an adverse outcome arising from analysis carried out exclusively through automated systems
• To claim compensation for damage suffered due to unlawful processing of personal data

10. Application method

You may submit your requests under the Turkish Personal Data Protection Law through the following channels:

By post or in person: Dr. Serdar Bora Bayraktaroğlu Muayenehanesi, Teşvikiye Mahallesi, Maçka Caddesi, Erhan Apartmanı, No: 16, Daire: 5, Harbiye, Şişli/İstanbul

By email: from an email address previously notified to us and registered in our systems, to info@drsbb.com

The application must contain the following information:

• First and last name
• Signature for written applications
• Turkish identity number for citizens of the Republic of Türkiye
• Nationality and passport or identity number for foreign persons
• Address for service of notices
• Email address and telephone number, if available
• Subject of the request
• Information and documents supporting the request

Applications are answered free of charge as soon as possible and no later than 30 days, depending on the nature of the request. If the procedure gives rise to an additional cost, the fee specified in the applicable legislation may be charged.

11. Amendments to this notice

This notice may be updated if the services offered on the website, the technologies used or the applicable legal rules change. The current version becomes effective on the date it is published on the website.