Last updated:
This Privacy Notice has been prepared in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and applies to the contact form, the patient satisfaction survey, the comments and complaints form, the visual simulation tool, and to all other communications and information requests submitted via drhasanabuoglu.com.
When you contact us through the website's contact form, complete our patient satisfaction survey, send us a comment, suggestion or complaint, use the visual simulation tool, or reach us by email, telephone, or messaging applications, we collect and process your personal data as described below. This notice provides you with the information required by Articles 13 and 14 GDPR.
1. Identity and Contact Details of the Data Controller
| Information | Detail |
|---|---|
| Data Controller | Assoc. Prof. Dr. Hacı Hasan Abuoğlu — Associate Professor of General Surgery, Bariatric & Metabolic Surgery |
| Legal Entity | Hacı Hasan Abuoğlu (Sole Proprietor — Independent Surgeon) |
| Address | Küçükbakkalköy Mah. Dudullu Cad. Brandium R2 Blok No: 23-25B İç Kapı No: 8 Ataşehir/İstanbul, Istanbul, Türkiye |
| Phone | +90 544 165 05 00 |
| info@drhasanabuoglu.com | |
| Website | https://www.drhasanabuoglu.com |
| Health Tourism Authorization | ST-2697 (issued by the Republic of Türkiye, Ministry of Health) |
2. Data Protection Officer
We have designated a Data Protection Officer ("DPO") who can be contacted for any questions about this notice or our data processing activities:
Name: Abdurrahman Çağlayan Email: abdurrahman@drhasanabuoglu.com Postal Address: Küçükbakkalköy Mah. Dudullu Cad. Brandium R2 Blok No: 23-25B İç Kapı No: 8 Ataşehir/İstanbul (marked "for the attention of the Data Protection Officer")
3. Categories of Personal Data Collected
The categories of data we collect depend on the channel you use:
3.1 Contact form
Identification data: First name, last name Contact data: Email address, phone number, country of residence (where provided) Special category — health data (Article 9 GDPR): Information you voluntarily provide in the message field about your medical history, current health condition, body mass index, planned surgical procedure, or other health-related queries Technical data: IP address, browser type and version, device type, access timestamps (server logs)
3.2 Patient satisfaction survey
Assessment data: The ratings you award to each service area, your free-text comments, your country of origin, the channel through which you reached the clinic, and the language in which you completed the survey Identification and contact data (OPTIONAL): First name, last name, email address, phone number — processed solely so that we can follow up with you, and only where you choose to enter them. If you leave these fields blank, your response is recorded anonymously and your identity never enters our systems at any stage.
3.3 Comments, suggestions and complaints form
Content data: The subject you select (comment · suggestion · complaint · compliment) and the text of your message Identification and contact data (OPTIONAL): Name, email address, phone number — the same principle applies as for the survey: if you leave these fields blank, your submission remains anonymous.
3.4 Visual simulation tool
Image data (capable of constituting special category data under Article 9 GDPR): The photograph you upload Other data: Phone number, height and weight
⚠️ Important — Health data are special category data under Article 9 GDPR. Please share only the information necessary to assess your initial inquiry. Detailed medical history, imaging studies, and laboratory results should be exchanged through secure channels during a formal consultation, not through the public contact form.
4. Purposes and Legal Bases of Processing
| Purpose | Categories of Data | Legal Basis |
|---|---|---|
| Responding to your inquiry | Identification, contact, message content | Article 6(1)(b) GDPR — performance of a contract / steps prior to entering into a contract at your request |
| Providing medical information and consultation scheduling | Identification, contact, health data | Article 6(1)(b) + Article 9(2)(h) GDPR — processing necessary for the provision of health care under the responsibility of a health professional subject to professional secrecy |
| Health data outside healthcare provision (e.g., marketing) | Health data | Article 9(2)(a) GDPR — your explicit consent |
| Fulfilling legal obligations | All categories as required | Article 6(1)(c) GDPR — legal obligation under Turkish health legislation, tax law, e-commerce law |
| Server security and abuse prevention | Technical data | Article 6(1)(f) GDPR — legitimate interests |
| Marketing communications (newsletter) | Article 6(1)(a) GDPR — your consent |
5. Recipients of Your Personal Data
Your personal data may be disclosed to the following recipients under appropriate safeguards:
5.1 Internal Recipients
- The medical team directly involved in your care
- The administrative staff supporting your inquiry
- The Data Protection Officer
5.2 External Processors (Data Processors under Article 28 GDPR)
| Processor | Service | Location | Safeguards |
|---|---|---|---|
| Resend Inc. | Email delivery | USA | Standard Contractual Clauses (SCC) + Data Processing Agreement |
| Vercel Inc. | Web hosting | USA / EU regions | SCC + DPA |
| Google Ireland Ltd. (Workspace) | Email inbox management | EU data centers | EU/EEA hosting; covered by GDPR |
| Cloudflare Inc. | CDN, security | Global edge / USA | SCC + DPA |
5.3 Other Recipients (only when required by law)
- Public authorities (e.g., Turkish Ministry of Health, courts) when legally compelled
- Legal counsel in case of legal proceedings
- Auditors and accountants (under confidentiality)
6. International Data Transfers
The Data Controller is located in Türkiye, which is not currently subject to a European Commission adequacy decision (Article 45 GDPR). Therefore, transfers of your personal data from the European Economic Area (EEA) or the United Kingdom to Türkiye are protected by the following safeguards:
- Standard Contractual Clauses (SCCs) adopted by the European Commission, signed between the data controller and processors
- Explicit consent for specific transfers when no other legal basis applies (Article 49(1)(a) GDPR)
- Necessity for the performance of a contract at your request (Article 49(1)(b) GDPR) — when you request medical consultation, the transfer is necessary
- Necessity for important reasons of public interest in healthcare (Article 49(1)(d) GDPR), where applicable
You may request a copy of the SCCs or details of the transfer safeguards by contacting our DPO at abdurrahman@drhasanabuoglu.com.
7. Retention Periods
| Data Category | Retention Period | At the End of the Period |
|---|---|---|
| Contact form records, including any height, weight or BMI details you provide in them | 6 months | The record is erased in its entirety |
| Visual simulation tool records — the photograph you upload, together with the phone number, height and weight submitted with it | 30 days | The record is erased in its entirety |
| First name, last name, email address, phone number and technical traces (IP hash, browser information) within survey and feedback records | 6 months | Anonymised — every field capable of identifying you is cleared |
| Survey ratings, comment text, follow-up notes and improvement records | Indefinite | Retained without any identifying data; they evidence the service quality that international health tourism certification requires us to demonstrate |
| Records that lead to a medical consultation | Held with the patient file (minimum 20 years under Turkish health legislation) | Destroyed at the end of the statutory period |
| Server logs | 6 months to 2 years (Turkish Law No. 5651) | Erased |
| Resend email logs | 30 days | Erased automatically |
| Cookies | See Cookie Policy | — |
Once the applicable period expires, your data is erased, destroyed, or anonymised in accordance with the storage limitation principle (Article 5(1)(e) GDPR) and our retention and disposal procedures. Erasure and anonymisation are carried out by an automated process that runs every day. Independently of this schedule, you may exercise your right to erasure (Article 17 GDPR) at any time and ask us to delete your data earlier (see Section 9).
Why are survey and feedback records not erased outright? International health tourism certification requires us to be able to demonstrate, retrospectively, both the results of our patient satisfaction measurement and the action taken on the comments and complaints we receive. The ratings and comments are therefore preserved; after 6 months, however, the information showing who submitted them is removed. The record then no longer relates to an identified or identifiable natural person and falls outside the scope of the GDPR (Recital 26).
8. Your Rights Under the GDPR
As a data subject, you have the following rights:
- Right of access (Article 15): obtain a copy of your data
- Right to rectification (Article 16): correct inaccurate data
- Right to erasure / "right to be forgotten" (Article 17): request deletion (subject to medical record retention obligations)
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20): receive your data in a structured format
- Right to object (Article 21): including objection to processing for direct marketing
- Right not to be subject to automated decision-making (Article 22)
- Right to withdraw consent (Article 7(3)) at any time, where processing is based on consent
- Right to lodge a complaint with a supervisory authority (Article 77)
9. Exercising Your Rights
To exercise any of your rights, contact us at:
Email: info@drhasanabuoglu.com DPO Email: abdurrahman@drhasanabuoglu.com Postal: Küçükbakkalköy Mah. Dudullu Cad. Brandium R2 Blok No: 23-25B İç Kapı No: 8 Ataşehir/İstanbul
We will respond to your request within one month (Article 12(3) GDPR). The response is free of charge unless requests are manifestly unfounded or excessive.
10. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority. You may contact:
- The supervisory authority in your EU Member State of residence, or
- Türkiye's Personal Data Protection Authority (KVKK) — for processing within Türkiye:
- Web: www.kvkk.gov.tr
- Address: Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No: 4, 06520 Balgat-Çankaya, Ankara, Türkiye
For UK residents, you may contact the Information Commissioner's Office (ICO):
- Web: www.ico.org.uk
11. Automated Decision-Making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
12. Source of Personal Data
We collect personal data directly from you, through the following channels:
- The contact form (website)
- The patient satisfaction survey (website)
- The comments, suggestions and complaints form (website)
- The visual simulation tool (website)
- WhatsApp and other messaging applications
- Telephone calls (calls are not recorded; manual notes may be taken)
- Server logs (collected automatically)
We do not purchase data from third parties.
13. Statutory or Contractual Requirement
Providing the data on the contact form (name, email, phone, message) is a contractual requirement to enable us to respond. Without this data, we cannot reply to your inquiry. There is no statutory obligation to provide health data; however, omitting relevant medical information may limit the usefulness of our preliminary response.
14. Updates to This Privacy Notice
This notice may be updated to reflect changes in law or our processing activities. The effective date appears at the top of this document.
| Version | Date | Change |
|---|---|---|
| 1.0 | 28.04.2026 | Initial publication |
| 1.1 | 26.08.2026 | Retention periods revised (contact form 6 months; simulation records 30 days; identifying details in survey and feedback records anonymised after 6 months); satisfaction survey, feedback box and visual simulation tool added as data categories and collection channels |
This Privacy Notice should be read together with our Privacy Policy and Cookie Policy.
Last updated: 26.08.2026