Privacy Notice

This Privacy Notice has been prepared in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and applies to the contact form, communications, and information requests submitted via drhasanabuoglu.com.

When you contact us through the website's contact form, by email, telephone, or messaging applications, we collect and process your personal data as described below. This notice provides you with the information required by Articles 13 and 14 GDPR.

1. Identity and Contact Details of the Data Controller

Information	Detail
Data Controller	Assoc. Prof. Dr. Hacı Hasan Abuoğlu — Associate Professor of General Surgery, Bariatric & Metabolic Surgery
Legal Entity	Hacı Hasan Abuoğlu (Sole Proprietor — Independent Surgeon)
Address	Küçükbakkalköy Mah. Dudullu Cad. Brandium R2 Blok No: 23-25B İç Kapı No: 8 Ataşehir/İstanbul, Istanbul, Türkiye
Phone	+90 544 165 05 04
Email	info@drhasanabuoglu.com
Website	https://www.drhasanabuoglu.com
Health Tourism Authorization	ST-2697 (issued by the Republic of Türkiye, Ministry of Health)

2. Data Protection Officer

We have designated a Data Protection Officer ("DPO") who can be contacted for any questions about this notice or our data processing activities:

Name: Abdurrahman Çağlayan Email: abdurrahman@drhasanabuoglu.com Postal Address: Küçükbakkalköy Mah. Dudullu Cad. Brandium R2 Blok No: 23-25B İç Kapı No: 8 Ataşehir/İstanbul (marked "for the attention of the Data Protection Officer")

3. Categories of Personal Data Collected

When you submit the contact form or otherwise communicate with us, we may collect:

Identification data: First name, last name Contact data: Email address, phone number, country of residence (where provided) Special category — health data (Article 9 GDPR): Information you voluntarily provide in the message field about your medical history, current health condition, body mass index, planned surgical procedure, or other health-related queries Technical data: IP address, browser type and version, device type, access timestamps (server logs)

⚠️ Important — Health data are special category data under Article 9 GDPR. Please share only the information necessary to assess your initial inquiry. Detailed medical history, imaging studies, and laboratory results should be exchanged through secure channels during a formal consultation, not through the public contact form.

4. Purposes and Legal Bases of Processing

Purpose	Categories of Data	Legal Basis
Responding to your inquiry	Identification, contact, message content	Article 6(1)(b) GDPR — performance of a contract / steps prior to entering into a contract at your request
Providing medical information and consultation scheduling	Identification, contact, health data	Article 6(1)(b) + Article 9(2)(h) GDPR — processing necessary for the provision of health care under the responsibility of a health professional subject to professional secrecy
Health data outside healthcare provision (e.g., marketing)	Health data	Article 9(2)(a) GDPR — your explicit consent
Fulfilling legal obligations	All categories as required	Article 6(1)(c) GDPR — legal obligation under Turkish health legislation, tax law, e-commerce law
Server security and abuse prevention	Technical data	Article 6(1)(f) GDPR — legitimate interests
Marketing communications (newsletter)	Email	Article 6(1)(a) GDPR — your consent

5. Recipients of Your Personal Data

Your personal data may be disclosed to the following recipients under appropriate safeguards:

5.1 Internal Recipients

• The medical team directly involved in your care
• The administrative staff supporting your inquiry
• The Data Protection Officer

5.2 External Processors (Data Processors under Article 28 GDPR)

Processor	Service	Location	Safeguards
Resend Inc.	Email delivery	USA	Standard Contractual Clauses (SCC) + Data Processing Agreement
Vercel Inc.	Web hosting	USA / EU regions	SCC + DPA
Google Ireland Ltd. (Workspace)	Email inbox management	EU data centers	EU/EEA hosting; covered by GDPR
Cloudflare Inc.	CDN, security	Global edge / USA	SCC + DPA

5.3 Other Recipients (only when required by law)

• Public authorities (e.g., Turkish Ministry of Health, courts) when legally compelled
• Legal counsel in case of legal proceedings
• Auditors and accountants (under confidentiality)

6. International Data Transfers

The Data Controller is located in Türkiye, which is not currently subject to a European Commission adequacy decision (Article 45 GDPR). Therefore, transfers of your personal data from the European Economic Area (EEA) or the United Kingdom to Türkiye are protected by the following safeguards:

• Standard Contractual Clauses (SCCs) adopted by the European Commission, signed between the data controller and processors
• Explicit consent for specific transfers when no other legal basis applies (Article 49(1)(a) GDPR)
• Necessity for the performance of a contract at your request (Article 49(1)(b) GDPR) — when you request medical consultation, the transfer is necessary
• Necessity for important reasons of public interest in healthcare (Article 49(1)(d) GDPR), where applicable

You may request a copy of the SCCs or details of the transfer safeguards by contacting our DPO at abdurrahman@drhasanabuoglu.com.

7. Retention Periods

Data Category	Retention Period
Contact form (responded to, no consultation)	12 months
Contact form (no response received)	6 months
Patient records (consultation completed)	Minimum 20 years (Turkish Health Legislation)
Server logs	6 months to 2 years (Turkish Law No. 5651)
Resend email logs	30 days (manually shortened)
Cookies	See Cookie Policy

After the retention period expires, your data is deleted, destroyed, or anonymised in accordance with our retention and disposal procedures.

8. Your Rights Under the GDPR

As a data subject, you have the following rights:

• Right of access (Article 15): obtain a copy of your data
• Right to rectification (Article 16): correct inaccurate data
• Right to erasure / "right to be forgotten" (Article 17): request deletion (subject to medical record retention obligations)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20): receive your data in a structured format
• Right to object (Article 21): including objection to processing for direct marketing
• Right not to be subject to automated decision-making (Article 22)
• Right to withdraw consent (Article 7(3)) at any time, where processing is based on consent
• Right to lodge a complaint with a supervisory authority (Article 77)

9. Exercising Your Rights

To exercise any of your rights, contact us at:

Email: info@drhasanabuoglu.com DPO Email: abdurrahman@drhasanabuoglu.com Postal: Küçükbakkalköy Mah. Dudullu Cad. Brandium R2 Blok No: 23-25B İç Kapı No: 8 Ataşehir/İstanbul

We will respond to your request within one month (Article 12(3) GDPR). The response is free of charge unless requests are manifestly unfounded or excessive.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. You may contact:

• The supervisory authority in your EU Member State of residence, or
• Türkiye's Personal Data Protection Authority (KVKK) — for processing within Türkiye:
  • Web: www.kvkk.gov.tr
  • Address: Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No: 4, 06520 Balgat-Çankaya, Ankara, Türkiye

For UK residents, you may contact the Information Commissioner's Office (ICO):

• Web: www.ico.org.uk

11. Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

12. Source of Personal Data

We collect personal data directly from you when you complete the contact form, send an email, message, or call us. We do not purchase data from third parties.

13. Statutory or Contractual Requirement

Providing the data on the contact form (name, email, phone, message) is a contractual requirement to enable us to respond. Without this data, we cannot reply to your inquiry. There is no statutory obligation to provide health data; however, omitting relevant medical information may limit the usefulness of our preliminary response.

14. Updates to This Privacy Notice

This notice may be updated to reflect changes in law or our processing activities. The effective date appears at the top of this document.

Version	Date	Change
1.0	28.04.2026	Initial publication

---

This Privacy Notice should be read together with our Privacy Policy and Cookie Policy.

Last updated: 28.04.2026