Privacy Policy – Op. Dr. Buğra İpek

Last Updated: 24 August 2026

As Op. Dr. Buğra İpek Clinic, we attach great importance to protecting the personal data and privacy of our patients, prospective patients, website visitors, and individuals who contact us.

This Privacy and Personal Data Protection Policy has been prepared to provide general information regarding the purposes and scope within which the personal data of individuals who visit our website, use our contact and online appointment forms, apply to our clinic, or contact us within the scope of international health tourism may be processed.

Your personal data is processed and protected in accordance with applicable legislation, particularly Turkish Personal Data Protection Law No. 6698 (“KVKK”).

1. Data Controller

Within the scope of KVKK, the data controller responsible for your personal data is:

Op. Dr. Buğra İpek Clinic

Address: Caddebostan Mahallesi, Bağdat Caddesi, Deniz Apartmanı No: 298-14, 34728 Kadıköy / Istanbul, Türkiye
Phone: +90 530 293 24 00
Email: [email protected]
Working Hours: Monday – Saturday, 09:00 – 17:00

2. Personal Data That May Be Processed

Depending on your use of our website, online appointment requests, communications with us, or receipt of healthcare services, the following categories of personal data may be processed:

Identity Information:
Name, surname, date of birth, and other identity information that may be required depending on the nature of the service.

Contact Information:
Telephone number, email address, address, country information, and other contact details provided by you.

Appointment and Application Information:
Requested procedure or treatment, preferred appointment date and time, communication preferences, messages, and explanations.

Health Information:
Where provided by you for treatment or preliminary assessment purposes, your medical history, current health condition, previous operations, medications, allergies, medical documents, laboratory or imaging results, photographs, and other health-related information concerning your treatment.

Transaction Security and Technical Data:
IP address, connection and access logs, website access date and time, device and browser information, security logs, and similar technical data.

International Health Tourism Information:
Where necessary for international patients, country information, travel planning, transfer, accommodation, interpretation, and information related to the organization of international health tourism services.

Request, Suggestion and Complaint Information:
Records relating to questions, requests, suggestions, feedback, and complaints submitted to our clinic.

Health data constitutes special categories of personal data under KVKK and is therefore subject to enhanced protection and security measures.

3. Purposes of Processing Personal Data

Depending on the nature of the data and the scope of your application, your personal data may be processed for the following purposes:

Receiving online appointment and preliminary consultation requests,
Planning and confirming appointments,
Communicating with patients and prospective patients,
Carrying out examination, medical assessment, diagnosis, treatment, and follow-up processes,
Preparing personalized treatment plans,
Ensuring patient safety,
Planning and providing healthcare services,
Creating and maintaining patient files and medical records,
Monitoring pre-operative and post-operative processes,
Planning application and treatment processes for international patients,
Organizing transfer, accommodation, and interpretation services requested within the scope of international health tourism,
Responding to questions, requests, and complaints,
Improving the quality of clinic services,
Ensuring the technical operation and security of the website,
Carrying out information and transaction security processes,
Fulfilling statutory record-keeping and retention obligations,
Fulfilling obligations towards authorized public institutions and authorities,
Establishing, exercising, or protecting legal rights in the event of legal disputes.

Personal data is processed in accordance with the general principles of KVKK, namely for specified, explicit and legitimate purposes and in a manner that is relevant, limited and proportionate to the purposes for which it is processed.

4. Processing of Health Data

Information concerning your health condition, medical history, medical photographs, examinations, test results, and treatment constitutes special categories of personal data.

Provided that an applicable legal basis exists, such data may be processed for purposes including the provision of healthcare services, medical diagnosis, treatment and care, ensuring patient safety, and planning healthcare services.

Under the current Article 6 of KVKK, special categories of personal data may only be processed where one of the legal conditions specified in the Law is present. Health-related data may, under the conditions prescribed by law, be processed without explicit consent by persons subject to confidentiality obligations or by authorized institutions and organizations. Where no other legal basis applies to the relevant processing activity, explicit consent may be required.

The necessary technical and administrative measures prescribed under applicable legislation and the regulations of the Turkish Personal Data Protection Board are implemented when processing special categories of personal data.

5. Methods of Collecting Personal Data

Your personal data may be obtained through electronic or physical means, including:

Contact forms on the website,
Online appointment forms,
Telephone conversations,
Email correspondence,
WhatsApp and similar communication channels,
Face-to-face meetings,
Examination and treatment processes,
Documents, photographs, and files submitted by you,
Technical records generated through the website,
Cookies and similar technologies.

6. Legal Grounds for Processing Personal Data

Personal data is processed on the basis of the appropriate legal grounds set out in Articles 5 and 6 of KVKK and other applicable provisions, depending on the nature of the specific processing activity.

These legal grounds may include:

Processing being expressly provided for by law,
Processing being necessary for the data controller to fulfil a legal obligation,
Processing being directly related to the establishment or performance of a contract,
Processing being necessary for the establishment, exercise, or protection of a right,
Processing being necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not adversely affected,
The applicable conditions concerning special categories of personal data being satisfied in relation to healthcare services,
Obtaining the explicit consent of the data subject where required.

The appropriate legal basis is determined separately for each personal data processing activity according to its nature.

7. Transfer of Personal Data

Your personal data may be transferred, only to the extent necessary for providing the relevant services and fulfilling legal obligations, and subject to the conditions prescribed by applicable legislation, to:

The Ministry of Health and authorized public institutions and authorities,
Authorized healthcare institutions,
Physicians and healthcare professionals who need to be involved in your treatment process,
Laboratories, imaging centers, and similar healthcare service providers,
Legal advisers, financial advisers, and other professional consultants,
IT, hosting, maintenance, backup, and security service providers,
Transfer, accommodation, and interpretation service providers where necessary within the scope of international health tourism.

Data minimization principles are observed in transfer activities, and only the data necessary for the relevant service is shared.

8. Transfer of Personal Data Abroad

Personal data may be transferred abroad due to certain international service providers used on the website or within our communication infrastructure.

Transfers of personal data abroad are carried out in accordance with Article 9 of KVKK and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad.

Where necessary, adequacy decisions, appropriate safeguards, standard contractual clauses, or other legal transfer mechanisms provided under applicable legislation are used.

9. WhatsApp and Third-Party Platforms

Our website and communication processes may include links to or services provided by third-party platforms such as WhatsApp, YouTube, Google, Trustpilot, or similar providers.

When you use these platforms, your personal data may also be processed in accordance with the relevant service provider’s own privacy policies and data processing terms.

Data processing activities carried out independently by third-party service providers are subject to the responsibility of those service providers.

In particular, we recommend that identity documents, detailed medical reports, or sensitive medical documentation should not be shared through WhatsApp or similar general-purpose communication channels unless necessary.

You may contact our clinic to learn which method should be used to securely submit medical documentation required for treatment assessment.

10. Retention Period of Personal Data

Personal data is retained for the period required for the purpose for which it is processed and in accordance with mandatory retention periods prescribed under applicable healthcare, tax, financial, legal, and other legislation.

Once the purpose of processing and any applicable legal retention obligations cease to exist, personal data is deleted, destroyed, or anonymized in accordance with applicable legislation.

11. Data Security

Appropriate technical and administrative security measures are implemented to prevent personal data from:

Being accessed by unauthorized persons,
Being unlawfully processed,
Being lost,
Being altered,
Being damaged,
Being disclosed without authorization.

Additional security measures appropriate to the level of risk are applied to special categories of personal data, including health data.

12. Your Rights Under KVKK

Under Article 11 of KVKK, you have the following rights regarding your personal data:

To learn whether your personal data is being processed,
To request information if your personal data has been processed,
To learn the purpose of processing your personal data,
To learn whether your data is being used in accordance with the stated purpose,
To learn the third parties to whom your personal data has been transferred in Türkiye or abroad,
To request the correction of incomplete or inaccurate personal data,
To request the deletion or destruction of personal data under the conditions prescribed by law,
To request notification of correction, deletion, or destruction operations to third parties to whom your personal data has been transferred,
To object to a result arising against you due to your personal data being analyzed exclusively through automated systems,
To request compensation for damages arising from unlawful processing of your personal data.

13. KVKK Applications and Contact

You may submit your requests concerning your rights under KVKK to the data controller using the methods prescribed under applicable legislation.

Op. Dr. Buğra İpek Clinic

Applications will be evaluated and finalized within the procedures and time periods prescribed under applicable legislation, depending on the nature of the request.

14. Updates to This Policy

This Policy may be updated in accordance with changes in applicable legislation, the clinic’s data processing activities, services used on the website, or technical infrastructure.

The current version of the Policy will be published on our website.