Privacy Policy

Data controller: Assoc. Prof. Dr. Berkay Akmaz
Website: https://drberkayakmaz.com
Last updated: 22.08.2026

1. Purpose and scope

This Privacy Policy explains the principles under which the personal data of persons who visit the website belonging to the Private Practice of Assoc. Prof. Dr. Berkay Akmaz, complete a contact or appointment form or communicate by telephone, email or messaging channels is processed.
The Policy has been prepared with due regard to the Law No. 6698 on the Protection of Personal Data ("KVKK"), the Regulation on Personal Health Data, the Regulation on Patients' Rights and the relevant healthcare legislation. It explains the general privacy rules concerning use of the website. Detailed information concerning patient and private practice processes is also provided separately in the Information Notice on the Processing of Personal Data published on the website.
This Policy is not a declaration of explicit consent. Viewing the Privacy Policy, visiting the website or submitting a contact form does not mean that general permission has been given for advertising, marketing, non-essential cookies or transfers abroad.

2. Identity of the data controller

The data controller for personal data processing activities carried out through the website is Assoc. Prof. Dr. Berkay Akmaz.

• Practice name: Assoc. Prof. Dr. Berkay Akmaz Private Practice
• Address: Kültür Mahallesi, Talatpaşa Bulvarı No:4/A, Alsancak, Konak/Izmir
• Telephone: +90 547 917 11 37
• Email: [email protected]
• Website: https://drberkayakmaz.com

The term "Private Practice" in this document refers to the private practice managed within the scope of the professional activity of the data controller, Assoc. Prof. Dr. Berkay Akmaz.

3. Data that may be processed through the website

Depending on the nature of the website visit, the features used and the information shared voluntarily by the data subject, the following data may be processed:

• Identity information: First name and surname shared through the contact or appointment form.
• Contact information: Telephone number, email address and preferred communication channel.
• Request and appointment information: Reason for contact, appointment request, preferred date, message content and records concerning resolution of the request.
• Health information: Complaints, health status, explanations concerning eye health and examination or treatment information shared only at the person's own discretion.
• Technical usage information: IP address, date and time of access, device type, browser information, pages visited, error logs and security information.
• Cookie and preference information: Essential technical cookies, the user's cookie selections and identifiers relating to consent-based tools when they are enabled.
• Consent and application records: Records showing that the privacy notice was provided, preferences relating to explicit consent and withdrawal and KVKK applications.

A Republic of Türkiye identity number, detailed medical report, laboratory result, card details, password or personal data belonging to third parties that is not necessary for an appointment or contact should not be entered into the explanation fields on the website. Detailed information required for healthcare services is assessed within healthcare processes where appropriate security measures have been taken.

4. Methods of collecting personal data

Personal data may be collected by electronic or physical means when the website is visited, a contact or appointment form is completed, a telephone call is made, an email is sent, a messaging link is used, a cookie preference is selected or a KVKK application is submitted.
Technical records may be generated automatically while the website and servers are operating. Form and communication content consists of information shared directly by the data subject. For applications made on behalf of another person, only information that may be shared within the scope of the relevant authority and that is necessary for the procedure should be provided.

5. Purposes and legal grounds for processing data

Personal data is processed to the extent necessary for the relevant procedure and in accordance with the following legal grounds:

If explicit consent is not required to carry out a processing activity, the data subject is not separately asked for explicit consent. Where explicit consent is required, it is obtained for a specific matter, on the basis of information and through free will. Refusal to give explicit consent cannot be made a prerequisite for booking an appointment or accessing healthcare services.

6. Privacy in contact and appointment forms

Information shared through a contact or appointment form is used to assess the application and contact the data subject in accordance with the request. Sending information through the form does not mean that a medical assessment, diagnosis, prescription or emergency healthcare service has been provided.
Information entered in the "complaint" or explanation field of the form may constitute special category health data depending on its content. Therefore, only information necessary to understand the request should be shared. Patient files, detailed test results, identity documents and similar sensitive content should not be sent through the website form, social media messages or unprotected email unless specifically requested by the Private Practice.
Form data is not transferred to advertising platforms, retargeting systems or third-party analytics tools in a manner that includes a patient's name, contact information, health complaint or treatment information.

7. Health data and patient confidentiality

Information such as health status, eye diseases, examination findings, treatment preferences and imaging results is special category personal data under the KVKK. This information is processed to the extent required by the healthcare service and by persons under an obligation of confidentiality.
Health data is not used for advertising targeting, remarketing, behavioural advertising, lookalike audience creation or commercial profiling. An advertising profile is not created by inferring a visitor's health status from their viewing of a specific disease, treatment or medical procedure page.
Patient testimonials, images relating to a treatment process, photographs or videos may be used only where permitted by the legislation governing promotion and information in healthcare services and, where required, with the data subject's separate, specific and freely given explicit consent. Consent on this matter is not a condition for the provision of healthcare services.

8. Cookies and similar technologies

Essential cookies may be used on the website to ensure its secure operation and provide basic features explicitly requested by the user. Non-essential analytics, performance, personalisation, advertising or social media cookies may be activated only with the explicit consent of the data subject unless another legally valid processing condition exists.
Cookie preferences may be viewed and changed through the cookie management panel on the website, where available. Categories requiring consent should be disabled by default, and the user should be clearly provided with options to accept, reject and manage preferences.
Tag management tools such as Google Tag Manager may be used. The data processing purpose and legal ground of each tag activated through such a tool is assessed separately. Use of a tag management tool does not mean that third-party analytics or advertising tools may operate without the user's permission.
The names, providers, categories, purposes of use, retention periods and first-party or third-party status of the cookies used are explained in the current Cookie Policy or cookie management panel on the website.

9. Third-party services and external links

The website may contain Google Maps, YouTube videos, Google Tag Manager tags or links directing users to third-party platforms such as Facebook, Instagram, TikTok, YouTube and WhatsApp.
When an external link is opened by the user, the relevant platform may apply its own privacy and data processing rules. While embedded videos, maps or similar content is displayed, the IP address, device information, technical identifiers and usage data may be shared with the relevant service provider.
Third-party content and services should be used with due regard to the privacy notice, cookie preference and international transfer conditions required by the applicable legislation. The Private Practice does not manage processing carried out by third parties as independent data controllers in their own environments. However, it is responsible for fulfilling its own legal obligations concerning the tools that it activates through the website.

10. Communication by telephone, email and WhatsApp

Information shared by telephone, email or WhatsApp is assessed within the scope of the appointment, application, existing service or request submitted by the data subject. Appointment reminders, responses to applications and essential information relating to the service are assessed separately from advertising or commercial promotional communications.
Messaging and email providers may use independent third-party infrastructure. It is recommended not to share detailed health reports, identity documents, payment card details or sensitive data that is not necessary for the procedure through these channels. If use of the communication channel preferred by the data subject results in a transfer of data abroad, the conditions under Article 9 of the KVKK are assessed separately.
Commercial electronic communications or communications promoting healthcare services may be conducted only to the extent permitted by the relevant healthcare legislation and, where required, with separately obtained explicit consent.

11. Sharing personal data with third parties

Personal data is not offered for sale or shared with third parties for the purpose of subjecting health data to advertising targeting. Where necessary and proportionate for the relevant procedure, data may be shared with the following recipient groups:

• Software, hosting and information security providers serving the hosting, maintenance and security of the website.
• Technical providers serving appointment, email, SMS or communication processes.
• Authorised physicians, hospitals, laboratories or other healthcare providers involved in providing the requested healthcare service.
• Professional advisers, banks and authorised payment service providers involved in accounting, legal or payment processes.
• Public institutions, judicial authorities and administrative bodies authorised by law.

Sharing is based on Article 8 of the KVKK and an appropriate legal ground under Article 5 or 6 according to the nature of the data. Service providers are expected to process data only to the extent necessary for their duties and to implement appropriate confidentiality measures.

12. Transfer of data abroad

Where map, video, tag, analytics, email, hosting or messaging services used on the website operate through infrastructure located abroad, certain data may be transferred abroad depending on the use of the relevant service. Whether a transfer occurs depends on the configuration of the tool used and the data processing infrastructure of the service provider.
Where data is transferred abroad, action is taken in accordance with Article 9 of the KVKK. Provided that the relevant processing condition exists, a transfer may be carried out on the basis of an adequacy decision or by providing appropriate safeguards prescribed by the Law, including a standard contract. Where these options are unavailable, only the exceptional grounds for transfer listed in the Law and having an occasional nature are considered.
It is not appropriate for continuous or systematic international transfers to be based solely on a general explicit consent form. Where explicit consent may be used as an exceptional ground for transfer, the data subject is separately informed of the possible risks.

13. Retention period

Personal data is retained for the period necessary to assess the relevant application, provide the service, ensure information security and fulfil legal obligations. The retention and limitation periods prescribed by the relevant legislation apply to health, financial records and dispute documents.
When the purpose of processing ceases to exist and there is no other legal ground requiring the data to be retained, personal data is erased, destroyed or anonymised. Cookie retention periods are also shown separately in the relevant cookie list.

14. Information security

The Private Practice takes technical and administrative measures appropriate to the processing risk in order to prevent unlawful processing of personal data, unauthorised access and data loss. These measures may include the use of secure connections, restriction of access authorisations, up-to-date software, backups, log records, encryption or equivalent protection methods and security controls for service providers.
No method of transmitting data over the internet can be guaranteed to be completely risk-free. Users are advised to sign out when using shared devices, prefer trusted connections and avoid sharing unnecessary health information.

15. Data relating to children

The website is not a platform intended for children to share sensitive health information independently. Appointments and health-related applications concerning children should be handled through their mother, father, parent, court-appointed guardian or other authorised legal representative.
Children's personal data is processed to the extent required by the healthcare service, taking account of their best interests and the authority of their legal representative. The Private Practice should be contacted if it becomes known that data concerning a child has been shared without authorisation.

16. Nature of health content

Texts, images, videos and other content on the website are intended for general information. This content does not replace an individual diagnosis, treatment, prescription, remote examination or emergency medical advice.
Assessments relating to a health condition are made as a result of a physician's examination and the necessary medical investigations. In the event of an urgent health problem, the nearest healthcare institution should be contacted or the 112 Emergency Call Centre should be called.

17. Rights and applications under the KVKK

Under Article 11 of the KVKK, data subjects have the right to learn whether their personal data is processed, request information if it has been processed, learn the purpose of processing, know the persons to whom data has been transferred within Türkiye or abroad, request correction of inaccurate data, request erasure or destruction when the conditions are met, request notification of the operations carried out to third parties, object to a result arising exclusively from automated analysis and request compensation for damage caused by unlawful data processing.
Applications may be submitted in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• In writing to Kültür Mahallesi, Talatpaşa Bulvarı No:4/A, Alsancak, Konak/Izmir,
• To [email protected] using a secure electronic signature or mobile signature,
• To [email protected] using an email address previously notified to the Private Practice and registered in the system.

The KVKK Data Subject Application Form on the website may also be used to prepare the relevant application.
Applications are concluded as soon as possible according to the nature of the request and no later than thirty days. Applications are, as a rule, free of charge. Where the process requires an additional cost, the fee in the tariff determined by the Board may be applied.

18. Other documents and updates

This Policy should be considered together with the Information Notice on the Processing of Personal Data, the Cookie Policy, explicit consent forms used where required and the KVKK Data Subject Application Form. These documents do not replace one another and are provided separately in accordance with their legal nature.
The Policy may be updated in the event of changes to the legislation, technical infrastructure, third-party services used or data processing activities. The current version is published on the website.