Privacy Policy and Personal Data Protection Notice
How Avrupa Cerrahi processes and protects the personal and health data of its patients, including international patients, under KVKK and the GDPR.
Last updated:
How Avrupa Cerrahi processes and protects the personal and health data of its patients, including international patients, under KVKK and the GDPR.
Last updated:
Last updated: 2 October 2026
This notice explains how your personal data is processed in the course of the healthcare services provided by Avrupa Cerrahi Sağlık Merkezi Ltd. Şti. It covers our patients living in Türkiye as well as patients who come from abroad for treatment and their relatives. It has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). For our patients living in the European Economic Area, the rights arising under the European Union General Data Protection Regulation (GDPR) are also set out separately.
Avrupa Cerrahi Sağlık Merkezi Ltd. Şti.
Levent Mahallesi, Levent Caddesi No:4, 34330 Beşiktaş / İstanbul, Türkiye
E-mail: info@avrupacerrahi.net
We obtain your separate consent before sending you campaign or promotional messages. Not giving this consent does not affect your access to healthcare services.
We process your personal data under Article 5 of the KVKK on the following legal grounds: the conclusion and performance of the healthcare services contract with you, compliance with our legal obligations, the establishment, exercise or protection of a right, and our legitimate interest, provided that this does not harm your fundamental rights.
Your health data is special category personal data. Under Article 6 of the KVKK, we process this data for the purpose of providing medical diagnosis, treatment and care services, and only through physicians, healthcare staff and authorised persons who are bound by a duty of confidentiality. For processing outside this scope (for example, sharing your health data with an intermediary agency other than at your request), we obtain your explicit consent.
For our patients living in the European Economic Area, the relevant GDPR provisions are: performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)), medical diagnosis and treatment for health data (Art. 9(2)(h)) and, where necessary, explicit consent (Art. 6(1)(a) and Art. 9(2)(a)).
Your data is shared only to the extent necessary for the purpose and only with the following recipients:
Our websites and patient records are kept on servers in Türkiye. However, some of our service providers have servers abroad. For example, enquiries submitted through web forms are processed on a US-based customer relationship management (CRM) platform, and e-mails are processed by an international e-mail service. Website traffic passes through a content delivery network (CDN). Analytics and advertising cookies run only if you have consented to cookies. If you choose to write to us through a messaging application such as WhatsApp, your correspondence is processed on that application's infrastructure.
We carry out these transfers in accordance with Article 9 of the KVKK: by signing standard contracts and notifying the Personal Data Protection Authority, or on the basis of the other safeguards or exceptions listed in the law. Transfers made at your request to your own physician or insurance company in your home country also fall within this scope.
The main measures we take to protect the confidentiality and privacy of patient data and to protect it against unauthorised access are as follows:
Your examination and treatment records are kept for the periods prescribed by healthcare legislation. Invoices and accounting records are kept for the periods set out in tax legislation. Information relating to enquiries that did not lead to treatment is kept for a maximum of two years from the last contact. Data whose retention period has expired is deleted, destroyed or anonymised.
Our websites use cookies that are strictly necessary for the site to function, as well as analytics and marketing cookies for visit statistics and advertising measurement. Non-essential cookies do not run until you give your consent. You can set your preference in the cookie banner that appears on your first visit to our site, and later change or withdraw that preference through the same banner. You can also delete or block cookies in your browser settings.
Under Article 11 of the KVKK, you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of the processing and whether the data is used in line with that purpose; know the third parties in Türkiye or abroad to whom it has been transferred; request rectification if it has been processed incompletely or inaccurately; request its erasure or destruction; request that these actions be notified to the third parties to whom it has been transferred; object to an outcome against you resulting from analysis exclusively by automated systems; and claim compensation for any damage you suffer as a result of unlawful processing.
Our patients living in the European Economic Area may also exercise, under the GDPR, the rights of access, rectification, erasure, restriction of processing, data portability and objection; withdraw the explicit consent they have given at any time; and lodge a complaint with the data protection authority in their country of residence.
To exercise your rights, you may send your request in writing to our address given in Section 1, or send it from the e-mail address registered in our system to info@avrupacerrahi.net. It is sufficient to state clearly your first name, surname, contact details and your request. International patients may submit their applications in their own language or in English. We will conclude your application free of charge within 30 days at the latest. If the action requires an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board (KVKK Board).
We may update this notice in line with changes in legislation or in our services. The current version is always published on this page. The date at the top of the page shows the date of the last update.