EN ▾
Privacy and Data Protection
Last updated: 5 October 2026
Privacy Notice
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It explains how we process the personal data of people who contact us through the doctorg.clinic website, the contact and medical forms, WhatsApp, e-mail and telephone, and of prospective and current patients.
1. Data Controller
Op. Dr. Mehmet Göktuğ Esmer
Küçükbakkalköy Mah. Defne Sk. No:1 Flora Suites, 34750 Ataşehir / Istanbul, Türkiye
E-mail: info@doctorg.clinic · Phone / WhatsApp: +90 532 063 23 41
2. Personal Data We Process
| Category | Examples | Source |
|---|---|---|
| Identity | Name, surname, date of birth, gender, nationality, passport number | Contact form, Medical Form, WhatsApp, e-mail |
| Contact | Phone / WhatsApp number, e-mail, country/city, address | Forms, WhatsApp, e-mail, phone |
| Request and correspondence | Procedure of interest, your messages, expectations, how you heard about us | Forms, WhatsApp, e-mail, phone |
| Health data (special category) | Height, weight, medical conditions, previous surgery, anaesthesia history, medication, allergies, pregnancy/breastfeeding, smoking, alcohol and substance use | Medical Form, WhatsApp, e-mail, consultation |
| Images | Photos and videos you send for assessment (health data when used for medical evaluation) | WhatsApp, e-mail |
| Travel and accommodation | Arrival/return dates, flight details, companion's name | Medical Form, WhatsApp, e-mail |
| Data about other people | Emergency contact's name and phone, companion details (please inform them before sharing) | Medical Form |
| Transaction security | IP address, date/time and page address recorded when a form is sent; server logs | Website (automatic) |
| Cookies and usage data | Google Analytics data only if you consent; your cookie choice | Website (automatic), see Cookie Policy |
Your personal data is not used to send marketing or advertising messages without your separate consent.
3. How We Collect Data
Data is collected partly by automated means (website contact form and Medical Form, cookies, server logs) and by non-automated means (WhatsApp and e-mail correspondence, phone and in-person conversations, consultation and treatment). Website forms are delivered by e-mail to info@doctorg.clinic and to the doctor's personal e-mail account (Microsoft Outlook.com). Medical Form answers are sent to info@doctorg.clinic together with a Word (.docx) patient form; if you enter your e-mail address you receive an acknowledgement e-mail.
4. Purposes
- Responding to your enquiries and appointment requests and communicating with you;
- Pre-assessment by the doctor based on the information and photos you send;
- Planning and carrying out consultation, surgery, anaesthesia and treatment;
- Coordinating with the hospital, anaesthesia team and other healthcare professionals;
- Arranging accommodation and transfers;
- Contacting the person you name in an emergency;
- Post-operative follow-up;
- Meeting legal record-keeping, reporting and retention obligations;
- Establishing, exercising and protecting legal rights in case of a dispute;
- Keeping the website and forms secure and preventing abuse;
- Only with your consent, measuring how the website is used.
5. Legal Bases
| Data / activity | Legal basis |
|---|---|
| Identity, contact and request data; travel and accommodation data | KVKK Art. 5(2)(c): necessary for entering into or performing a contract; Art. 5(2)(f): legitimate interest, provided your fundamental rights are not harmed |
| Health data and photos used for medical evaluation | KVKK Art. 6(3)(e): necessary for medical diagnosis, treatment and care and for planning and managing healthcare services, by persons under a duty of confidentiality |
| Keeping health records and reporting to authorities as required by law | KVKK Art. 5(2)(ç) and Art. 6(3)(b): expressly provided for by law / legal obligation |
| Establishing and protecting rights; vital interests | KVKK Art. 5(2)(e), Art. 6(3)(d) and Art. 6(3)(c) |
| Emergency contact and companion data | KVKK Art. 5(2)(f): legitimate interest in patient safety |
| Transaction security (IP address, server logs), storing your cookie choice | KVKK Art. 5(2)(f): legitimate interest in site and form security |
| Google Analytics cookies | KVKK Art. 5(1): your explicit consent ("Accept" in the cookie banner) |
| Transfer of personal data abroad | KVKK Art. 9(6)(a): your explicit consent (see section 6.2 and the Explicit Consent text) |
Where processing is based on consent, you can withdraw it at any time; withdrawal does not affect processing carried out before it. The before/after images on this website are published with the separate written consent of the patients concerned.
6. Transfers
6.1. Within Türkiye
| Recipient group | Purpose |
|---|---|
| Private hospital(s) where surgery takes place, anaesthetist and healthcare professionals in the surgical team | Patient registration, surgery and admission planning, treatment (KVKK Art. 8(2) and Art. 6(3)(e)) |
| Hotel and transfer providers | Accommodation and transfers; only name, contact, flight and date details (no health data) |
| Competent public authorities and courts | Legal reporting and information obligations, legal proceedings |
6.2. Outside Türkiye
Some of the technical and communication services we use are provided by companies based abroad or process data on servers abroad:
| Provider | Service | Data transferred |
|---|---|---|
| Google (Google Workspace / Gmail) | Delivering and storing form submissions and e-mails (info@doctorg.clinic) | All data in forms and e-mails, including health data |
| Microsoft (Outlook.com) | Delivering a copy of the contact form to the doctor's personal e-mail account | Contact form content |
| WhatsApp (Meta) | Messaging, photo/video pre-assessment, appointment and travel coordination | Messages, photos and videos, including health data |
| Hostinger | Hosting the website and form infrastructure | Data passing through the server when forms are sent, IP address, server logs |
| Google (Google Analytics 4) | Only with your consent, website usage statistics | Cookie identifiers, device/browser data, IP address, page and click events |
| Google (Google Fonts, Google Maps), flagcdn.com | Loading fonts, the map and the flag images in the language menu | IP address, browser data, page address |
There is no adequacy decision of the Turkish Personal Data Protection Board for these countries, and the appropriate safeguards listed in Article 9(4) KVKK (such as a standard contract) are not yet in place. Transfers abroad are therefore made on the basis of your explicit consent under Article 9(6)(a) KVKK, after you have been informed of the possible risks. Possible risks: the destination country may not offer the same level of protection as Türkiye; your data may be accessible to that country's authorities; it may be harder to exercise your rights there. If you do not wish to give consent, you can contact us by phone on +90 532 063 23 41 or in person at the practice.
7. Retention
Personal data is kept for the periods required by applicable legislation or, where no period is set, for as long as the purpose of processing requires. When these periods end, it is deleted, destroyed or anonymised under Article 7 KVKK, on our own initiative or at your request. In case of a dispute, relevant data may be kept for the limitation periods to protect legal rights.
8. Your Rights (Article 11 KVKK)
You have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under Article 7; to request that such actions be notified to third parties to whom the data was transferred; to object to an adverse result arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing. You can withdraw consent at any time.
9. How to Apply
Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit requests in writing with a wet signature to the address above (by hand or post), signed with a secure electronic or mobile signature to info@doctorg.clinic, or by e-mail to info@doctorg.clinic from an e-mail address you have previously given us and that is in our records. Your request must include your name and surname, signature (for written requests), Turkish ID number for Turkish citizens or nationality and passport number for foreign nationals, address for notifications, e-mail address if any, telephone number and the subject of your request.
Requests are answered free of charge within thirty days at the latest; if the action involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your request is rejected, you find the answer insufficient or it is not answered in time, you may complain to the Board within thirty days of learning of the answer and in any case within sixty days of your application.
This English text is a translation for information; in case of discrepancy, the Turkish text prevails.
Explicit Consent: Transfer of Personal Data Abroad
The consent box on the website forms and in WhatsApp is explicit consent to the text below. It is separate from the Privacy Notice; not giving it does not prevent you from receiving consultation or treatment.
I have read the Doctor G Privacy Notice. I give my explicit consent to the transfer abroad of my identity, contact, travel and health data, photos and videos that I share through the website contact form and Medical Form and via WhatsApp, limited to the purposes of contacting me, pre-assessment and treatment planning, through the e-mail service providers Google and Microsoft, the messaging service provider WhatsApp (Meta) and the hosting provider Hostinger.
I have been informed that there is no adequacy decision of the Board for the destination countries and that the appropriate safeguards in Article 9(4) KVKK are not in place; that the destination country may not offer the same level of protection as Türkiye; that my data may be accessible to that country's authorities; and that it may be harder for me to exercise my rights there. I know that if I do not consent I can contact Doctor G by phone or in person, and that I can withdraw my consent at any time by writing to info@doctorg.clinic.
Cookie Policy
Cookies are small text files that a website stores in your browser; the browser's local storage can be used in a similar way.
- We do not use advertising, retargeting or social media tracking cookies.
- Google Analytics 4 cookies are set only if you choose "Accept" in the cookie banner; if you do not consent, the Google Analytics code is not loaded.
- Google Analytics never runs on the Medical Form pages, and what you type into forms is never measured.
| Name | Type and party | Purpose | Duration | Legal basis |
|---|---|---|---|---|
| dg_consent | Local storage, first party | Remembering your cookie banner choice | Until you clear browser data | KVKK Art. 5(2)(f) |
| _ga | Cookie; Google Analytics (data sent to Google) | Distinguishing visitors | 2 years | Explicit consent |
| _ga_W39V4SBYP6 | Cookie; Google Analytics | Maintaining session state | 2 years | Explicit consent |
With your consent we measure pages visited, device/browser data, approximate location, contact form submissions and clicks on WhatsApp, phone, e-mail, Instagram and Trustpilot links. Ad storage and ad personalisation are disabled.
Third-party content that does not set cookies: Google Fonts (fonts), Google Maps (embedded map) and flagcdn.com (flags in the language menu) are loaded directly from these providers' servers when a page opens, which sends your IP address and browser data to them. Google Tag Manager is loaded only after you consent.
Managing your choice: choose "Accept" or "Decline" in the cookie banner. You can reopen the banner at any time with "Cookie settings" at the bottom of every page and withdraw consent; measurement then stops and cookies starting with _ga are deleted. You can also delete cookies and site data in your browser settings.