Data Controller
The data controller for this website and for the contact channels listed on it is Prof. Dr. H. Ibrahim Petekkaya, medical oncologist. Data entered into the hospital information system during examination and treatment is covered by the separate notice of Egepol Hospital; this notice covers only the data collected through the website and the doctor's direct contact channels. The agency that maintains the site acts as a data processor on the controller's instructions.
Personal Data Processed and Purposes
The website has no forms; personal data is collected only when a visitor initiates contact. The data processed and the purposes are listed below.
- Identity and contact data
- Name, telephone number, e-mail address and country or city of residence; processed to arrange appointments, reply to enquiries and follow up a request.
- Health data
- Diagnosis, pathology and imaging reports, test results, genetic and genomic reports, medication list and treatment history; processed only for medical assessment, a second opinion or review before a consultation.
- Website usage data
- Pages visited, session length and browser information; processed only with cookie consent and only to understand how the site is used.
The legal basis for contact and appointment data is Article 5 of the KVKK: the establishment of a contract and the legitimate interest of the controller. The legal basis for health data is Article 6 of the KVKK: the explicit consent of the person concerned, or processing for the purpose of medical diagnosis and treatment by a doctor bound by professional secrecy. The basis for analytics data is explicit consent.
Protection of Health Data
Health data sent by WhatsApp (+90 533 398 50 77) or e-mail (drpetekkaya@gmail.com) is special-category personal data. It is seen only by Prof. Dr. H. Ibrahim Petekkaya and the clinical molecular oncology team, for assessment; it is not used for marketing or statistics, and no patient information is ever published on the site.
WhatsApp uses end-to-end encryption, but messages pass through the servers of WhatsApp LLC, and the choice of this channel is the sender's own. Patients who prefer to send health data by e-mail, or to hand it over only at a consultation, may do so. Genetic data is also special-category data, and separate explicit consent is obtained before hereditary testing.
Important: The texts on this site are written and reviewed by the doctor; artificial intelligence tools may be used in drafting. No patient data is ever entered into an artificial intelligence tool.
Transfers and Retention
Personal data is not transferred to third parties without the knowledge and, where required, the explicit consent of the person concerned. Transfers may be made to public authorities where the law requires it and, with the patient's consent, to the hospital or laboratory involved in treatment. International transfer occurs only through the infrastructure of the channel the sender has chosen (WhatsApp or an e-mail provider), under that provider's terms.
Messages and documents from enquiries that do not lead to an appointment are kept for no longer than 12 months and are then deleted. Documents from enquiries that lead to an appointment become part of the patient record and are subject to the retention periods in Turkish health legislation. Analytics data is retained in Google Analytics 4 for 14 months.
Cookies and Analytics
The site uses no cookies other than those technically necessary. Google Analytics 4 measurement cookies run only after the visitor gives consent in the cookie notice, and no measurement tag is loaded before consent. The consent choice is stored in the browser under the key "ipk_consent" and is asked again after six months. IP anonymisation is on and Google signals are off; the data is not used for advertising. The list of cookies, their durations and how to withdraw consent are explained in the cookie policy.
Your Rights
Under Article 11 of the KVKK, you may apply to the data controller to exercise the following rights.
- To learn whether your personal data is processed and, if so, to request information about it.
- To learn the purpose of processing and whether the data is used in line with that purpose.
- To know the third parties, in Türkiye or abroad, to whom the data has been transferred.
- To request correction of incomplete or inaccurate data.
- To request erasure or destruction of the data under the conditions of Article 7, and notification of that action to any third party recipient.
- To object to a result that is to your detriment and is produced solely by automated analysis of your data.
- To claim compensation for damage caused by unlawful processing.
Note for EU and UK Residents
If you live in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or the UK GDPR may also apply to the data you send. Health and genetic data is special-category data under Article 9 of the GDPR; it is processed on the basis of your explicit consent when you send it, and for the provision of health care by a professional bound by secrecy. Sending your data to Türkiye is a transfer outside the EU and the UK; it rests on your explicit consent and is limited to what the assessment needs.
You have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time without affecting processing carried out before withdrawal. Requests go through the channel below; you may also complain to the supervisory authority in your own country.
How to Make a Request
Requests are made by e-mail to drpetekkaya@gmail.com, stating your full name and the subject of the request, or in writing to Egepol Hospital, Güneşli Mah. 507 Sok. No:3, Konak, Izmir, Türkiye. Requests are answered within 30 days at the latest, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. If a request is refused, the reply is found insufficient or no reply is given in time, you may complain to the Turkish Personal Data Protection Board.
This notice is updated when the law or the processing changes; the current version is published here. Contact channels are on the contact page.
Sources
- Personal Data Protection Law No. 6698. Official Gazette 07.04.2016, no. 29677. Link
- Personal Data Protection Authority of Türkiye. Obligation to inform, rights of the data subject and application procedure. Link
- Regulation on Personal Health Data. Official Gazette 21.06.2019, no. 30808. Link
- Regulation (EU) 2016/679 (General Data Protection Regulation). Link
- Google. Data privacy and security in Google Analytics. Link