Privacy Policy

Purpose and Scope of this Information Notice

As Adem Emre İlhan, we attach great importance to the protection of your personal data within the framework of the European Union General Data Protection Regulation (“GDPR”) and, where applicable, the relevant national data protection legislation. We process your personal data, as a data controller within the meaning of the GDPR, for the purposes and on the legal bases set out below and in accordance with the GDPR and applicable legislation.

This Information Notice on the Processing of Personal Data by Adem Emre İlhan has been prepared, in accordance with Articles 12, 13 and 14 of the GDPR, to inform you as transparently as possible about the identity and contact details of the data controller, the methods and legal bases for collecting your personal data, the purposes for which such data are processed, to whom and for what purposes they may be disclosed, the periods for which they are retained, and your rights under the GDPR. References in this Information Notice to “your personal data” also include special categories of personal data concerning you.

We hereby inform you that we process your personal data as described below, in all cases:

• lawfully and fairly,

• for specified, explicit and legitimate purposes,

• in a manner that is adequate, relevant and limited to what is necessary in relation to those purposes,

• ensuring that it is accurate and, where necessary, kept up to date, and

• retaining it only for as long as necessary for the purposes for which it is processed or as required under applicable legislation.

Data Controller

Name : Adem Emre İlhan

Address : ******

Personal Data We Process

Under the GDPR, personal data means any information relating to an identified or identifiable natural person, in particular where the person can be identified directly or indirectly by reference to an identifier or to one or more characteristics specific to that person. The categories of personal data processed by us, Adem Emre İlhan, and the types of personal data falling within these categories are set out below.

Identity Data	such as first name, last name, date of birth, nationality, gender, identification document details (e.g. ID or passport number, issuing authority and period of validity), signature
Contact Data	such as mobile and landline telephone numbers, residential/postal address, e-mail address
Financial and Transaction Data	such as bank account and IBAN details, chosen payment method, transaction records, invoicing and billing information
Special Categories of Personal Data	(Health Data) such as medical history and clinical information (including previous operations or procedures, blood group, skin type, allergies, medication currently used, pregnancy status, smoking habits and similar health-related information)
Image and Audio-visual Data	such as photographs and video recordings relating to you (for example those taken in connection with your medical record and treatment)
Physical Access and Security Data	such as closed-circuit television (CCTV) footage recorded at our premises

Method of Collection of Your Personal Data

Your personal data are collected, whether directly from you or indirectly, in written, oral or electronic form and in both physical and virtual environments. This includes, in particular, information obtained through forms you complete, statements you make to us, notifications you submit via electronic channels, as well as through camera systems and digital recording systems, by automated and non-automated means. Your personal data may be created and updated for as long as your relationship with Adem Emre İlhan continues and may be processed and stored in both electronic and physical filing systems.

Purposes and Legal Bases for Processing Your Personal Data

The personal data we collect may be processed by Adem Emre İlhan for the purposes set out below, in accordance with the fundamental principles laid down in the European Union General Data Protection Regulation (“GDPR”) and on the legal bases set out in Article 6 GDPR, as well as, in the case of special categories of personal data, the exceptions provided for in Article 9 GDPR.

1) Processing activities based on your explicit consent

The following processing activities will only be carried out on the basis of your explicit consent in accordance with Article 6(1)(a) GDPR (and, where special categories of personal data are involved, Article 9(2)(a) GDPR). You are under no obligation to give this consent and refusing to do so will not in any way affect your ability to receive healthcare services from Adem Emre İlhan.

• Using your contact details to send you information messages (such as SMS, e-mails and telephone calls) about the services provided by Adem Emre İlhan and practical matters relating to those services, in line with applicable rules on electronic communications,

• Keeping you informed about new service options, procedures and applications offered by us,

• Inviting you to information sessions, meetings and other events organised by Adem Emre İlhan,

• Providing you, where appropriate, with tailored information and suggestions regarding our services in line with your stated preferences and interests,

• Planning and managing our information and communication activities in relation to such services and events.

Medical photographs and video recordings taken in the course of providing healthcare services are processed for the purposes of planning your diagnosis and treatment, creating and maintaining your medical records/file and providing and managing healthcare services. Such processing is carried out by healthcare professionals and authorised personnel who are subject to professional secrecy, on the basis of Articles 6(1)(b) and/or 6(1)(c) and 9(2)(h) of the General Data Protection Regulation (“GDPR”) and, where applicable, the relevant national health legislation, without relying on your consent. These images are not used for purposes other than the aforementioned medical purposes and, in particular, are not used for advertising or promotional activities.

2) Processing necessary for the performance of a contract

To the extent that the processing of your personal data is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract, within the meaning of Article 6(1)(b) GDPR, your personal data are processed for the following purposes:

• Providing the services you have requested and designing and implementing an individualised treatment or service plan,

• Managing appointments and maintaining records of interactions and communications with patients/clients,

• Enabling you to benefit from the services offered by Adem Emre İlhan in accordance with the agreed terms.

3) Processing necessary for compliance with a legal obligation;

To the extent that the processing of your personal data is necessary for compliance with a legal obligation to which we are subject, within the meaning of Article 6(1)(c) GDPR (and, where special categories of personal data are concerned, Article 9(2)(h) and/or 9(2)(i) GDPR together with applicable health and safety legislation), your personal data are processed for the following purposes:

• Keeping financial and accounting records and issuing invoices in accordance with tax and accounting laws,

• Implementing and documenting occupational health and safety and hygiene measures as required by applicable legislation,

• Providing information and reports to competent public authorities and regulatory bodies where this is required by law.

4) Processing necessary for the establishment, exercise or defence of legal claims;

To the extent that the processing of your personal data is necessary for the establishment, exercise or defence of legal claims, within the meaning of Article 9(2)(f) GDPR and, where applicable, Article 6(1)(f) GDPR, your personal data are processed for the following purposes:

• Using relevant records and information as evidence in connection with potential or actual disputes,

• Providing information in response to requests and queries made by data subjects concerning their personal data,

• Handling and responding to complaints, feedback and other communications submitted by data subjects in relation to the services provided or the processing of their personal data

5) Processing based on our legitimate interests:

To the extent that the processing of your personal data is necessary for the purposes of the legitimate interests pursued by the data controller, within the meaning of Article 6(1)(f) GDPR, and provided that such interests are not overridden by your interests or fundamental rights and freedoms, your personal data are processed for the following purposes:

• Ensuring the security and integrity of our premises and facilities, including by means of CCTV and other physical access and security measures

6) Special categories of personal data;

Your personal health data, as special categories of personal data within the meaning of the GDPR, are processed, in accordance with Article 9(2)(h) GDPR (and, where applicable, Article 9(2)(i) GDPR, together with Article 6(1)(b) and/or 6(1)(c) GDPR and relevant national health legislation), for the purposes of:

• protecting public health,

• preventive or occupational medicine,

• medical diagnosis,

• the provision of health care or treatment, and

• the management of health-care systems and services, including planning and financing of such services.

Such processing is carried out by health professionals and other persons who are subject to an obligation of professional secrecy or by persons who are under an equivalent obligation of confidentiality under Union or Member State law or rules established by national competent bodies.

Recipients of Your Personal Data

Your personal data may, in accordance with the fundamental principles set out in the European Union General Data Protection Regulation (“GDPR”) and on the legal bases provided for in Article 6 GDPR and, in the case of special categories of personal data, the exceptions provided for in Article 9 GDPR, be disclosed by Adem Emre İlhan to the following categories of recipients, strictly for the purposes described in this Information Notice and only to the extent necessary; the business partners and, where applicable, shareholders of Adem Emre İlhan; third-party service providers and other parties engaged by us to support the operation of our activities and the provision of our services (including, where relevant, IT, hosting, cloud, archiving and similar technical service providers); suppliers, service providers and/or subcontractors involved in the performance and administration of our services and internal processes; competent public authorities, regulatory bodies and other official institutions where required under applicable law; natural or legal persons under private law (such as other healthcare providers, laboratories or institutions involved in your treatment, where applicable); lawyers and law firms for the purposes of establishing, exercising or defending legal claims; accountants, tax advisers and other financial professionals for the purposes of carrying out accounting, tax and financial processes and fulfilling related legal obligations.

Data Processing and Retention Period

Your personal data are processed and retained, for the purposes set out in this Information Notice only, in accordance with the General Data Protection Regulation (“GDPR”) and, where applicable, the relevant national legislation, for as long as is necessary for the purposes for which they are processed and/or for the periods required under applicable law. When determining the appropriate retention period, we take into account in particular: the provisions of the GDPR, the health, tax, consumer and commercial laws of the relevant country, mandatory archiving obligations, contractual and statutory limitation periods, and the continued necessity of the processing in light of its purposes. Once these periods have expired or the relevant processing purposes no longer apply, your personal data are deleted, destroyed or anonymised in accordance with the GDPR. In this context; CCTV recordings are, as a rule, retained for a maximum period of 1 month for the purpose of ensuring the security of our physical premises; other personal data are, as a rule, retained for a maximum period of 10 years from the time the relevant processing purpose ceases to apply, unless a longer retention period is required under applicable legislation or is necessary for the resolution of potential legal or administrative disputes. If the legal rules governing data retention periods change, the updated statutory periods will apply.

Data Subject Rights and How to Exercise Them

Your rights as a data subject

As a data subject, you have the following rights in relation to the processing of your personal data under the European Union General Data Protection Regulation (“GDPR”):

• The right to be informed whether your personal data are being processed and, where that is the case, the right of access to such personal data (Article 15 GDPR),

• The right to rectification of inaccurate or incomplete personal data concerning you (Article 16 GDPR),

• The right to erasure (“right to be forgotten”) of your personal data in circumstances where, in particular, the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, you withdraw your consent where the processing is based on consent, or your personal data have been unlawfully processed (Article 17 GDPR),

• The right to restriction of processing in certain circumstances (Article 18 GDPR),

• The right to data portability, i.e. the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and to have those data transmitted to another controller where technically feasible (Article 20 GDPR),

• The right to object to the processing of your personal data where such processing is based on our legitimate interests within the meaning of Article 6(1)(f) GDPR, as well as the unconditional right to object at any time to the processing of your personal data for direct marketing purposes (Article 21 GDPR),

• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, and the right to obtain human intervention, to express your point of view and to contest the decision (Article 22 GDPR),

• Where the processing is based on your consent, the right to withdraw your consent at any time (such withdrawal will not affect the lawfulness of processing based on consent before its withdrawal),

• The right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

Exercising your rights

If you wish to exercise any of the rights listed above, you may submit your request to Adem Emre İlhan:

• by delivering or sending a signed written request by post to the following address:
  ****************, or

• by contacting us via the e-mail address and/or other contact channels indicated in this Information Notice.

To enable us to process your request properly and in a timely manner, your request should include at least; your name and surname, contact details through which we can reach you (postal address and/or e-mail address, telephone number), and a description of the right you wish to exercise and the content of your request. Where necessary, we may ask you to provide additional information or documentation in order to verify your identity.

If a request is made on behalf of a data subject by a third party, that person must provide written proof of authority or a power of attorney demonstrating that they are authorised to act on behalf of the data subject.

In accordance with Article 12 GDPR, Adem Emre İlhan will respond to your request without undue delay and in any event within one month of receipt of the request. That period may be extended by a further two months where necessary, taking into account the complexity and number of the requests; in such a case, you will be informed of any extension and the reasons for the delay.

Your requests will, as a rule, be handled free of charge. However, where your request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or we may refuse to act on the request in such circumstances, in accordance with the GDPR.

CONTACT DETAILS

Name / Title : ADEM EMRE İLHAN
Tax Identification Number : ……………
Telephone Number : ……………
Postal Address : ……………
E-mail Address : ……………

This Information Notice was provided to the data subject on … / … / 2025.

Name / Surname

Signature