Privacy Policy

1. Data controller

This website is operated by Dr. Güler Gamze Eren, a board-certified plastic surgeon practising at Memorial and Medicana hospitals in Istanbul, Turkey. References to "we", "us", or "the clinic" in this policy refer to the clinic and its administrative team.

Dr. Güler Gamze Eren is registered with the Göztepe Tax Office, Tax No. 3530449537, and is considered the "Data Controller" under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the "Controller" under the EU General Data Protection Regulation ("GDPR").

A law firm specialising in personal data protection has been contracted as Data Protection Officer. The compliance process is carried out under the responsibility of the Data Controller with the consultancy and guidance of this firm.

Contact: info@drgamzeeren.com

2. What data we collect

We may collect the following categories of personal data, depending on how you interact with us:

• Identity information: Your name, surname, passport or ID number, date and place of birth, gender, and profession.
• Contact information: Your address, phone number (including WhatsApp), email address, IP address, and social media account details.
• Health information: Medical history, allergies, chronic conditions, previous surgeries, medications, test and imaging results, body analysis and measurement data, and any health details you share during consultations or via messaging.
• Photograph and video data: Images and videos taken before, during, or after medical procedures, including photos you send via WhatsApp or other messaging platforms for consultation purposes.
• Financial information: Bank account details, payment information, billing and invoice records.
• Transfer and accommodation information: If you are an international health tourist, your flight details, hotel accommodation, and transfer arrangements.

3. How we collect your data

Your personal data is collected through:

• The contact form on this website (www.drgamzeeren.com)
• Emails sent to our clinic addresses (info@drgamzeeren.com, asistan@drgamzeeren.com, gamze@drgamzeeren.com, clinic@drgamzeeren.com)
• Direct messages and calls via WhatsApp, Zoom, FaceTime, Skype, Messenger, Google, Instagram, Facebook, and similar platforms
• Messages and comments on our social media accounts (Instagram, YouTube, Facebook, Twitter, LinkedIn)
• Advertisements and promotional panels on social media platforms
• In-person visits, consultations, and the Patient Information and Consent Form
• Photographs and video recordings taken before, during, or after medical procedures

4. Purpose of processing

We process your personal data for the following purposes:

• Creating and managing your patient file
• Conducting examinations, medical diagnosis, treatment, and care services
• Follow-up checks after treatment or surgery
• Managing any complications that may arise
• Communicating with you directly and managing appointments
• Consulting with other specialist physicians when necessary for your treatment
• Planning transfer, accommodation, and interpreter services for international health tourists
• Fulfilling legal and contractual obligations under Turkish Health Law and International Health Tourism legislation
• Managing patient satisfaction and handling requests
• Processing payments and issuing invoices
• Sending you information about medical services and innovations, with your explicit consent
• Carrying out promotion and marketing activities within the scope of International Health Tourism Incentive legislation, with your explicit consent

5. Legal basis for processing (GDPR & KVKK)

If you are based in the European Economic Area (EEA) or are a resident of an EU country, we process your data under the following legal bases:

• Consent (GDPR Art. 6/1/a, KVKK Art. 5/1) — you give explicit consent when submitting the contact form, sending messages, or agreeing to marketing communications
• Contractual necessity (GDPR Art. 6/1/b, KVKK Art. 5/2/c) — to provide medical examination, diagnosis, treatment, and care services
• Legal obligation (GDPR Art. 6/1/c, KVKK Art. 5/2/a) — to fulfill obligations under Health Law, tax legislation, and International Health Tourism regulations
• Legitimate interest (GDPR Art. 6/1/f, KVKK Art. 5/2/f) — to manage patient satisfaction, legal processes, and follow-up communications

Health data, classified as special category personal data under GDPR Art. 9 and KVKK Art. 6, is processed for the purpose of medical diagnosis, treatment, and care by Dr. Gamze Eren, who is under a legal obligation of confidentiality (GDPR Art. 9/2/h, KVKK Art. 6/3).

6. When explicit consent is required

Your explicit consent is required for:

• Sending you promotional or informational messages about medical services via SMS, email, or mobile communication
• Sharing your photographs or video recordings on social media accounts or this website
• Transferring your data to service providers whose servers are located abroad (WhatsApp, Instagram, Google, email providers, etc.)

When you use third-party messaging or social media platforms (WhatsApp, Instagram, Zoom, etc.) to communicate with us, you accept their Privacy Policies and Cross-Border Data Transfer Principles. In these cases, your explicit consent for cross-border transfer is obtained by the service provider, not by us.

7. Data sharing and recipients

We never sell your personal data. Your data may be transferred to the following parties, subject to confidentiality agreements and appropriate technical and administrative security measures:

• Private hospitals (Memorial, Medicana) for clinical administration
• Other specialist doctors for consultation purposes
• Other doctors for scientific education and training
• Translators and interpreters
• Travel agencies, hotels, and transfer services for health tourism logistics
• Financial advisors, tax and finance consultants, and auditors
• Legal advisors and Data Protection Officer
• IT and web consultants, database/server providers, and clinic management software providers
• International promotion consultants
• Suppliers and support management system providers
• Public institutions and judicial authorities, when required by law

8. Cross-border data transfer

When you communicate with us via platforms whose servers are located abroad (WhatsApp, Instagram, Google, email providers, etc.), your personal data may be transferred outside Turkey. This constitutes a cross-border transfer under KVKK Art. 8-9 and GDPR Art. 45-49. By using these platforms to communicate with us, you accept their privacy policies and cross-border data transfer terms.

9. Data retention

We retain your personal data according to the following schedule:

• Medical records (active patients): Retained for 10 years from the date of your last treatment, in accordance with Turkish Health Law and medical record retention requirements. This includes your medical history, consultation notes, surgical records, photographs, and treatment outcomes.
• Inquiry-only data (non-patients): If you contact us but do not proceed with a consultation or treatment, your data is retained for 2 years from your last contact, then securely deleted. This includes your name, contact details, and any messages exchanged.
• Financial records: Retained for the durations required by Turkish tax legislation and commercial law.

All data is stored securely with access controls. You may request earlier deletion of your data at any time by contacting us at info@drgamzeeren.com. We will respond to your request within 30 days.

10. Age limit

Under KVKK, individuals aged 18 and over may give consent for processing of their personal data. For patients under 18, consent must be given by a legal representative.

Under GDPR, individuals aged 16 and over (or the age limit stipulated in their country of residence) may give consent in person. For patients under this age, consent must be given by a legal representative.

11. Your rights

Under GDPR (Arts. 15-21), you have the right to:

• Access the personal data we hold about you (Art. 15)
• Request correction of inaccurate or incomplete data (Art. 16)
• Request deletion of your data, the "right to be forgotten" (Art. 17)
• Request restriction of processing of your data (Art. 18)
• Receive your data in a portable format or request transfer to another controller (Art. 20)
• Object to processing based on legitimate interest, including profiling (Art. 21)
• Withdraw consent at any time (Art. 6/1/a)
• Lodge a complaint with your local data protection authority

Under KVKK (Art. 11), you have the right to:

• Learn whether your personal data is being processed
• Request information if your data has been processed
• Learn the purpose of processing and whether data is used for its intended purpose
• Know the third parties to whom your data has been transferred, domestically or abroad
• Request correction of incomplete or incorrect data
• Request deletion or destruction of your data when the reasons for processing no longer exist
• Object to automated processing that produces unfavourable results
• Request compensation for damages caused by unlawful processing

To exercise these rights, you may submit a written, signed application to our clinic address (Caddebostan Mah. Ethem Efendi Cad. No:3/9 Kadıköy/İstanbul) or send it via email to info@drgamzeeren.com. We will respond free of charge within 30 days at the latest.

12. Withdrawal of consent

If you have given explicit consent for the processing of your personal data, you may withdraw it at any time, in accordance with GDPR Art. 6/1/a and KVKK Art. 5/1. To withdraw your consent, please send a declaration to info@drgamzeeren.com.

13. Cookies

This website uses minimal cookies for essential functionality (language preference, session state). We do not use tracking or advertising cookies without your consent. A cookie consent notice is shown on your first visit.

14. Security

We take reasonable technical and organisational measures to protect your data from unauthorised access, disclosure, or loss. Data submitted through this website is transmitted securely via HTTPS.

15. Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page. Continued use of our website after changes constitutes acceptance of the updated policy.

16. Contact

Questions about this policy? Get in touch:

Dr. Güler Gamze Eren Clinic
Caddebostan Mah. Ethem Efendi Cad. No:3/9
34728 Kadıköy / İstanbul, Turkey
info@drgamzeeren.com