Personal Data Notice

Data controller

This notice is provided by Umut Zereyak, an individual taxpayer operating under the Dr Umut Zereyak Clinic brand, under Article 10 of Turkish Law No. 6698. It is an information notice, not a consent form.

• Service provider: Umut Zereyak
• Brand: Dr Umut Zereyak Clinic
• Tax office: Erenköy
• Tax number: 9980512598
• Address: Caddebostan Mah. Kantarcı Rıza Sk. No:1, İç Kapı No:4, Kadıköy/İstanbul, Türkiye
• Clinic / appointments: +90 505 115 7001
• Coordinator · WhatsApp: +90 505 115 7010
• Email: doctoruz34@gmail.com
• Alternative email: umut@zereyak.com

Data, purposes and legal bases

Name, contact, appointment and order information is processed to establish and perform the contract under Article 5/2-c. Billing and financial records rely on legal obligations under Article 5/2-ç; disputes and request records on the establishment, exercise or defence of rights under Article 5/2-e. Security logs may rely on necessary legitimate interests under Article 5/2-f where fundamental rights are not harmed.

Health history, medical documents and assessment photographs provided by the patient are processed for healthcare by persons under a duty of confidentiality or authorised bodies when Article 6/3-e conditions are met. Optional contact-form photographs require separate explicit consent under Article 6/3-a. Sending photographs is not a condition of the service, and this consent does not authorise advertising or social media use.

How data is collected

Data is collected electronically or through physical means forming part of a filing system, via website contact and purchase forms, optional photograph uploads, email, telephone, the coordinator's WhatsApp, Google Meet and payment records.

Card details are sent directly to the bank's payment system. Card numbers and CVV are neither received nor stored by the application server. The bank's own data processing information also applies.

Recipients and transfers

Necessary data may be shared, for the relevant purpose and under Article 8, with authorised doctors and staff, banks and accounting providers, hosting and communication providers, legally authorised public bodies and legal advisers protecting rights. Health-data access remains limited by duties and the relevant special-category processing conditions.

Using external platforms such as Google Meet and WhatsApp may involve transfers abroad. The requirements of Article 9 of Law No. 6698 must be met separately before a relevant transfer. The personal data notice, general contract acceptance and an early-service request do not constitute blanket consent to international transfers.

Retention and security

Records are kept only as long as required for the purpose and applicable legal obligations. When those grounds cease, data is deleted, destroyed or anonymised as appropriate. Access to health data is restricted by role and the applicable conditions for special-category data.

Contact photographs and the related consent record are encrypted in private storage and accessible only through an authorised administrator session. They are not placed in public media. Notification emails contain neither photographs nor the message body. You can check that your face is not visible before uploading; the system does not automatically conceal faces.

Your rights and applications

Under Article 11, you may ask whether your data is processed, request information about the purpose and proper use, learn the recipients, seek correction of incomplete or inaccurate data, request deletion or destruction where statutory conditions apply and notification of those actions to recipients. You may object to an adverse result based exclusively on automated analysis and seek compensation for unlawful processing.

Apply in writing to the address above or through other legally permitted methods. Email applications must meet the applicable registered-email and identity-verification requirements. Applications are answered as soon as possible and within thirty days; fees may apply only where legislation permits. Recording that this notice was presented does not constitute explicit consent.