KVKK Disclosure Notice

This disclosure notice has been prepared in accordance with Article 10 of Law No. 6698 (Turkish Personal Data Protection Law — KVKK).

Data Controller

• ·Data controller: Muhammet Sadıç
• ·Address: Levazım Mah. Koru Sk. No:2 Floor 18, Zorlu Center, 34340 Beşiktaş/Istanbul, Türkiye
• ·Email: [email protected]
• ·Phone: +90 554 025 62 12

Types of Data That May Be Processed

• ·Identity information
• ·Contact information
• ·Enquiry and request data
• ·Transaction-security data
• ·Cookie and usage data
• ·Account data: email address; name and profile picture when signing in with Google
• ·Comment data: display name, comment text, the page commented on and, if signed in, the user ID
• ·Initial assessment form data: city, district, patient age group, main need/concern, mobility, surgery/diagnosis notes, phone, contact preference, the time of explicit consent and the accepted text version (the form does not ask for a name)
• ·Special categories of personal data: health information shared in the main need/concern, mobility and surgery/diagnosis notes fields

Processing Purposes and Legal Grounds

Personal data may be processed for the purposes of communication, enquiry handling, service planning, security, user-experience improvement and fulfilment of legal obligations, based on the legal grounds appropriate to each specific processing activity.

Personal data is collected electronically through the website's form, sign-in and comment areas and through cookies.

• ·Contact and request data (phone, contact preference, city, district, age group): to assess your request and contact you; KVKK Art. 5/2-c (directly related to establishing the requested service contract) and Art. 5/2-f (legitimate interests of the data controller).
• ·Account and comment data: to let you sign in and to publish your comments; KVKK Art. 5/2-c and Art. 5/2-f.
• ·Health information: to assess the initial assessment request. This information is a special category of personal data under KVKK Art. 6. The legal ground is explicit consent (Art. 6/3-a); consent is given through the mandatory box on the initial assessment form, and the statement is on the KVKK Explicit Consent page. The form cannot be sent until this box is ticked. The same box also covers consent to the transfer of your contact information. The mobility and surgery/diagnosis notes fields are optional; if you do not want to write your health information on the form, you can call us by phone.

Recipients of Personal Data

Personal data is transferred to the providers below for the stated purposes.

Transfers Abroad

Transfers to the providers in the table are treated as transfers abroad under Article 9 of the KVKK; this includes the server and backups in the European Union.

• ·The data held in the European Union is the primary database and the encrypted backups; the temporary copy of old form records, comments and account details described below is not part of this.
• ·Website traffic passes through Cloudflare and connection encryption ends at Cloudflare; form content and other traffic may therefore be processed outside the European Union.
• ·After the November 2026 change, the age group, main need/concern, mobility, district and surgery/diagnosis notes are not included in notification messages and are not sent to Resend, Microsoft or Telegram. This information is kept in the database and its encrypted backups; the operator reads it on a sign-in protected admin page that only the authorised account can open. It passes through Cloudflare between you and the server and between the server and the operator, and may be visible at Cloudflare during transmission.
• ·The city, phone and contact preference in notification messages are personal data and are transferred abroad together with the admin page link; message copies may be stored permanently by Resend, Microsoft and Telegram outside the European Union.
• ·Notifications sent before the November 2026 change also contained the age group, main need, mobility, district and diagnosis note; these copies may remain with the providers until they are deleted.
• ·Form records, comments and account details created before the November 2026 server migration are kept for at most 30 days after the migration in Supabase's database in Sydney (Australia) for rollback, and are then deleted.
• ·Possible risks: in the countries of transfer, data protection rules, public authorities' access to data and the remedies available to data subjects may differ from those in Türkiye. The KVKK Retention and Destruction page explains how these copies are handled in deletion requests.

Data-Subject Rights

Data subjects may exercise the rights set out in Article 11 of the KVKK, including access, rectification, erasure/destruction, learning the third parties to whom data is transferred, objection and compensation.