Updated: 2 October 2026
This notice concerns personal information collected through the Medical Law Türkiye website and communications with its legal team. It should be read with the Privacy Policy . A formal legal instruction can involve additional purposes and recipients specific to the matter.
The data controller for the processing described in this notice is Att. Başak Çavuşoğulları, Ofis+ Plaza, Lefkoşe Cd. No: 3, 16265 Nilüfer, Bursa, Türkiye.
For a privacy request, contact [email protected] or +90 531 933 63 16. Identify the relevant enquiry or file and the right you wish to exercise. Do not send a full medical history for an initial request. Identity verification and the legally required application method may be needed.
Information is collected directly through website forms, chat, email, telephone and messaging, and through documents supplied for review. Browser technologies generate technical and interaction information. The purposes include responding to enquiries, assessing a possible instruction, conducting agreed legal work, complying with legal duties and operating and measuring the website.
The condition for processing depends on the purpose and information involved. Under KVKK Article 5, relevant conditions can include necessary steps concerning a contract, legal obligations and establishing, exercising or protecting a right. Explicit consent may be required where another applicable condition is absent; it must be assessed separately from an acknowledgement that a notice was read.
Medical, reproductive and other special-category information requires a condition under current KVKK Article 6 and additional safeguards. Article 6 includes processing necessary to establish, exercise or protect a right as well as explicit consent and other specified conditions. Sending a message does not give unrestricted permission for every later use or transfer.
Please begin with a short description, treatment location and approximate dates. Avoid putting full medical records, intimate photographs, identity documents or genetic information in a public website form or chat. The legal team can discuss the records needed and an appropriate sharing arrangement.
Information can be processed by the service providers supporting the website and correspondence. In an instructed matter, relevant information may also need to be disclosed to the responsible lawyers, authorised staff, translators, medical experts, courts, public authorities, insurers or other necessary participants, depending on the work and legal basis.
Some providers operate internationally and may process information outside Türkiye. A lawful processing condition does not by itself establish a lawful overseas transfer. KVKK Article 9 requires the applicable transfer conditions and safeguards to be assessed separately. Where GDPR applies, its international-transfer requirements also need assessment. Provider policy links explain their practices; they do not replace the legal team’s obligations.
The period relevant to an enquiry or legal file depends on its purpose, any ongoing instruction or dispute, and applicable professional, record-keeping and legal obligations. Deletion may be restricted while information is needed for a legal obligation or the establishment, exercise or protection of a right. Ask the privacy contact about the information and retention basis relevant to your file.
Provider storage is separate from the legal team’s file. Web3Forms publishes a maximum form-submission retention period of three years, subject to its plan and deletion settings. Chat and analytics retention also depends on the relevant provider and account settings. Cookie expiry is not the same as deletion of information already transmitted to a provider.
Professional confidentiality and data-protection obligations apply to legal work. No website, email or messaging channel can guarantee absolute security. A request for access or deletion requires assessment, including the rights of other people and any obligation to retain records.
An application to the responsible controller should identify you, the processing concerned and the request, using a method that meets the applicable statutory requirements. The controller must respond as soon as possible and within the statutory maximum of 30 days. An ordinary enquiry email does not automatically satisfy every formal application requirement.
Where an application is rejected, the response is insufficient or no response is provided in time, KVKK Article 14 provides for a complaint to the Authority within 30 days of learning of the response and in any event within 60 days of the application. The controller application must be made first. Obtain advice promptly about the method and dates applicable to your request.
Living in Europe does not by itself decide the territorial scope of GDPR. Where it applies to the processing, relevant rights can include access, rectification, erasure, restriction, objection, portability where its conditions are met, and withdrawal of consent for processing based on consent. You may also complain to the competent supervisory authority. These rights can be subject to legal conditions and exceptions.