This notice explains how Prof. Dr. Mesut Gürdal processes personal data in connection with this website and appointment enquiries, under Türkiye’s Personal Data Protection Law No. 6698 (KVKK). It covers website visitors and people contacting the clinic to arrange an appointment.
1. Data controller and contact details
Prof. Dr. Mesut Gürdal
Mustafa Kemal Mah. 2079. Sokak, Via Green B Blok, Kat: 3 No: 16, Çankaya / Ankara
Email: drmesutgurdal@gmail.com
Telephone: +90 536 206 17 00
2. Data collected and collection methods
- Appointment enquiries: your full name, mobile phone number, preferred start and end dates and preferred time of day, collected through the online form and during appointment-related communications.
- Request records: a request identifier, submission time, request and notification status, and the version of the notice acknowledged. Appointment scheduling records may also include the agreed date and time.
- Website security: IP address and technical connection information handled by the hosting service. For request limits, the application creates a time-dependent hash from the IP address; it does not save the plain IP address in the appointment record.
- Data protection applications: the identity, contact and request information you provide to exercise your rights, including information needed to verify your identity.
The appointment form has no fields for a national identity number, date of birth, diagnosis, medical report or file upload. Please do not enter medical information in the name or phone fields, or send medical documents through social media messages.
3. Purposes and legal grounds
- Receiving and arranging an appointment: name, contact and scheduling details are used to assess your enquiry and call you to agree an appointment, under Article 5(2)(c), where processing is necessary and directly related to establishing or performing a contract.
- Keeping the website secure: technical records and request limits help prevent automated abuse and keep the service available, under the legitimate-interest condition in Article 5(2)(f), provided your fundamental rights and freedoms are not harmed.
- Responding to data protection requests: application and identity-verification details are processed to fulfil the controller’s legal obligations under Article 5(2)(ç).
- Establishing, exercising or protecting a right: relevant request and communication records are processed only where necessary for that purpose, under Article 5(2)(e).
Appointment details are not used for advertising or marketing. The “I have read” checkbox records acknowledgement of this notice; it is not marketing consent, consent to medical treatment, or blanket permission for data transfers. Health data is subject to the separate conditions for special-category data in Article 6; it is not requested through this form.
4. Who receives the data and why?
When online appointment requests are available, your form details are saved in the appointment database and emailed to the clinic’s two designated inboxes: info@mesutgurdal.com.tr and drmesutgurdal@gmail.com. The purpose is for the doctor or authorised clinic assistant to review your enquiry and call you to arrange an appointment. Patients are not sent an automated SMS, email or verification code.
Cloudflare provides the website hosting, database and security infrastructure. When email delivery is enabled, Cloudflare’s sending service and the receiving mail providers, including Google/Gmail, process the information needed to deliver and store the notification. Legally authorised public bodies may receive relevant records where disclosure is required by law. Form details are not published on the website or automatically sent to DoktorTakvimi or social media platforms.
5. International processing and external content
Cloudflare’s infrastructure and Google/Gmail services involve providers and systems outside Türkiye. Technical website data, and appointment notifications, can therefore involve international processing. Such transfers require the conditions in Article 9 of the Law; acknowledging this notice does not by itself establish a lawful transfer mechanism.
The online form sends your appointment enquiry to the clinic’s two email addresses listed above through Cloudflare Email Service. If you prefer not to use the online form, you can arrange an appointment by calling the clinic.
YouTube, Google Maps and DoktorTakvimi embeds load only after you choose to open them. Their providers may then receive your IP address and browser or device information, and process it abroad. External links are subject to the destination service’s own privacy terms. You can read the website without opening these services. See our Cookie and External Content Policy for details.
6. Retention and security
Retention must be limited to the time needed for the relevant purpose and any applicable legal obligations or protection of rights. Appointment enquiries are distinct from medical records and must not automatically be treated as a patient file. When the grounds for processing no longer exist, deletion, destruction or anonymisation is required under the applicable rules. The clinic must determine retention periods for both database records and notification emails; this website does not promise deletion after a fixed number of days.
The website uses encrypted HTTPS connections and server-side validation. Appointment records are not publicly accessible, and form details are not saved in the browser’s local storage. The application limits repeated requests using expiring technical records. These safeguards do not replace the clinic’s responsibility for staff access, mailbox security and data retention.
7. Your rights
Under Article 11, you may apply to the data controller to:
- Learn whether your personal data is processed and request information about that processing;
- Learn the purpose of processing and whether your data is used for that purpose;
- Learn which third parties receive your data in Türkiye or abroad;
- Request correction of incomplete or inaccurate data;
- Request erasure or destruction when the legal conditions are met, and notification of corrections or erasure to recipients;
- Object to an adverse result arising solely from automated analysis of your data;
- Seek compensation for harm caused by unlawful processing.
8. How to make a request
You can deliver a signed written request to Prof. Dr. Mesut Gürdal at the clinic address above, or send it by post. If you use an email address previously notified to the controller and recorded in its systems, you may send your request to drmesutgurdal@gmail.com. An ordinary email from an unregistered address may require additional identity verification or use of another legally recognised application method.
Include your name, surname, identification information required by the application rules, an address for the response, the subject of your request and, for written applications, your signature. Include only documents relevant to the request. Do not submit identity documents or health records through the appointment form. Requests are answered as soon as possible and no later than 30 days; any permitted processing fee is subject to the Authority’s tariff.
9. Related information
You can also read the Privacy Policy. For the statutory framework, see the Turkish Authority’s guidance on the duty to inform, applications and individual rights, and international transfers. This English text explains the same website and appointment process as the Turkish notice.