This text is a template. Please have it reviewed by your legal adviser and adapted to your practice before publishing. In case of any discrepancy, the Turkish version prevails.

Last updated: 15.10.2026

This Privacy Notice has been prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK” or the “Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to inform our clients, people who request an appointment and visitors to our website about how their personal data is processed.

1. Data Controller

Your personal data is processed by Podologist Aysu Şen (the “Data Controller”) in the capacity of data controller, as described below.

Data controller: Podologist Aysu Şen
Address: Atatürk Mahallesi, Atapark Caddesi, Atapark Konutları C3 Blok Daire: 2, Ataşehir / Istanbul, Türkiye
Email: podologaysusen@gmail.com
Phone: +90 530 617 10 03

2. Categories of Personal Data Processed

Identity data: First name, surname, date of birth or age.
Contact data: Phone number, email address and, where necessary, postal address.
Appointment and client transaction data: Appointment date and time, the service requested, appointment history, and the content of messages and requests sent via the web form, WhatsApp, email or phone.
Special categories of personal data (health data): Foot-related complaints, information on long-term conditions such as diabetes, statements about medication and allergies, pregnancy status, podological assessment and care notes, and photographs of the feet taken only with your explicit consent and for follow-up purposes.
Financial data: Information relating to payment for services and invoicing.
Transaction security data: Server logs such as IP address, browser and device information, and the date and time of visits.
Cookie data: Data obtained through strictly necessary cookies and, where you consent, preference and analytics cookies. Details are set out in the Cookie Policy.

3. Purposes of Processing

Your personal data is processed for the following purposes, in a manner that is relevant, limited and proportionate to them:

Receiving, scheduling, confirming and, where needed, reminding you of appointment requests;
Carrying out podological assessment, foot care procedures and follow-up;
Creating a personalised care plan and taking your health status into account so that procedures can be performed safely;
Advising you to see an appropriate physician where necessary;
Responding to your questions, requests and complaints and communicating with you;
Collecting payments, invoicing and keeping financial records;
Complying with legal obligations and responding to requests from competent authorities;
Keeping the website secure, maintaining its technical operation and preventing misuse;
Establishing, exercising and protecting legal rights in the event of a dispute.

4. Legal Grounds for Processing

4.1. General personal data

Your identity, contact, appointment and client transaction, financial, transaction security and strictly necessary cookie data are processed on the following legal grounds set out in Article 5(2) of the KVKK:

Processing is necessary for the conclusion or performance of a contract, provided that it directly relates to that contract (Art. 5(2)(c));
Processing is necessary for the Data Controller to comply with a legal obligation (Art. 5(2)(ç));
Processing is necessary for the establishment, exercise or protection of a right (Art. 5(2)(e));
Processing is necessary for the legitimate interests of the Data Controller, provided that it does not harm your fundamental rights and freedoms (Art. 5(2)(f)).

For non-essential cookies and any processing not covered by the grounds above, your explicit consent (Art. 5(1)) is obtained.

4.2. Health data

Health data is a special category of personal data under Article 6 of the KVKK and is processed only where one of the conditions set out in the Law is met, with the adequate measures determined by the Personal Data Protection Board in place. Under Article 6(3) of the KVKK, your health data is processed on legal grounds such as your explicit consent or, in the cases provided for by the relevant legislation, where processing is necessary for the provision of care services by persons under a duty of confidentiality.

Given the nature of podological care, your explicit consent is additionally obtained for the processing of your health data. Details are set out in the Explicit Consent Statement. You may withdraw your consent at any time; withdrawal takes effect for the future.

5. Transfer of Personal Data

To the extent necessary for the purposes above and in line with Articles 8 and 9 of the KVKK, your personal data may be transferred to the following recipient groups:

Competent public authorities and judicial bodies: To comply with legal obligations and requests from competent authorities.
Advisers: Professional advisers bound by confidentiality, such as a certified accountant or lawyer, to the extent required.
Service providers: Technical infrastructure providers such as website hosting, email services, messaging (WhatsApp – Meta Platforms) and mapping services (Google Maps).
Physicians: Only at your request and with your explicit consent, to share information with a physician you are referred to.

Transfers abroad

Because the servers of WhatsApp, email, mapping and hosting providers may be located outside Türkiye, using these services may result in your personal data being transferred abroad. Such transfers take place in accordance with Article 9 of the KVKK: where there is an adequacy decision, where one of the appropriate safeguards (such as standard contractual clauses) is in place, or where one of the occasional transfer exceptions listed in the Law (including your explicit consent) applies. Please note that if you choose to contact us via WhatsApp, your messages will be processed on Meta Platforms’ infrastructure; you may prefer to contact us by phone or in person instead.

6. Method of Collection

Your personal data is collected by partly automated and non-automated means through the contact and appointment forms on the website, WhatsApp, phone calls, email, face-to-face meetings and client information forms, as well as through cookies and server logs on the website.

7. Retention Periods

Your personal data is kept for as long as necessary for the purposes for which it is processed and for the retention and limitation periods set out in the relevant legislation. For example, financial records are kept for the periods required by tax legislation, while client records and care notes are kept for as long as necessary to continue providing care and to protect rights against potential legal claims. Requests that do not lead to an appointment are deleted within a reasonable time once the purpose no longer applies.

When the retention period ends, your personal data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

8. Your Rights (Article 11 of the KVKK)

Under Article 11 of the KVKK, you have the right to apply to the Data Controller to:

Learn whether your personal data is being processed;
Request information about the processing if your personal data has been processed;
Learn the purpose of processing and whether your data is used in line with that purpose;
Know the third parties, in Türkiye or abroad, to whom your personal data is transferred;
Request correction if your personal data is incomplete or inaccurate;
Request deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
Request that any correction, deletion or destruction be notified to third parties to whom your data has been transferred;
Object to any outcome against you arising from the analysis of your data exclusively by automated systems;
Claim compensation for damage suffered as a result of unlawful processing of your personal data.

9. How to Apply

You may submit requests regarding your rights by one of the following methods, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

A signed written application delivered in person or through a notary public to: Atatürk Mahallesi, Atapark Caddesi, Atapark Konutları C3 Blok Daire: 2, Ataşehir / Istanbul;
An application signed with a secure electronic signature or mobile signature, or sent from the email address you have previously provided to us and that is registered in our records, to podologaysusen@gmail.com;
Via registered electronic mail (KEP).

Your application must include your name, surname and, for written applications, your signature; your Turkish ID number (for foreign nationals, nationality and passport number or ID number if any); your residential or business address for notification; your email address for notification if any; your phone number; and the subject of your request. Any relevant information and documents should be attached.

Your application will be concluded free of charge within 30 (thirty) days at the latest, depending on the nature of the request. If the process incurs an additional cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board. If your application is rejected, if you find the response insufficient, or if no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the KVKK.

10. Changes

This Privacy Notice may be updated in line with changes in legislation or in our data processing activities. The updated version takes effect on the date it is published on the website.

Privacy Notice under Turkish Law No. 6698