Data Protection Notice

Last updated: September 18, 2026

1. Data Controller

Your personal data are processed by Assoc. Prof. Oğuz Baran as data controller, within the limits set out below.

Email: obaran@kuh.ku.edu.tr
Address: Koç University Hospital, Davutpaşa Caddesi No:4, Topkapı, 34010 Zeytinburnu / İstanbul

2. The Nature of the Relationship Formed Through This Site

Information and imaging studies sent through this website are reviewed for the purpose of preliminary assessment. An enquiry made through the site does not create a physician–patient relationship, does not amount to diagnosis or treatment, and does not open a patient record. Diagnosis and treatment are conducted only following an examination carried out in the proper manner, within the relevant health-care institution.

3. The Personal Data Processed

Only the data you enter into the forms are processed. During your visit we collect no IP address, location, browser information or similar data; your movements on the site are not tracked.

As on every web server, the hosting provider keeps technical access logs for the purposes of security and fault detection. These logs are not accessed and are not used for any purpose.

3.1. Contact form

• Name and surname
• Email address; and, if you wish, a telephone number
• The subject and the message you write

3.2. Imaging submission form

Through this form, in addition to the above, your health data are processed: these are personal data of a special category within the meaning of KVKK art. 6. They are not stored on the server; at the moment you submit the form they are sent to the physician’s institutional email address.

• Name and surname, date of birth, sex, country and province
• Your symptoms, your questions and what you state about your treatment history
• The medical images and reports you upload

4. Purposes of Processing

• to answer your question and to contact you in accordance with your request;
• to carry out a preliminary assessment of the studies you send;
• to direct your request for an appointment to the relevant health-care institution.

Your personal data are used for no purpose beyond these. They are not processed for marketing, advertising, profiling or statistical purposes, and are on no account sold or transferred.

5. Method of Collection and Legal Basis

Your personal data are collected only if you complete the forms on this website, electronically and by automated means. No advertising, tracking or analytics cookie is used on the site; there is only the strictly necessary session cookie that allows the forms to work securely.

Your contact details are processed pursuant to KVKK art. 5/2-c and art. 5/2-f, so that your request may be met.

Two grounds exist together in respect of your health data: under KVKK art. 6/3 such data may be processed for the purpose of medical assessment by a physician bound by a duty of confidentiality, without the need for express consent; in addition, your express consent is obtained in the imaging submission form. You may withdraw that consent at any time.

The processing of health data also has regard to the provisions of Law No. 3359 on the Fundamentals of Health Services and of the Regulation on Personal Health Data.

6. Transfer

Your personal data are not shared with any third party for purposes of promotion, marketing or commerce. Only the following parties, strictly necessary for the technical provision of the service, are involved:

• Hosting provider: provides the server on which the site and the database reside; it does not access the content and acts as a data processor.
• Email infrastructure: since the message you send through the contact form is delivered by email, it passes through the mail infrastructure of the server provider and of the recipient institution.
• Competent authorities: requests from judicial and administrative authorities are met in the cases expressly provided for by law.

Your personal data are not transferred abroad.

7. Retention and Deletion

No personal or health data are stored on the server of this website. When you complete the imaging submission form, the information you provide is sent directly to the physician’s institutional email address; it is not written to the server’s database. Only the files you upload reside temporarily on the server, together with a technical record, containing no personal data, kept in order to manage them.

• Medical images and reports: permanently deleted from the server without delay and within 15 days at the latest after the physician has reviewed them.
• Contact form messages: deleted within 6 months at the latest after being answered.
• Correspondence in the physician’s institutional email account: retained within the institution’s infrastructure for the periods laid down in the relevant legislation, in accordance with obligations of medical record-keeping and of proof.

You may also request deletion before those periods expire; such a request is met without delay.

8. Data Security

• An encrypted connection (HTTPS) is used throughout the site.
• Uploaded medical files are closed to direct access; they can be viewed only from an authorized account.
• Access to the database is restricted and the administration panel is password-protected.

9. Your Rights

Under KVKK art. 11 you have the right to learn whether your data are processed; to request information if they have been; to learn the purpose of processing; to request the correction of data processed incompletely or inaccurately; to request their erasure or destruction; to request that any such action be notified to third parties; to object to a result adverse to you arising from analysis by automated systems; and to claim compensation for loss.

10. Applications

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests in the following ways:

• in writing to the address above, or through a notary;
• to obaran@kuh.ku.edu.tr, from the email address you have previously notified and which is registered in the system;
• by secure electronic signature or mobile signature.

Your application must clearly set out information establishing your identity and the nature of your request. It will be concluded free of charge within thirty days at the latest; where the process entails a separate cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

If your application is refused or goes unanswered, your right to complain to the Personal Data Protection Board is reserved.

11. Changes

This text may be updated to reflect changes in the legislation or in the operation of the site. The current text is always published on this page.