A.1 Your rights
Under Article 11 of the Law on the Protection of Personal Data (KVKK), in respect of your personal data you have the right:
- to learn whether they are processed
- to request information about the processing if they have been processed
- to learn the purpose of the processing and whether they are used in accordance with that purpose
- to know the third parties to whom they are transferred, in Türkiye or abroad
- to request their rectification if they have been processed incompletely or inaccurately
- to request their erasure or destruction
- to request that rectification/erasure operations be notified to the third parties to whom the data were transferred
- to object to a result arising against you through analysis exclusively by automated systems
- to claim compensation for damage suffered as a result of unlawful processing.
If you are established in the European Union, you additionally have, under the GDPR, the rights to request restriction of processing, to data portability, to withdraw your explicit consent and to lodge a complaint with the supervisory authority of your own country.
A.2 Request channels
| Channel | Address |
|---|---|
| In-platform form | /kvkk-basvuru — available only to signed-in users (authenticated session); patient and staff roles may use it |
| (to be added to this section when the e-mail channel is opened) | |
| Registered electronic mail (KEP) address | (to be notified upon incorporation of the legal entity) |
| Written request (post) | (to be notified upon incorporation of the legal entity) |
How it works: the secondary legislation under the KVKK provides that a request be made in writing, via KEP / secure electronic signature / mobile signature, or from an e-mail address previously notified to the data controller and registered in its system. The in-platform form is submitted only from your registered account, with an authenticated session; for e-mail requests, your address registered in the system is taken as the basis. A request arriving from an address other than your registered one is subject to identity confirmation.
A.3 What your request must contain
- Name, surname and, if the request is in writing, signature
- For citizens of the Republic of Türkiye, the T.C. identity number; for foreign nationals, nationality, passport or identity number (solely for identity confirmation; not retained beyond the request)
- Residential or workplace address for service of notices; e-mail and telephone if available
- Subject of the request — which right you wish to exercise; if relevant, which case/record
A.4 Response time and fee
A.4.1. Your request is concluded according to its nature as soon as possible and within thirty days at the latest. (For users established in the EU, the GDPR period is one month; for complex requests it may be extended by two months with notice.)
A.4.2. The procedure is free of charge unless it requires a separate cost; otherwise the fee in the tariff set by the Board may be charged.
A.4.3. If your request is refused, the refusal is notified with reasons.
A.5 Complaint to the Board
If your request is refused, you find the response insufficient or no response is given within the time limit, you may lodge a complaint with the Personal Data Protection Board within thirty days from the date you learn of the response and in any event within sixty days from the date of the request. If you are established in the EU, you may also apply to the supervisory authority of your own country.
A.6 Account and data deletion — from within the platform
You can exercise your right to erasure directly from the My Account page: your personal data are deleted immediately; your clinical records are closed to access for the statutory retention period and destroyed at the end of that period (Document A01, Section 8). Deletion cannot be undone; download the documents you wish to keep before deleting.
A.7 Access to and export of your records — from within the platform
You can view your clinical records on the Platform, open the categories you select via a sharing link and export them in a standard format (FHIR); you can see your access history at /erisim-kaydi and your consent records at /onam/kanit. These functions are the self-service exercise, from within the platform, of the rights in A.1; no separate request is required.