This notice explains how Op. Dr. Erdal Erkoç (EE Clinic) processes personal data when you visit erdalerkoc.com or contact us by WhatsApp, phone, e-mail or Instagram. It is written to meet the Turkish Personal Data Protection Law No. 6698 (KVKK) and, for visitors from the European Economic Area, the United Kingdom and Switzerland, the General Data Protection Regulation (GDPR).
Last updated: 23 September 2026.
1. Who is responsible for your data
The data controller is Op. Dr. Erdal Erkoç, ENT and rhinoplasty surgeon, trading as EE Clinic.
- Address: Acıbadem Mah. Derin Sok. No:8, B2 Blok D:60, Akasya AVM Kent Etabı, Üsküdar, Istanbul, Türkiye
- E-mail: info@erdalerkoc.com
- Phone and WhatsApp: +90 533 712 27 89
2. What this notice covers
This notice covers the website erdalerkoc.com and the channels you use to contact us for the first time (WhatsApp, phone, e-mail, Instagram). Medical records created when you are examined or operated on at the clinic or at the hospital are governed by Turkish healthcare legislation and by the patient information and consent forms you sign in person. Those forms are separate from this notice.
3. What we process, why, and on which legal basis
3.1 Visiting the website
When you open a page, technical data is recorded automatically: your IP address, browser and device type, date and time, the pages you view and the page that referred you. This data is held in the server logs of our hosting provider and by Cloudflare, which protects the site against attacks and speeds up delivery.
Purpose: displaying the site correctly, security, detecting errors and abuse. Legal basis: our legitimate interest in running a secure website (KVKK Art. 5/2(f); GDPR Art. 6(1)(f)).
3.2 Visit statistics
We use two tools to understand which pages are read and how the site is found:
- Burst Statistics runs on our own server. It does not share data with third parties, works without cookies and stores the IP address only in shortened, anonymised form.
- Google Analytics 4 (Google Ireland Ltd.) is loaded only if you allow “Analytics” cookies in the cookie banner. Google may process the data on servers in the United States. IP addresses are anonymised by Google Analytics 4 by default.
Purpose: measuring reach and improving content. Legal basis: your consent given in the cookie banner (KVKK Art. 5/1; GDPR Art. 6(1)(a)). You can withdraw consent at any time (see section 4).
3.3 Contacting us by WhatsApp, phone or e-mail
When you write or call, we process your name, phone number or e-mail address, the content of your message and anything you choose to attach, such as photographs of your nose, previous surgery reports or information about your health.
Purpose: answering your questions, giving a preliminary assessment, planning a consultation or a surgery date, and sending you the information you request (for example the travel guide or a quotation).
Legal basis: taking steps at your request before a contract (KVKK Art. 5/2(c); GDPR Art. 6(1)(b)). Photographs of your face and information about your health are special categories of data. We process them only with your explicit consent (KVKK Art. 6; GDPR Art. 9(2)(a)). By sending such material you consent to its use for the assessment you asked for. You can withdraw that consent at any time by writing to us; we will then delete the material unless the law requires us to keep it. Please send only what is needed for the assessment.
WhatsApp is operated by WhatsApp LLC and Meta Platforms. Messages are end-to-end encrypted, but Meta processes connection data (for example your phone number and the time of the message) on servers outside Türkiye and the European Economic Area, under Meta’s own privacy policy. If you prefer not to use WhatsApp, you can reach us by e-mail or phone.
3.4 Map on the clinic page
The clinic page embeds a map from Google Maps. When the page loads, your browser connects to Google, which receives your IP address and may set its own cookies. Legal basis: our legitimate interest in showing you where the clinic is (GDPR Art. 6(1)(f)); you can instead open the address in a map application of your choice.
3.5 Social media
Links to our Instagram account take you to Meta’s platform, where Meta’s privacy policy applies. We do not receive personal data from Instagram unless you write to us there.
3.6 What we do not do
The website has no user accounts, no comment function and no newsletter. We do not sell personal data and we do not use it for automated decision-making. We do not publish patient photographs without written consent.
4. Cookies
Cookies are small text files stored in your browser. When you first visit, a banner asks which categories you allow. Strictly necessary cookies are set without consent; all others only after you allow them.
| Cookie | Set by | Purpose | Duration | Category |
|---|---|---|---|---|
| __cf_bm | Cloudflare | Distinguishes real visitors from automated traffic | 30 minutes | Necessary |
| mfnConsent | erdalerkoc.com | Remembers your cookie choices | 12 months | Necessary |
| _ga, _ga_* | Google Analytics | Visit statistics | Up to 2 years | Analytics |
To change your choice, delete the site’s cookies in your browser settings or clear the site data; the banner will then appear again. You can also block cookies entirely in your browser, in which case some functions may not work.
5. Who receives your data
We share personal data only with service providers that we need to run the website and to communicate with you, and only to the extent necessary:
- GoDaddy (website hosting)
- Cloudflare Inc. (security and content delivery network)
- Google Ireland Ltd. and Google LLC (Analytics, Maps)
- Meta Platforms (WhatsApp, Instagram)
- Our e-mail service provider
Some of these providers process data outside Türkiye and outside the European Economic Area, mainly in the United States. Under KVKK Art. 9 such transfers rest on your explicit consent, which you give when you allow the related cookies or contact us through WhatsApp. For visitors covered by the GDPR, transfers rest on the EU standard contractual clauses or on the provider’s certification under the EU-US Data Privacy Framework.
We also disclose data when a law, a court or a public authority requires it.
6. How long we keep your data
- Server and security logs: a short period, normally no longer than 90 days.
- Statistics: Google Analytics data for 14 months; Burst Statistics keeps only aggregated, anonymous figures.
- Enquiries by WhatsApp, e-mail or phone that do not lead to treatment: deleted or anonymised no later than 2 years after the last contact.
- If you become a patient, your file is kept for the period required by Turkish healthcare legislation and then destroyed.
- Your cookie choice: 12 months.
7. Your rights
Under KVKK Art. 11 you have the right to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether the data is used for that purpose,
- know the third parties in Türkiye or abroad to whom the data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction of the data when the reasons for processing no longer exist,
- request that corrections and deletions are notified to the third parties who received the data,
- object to a result that is to your detriment and was produced solely by automated analysis,
- claim compensation if you suffer damage because of unlawful processing.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection, the right to withdraw consent at any time without affecting earlier processing, and the right to lodge a complaint with a supervisory authority. In Türkiye the authority is the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr); in the EEA it is the authority of the country where you live.
To exercise your rights, write to info@erdalerkoc.com with the subject “Data protection request”, or send a signed letter to the address in section 1. Under Turkish law an application must be made in writing, by registered electronic mail (KEP), with a secure electronic signature, or from an e-mail address you have previously notified to us. We answer as soon as possible and at the latest within 30 days (KVKK Art. 13; GDPR Art. 12).
8. Security
The site is served over HTTPS. Access to the administration area is restricted and protected, software is kept up to date, and Cloudflare filters malicious traffic. Everyone who works with patient information is bound by professional and medical secrecy.
9. Children
Our services are intended for adults. Rhinoplasty for people under 18 is considered only with the consent of a parent or legal guardian, and we do not knowingly collect children’s data through the website.
10. Changes to this notice
We update this notice when our tools or legal obligations change. The date at the top shows the current version.