Privacy

Contents

1. Controller & Contact
2. What Data We Collect
3. How We Use Your Data
4. Legal Basis for Processing
5. Medical Data (Special Category)
6. Cookies & Tracking
7. Third-Party Services
8. Data Retention
9. International Data Transfers
10. Your Rights (GDPR)
11. Children’s Privacy
12. Changes to This Policy
    

Important: This website is operated by a medical professional offering bariatric and metabolic surgery services. We handle sensitive health information and take your privacy very seriously. This policy explains clearly what data we collect, why, and how it is protected.

1. Controller & Contact

The data controller responsible for this website is:

• Name: Op. Dr. Volkan Arayıcı
• Clinic Address: Yelki Mahallesi 2482 Sokak No:2 Daire:4, Güzelbahçe/İzmir, Turkey
• Email: info@volkanarayici.com
• Phone / WhatsApp: +90 532 466 67 67
• Website: https://volkanarayici.com

For all privacy-related inquiries, please contact us using the details above.

2. What Data We Collect

We collect the following categories of personal data, depending on how you interact with our website:

a) Data you provide directly

• Full name
• Email address
• WhatsApp / mobile phone number
• Health-related information you voluntarily share (e.g., weight, BMI, medical history) when requesting a consultation
• Questions or messages you submit via the contact form

b) Data collected automatically

• IP address and approximate geographic location
• Browser type, device type, and operating system
• Pages visited, time spent on site, and referring URLs
• Cookie identifiers (see Section 6)

c) Data from WhatsApp communication

When you contact us via WhatsApp, your messages, phone number, and any information you share are processed by WhatsApp (Meta Platforms). Please also review WhatsApp’s own privacy policy. WhatsApp communication should not be used for urgent medical emergencies.

3. How We Use Your Data

We use your personal data for the following purposes:

• Medical consultation: To evaluate your eligibility for bariatric procedures and provide pre-operative advice
• Appointment scheduling: To book, confirm, and manage consultation and surgery appointments
• Patient communication: To respond to your enquiries via email, phone, or WhatsApp
• Post-operative care: To provide follow-up guidance and support after surgery
• Website improvement: To analyse site traffic and optimise content (using anonymised or aggregated data)
• Legal obligations: To comply with applicable Turkish and EU medical record-keeping requirements

We do not use your data for automated decision-making or profiling that produces significant effects on you.

4. Legal Basis for Processing

Where the EU General Data Protection Regulation (GDPR) applies — including for visitors from EU/EEA countries, the United Kingdom, and Switzerland — we rely on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): When you submit the contact form or voluntarily provide health information for a consultation
• Contract (Art. 6(1)(b) GDPR): When processing is necessary to carry out pre-contractual steps or a treatment agreement
• Legal obligation (Art. 6(1)(c) GDPR): Where we are required by law to retain medical or financial records
• Legitimate interests (Art. 6(1)(f) GDPR): For website security, fraud prevention, and general site analytics

5. Medical Data (Special Category)

Health data is treated with the highest level of protection. Under GDPR Art. 9, health information is a “special category” requiring explicit consent and strict safeguards.

Any health-related information you share — such as your weight, BMI, medical history, or current medications — is processed exclusively for the purpose of medical consultation and treatment planning. This data is:

• Accessed only by Dr. Arayıcı and directly involved clinical staff
• Never sold or shared with third parties for commercial purposes
• Stored securely and separately from general contact information
• Retained only for as long as required by medical or legal standards

Our legal basis for processing health data is your explicit consent (Art. 9(2)(a) GDPR) and, where a treatment relationship is established, medical necessity (Art. 9(2)(h) GDPR).

6. Cookies & Tracking

Our website uses cookies — small text files stored on your device. We use the following types:

• Strictly necessary cookies: Required for the website to function (e.g., session management). These cannot be disabled.
• Analytics cookies: We may use tools such as Google Analytics to understand how visitors use our site. This data is anonymised where possible. For visitors in the EU/EEA, UK, and similar jurisdictions, analytics cookies are only placed after you provide your consent.
• Marketing cookies: If used, these allow us to display relevant content across platforms. We will request your consent before placing such cookies.

You can manage or withdraw cookie consent at any time via your browser settings or any cookie consent tool displayed on our site. Blocking certain cookies may affect site functionality.

7. Third-Party Services

We use the following third-party services that may process your data:

• Google Analytics / Google Tag Manager: Website usage analytics (Google LLC, USA)
• WhatsApp (Meta): Direct patient communication (Meta Platforms, USA)
• YouTube: Embedded videos on our site (Google LLC, USA)
• WordPress / WP Rocket: Website platform, caching, and performance optimisation tools

Each of these providers has its own privacy policy. Where data is transferred to the USA, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards as permitted under GDPR Chapter V.

8. Data Retention

We retain your personal data only as long as necessary:

• Contact form enquiries: Up to 2 years from last contact, unless a treatment relationship is established
• Patient medical records: Retained for the period required under applicable Turkish medical and healthcare regulations, including Law No. 3359, and any other applicable legal or professional obligations.
• Analytics data: Up to 26 months (Google Analytics default, may be configured shorter)
• Financial/invoicing records: As required by Turkish tax law (generally 5–10 years)

After the applicable retention period, data is securely deleted or anonymised.

9. International Data Transfers

Our clinic is located in Turkey, which is not currently recognised by the European Commission as having an adequate level of data protection. When we receive data from EU/EEA residents, we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs) with data processors
• Your explicit informed consent where required
• Technical and organisational security measures (encryption, access controls)

You may request a copy of applicable transfer safeguards by contacting us.

10. Your Rights (GDPR)

If you are located in the EU/EEA or the UK, you have the following rights under the GDPR:

• Right of access (Art. 15): Request a copy of all personal data we hold about you
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): Request deletion of your data (“right to be forgotten”), subject to legal retention obligations
• Right to restriction (Art. 18): Request that we limit how we use your data
• Right to portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: Withdraw any previously given consent at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at info@volkanarayici.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority or supervisory authority in your country of residence.

11. Children’s Privacy

Our services are intended for adults. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has submitted data to us, please contact us immediately and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be published on this page with a revised “Last updated” date. For significant changes, we will take reasonable steps to notify you (e.g., via email or a prominent website notice).

We encourage you to review this policy periodically.

Privacy Questions?

If you have any questions about this Privacy Policy or how we handle your data, please reach out to us directly:

📧 info@volkanarayici.com 

📞 +90 532 466 67 67

🌐 volkanarayici.com/kontakt

Privacy Policy – Op. Dr. Volkan Arayıcı  |  Last updated: May 2026