KVKK
Privacy Notice.
Who is responsible?
Under Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed by Estekip Teknoloji A.Ş. ("Estekip") as the data controller within the framework explained below.
Contact: Merkez Mah. Sanayi Cad. No: 14, 34520 Beylikdüzü / İstanbul · kvkk@estekip.com · MERSIS 0042–****–1842
Which data is processed?
The following categories of personal data may be processed through the platform:
- Identity information: First name, last name, national ID/passport, date of birth
- Contact: Email, phone, address
- Health data: Operation records, test results, photographs, consent forms (special category personal data)
- Financial: Payment method, billing address, escrow transaction history
- Transaction security: IP address, device information, session data
- Marketing preferences: Limited to consent only
For what purpose?
- Carrying out your treatment processes and communicating with the clinic
- Fulfilling legal obligations (KVKK · GDPR · health legislation)
- Payment transactions and escrow management
- Statistical analysis, anonymized reporting
- Fulfilling contractual obligations
- Security breach detection and response
To whom is it transferred?
Personal data is transferred to the following third parties only within the framework of a legal basis and explicit consent:
- The clinic (tenant) you receive service from — for carrying out operational processes
- Iyzico Payment Institution (BDDK licensed) — payment transactions
- BirFatura.com — e-invoice transmission
- AWS (Frankfurt eu-central-1) — hosting
- Health authorities — upon legal request
Cross-border transfers are made only to countries providing adequate protection and within the framework of standard contractual clauses.
What are your rights?
Under Article 11 of the KVKK, you have the following rights:
- To request access and information about your processed data
- The correction of incorrectly processed data
- A request for erasure outside the legal retention period
- The portability of data in a machine-readable format
- To object to processing for marketing purposes
For your requests: self-service ZIP export from the patient panel · or kvkk@estekip.com · response time max. 30 days (urgent data breach notification within 72 hours).