Privacy notice

What this site does not collect

There is no account, no comment section, no newsletter sign-up and no file upload. Reading the pages leaves nothing behind: data is processed only when the form on the contact page is filled in and sent, and that is the visitor’s own choice.

Nothing measures visitor behaviour: no analytics package, no heat maps, no tracking pixels, no advertising network and no social media trackers. Pages make no request to any third-party server; fonts and images are served from the site’s own address.

No server access logs are kept. Logging is switched off on both the content delivery network and the storage layer, so no record of a visit is created and none reaches the controller.

Three values stored in the browser

The site stores three values. All three stay in the visitor’s own browser, carry no identifier, and serve no measurement or advertising purpose.

• The “lang” cookie — written only when the language switch is used. Its content is “tr” or “en”, and it decides which language the root address opens in on a later visit. It lasts one year. It is sent with requests to the site and read only for that routing decision; it is not stored.
• The “theme” value — written to the browser’s local storage when a light, dark or system theme is chosen. It never leaves the browser and is never sent to a server.
• The “ok_form” cookie — written only at the moment the form is sent, so that the thank-you page can show what was submitted together with a reference number. Since no automatic reply email is sent, that page stands in for one. It lives at most ten minutes, is deleted as soon as the thank-you page has been shown, is sent only to the form addresses, and cannot be read by scripts in the browser.

Data arriving through contact channels

Personal data is processed only when someone chooses to get in touch. There are four channels: the form on the contact page, email, telephone and WhatsApp. The form runs on the site’s own infrastructure; the other three sit outside it. Which one to use is the visitor’s choice.

What the form processes is exactly what its fields hold: full name, email address, subject (optional) and the message itself. There is no other field; no IP address, browser details or location is recorded. On the other channels, what is processed is again whatever the person chooses to send.

Each purpose has a single legal ground. Answering the message — Article 5/2-f of Law no. 6698 (the controller’s legitimate interest). Arranging the consultation where an enquiry leads to one — Article 5/2-c (directly related to the conclusion or performance of a contract). Limiting misuse of the form — Article 5/2-f.

The form carries no consent checkbox and no explicit consent is taken. The reason is legal rather than technical: one processing activity cannot rest on explicit consent and legitimate interest at the same time, so the ground has to be single. The grounds above do not require consent; the form only informs.

Health information is a special category of personal data. The form does not ask for it and none of its fields request it. Where someone does write health information into the message, it is processed by a health professional bound by professional secrecy, under Article 6/3 of the Law, and only to deal with the request made.

Transfers and where data is held

The site is hosted on Amazon Web Services and served through a content delivery network. Because access logging is off, browsing the pages produces no personal data to transfer.

A form submission is processed in Amazon Web Services’ Germany (Frankfurt) region and turned into an email there. The resulting message lands in the mailbox held on the mail provider’s servers, also in Germany, and is kept there. The region was chosen deliberately: the form is processed in the same country where the email is stored.

Under Article 9 of the Law this counts as processing and storage abroad. It concerns everyone who uses the form or the email channel.

Following the WhatsApp link moves the conversation onto WhatsApp’s own infrastructure, under that service’s own terms; the site has no control over it. Telephone calls run over the operator’s network.

Beyond these, personal data is not transferred to third parties. Nothing is shared for advertising, marketing, profiling or sale.

How data is collected and how long it is kept

Data is collected entirely by electronic means and directly from the person concerned. No automated collection tool, third-party data source or purchased list is used.

Form submissions are not kept in any database. The fields that arrive are turned into an email, and once that email has been sent the work is done; no record of the submission itself is retained. From there on it is stored in the mailbox like any other incoming message.

There is one exception, kept in order to limit misuse of the form: an irreversible digest (SHA-256) of the email address written into the form, a counter, and an expiry stamp. The address itself, the name, the subject and the message never go there. The record deletes itself after one hour.

Correspondence in the mailbox is kept until the purpose it was processed for has ended and any period required by law has run out, then deleted. Where someone asks for deletion earlier, the request is handled through the channel below.

Rights of the data subject

Under Article 11 of the Law, anyone may apply to the data controller and ask to:

• learn whether their personal data is being processed
• request information about it where it has been processed
• learn the purpose of processing and whether the data is used accordingly
• know the third parties, in Türkiye or abroad, to whom the data has been transferred
• have incomplete or inaccurate data corrected
• have the data erased or destroyed under the conditions set out in the Law
• have any correction, erasure or destruction notified to the third parties the data was transferred to
• object to a result reached to their detriment through analysis carried out solely by automated systems
• claim compensation for loss suffered because of unlawful processing

Making a request

Requests can be sent to hello@ozlemkasapoglu.com. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, a request needs to carry a name, a surname, contact details and the subject of the request. Requests are concluded within thirty days at the latest.

Site editor and updates

Under Article 5/1-ı of the Turkish Regulation on Promotion and Information Activities in Health Services: the editor of this website is ioxxoi Teknoloji Anonim Şirketi, reachable at studio@ioxxoi.com. Each page carries its own last-updated date in the footer.

This notice describes what the site actually does. Should anything change that affects the processing of personal data, the notice changes with it and the new date appears in the footer.