This privacy notice has been prepared to inform you about the processing of your personal data, in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

1. Data controller

Your personal data is processed by Dietitian Elif Arslan ("the Dietitian") as data controller.

Address: Kavaklıdere Mah. Tunalı Hilmi Cad. No: 00/0, Çankaya / Ankara, Türkiye
Email: kvkk@elifarslan.example

2. Personal data processed

Depending on the nature of the service, the following personal data may be processed:

Identity data: First name, surname, date of birth.
Contact data: Phone number, email address.
Appointment data: Requested date and time, session type (in person or online), appointment notes.
Health data (special category personal data): Measurements such as height, weight and waist circumference shared in the appointment form or during sessions; any illnesses, allergies, medication use and laboratory results; pregnancy and breastfeeding status; eating habits.
Transaction security data: IP address, browser information and website usage logs.
Financial data: Payment and invoicing information.

3. Purposes of processing

Receiving, scheduling and confirming appointment requests,
Assessing nutritional status and preparing a personalised nutrition plan,
Conducting follow-up sessions and communicating with clients,
Coordinating with your physician where necessary and with your consent,
Carrying out invoicing and accounting processes,
Fulfilling legal obligations and providing information to authorised bodies,
Ensuring the security and technical operation of the website.

4. Method of collection and legal basis

Your personal data is collected through the appointment and contact forms on the website, email, phone, messaging applications, online meeting platforms and in-person sessions, by fully or partly automated means or by non-automated means.

This data is processed on the following legal grounds set out in Article 5 of the KVKK:

processing is directly related to the conclusion or performance of a contract,
processing is necessary for the data controller to comply with a legal obligation,
processing is necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject.

Under Article 6 of the KVKK, your health data is processed by persons under a duty of confidentiality for the purposes of medical diagnosis, treatment and care services, or where you have given explicit consent. For health data shared via the appointment form, your consent is additionally obtained under the Explicit Consent Form.

5. Transfer of personal data

Limited to the purposes above and in accordance with Articles 8 and 9 of the KVKK, your personal data may be transferred to:

authorised public institutions and organisations where required by law,
persons providing accounting and financial advisory services,
your physician, for coordination purposes, where you have given explicit consent,
business partners providing website hosting, email and online meeting services.

Where some technical service providers have servers located abroad, such transfers are carried out in compliance with the conditions set out in Article 9 of the KVKK.

6. Retention period

Your personal data is kept for as long as required by the purpose of processing and for the statutory retention periods set out in the relevant legislation. When these periods expire, the data is deleted, destroyed or anonymised.

7. Your rights as a data subject (KVKK Article 11)

Under Article 11 of the KVKK, by applying to the data controller you have the right to:

learn whether your personal data is being processed,
request information if it has been processed,
learn the purpose of processing and whether it is used in line with that purpose,
know the third parties to whom it is transferred in Türkiye or abroad,
request correction if it is incomplete or inaccurate,
request deletion or destruction within the framework of the conditions in Article 7 of the KVKK,
request that corrections, deletions or destructions be notified to the third parties to whom the data was transferred,
object to a result against you arising from analysis of the processed data exclusively through automated systems,
claim compensation for damages arising from unlawful processing.

8. How to apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit requests regarding your rights in writing to the address above, together with documents proving your identity, or by secure electronic signature or from your email address registered in our system to kvkk@elifarslan.example. Applications are concluded free of charge within thirty days at the latest, depending on the nature of the request. If the process requires an additional cost, the fee schedule set by the Personal Data Protection Board may apply.