Last updated: October 22, 2026
This privacy notice has been prepared to provide information about personal data processing activities connected to the CliNext system, which is used by Dr. Kerem Çağlayan to support clinical patient follow-up, communication, and reporting processes. CliNext is a clinical management and decision support environment used for healthcare professionals. If patients communicate with the clinic via WhatsApp, telephone, email, or other communication channels, the relevant records may be associated with CliNext depending on the feature used and the legal conditions.
This text should be evaluated together with the Privacy Policy and KVKK Privacy Notice regarding the general use of the website. In services provided within a specific hospital, medical center, or other healthcare institution, there may be activities for which the relevant institution is separately the data controller, as well as its own privacy notice.
1. Data controller and contact
In this text, with regard to CliNext activities carried out by Dr. Kerem Çağlayan, the data controller is stated as Dr. Kerem Çağlayan. If the data processing activity is carried out under the responsibility of another healthcare institution, the notice belonging to that institution also applies.
Contact: [email protected] · +90 541 824 94 24 · drcaglayan.com.tr. We recommend that you do not unnecessarily share your health data as an email attachment when submitting a rights request.
2. Which personal data may be processed?
Depending on the nature of the clinical services, the following data groups may be processed:
- Identity and contact: first and last name, contact information, information used to match patient files and visit records;
- Health and clinical data: complaints, medical history, diagnosis, medication and allergy information, examination notes, vital signs, laboratory and imaging results, QEEG and other submitted clinical documents;
- Communication records: appointment and follow-up requests, message sending/receiving times, message contents or attachments (if the relevant function is used), communication preference, and report sharing records;
- Technical and security records: authorized user transactions, access and error logs, and technical information necessary for ensuring the security of the service.
Health information constitutes special categories of personal data within the scope of the Personal Data Protection Law No. 6698 (KVKK). Therefore, it requires additional protection and legal processing conditions compared to general personal data.
3. Purposes of processing
Personal data may be processed for creating and updating patient files, following up on examinations and treatments, preparing medical documents, conducting appointment/communication processes, delivering requested reports to the patient, fulfilling legal record-keeping obligations related to healthcare services, ensuring information security, and responding to legal claims when necessary.
If an artificial intelligence-supported feature is used within CliNext, the relevant information may be processed for the purposes of classifying source documents, historical comparison, and generating draft clinical assessments to be presented for the physician’s review. Artificial intelligence outputs do not replace a definitive diagnosis or the physician’s independent medical judgment. The external artificial intelligence provider to be used and the transfer conditions are evaluated separately prior to the specific transaction.
4. Method of data collection and legal grounds
Data may be obtained directly from the patient; from the records of the physician or authorized healthcare professional; from tests and reports shared by the patient; from selected communication channels such as telephone, email, and WhatsApp; and, when necessary, from the records of authorized healthcare institutions.
Depending on the type of processing activity, reliance is placed on the legal grounds set forth in Articles 5 and 6 of the KVKK. With respect to health data, the applicable processing conditions for special categories of data and the limitations stipulated by the relevant legislation are taken as the basis. When there is an independent processing purpose that requires explicit consent, consent is obtained separately; visiting this page or merely sending a message does not constitute unlimited explicit consent for all kinds of data processing.
5. Communication via WhatsApp and Meta platform
If preferred, the WhatsApp Business Platform / Cloud API may be used for appointments, test reminders, sending reports, or correspondence with the patient. In this communication, the telephone number, message and its attachments, and delivery information may pass through the WhatsApp/Meta infrastructure to the extent of the feature used. Meta and WhatsApp’s own terms of service and privacy regulations are also important with respect to transactions on this platform.
WhatsApp is not a reliable emergency contact channel for urgent medical conditions. In case of urgent complaints, do not wait for a WhatsApp response; call 112 or go to the nearest emergency department. Share your health data by limiting it to the necessary scope as much as possible. By informing the clinic of your communication preference, you can obtain information about suitable alternative channels.
6. Third-party service providers and transfer
To the extent necessary for the provision of the service, personal data may be shared with hosting, backup, technical support, communication and message transmission infrastructure providers, platform operators such as WhatsApp/Meta, authorized institutions within the scope of legal obligations, and authorized persons in the execution of the relevant healthcare service. These transfers are evaluated within the framework of purpose limitation, access authorizations, and applicable data protection conditions.
Depending on the technical structure of the international technology services used, data transfer abroad may be involved. For such a transfer to take place, the conditions sought in Article 9 of the KVKK and other relevant regulations must be met. The use of a service provider does not mean that all patient data is automatically transferred to that provider.
7. Data security and access
Access to clinical records must be limited by duty and authority; account security, access controls, and appropriate technical/administrative measures must be implemented. Absolute security cannot be guaranteed in electronic communication. If the possibility of suspicious transmission, wrong recipient, or unauthorized access is noticed, you can apply through the specified communication channels.
8. Retention period and deletion
Patient and health records are kept for the retention period valid for the relevant health legislation, legal obligations, and concrete processing purpose. Different retention periods may apply for technical records and communication contents. When the periods expire and there is no ongoing legal reason for retention, deletion, destruction, or anonymization processes are evaluated according to the relevant legislation. Deleting a chat in the WhatsApp application does not mean that the clinical record required to be kept by law is automatically deleted.
9. Your rights under the KVKK
Within the scope of Article 11 of the KVKK, when the conditions are met; you can exercise your rights to learn whether personal data about you is processed, to request information if it has been processed, to learn the purpose of processing, to know the third parties to whom the data is transferred, to request the correction of incomplete or inaccurate data, to request deletion/destruction under the conditions in the legislation, and your other statutory rights.
You can submit your applications in a manner suitable for identity verification via the contact information above. Current legislation applies to application and response processes. With regard to health records, legal retention obligations may limit the full fulfillment of some deletion requests.
10. CliNext data deletion instructions
You can send your correction or deletion request regarding the personal data you transmitted via CliNext or WhatsApp to the address [email protected] with the subject “CliNext Data Deletion Request” (“CliNext Veri Silme Talebi”) or submit it through the clinic’s communication channels. In your request, it is sufficient to specify which communication channel and which data or record you are applying for; do not send health documents unless necessary for identity verification.
Upon request, the authorized person verifies identity and application authority by an appropriate method, examines the relevant records and legal retention obligations, and responds within the legal framework regarding the feasibility and outcome of the deletion/correction process. Medical patient files or records required to be kept by law may not be deleted immediately; in this case, the reason is explained. Deleting the WhatsApp chat on your phone does not mean that clinical records or records in Meta’s own system are automatically deleted.
11. Update and scope
This text may be updated when the functions of CliNext, the service providers used, or legal requirements change. The current version is published at this address. This page provides general clarification; it does not replace additional consents and clarifications regarding a specific healthcare service.