Data controller / site editor

This draft notice identifies the site editor as the contact point. The production data-controller role and its obligations must be verified through qualified legal review before launch.

Data categories

The theme preference remains local in localStorage. If enabled at the hosting layer, access and security logs may include IP address, request time and path, and user agent. Email data is processed through email providers only when the user independently sends an email.

Purposes

Possible technical logs may be processed only as necessary to deliver and secure the site. Email data may be processed only as necessary to answer user-initiated, non-health correspondence.

Collection method and legal basis

The collection method for hosting logs and the legal basis applicable to each processing activity must be reviewed, selected and documented against the production configuration before launch. This notice does not request consent.

Recipient categories

Possible recipient categories are limited, as necessary, to the configured hosting or technical provider and the user’s email provider. This repository does not name any provider.

Rights under Article 11

Where the statutory conditions apply, data subjects have the rights below. Requests may be sent to the email channel below; do not include personal health information.

• Learn whether their personal data is processed.
• Request information if their personal data has been processed.
• Learn the purpose of processing and whether the data is used in accordance with that purpose.
• Know the third parties to whom personal data is transferred domestically or abroad.
• Request correction where personal data has been processed incompletely or incorrectly.
• Request deletion or destruction of personal data under the conditions set out in Article 7.
• Request notification of correction, deletion or destruction to third parties to whom personal data has been transferred.
• Object to a result adverse to the person arising from analysis of processed data exclusively through automated systems.
• Claim compensation for actual damage incurred because personal data was processed unlawfully.

Notice and explicit consent are separate

This site currently requests no explicit consent because it has no data-entry form. If a future processing activity requires consent, notice and explicit consent must be designed as separate processes.

Current repository implementation

No account, login, backend database, contact, appointment, symptom or upload form, analytics, advertising pixel, social embed, map, video embed, marketing tracker or health-data collection field is implemented.

The application intentionally stores only the user’s theme choice in browser localStorage under the “theme” key; this preference is not used for profiling or advertising.

The application does not intentionally set its own HTTP cookies. Therefore no consent banner is shown for the current no-cookie implementation.

External links and direct email

After the user follows a hospital, MHRS, LinkedIn, DOI, PubMed, PMC or AVESİS link, that external site’s own data practices apply.

Direct email is handled outside the site by the user’s email client and provider, without an on-site form. Do not send personal health information by email.

Hosting logs and prelaunch review

A hosting provider may process necessary access and security logs such as IP address, request time and path, and user agent. This repository defines no provider, retention period, transfer geography or logging configuration; these choices must be configured and documented before production launch.

These texts describe the current repository implementation and still require review by qualified Turkish health-law and KVKK counsel before launch; they do not certify or guarantee legal compliance.