Last Updated: 9 August 2026
At Koza Health Group, we attach great importance to the privacy and security of the personal data of our patients, patients' relatives, visitors, employees, job applicants, service providers and website visitors.
This Privacy Notice has been prepared in accordance with Turkish Personal Data Protection Law No. 6698 ("KVKK"), applicable secondary legislation and healthcare regulations to explain how your personal data is collected, processed and transferred and to inform you about your rights in relation to your personal data.
1. Data Controller
Your personal data may be processed by Koza Health Group and the relevant Koza Health Group healthcare institution from which you receive healthcare services, acting as the data controller under applicable Turkish data protection legislation. Depending on the nature of the healthcare service, the legal entity operating the relevant healthcare institution may act as the data controller.
2. Personal Data We Process
Depending on the nature of the healthcare service or interaction, we may process the following categories of personal data:
- Identity data: Name, surname, Turkish identification number, passport or foreign identity number, date and place of birth, gender and similar identification information.
- Contact data: Telephone number, e-mail address and residential or contact address.
- Health data: Examination and treatment information, diagnoses, medical history, medication, allergies, laboratory results, radiology and imaging results, physician assessments, prescriptions, surgical and procedural information and other health data required for the provision of healthcare services.
- Financial and insurance data: Billing and payment information, private health insurance information, Social Security Institution information and authorization records.
- Patient transaction data: Appointment, admission, registration, discharge and healthcare utilization information.
- Visual and audio data: CCTV recordings collected for security purposes and, where required, visual or audio records obtained in connection with healthcare services.
- Digital transaction data: Website usage information, IP addresses, access and transaction logs, cookie information and technical records maintained for information security purposes.
- Communication and request data: Call center communications, contact forms, complaints, requests, suggestions and patient satisfaction records.
Health-related information constitutes special category personal data under Turkish data protection legislation and is subject to additional technical and organizational safeguards required by applicable law.
3. Purposes of Processing
Your personal data may be processed for purposes including:
- Providing preventive medicine, diagnosis, examination, treatment, care and rehabilitation services,
- Managing patient registration, admission, appointment and discharge processes,
- Providing laboratory, radiology, imaging and other diagnostic services,
- Managing medication, prescription and treatment processes,
- Ensuring patient safety and healthcare quality standards,
- Coordinating healthcare services among physicians and healthcare professionals,
- Managing insurance authorization, billing and payment procedures,
- Fulfilling mandatory notifications to the Ministry of Health and other competent authorities,
- Sending appointment reminders and healthcare-related notifications,
- Managing patient satisfaction, requests and complaints,
- Meeting legal and administrative obligations,
- Ensuring information security, physical security and the security of patient records,
- Planning and improving healthcare quality and operational processes, and
- Responding to lawful requests from competent authorities.
Personal data is processed in accordance with the principles of lawfulness and fairness, accuracy and keeping data up to date where necessary, processing for specified, explicit and legitimate purposes, being relevant, limited and proportionate to those purposes, and retention for the period prescribed by applicable law or required for the relevant processing purpose.
4. Collection Methods and Legal Grounds
Personal data may be collected orally, in writing or electronically through our hospitals and medical centers, patient registration and admission desks, physicians and healthcare professionals, laboratory and imaging systems, website, online forms, appointment systems, call center, e-mail, paper forms, CCTV systems, health information systems and electronic platforms operated with competent public authorities.
Personal data is processed on the basis of the legal grounds applicable to the relevant processing activity under Articles 5 and 6 of Turkish Personal Data Protection Law No. 6698 and applicable healthcare legislation. Where explicit consent is legally required for a particular processing activity, such consent will be obtained separately.
5. Disclosure and Transfer of Personal Data
Where permitted or required by applicable law and subject to appropriate safeguards, your personal data, including health data where necessary, may be transferred to the following recipients only to the extent required for the relevant processing activity:
- The Turkish Ministry of Health and its authorized systems,
- The Social Security Institution,
- Competent public institutions and authorities,
- Judicial and administrative authorities,
- Private health insurance companies,
- Laboratories, imaging centers and other healthcare service providers involved in your care,
- Authorized physicians and healthcare professionals,
- IT, archiving, security and technical service providers, and
- Other persons or organizations legally authorized to receive such information.
Any international transfer of personal data will be carried out in accordance with the current provisions of Turkish data protection legislation governing transfers abroad and applicable secondary legislation.
6. Retention and Security
Personal data is retained for periods required under applicable healthcare and data protection legislation and for as long as necessary for the purposes for which it was collected. When the applicable retention period expires or the reasons requiring processing cease to exist, personal data will be deleted, destroyed or anonymized in accordance with applicable legislation.
Koza Health Group implements appropriate technical and organizational measures designed to prevent unlawful processing of or unauthorized access to personal data and to ensure secure storage of personal and special category personal data.
7. Your Rights
Under Article 11 of Turkish Personal Data Protection Law No. 6698, you may have the right to:
- Learn whether your personal data is being processed,
- Request information regarding such processing,
- Learn the purposes for which your personal data is processed and whether it is used accordingly,
- Learn the third parties to whom your personal data has been transferred in Türkiye or abroad,
- Request correction of incomplete or inaccurate personal data,
- Request deletion or destruction where the legal conditions are satisfied,
- Request notification of correction, deletion or destruction to third parties to whom the data has been transferred,
- Object to a result arising against you solely through automated analysis of processed data, and
- Claim compensation if you suffer damage as a result of unlawful processing.
8. Applications and Contact
You may submit requests concerning your personal data to Koza Health Group or the relevant Koza Health Group healthcare institution from which you received healthcare services, together with sufficient information and documentation to verify your identity and in accordance with the application procedures prescribed by applicable law.
Call Center: 444 7 330
Applications will be assessed in accordance with Turkish Personal Data Protection Law No. 6698 and the applicable procedures governing applications to data controllers.