Data Protection Notice (KVKK)
Last updated: 12 October 2026
This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) by Clinique Beauté (Dr. Emel Polat's clinic) as data controller.
Data controller
Clinique Beauté (Dr. Emel Polat), Ebru Sokak 29/A, 34335 Akatlar, Beşiktaş / Istanbul, Türkiye. E-mail: info@emelpolat.com.tr. Phone: +90 533 432 00 84.
Personal data processed
Identity and contact (first and last name, e-mail, optional phone); special-category health data (health questionnaire, skin and meal analysis results, water, sleep, mood, activity and cycle entries, medication and allergy declarations, appointments, treatments, prescriptions, lab results, signed documents, treatment photos); messages; security and technical data (IP address, device and app information, notification ID, activity logs). A photo you select for analysis is not stored.
Purposes and legal bases
Performing the account and contract, appointments and communication, providing healthcare and keeping its records, security and legal obligations. Health data is processed under Article 6 of the KVKK on your explicit consent (and in the cases the law provides for healthcare delivery); AI analysis and sharing wellness data with your doctor rely on separate, optional explicit consents. Marketing messages are sent only with your consent.
Method of collection
Your data is collected from information you enter in the mobile app and web panels, by doctors and staff at the clinic, and automatically through the clinic's appointment system (Estesoft / Stella).
Recipients and transfers
The database, authentication and file storage are on our servers in Istanbul; backups are kept encrypted in Türkiye. Data is transferred only as far as the service requires: in Türkiye to Estesoft / Stella (appointments), Netgsm (SMS; only when SMS notifications are on) and our AI providers (EVREN, LLMTR; only with your consent and without your name, national ID number or contact details); abroad to Resend (e-mail, EU / Ireland infrastructure) and OneSignal (push notifications, USA). Transfers abroad rely on your explicit consent and appropriate safeguards under Article 9 of the KVKK. Competent public authorities may be recipients where the law requires.
Retention periods
Account data is kept while the account is open and permanently deleted 30 days after a deletion request (restorable until then). Clinical records are kept for at least 20 years under the legislation and financial records for 10 years, with access limited to authorized healthcare staff. Technical error logs are kept for at most 30 days.
Your rights (KVKK Art. 11)
You have the right to learn whether your data is processed, request information, learn whether it is used for its purpose, know the recipients, request correction, deletion or destruction, request that these actions be notified to recipients, object to a result produced by automated analysis and claim compensation for damages. You can withdraw your consents at any time under Profile > My contracts (consents).
How to apply
In the app you can download your data and delete your account under Profile > My Data. For other requests write to info@emelpolat.com.tr (subject: KVKK Request, with identity verification) or to our clinic address; requests are concluded within 30 days. You may also complain to the Turkish Personal Data Protection Authority.
For your questions: info@emelpolat.com.tr