Data controller
Under Law No. 6698 on the Protection of Personal Data (“KVKK” or the “Law”), your personal data is processed by specialist physiotherapist Bahar İpşir Özer, as data controller (the “Data Controller”), within the scope described in this notice. The Data Controller is a health professional who provides physiotherapy services in her own name.
- Data controller
- Bahar İpşir Özer
- Address
- Premier Kampüs Ofis, A Blok, D:37, İmrahor Cd. No:29, Gürsel Mah., 34400 Kağıthane / İstanbul
- Phone
- +90 505 732 43 86
This notice covers personal data processed through the baharozer.com website (the “Site”) and communication initiated through the Site. Separate information is provided about personal data processed during physiotherapy services at the office.
This notice is provided for your information under Article 10 of the Law and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform. You do not need to accept or approve it. Your explicit consent to the processing of health data is obtained separately, through the Explicit Consent Statement.
Personal data processed
The following personal data may be processed through the Site, in particular via the appointment form:
- Identity
- Your first name and surname.
- Contact
- Your phone number and, if you provide it, your email address.
- Request details
- Your preferred appointment time, the language in which you completed the form, the date of the request and notes on the follow-up of your request.
- Health data Special category of personal data
- The service you choose and any health information it may reveal (for example pregnancy, lymphoedema or a neurological condition), and health information you choose to share in the message field, such as your symptoms, diagnosis, surgery or treatment.
- Transaction security
- A salted hash of your IP address, browser information (user agent), the time of your explicit consent and the version of the text you accepted, technical data processed for bot protection (Cloudflare Turnstile) and records of sign-in attempts to the admin panel.
- Site usage data
- The address of the page you view, the page that referred you to the Site, your browser and device type and your country. This information is not linked to your identity and is used only for anonymous statistics.
Your IP address is processed technically by the infrastructure provider so that the Site can be delivered to you and protected. Appointment records do not store the IP address itself. To limit repeated submissions within a short period, they store only a hash created with a secret key, which is hard to reverse.
Writing health information in the message field is optional. Please do not share information that is not needed for your request. A request for a child under 18 or for a person under guardianship must be submitted by their parent or legal guardian. If you are leaving a request on behalf of an adult relative, please make sure they know about it and share only what is needed to get in touch (you can choose “Not sure / Other” as the area of interest). Health matters are then discussed with your relative directly at the first meeting.
How personal data is collected
Your personal data is collected electronically: directly from you when you fill in the appointment form on the Site or get in touch by phone, WhatsApp or email, and partly by automated means, for security and for anonymous visit statistics, when you visit the Site or use the appointment form.
This data is processed for the purposes set out under Purposes of processing and on the legal grounds set out under Legal grounds.
Purposes of processing
Your personal data is processed for the following purposes:
- receiving and evaluating your appointment request and getting back to you
- communicating with you and arranging a suitable appointment day and time
- preparing for the first meeting based on the information you share
- complying with legal obligations and responding to requests from competent authorities
- keeping the Site and data secure, and preventing spam, bots and misuse
- producing anonymous statistics on how the Site is used, and improving the Site
- establishing, exercising or protecting rights in the event of a dispute.
Your personal data is not used for advertising, marketing or profiling.
Legal grounds
Your personal data is processed on the following legal grounds provided for in Articles 5 and 6 of the Law:
- Establishment or performance of a contract (Art. 5(2)(c)): Your identity, contact and request details (other than any that qualify as health data) are processed because they are directly related to evaluating your appointment request and establishing a service relationship.
- Legal obligation (Art. 5(2)(ç)): Data needed to comply with obligations arising from legislation is processed.
- Establishing, exercising or protecting a right (Art. 5(2)(e)): Data such as explicit consent records is kept as evidence in the event of a dispute.
- Legitimate interest (Art. 5(2)(f)): Provided this does not harm your fundamental rights and freedoms, transaction security data is processed to keep the Site secure and prevent misuse, and Site usage data is processed only as anonymous statistics, to measure how the Site is used and improve it.
- Explicit consent (Art. 6(3)(a)): Health data that the service you choose may reveal, and health data you share in the message field, is a special category of personal data and is therefore processed on the basis of your explicit consent, in line with the Explicit Consent Statement.
The conditions for processing special categories of personal data were revised by the amendments made to Article 6 of the Law by Law No. 7499. For health data submitted through the Site, explicit consent is relied upon. The main measures taken to protect this data are described under Data security.
Transfers of personal data
Your personal data is not sold and is not shared for advertising. To the extent necessary for the purposes above, and in accordance with Articles 8 and 9 of the Law, it may be transferred to the following recipients:
- Hosting and security provider (Cloudflare): The Site runs on the infrastructure of Cloudflare, Inc. Appointment requests are stored in Cloudflare’s database service, and content delivery, security, bot protection (Cloudflare Turnstile) and anonymous visit statistics (Cloudflare Web Analytics) are also provided by Cloudflare on the Data Controller’s behalf. Cloudflare’s servers are also located outside Türkiye.
- Email notification (Cloudflare Email Routing): When a new appointment request arrives, a notification email is sent to the Data Controller through Cloudflare’s email service. This email contains only the request number and a link to the admin panel. It contains no information about you, such as your name, contact details, the service you chose or your message. The content of the request can be viewed only in the password-protected admin panel.
- Competent public authorities: Data may be shared with courts and competent public authorities where required by law, and only to the extent requested.
Transfers abroad
Because appointment requests are stored on Cloudflare servers outside Türkiye, and technical data processed while delivering the Site, providing bot protection and producing visit statistics may also be processed on those servers, your personal data is transferred abroad. For transfers to countries without an adequacy decision, the Data Controller relies on the standard contract announced by the Personal Data Protection Board, one of the appropriate safeguards provided for in Article 9 of the Law. The standard contract is signed with the relevant service provider and notified to the Personal Data Protection Authority within five business days of signature.
Maps and third-party links
The Google Maps map on the Site is not loaded unless you choose to view it. When you load the map, your browser connects to Google’s servers and technical data such as your IP address is sent to Google. Google’s privacy policy applies to this processing. Directions, WhatsApp and Instagram links take you to third-party platforms, and any data you share there is subject to that platform’s own terms.
Retention and deletion
Your personal data is kept only for as long as necessary for the purpose for which it is processed. The retention periods for each type of record are as follows:
- Appointment requests
- 1 (one) year after the request was received or last updated. The explicit consent record, the salted IP hash and the browser information are deleted together with the request.
- Requests marked as spam
- 30 (thirty) days after being marked as spam.
- Admin panel sign-in attempts
- 90 (ninety) days after the attempt. Only a salted hash of the IP address is kept in these records.
- Server logs (Cloudflare Workers Logs)
- Request metadata, kept for up to 7 (seven) days and then deleted automatically by Cloudflare.
- Anonymous click counters
- Contain no personal data. Only daily totals per link type and language are kept, and they are deleted automatically after 400 (four hundred) days.
Appointment requests, requests marked as spam and sign-in attempts are deleted by an automated process that runs every day once their period has passed. Deleted records may remain technically recoverable for up to 30 more days through the infrastructure provider’s database restore (backup) feature, after which they are removed automatically.
Request lists exported from the admin panel contain only what is needed for contact and follow-up, and no health information. These lists, and any backup copies the Data Controller makes, are kept only on an encrypted device and deleted once they have served their purpose.
If your request leads to physiotherapy services, the records that must be kept in connection with those services are retained for the periods required by the relevant legislation. Statutory retention obligations are reserved.
Once the retention period expires, data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
Data security
Appropriate technical and organisational measures are taken under Article 12 of the Law to prevent unlawful processing of and unlawful access to your personal data and to ensure that it is kept safe. These measures include the following:
- Communication between the Site and your browser takes place over an encrypted (HTTPS) connection.
- Only the Data Controller can access appointment requests, through a password-protected admin panel.
- Notification emails do not contain the content of the request. Requests can be viewed only in the admin panel.
- IP addresses are stored as a hash salted with a secret key rather than in plain form.
- The form is protected against automated (bot) submissions with Cloudflare Turnstile, and repeated submissions within a short period are limited.
- Records whose retention period has ended are deleted automatically every day.
Cookies and visit statistics
The Site does not use advertising, marketing or analytics cookies. The cookies and similar technologies used on the Site are as follows:
| Name and type | Provider | Purpose | Duration |
|---|---|---|---|
__Host-bo_sessionCookie | The Site (first party) | The only cookie the Site itself sets, and it is strictly necessary. It only keeps the site owner’s admin panel session secure. It is not placed in visitors’ browsers. | Ends when the browser is closed, 12 hours at most |
cf.turnstile.uLocal storage | Cloudflare Turnstile (third party) | Protects the appointment form against automated (bot) submissions. Used only on the appointment pages, inside the Turnstile verification frame. | Until you clear your browser data |
| Google MapsMap frame | Google (third party) | Shows the map. It loads only when you press “Show map”. Google may then use its own cookies, and Google’s privacy policy applies. | Set by Google |
| Network error reportingNEL and Report-To headers | Cloudflare (infrastructure provider) | If connecting to the Site fails, your browser reports the failure to Cloudflare. No reports are sent for successful visits. | A browser policy kept for up to 7 days |
| Cloudflare Web AnalyticsMeasurement script | Cloudflare (on the Data Controller’s behalf) | Produces anonymous visit statistics (see below). | Uses no cookies or local storage and stores nothing on your device |
Cloudflare may also use short-lived security cookies to protect the Site when it detects unusual or malicious traffic. Because the admin session cookie and Cloudflare’s security and network error reporting technologies are needed to deliver the Site securely and reliably, they are used on the legal ground of legitimate interest (Art. 5(2)(f)) and your separate consent is not requested. You can delete or block cookies and site data in your browser settings, but some security features, such as form verification, may then not work.
Visit statistics
Only anonymous statistics are kept, to see how the Site is used and to improve it. Two methods are used:
- Cloudflare Web Analytics: Cloudflare adds its own measurement script to the Site’s pages. The script uses no cookies or local storage and does not try to recognise your browser by fingerprinting. It records the address of the page viewed, the page that referred you to the Site, the browser and device type and the country, and the Data Controller sees these only as aggregate figures.
- The Site’s own click counters: When you click a WhatsApp, phone, directions or Instagram link, the Site adds one to that day’s counter in its own database. The counter only distinguishes the type of link and the language of the page. No IP address, device identifier or cookie is stored with it.
This measurement relies on legitimate interest (Art. 5(2)(f)). Because nothing is stored on your device for it, your separate consent is not requested. The data is not used to build profiles, and your browsing on other sites is not tracked.
Your rights
Under Article 11 of the Law, you may apply to the Data Controller to exercise the following rights:
- to learn whether your personal data is being processed
- to request information about the processing if your personal data has been processed
- to learn the purpose of the processing and whether the data is used in line with that purpose
- to know the third parties, in Türkiye or abroad, to whom your personal data has been transferred
- to request the correction of incomplete or inaccurate personal data
- to request the deletion or destruction of your personal data under the conditions set out in Article 7 of the Law
- to request that any correction, deletion or destruction be notified to third parties to whom your personal data has been transferred
- to object to an outcome against you arising from the analysis of processed data exclusively by automated systems
- to claim compensation if you suffer damage because your personal data has been processed unlawfully.
You may withdraw your explicit consent at any time. A phone call or a WhatsApp message is enough. Withdrawing it does not affect processing carried out on the basis of your consent before that date.
How to apply
You can submit requests concerning your rights in writing to the address given under Data controller, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, or by the other methods set out in the Communiqué (for example, using registered electronic mail (KEP), a secure electronic signature or a mobile signature, or from an email address you have previously provided to the Data Controller and that is on record).
Your application must include:
- your name, surname and, if the application is in writing, your signature
- the T.R. identity number for citizens of the Republic of Türkiye, or nationality and passport number (or identity number, if available) for foreign nationals
- a residential or business address for notifications
- if available, an email address, telephone or fax number for notifications
- the subject of your request.
Your application will be concluded free of charge as soon as possible, and within thirty days at the latest, depending on the nature of the request. If the process involves an additional cost, a fee may be charged in line with the tariff set by the Personal Data Protection Board. Additional information may be requested to verify your identity.
If your application is rejected, if you find the response insufficient, or if no response is given in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 of the Law.
Changes to this notice
This notice may be updated to reflect changes in legislation or in how personal data is processed. The current version is always published on this page. The “Last updated” date at the top shows when it was last changed.