Legal
Protection of Personal Data
About this translationThis is an English translation of the Turkish policy, provided for information. The practice is based in Turkey and is governed by Turkish Law No. 6698 on the Protection of Personal Data; in case of any discrepancy, the Turkish version prevails.
Under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”), the following explains how your personal data is processed in the course of online psychological services.
Contents
1. Data controller
Haktan Tay — Psychologist, psychoanalytic orientation
Email: psikologhaktantay@gmail.com
Form of service: online (remote) sessions only
As regards professional ethics, the Ethics Regulation of the Turkish Psychological Association (TPD) and the ethical framework of psychoanalytic training institutions (ECF, NEL) apply.
2. Scope of the service (online sessions)
The service is offered remotely only (video or voice calls). No face-to-face clinical meetings take place. Therefore:
- Data such as addresses, physical clinic records or door cameras are not processed.
- The image and sound of sessions are not recorded (unless otherwise stated).
- As a rule, an end-to-end encrypted channel is used as the session platform.
3. Personal data processed
| Category | Data | Source |
|---|---|---|
| Identity | First and last name | Contact form / email |
| Contact | Email, phone | Provided by the client |
| Content | Session request, subject, preferred date, message | Contact form |
| Health (special category) | Psychological content shared during sessions, clinical notes | Client’s own statements |
| Financial | Payment receipts / invoice details | Bank transfer / payment method |
4. Purposes of processing
- Replying to contact requests and scheduling appointments
- Conducting psychoanalytically oriented online sessions
- Keeping clinical records (at a minimum level) under the TPD Ethics Regulation
- Discussing cases in supervision, with the client’s identity anonymised
- Meeting legal obligations (invoicing, bookkeeping)
- Professional development (anonymous case studies, theoretical writing)
5. Legal grounds
Your data is processed on the following legal grounds:
- KVKK Art. 5/2-c: where necessary for the conclusion and performance of a contract (providing the sessions)
- KVKK Art. 5/2-ç: legal obligation (Tax Procedure Law, invoicing, etc.)
- KVKK Art. 6/3: for health data — processing by a person under a duty of confidentiality for the purpose of providing health services
- KVKK Arts. 5/1 and 6/2: your explicit consent for any processing outside the above
6. Transfers to third parties
Given the nature of the service, the following data processors are used:
Online session platform
Sessions take place on communication platforms that are end-to-end encrypted or offer equivalent security. These platforms act as third-party data processors. Some of their servers may be located abroad (EU / USA); transfers abroad under Article 9 of the KVKK therefore arise.
Contact form infrastructure
The contact form on this site runs on Google Forms. Data sent through the form is transferred to the servers of Google LLC. (Google Privacy Policy)
Other
- Email service (Gmail): Google Mail is used for correspondence.
- Bank / payment: banking channels are used to collect session fees; payment details are processed by the banks concerned.
- Accountant: limited data sharing to meet legal obligations.
- Competent public authorities: to the extent necessary, upon a court order or legal request.
Beyond these, the data you send us through the contact form and in sessions is not shared with third parties, not sold and not used for advertising. For the Google Ads measurement tag on the site, see the Privacy & Cookies page.
7. Retention periods
| Type of data | Period | Basis |
|---|---|---|
| Contact form (not followed by sessions) | 1 year | Reasonable period to answer the person’s request |
| Clinical records (minimal notes) | 10 years | TPD recommendation and limitation periods |
| Invoicing / accounting | 5 years (minimum) | Tax Procedure Law |
| Email correspondence | 2 years | Continuity of communication |
At the end of these periods, records are deleted, destroyed or anonymised.
8. Security measures (KVKK Art. 12)
Technical measures:
- Encrypted channels (TLS / E2EE) for all sessions
- Clinical notes accessible only to the data controller; encrypted devices
- Strong passwords and two-factor authentication (2FA)
- Website served over HTTPS with a strict Content Security Policy (CSP)
- Regular security updates and backups
Administrative measures:
- Professional duty of confidentiality (TPD Ethics Regulation)
- Data minimisation — only necessary data is processed
- Explicit consent and privacy notice procedures
- Written agreements with data processors (setting out the terms of processing)
9. Children and young people
Sessions with people under 18 take place only with the written consent of a parent or guardian. The consent form refers explicitly to this policy. The balance between confidentiality and the duty to inform parents is managed within the framework of the TPD Ethics Regulation.
10. Data breach notification
If a data breach is detected:
- the Turkish Personal Data Protection Board is notified within 72 hours;
- clients who may be affected are informed directly within a reasonable time;
- the incident is recorded and its causes analysed.
11. Your rights (KVKK Art. 11)
As a data subject, you have the right to:
- learn whether your personal data is processed;
- request information about it if it has been processed;
- learn the purpose of processing and whether the data is used in line with that purpose;
- know the third parties in Turkey or abroad to whom it has been transferred;
- request correction if it is incomplete or inaccurate;
- request its deletion, destruction or anonymisation;
- object to an outcome against you resulting from analysis by automated systems;
- claim compensation if you suffer damage because of unlawful processing.
12. How to apply
To exercise your rights you may apply in writing to psikologhaktantay@gmail.com, in accordance with the Communiqué on the Procedures and Principles of Applications to the Data Controller. Applications are answered free of charge within 30 days at the latest.
Your application should state your full name, identity number (for Turkish citizens) or another identifying document, address, the subject of your request and, where necessary, supporting documents.