Privacy Policy (GDPR & KVKK)

How your personal data is processed and protected.

This Privacy Policy explains how your personal data is processed in connection with the online therapy services provided through this website. Because services are offered internationally, this policy addresses both the EU General Data Protection Regulation (“GDPR”), where it applies to clients located in the EU/EEA, and Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”). This document is provided for information; it does not constitute legal advice.

1. Data Controller

The data controller is Serin Bitar-Çanak, independent trauma therapist and mental health counselor.

  • Email: serinbitarcanak@gmail.com
  • Website: serinbitarcanak.com

2. Personal Data Processed

Within the scope of the online therapy and counseling services provided, the following categories of personal data may be processed:

  • Identity data: name, surname.
  • Contact data: email address, phone number, social media account details.
  • Health data (special category): information about your mental and physical health shared in the intake/assessment form and during sessions, trauma history, symptoms, and therapeutic process notes.
  • Appointment and transaction data: session dates and times, contact requests, preferred language.
  • Financial data: information related to payments/transfers.
  • Audio/visual data: audio and video processed during online video sessions (no recordings are made; used only for real-time communication).
  • Digital trace data: technical data collected via cookies during your visit to the website.

3. Purposes of Processing

  • Providing, planning, and conducting therapy and psychological counseling services,
  • Carrying out the initial application and suitability assessment,
  • Creating and managing appointments and communicating with you,
  • Conducting payment and invoicing processes,
  • Ensuring the quality and continuity of the service,
  • Fulfilling legal obligations and protecting rights in potential disputes.

4. Legal Bases for Processing

Under the GDPR (for clients located in the EU/EEA), processing is based on: the performance of a contract (Art. 6(1)(b)) for providing the services you request; compliance with legal obligations (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) such as service administration and security; and, for health data, your explicit consent (Art. 9(2)(a)).

Under the KVKK, processing is based on the establishment or performance of a contract, fulfillment of legal obligations, and the legitimate interests of the data controller (Art. 5); health data is processed solely on the basis of your explicit consent (Art. 6).

5. Special Category (Health) Data and Explicit Consent

Due to the nature of the therapy process, your health data constitutes special category personal data and is processed solely on the basis of your explicit consent. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal, but it may mean the therapeutic service can no longer continue. Your health data is protected with particular care within the framework of professional confidentiality and ethical rules.

6. Recipients and International Transfers

Your personal data may be shared, to the extent necessary for providing the service, with:

  • Service providers: digital platforms used for appointments (online calendar), intake forms, video sessions, and email services.
  • Authorized public institutions: only where a legal obligation exists.

Some of these platforms (for example, Google services) may host their servers outside your country of residence. Where the GDPR applies, such transfers rely on appropriate safeguards such as European Commission adequacy decisions or standard contractual clauses used by these providers. Under the KVKK, such transfers are carried out on the basis of your explicit consent or the conditions set out in the applicable legislation (Art. 9).

7. Method of Collection

Your personal data is collected electronically through online intake/assessment forms, communication established via email and social media, the appointment platform, video sessions, and website cookies.

8. Retention

Your personal data is retained only for as long as required by the purpose of processing and with regard to statutory retention periods (for example, those prescribed for financial records). Once these periods expire, your data is deleted, destroyed, or anonymized.

9. Data Security

Appropriate technical and organizational measures are taken to prevent unlawful processing of and unauthorized access to your personal data, and to ensure its secure storage.

10. Your Rights

If you are located in the EU/EEA (GDPR), you have the right to: access your personal data; have it rectified or erased; restrict or object to its processing; receive it in a portable format; withdraw consent at any time; and lodge a complaint with your local data protection supervisory authority.

Under the KVKK (Art. 11), you have the right to: learn whether your data is processed and request information about it; learn the purpose of processing; know the third parties to whom it is transferred; request correction, deletion, or destruction; request notification of these actions to third parties; object to results arising from exclusively automated analysis; and claim compensation for damages caused by unlawful processing.

11. How to Exercise Your Rights

You may submit requests regarding your rights by sending an email to serinbitarcanak@gmail.com. Requests are answered within the periods prescribed by the applicable legislation (one month under the GDPR, extendable where necessary; thirty days under the KVKK). Your request must include information verifying your identity.

12. Cookies

This website may use essential and functional cookies to improve your browsing experience. You can manage or block cookies through your browser settings; however, disabling certain cookies may affect site functionality.

13. Changes to This Policy

This Privacy Policy may be revised in line with changes in legislation or updates to service processes. The current version is always published on this page. The Turkish KVKK notice is available at /tr/kvkk/; in matters governed by Turkish law, the Turkish text prevails.

Last updated: July 2026