Privacy
Privacy Notice
Last updated: 28 July 2026
This page explains what information is collected when you visit this site, why it is collected, who it is shared with, and what rights you have over it. It serves as the notice required by GDPR Article 13.
Data Controller and Contact
The controller of your personal data is Dr. İlknur Akbulut. Authentic Longevity is a writing and publishing project she runs personally; there is no separate company behind it. The site is operated from Türkiye and is written for readers in Türkiye and Europe. Because the controller is established in Türkiye, Turkish data protection law (Law No. 6698, KVKK) applies to all processing described here, and this notice is also written to meet GDPR Article 13 for readers in the EU and the EEA. For anything in this document, and for any question or request, write directly to ilknur@authenticlongevity.io. One person reads that inbox, not a department, so plain language is welcome.
What Is Collected, and Where From
Information is collected electronically, by automated or partly automated means, at four points. One: if you fill in the contact form, your name, your email address and the message you write. Two: if you email directly, your email address and whatever you write. Three: technical records kept by the hosting service so the site can run and stay secure, meaning your IP address, browser and device information, the page requested, and the date and time. Four: aggregated visit statistics, meaning the page viewed, where you arrived from, approximate country or region, device type, browser and operating system. Nothing is bought from data brokers, nothing is gathered from other sources, no profiles are built, and no automated decisions are made about you.
Purposes and Legal Bases
Each purpose has its own legal basis. To read and reply to your message and continue the correspondence: legitimate interests, GDPR Article 6(1)(f), and where your message asks about working together, steps taken at your request before entering into a contract, Article 6(1)(b). To keep the site running and secure, to see errors and prevent abuse: Article 6(1)(f). To see in aggregate which pieces are read and improve the site accordingly: Article 6(1)(f). For the one strictly necessary cookie that remembers your language: Article 6(1)(f). To answer or retain something where the law requires it: legal obligation, Article 6(1)(c). If you choose to send a message containing health information: explicit consent, Article 9(2)(a), which you can withdraw at any time. Nothing here is processed for marketing, advertising or profiling. Under KVKK the corresponding grounds are Article 5(2)(f), 5(2)(c), 5(2)(ç) and, for health information, Article 6(3)(a).
Please Do Not Send Health Information
The contact form is not a medical channel. Please do not write your symptoms, diagnoses, medications, test results or scan reports into it. Health data is a special category under both GDPR Article 9 and KVKK Article 6, it carries the highest level of protection, and email is not a secure channel for it. If you have a question about your own health, speak to a clinician who knows you and is licensed where you live. If you send such information anyway, it is processed only on the basis of your explicit consent and only so that you can be answered; it is never used for anything else, never shared, and deleted within three months of the correspondence ending. You can withdraw your consent at any time and ask for your message to be deleted immediately.
Who the Data Is Shared With
Three service providers keep this site standing, and each acts as a processor doing only the task it is given. Vercel Inc. (United States): hosting and visit statistics, which involves processing your IP address and browser information. Resend (United States): turning a contact form submission into an email and delivering it. Hostinger International Ltd (Cyprus, European Union): hosting the mailbox the message arrives in. Beyond these, data is disclosed only to public authorities that make a lawful and properly formed request, and only to the extent that request requires. Your data is never sold, never shared with advertising networks, and never passed to third parties for marketing.
International Transfers
Of the providers listed above, Vercel and Resend are established in the United States, while Hostinger, which hosts the mailbox, is registered in Cyprus inside the European Union. The controller herself is established in Türkiye. So when you view the site or write to us, some of your data leaves the EU and the EEA. Transfers to the United States providers rest on their standard data processing agreements, which incorporate the European Commission's Standard Contractual Clauses under GDPR Article 46(2)(c). Türkiye is not covered by a European Commission adequacy decision, so data reaching the controller directly, for example an email you send, is a transfer to a third country made because it is necessary for the performance of a contract with you or for steps taken at your request, GDPR Article 49(1)(b). Under Turkish law the same movements are transfers abroad under KVKK Article 9, for which the Turkish Data Protection Board has issued no adequacy decision covering the United States; work on the Board's standard contract is in progress. Only the minimum data needed to run the service is transferred. If you would rather not have your message travel this way, you can choose a different channel to reach us.
Cookies, Analytics and What Stays in Your Browser
This site sets exactly one cookie: NEXT_LOCALE, which remembers your language. It is first party, limited to your browser session, and strictly necessary so the site opens in the right language. There are no advertising cookies, no profiling cookies, no cross-site tracking cookies, no pixels and no third party ad tags. Visit statistics are collected with Vercel Analytics, which sets no cookie and distinguishes visitors using a hash derived from the incoming request that is discarded after 24 hours. That method is not used for tracking and builds no personal profile, but it is not fully anonymous either, and we would rather say so plainly. Separately, a few things stay only in your own browser and never reach us: what you write in the letter exercise, the short notes you leave, your sound preference in the rooms, and a simple visit counter. You can delete all of these at any time by clearing this site's data in your browser.
How Long Things Are Kept
Contact form messages and email correspondence are kept for at most 12 months after the exchange ends, then deleted. Messages containing health information are deleted within 3 months of the exchange ending. Technical records held by the hosting service remain for that provider's own short retention period and are not separately archived by us. Visit statistics are held in aggregate and cannot be traced back to an individual. Notes and preferences stored in your browser stay with you until you delete them; we never have access to them at all. Data whose purpose has ended is deleted on our own initiative, without waiting for you to ask.
Your Rights
You have the right to be told whether your data is being processed and to obtain a copy of it (GDPR Article 15); to have inaccurate or incomplete data corrected (Article 16); to have your data erased (Article 17); to have processing restricted (Article 18); to receive the data you gave us in a structured, commonly used, machine readable format and have it transmitted to another controller (Article 20); to object at any time to processing based on legitimate interests, including on grounds relating to your particular situation (Article 21); to withdraw consent at any time where processing rests on consent, without affecting the lawfulness of what was done before (Article 7(3)); and not to be subject to a decision based solely on automated processing, which does not happen here in any case (Article 22). The same substantive rights are set out for everyone at KVKK Article 11, which adds the right to know the third parties your data has been transferred to at home or abroad, the right to have corrections and deletions notified to those third parties, and the right to claim compensation for damage caused by unlawful processing.
Making a Request, and How Fast You Get an Answer
To exercise any of these rights, write to ilknur@authenticlongevity.io; putting "data request" in the subject line helps it get picked out. So that identity can be verified, please send the request from the email address you have used with us before; if that is not possible, a limited further question may be asked to confirm who you are. You will not be asked for an identity or passport number. Requests are answered free of charge within 30 days at the latest, which satisfies both the KVKK Article 13 deadline and the GDPR Article 12(3) one month period. If a request is refused, if the answer is inadequate, or if no answer arrives in time, you can complain to the Turkish Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr) within 30 days of learning the answer and in any event within 60 days of your request. If you are in the EU or the EEA you may also lodge a complaint with the supervisory authority in your country of residence, place of work, or the place of the alleged infringement, under GDPR Article 77.
Security
The site is served entirely over an encrypted connection (HTTPS), so what you send through the form travels encrypted. Only Dr. İlknur Akbulut has access to the data; there is no team, no assistant and no second account. The mailbox that receives messages is protected with two step verification. Email itself, however, is not an end to end encrypted channel by nature, which is why we ask you not to send sensitive information. In the unlikely event of a security incident, the relevant authorities and the people affected will be notified as quickly as the law requires.
Medical Disclaimer
I am a doctor, but I am not practicing medicine here. I do not currently see patients. What I write on this site is personal opinion and approach, drawn from my own reading, my professional background, and my own life.
Nothing here is a diagnosis. I do not prescribe treatment, recommend medication or supplements, or interpret anyone's test results or scans. I am nobody's doctor here: reading these pages, writing to me, or speaking with me does not create a doctor and patient relationship between us.
What I write is general and is not tailored to you. It is not a substitute for examination, diagnosis, or treatment by a clinician who knows you and is licensed to practice where you live.
Talk to your own doctor before you change anything about your health. This matters even more if you live with a chronic condition, take regular medication, or are pregnant. Never delay seeing your doctor because of something you read here.
Please do not send me your symptoms, your diagnosis, the medication you take, or your test results. Email is not a secure medical channel, and I do not need that information.
Do not use this site in an emergency. Call 112 in Türkiye, or the local emergency number wherever you are.
What I write reflects my own views only. It is not the position of any organization I work for now or have worked for in the past.