LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA CLARIFICATION TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA
Dear visitor,
The purpose of this clarification text on the Protection and Processing of Personal Data is to prevent unlawful disclosure of all kinds of personal data belonging to all real persons associated with our Clinic, including persons who benefit from our Clinic products and services or who contact our Clinic to benefit from them, our employees, employee candidates and business partners, in accordance with the relevant laws and regulations, unlawful disclosure of personal data in accordance with Article 12 of the Personal Data Protection Law, unlawful access to personal data, In order to prevent the transfer of personal data or any data security breaches that may occur in any way, it is to inform the data subject within the scope of fulfilling the obligation to inform in accordance with Article 10 of the Law that the necessary measures have been taken, that in this context, as the data controller, it takes administrative and technical measures to ensure the highest level of security for the protection of the personal data of the data subject in accordance with the legislation published and / or to be published, and that it conducts audits or have them done.
1. Data Controller
Pursuant to the Law No. 6698 on the Protection of Personal Data, the data controller for the processing of your personal data is Op. Dr. Esra Çabuk Cömert, who is located at the address "Beştepe Mahallesi Yaşam Caddesi No:13/A 82" and registered to Maltepe Tax Office with the tax number 26408397818.
In the capacity of data controller; your personal data, which are shared with us directly and / or indirectly, requested by visiting our clinic and / or our website or by calling our call center or by our call center's call, in connection with the purpose of processing, limited and measured, within the framework of the purpose that requires their processing; can be recorded, stored, retained, reorganized, shared with institutions authorized by law to request such personal data, transferred to domestic or foreign third parties in the cases and conditions stipulated by the Law, transferred, classified, deleted at the request of the person concerned and processed in the ways listed in the Law.
2. Personal Data to be Processed
Your personal data to be processed by the data controller is your data that means "any information relating to an identified or identifiable natural person" as defined in the KVKK. Within the scope of the same Law, sensitive personal data refers to "data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data".
With the consent of patients/visitors, our Clinic may obtain, classify, record and store personal or special categories of personal data in whole or in part according to the purpose of obtaining personal data or for the period stipulated by the provisions of the relevant law.
Accordingly, your personal data categories and their contents, including but not limited to the following, are as follows:
Credentials
Name, surname, Turkish ID number, SSI registration number, signature, marital status, identity card serial and sequence number, date of birth, place of birth, ID, driver's license, occupation, photocopy of passport.
Contact data
Phone number, e-mail address, residence address.
Financial data
Your bank account number, IBAN number, billing information.
Insurance Data
Your data related to private health insurance and Social Security Institution data for the purpose of financing and planning health services.
Special categories of personal data
(Your medical data)
All kinds of personal data relating to health and sexual life obtained during or as a result of the execution of medical diagnosis, treatment and care services, including but not limited to your laboratory results, test results, examination data, appointment information, check-up information, measurements, drawings, various molds, prescription information.
Audio and visual recordings
Two – and 3–dimensional photos and video recordings taken before - during - after the operation.
Family and relatives data
Patient relatives name, surname, contact information, family health information, although required for patient history.
Physical space security
Camera footage.
3. Purpose of Processing of Personal Data
Your personal data and, in case of explicit consent, your special categories of personal data are processed by the data controller for the purposes and legal reasons specified below, but not limited to these and, if necessary, for similar purposes and reasons, within the personal data processing conditions specified in Article 5 and Article 6 of the KVKK and within the purposes and conditions limited to the purposes and conditions in accordance with the principles and periods specified in the VERBIS record of our Clinic.
In this context, the purpose of processing your personal data include:
• Fulfilling our legal obligations,
• Service requirement provided by our clinic to confirm your identity,
• Protection of public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and financing,
• Sharing the requested information with the Ministry of Health and other public institutions and organizations in accordance with the relevant legislation,
• Planning and managing the internal functioning of the clinic and daily operations,
• Measuring, increasing and researching patient satisfaction,
• Supply of medicines and medical devices,
• Ability to inform you about the appointment if you make an appointment,
• Conducting analysis, conducting research for the purpose of improving health services,
• Participation in campaigns and providing campaign information by our outpatient clinic,
• The ability to design and transmit special content, concrete and abstract benefits on web and mobile channels,
• The ability to make billing.
4. The Method of Collection of Personal Data and its Legal Reason
Your personal data can be collected by various methods based on Information Technologies, through a call center, website, social media channels, mobile applications and similar means verbally, in writing or electronically, including GSM technologies.
In addition, in line with the purposes of processing personal data, personal data are processed based on and limited to at least one of the personal data processing conditions stipulated in Articles 5 and 6 of the Law, in accordance with the general principles and periods specified in the Law and our company's VERBIS record, especially the principles specified in Article 4 of the Law.
Mandatory Principles to be Followed in the Processing of Personal Data
• Processing in Accordance with the Law and the Rule of Honesty
• Ensuring that Personal Data is Accurate and Up-to-Date When Necessary
• Processing for Specific, Clear and Legitimate Purposes
• Being Connected, Limited and Restrained with the Purpose for which they are Processed
• Retention of Personal Data for the Period Stipulated in the Relevant Legislation or Necessary for the Purpose for which They are Processed Processing Conditions
According to Article 5 of the Law, personal data cannot be processed without the explicit consent of the data subject. The Explicit Consent of the Personal Data Owner must be related to a specific issue and must be disclosed by free will based on being informed. In the presence of one of the following conditions, it is possible to process personal data without seeking the explicit consent of the person concerned.
a. Clearly Stipulated in the Laws
b. Failure to Obtain the Explicit Consent of the Person Concerned Due to Actual Impossibility
c. Having a Direct Interest in the Establishment or Execution of a Contract
d. To Fulfill the Legal Obligation of the Data Controller
e. Publicized by the Relevant Person Himself / Herself
f. The Necessity of Data Processing for the Establishment or Protection of a Right
g. Mandatory Data Processing for the Legitimate Interest of the Data Controller
Processing of Personal Data of a Special Nature
Article 6 of the Law defines race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership to associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, and biometric and genetic data as sensitive personal data and stipulates that it is prohibited to process sensitive personal data without the explicit consent of the data subject. Accordingly, personal data of special nature are processed by the data controller in accordance with the principles set out in this Clarification Text and by taking all necessary administrative and technical measures, including the procedures and principles to be determined by the Board, and in the presence of the following conditions:
a. Personal data of a special nature other than health and sexual life: may be processed without seeking the explicit consent of the data owner in the conditions clearly stipulated in the laws. In all other cases and situations, the explicit consent of the data owner will be obtained in order for the processing of such special personal data.
b. Private personal data related to health and sexual life: however, for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and maintenance services, planning and management of health services and financing, may be processed by persons or authorized institutions and organizations under the obligation to keep secrets without seeking the explicit consent of the relevant person.
Your personal data, which are considered among your personal data of a private nature, other than health and sexual life, may only be transferred to the natural or legal persons listed above without seeking your explicit consent in accordance with the provisions provided for in the Decrees. Your personal data related to health and sexual life can only be transferred to the natural or legal persons listed above without seeking your explicit consent in order to fulfill our legal obligations contained in the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, as well as the Personal Data Protection Law No. 6698, the Basic Law on Health Services No. 3359, the Regulation on Personal Health Data dated 21.06.2019 and other relevant legislation. Electronic Medical Records and Electronic Health records are also included in this scope.
In all other cases and situations, the explicit consent of the data owner will be obtained in order for the processing of such special personal data. In the processing of personal data of a special nature, it is also necessary to take adequate measures determined by the Board.
Deletion, Destruction or Anonymization of Personal Data
According to Article 7 of the Law, although it has been processed in accordance with the provisions of this Law and other relevant laws, personal data is deleted, destroyed or brought anonymously by the data controller ex officio or upon the request of the person concerned, in case of the elimination of the reasons requiring its processing. Within this scope, our Clinic stores personal data only for as long as it is mandatory and necessary for the purpose specified in the relevant legislation or for which they are processed. In the event that the period expires or the reasons requiring processing disappear, personal data will be destroyed by means of destruction methods (deletion and/or destruction and/or anonymization) determined in accordance with the periodic destruction periods or the application of the data subject, if any. In personal data processing activities, we act in accordance with the general principles specified in Article 4 of Law No. 6698.
5. Transfer of Personal Data
The Law stipulates regulations on the transfer of personal data in parallel with the regulations on the Processing of Personal Data. According to Article 8 of the Law:
Personal data cannot be transferred without the explicit consent of the person concerned. Even without the explicit consent of the personal data owner, if one or more of the following conditions exist, personal data may be transferred to third parties by our Polyclinic with due care and by taking all necessary security measures with the methods stipulated by the Board. The relevant activities regarding the transfer of personal data are clearly stipulated in the laws,
• The transfer of personal data by our Clinic is directly related to the establishment or performance of a contract and is necessary,
• The transfer of personal data is mandatory for our Outpatient Clinic to fulfill its legal obligation,
• Transfer of personal data by our Clinic on a limited basis for the purpose of publicization, provided that it has been made public by the data owner,
• The transfer of personal data by our Clinic is mandatory for the establishment, use or protection of the rights of our Clinic or the data owner or third parties,
• It is mandatory to carry out personal data transfer activities for the legitimate interests of our Clinic, provided that they do not harm the fundamental rights and freedoms of the data owner,
• It is necessary for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid.
According to Article 9 of the Law, personal data cannot be transferred abroad without the explicit consent of the data subject.
6. Rights of the Personal Data Owner
As a personal data owner within the scope of Article 11 of KVKK you have the following rights;
• To learn whether your personal data has been processed or not,
• If your personal data has been processed, requesting information about it,
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom your personal data are transferred at home or abroad,
• To request correction of your personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to the third parties to whom the personal data are transferred,
• Although it has been processed in accordance with the provisions of Law No. 6698 and other relevant laws, to request the deletion or destruction of your personal data in the event that the reasons requiring its processing disappear and to request notification of the transaction made within this scope to third parties to whom your personal data has been transferred,
• Objecting to the occurrence of a result against you by analyzing your processed data exclusively through automated systems,
• You have the right to request compensation of the damage in case you suffer damage due to the unlawful processing of your personal data.
In accordance with paragraph 1 of Article 13 of the KVKK, as personal data owners, you can submit your requests regarding your rights to our Polyclinic in writing or by other methods determined by the Personal Data Protection Board. You can access the application information text and application form, which explains the channels and procedures to submit your application, on our website or you can request it from us
In the event that the personal data owner duly submits his/her request regarding the rights to us, we will finalize the relevant request free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board. In cases where the application is rejected, the response is found insufficient or the application is not responded to in due time; You can file a complaint to the Personal Data Protection Board within thirty days from the date you learn our response and in any case within sixty days from the date of application.
For our visitors/patients who are citizens of the European Union and other foreign countries, information and clarification will be made with the help of an English translation of the text or an interpreter upon request.
The present Clarification Text on the Processing of Personal Data, which is prepared in accordance with the provisions of Law No. 6698 and other relevant legislation current as of the date of publication, is submitted for your information.
Best regards.