INFORMATION TEXT ON THE PROCESSING OF PERSONAL DATA
“Clarification Text”
In accordance with the provisions of the Personal Data Protection Law No. 6698 (“KVKK”) and the European Union General Data Protection Regulation (GDPR). Merkez Mahallesi Palazoğlu Sokak Eren Palas Apt.
Dr. Ahmet Demir, operating at the address No:5-7 Floor:2 Daire:9 Şişli/İstanbul, and the Practice he runs (hereafter referred to as Physician/Practice/Employer) in the capacity of Data Controller, your personal information within the framework explained below; will be recorded, stored, updated, and may be disclosed to third parties where the legislation allows,
It can be transferred, classified and processed in the ways listed in KVKK and GDPR, and we inform you about our mutual rights and obligations within the scope of the said legal regulation.
Within the scope of the legal legislation, we will record, store and process your personal information in our archives, which is necessary to establish the Doctor-Patient relationship and to provide you with health services (diagnosis, treatment, care services, etc.) in line with the benefit of the patient and public health, -Private Hospitals Law, Private Hospitals Regulation,
To record the identity, address, telephone, medical history and all other necessary information to determine the patient's information so that we, as our Practice, can provide you with health services within the scope of the Health Practice Communiqué, Patient Rights Regulation and other legislation; We are obliged to arrange all records and documents in the medical patient file that will be the basis for the transaction in electronic or paper format,
-For the purpose of public health and preventive medicine services, the Ministry of Health of the Republic of Turkey, Provincial Health Directorates, Public Health Centers and other units affiliated to the Ministry of Health, the Social Security Institution and, if you use your private health insurance, your insurance company may request it from the competent authorities, including but not limited to these institutions. persons appointed by the competent authorities
If requested by or within the scope of e-pulse and similar systems established by us or within the scope of our notification and/or reporting obligation imposed on us
We inform you that your personal data will be shared with the relevant authorities and individuals.
PURPOSES OF PROCESSING OF PERSONAL DATA, METHODS OF COLLECTION AND LEGAL REASONS
Your personal data, establishment of physician-patient relationship,
to perform and fulfill the terms of the contract, to use it in the services we can offer you;
To record other necessary information, including identity, address, tax number and personal health data, to identify the information of the person who carries out the transaction/transaction; To organize all records and documents that will be the basis for the transaction in electronic (internet/mobile etc.) or paper media; To comply with the information storage, reporting and information obligations stipulated by the legislation, competent institutions and other authorities; In order to increase the service quality through service activities, to offer requested / other products / services, and your special personal data are processed for communication, providing information and similar processes within the contractual relationship.
Your blood type, laboratory and imaging results, analyses, allergies, chronic diseases, venereal diseases, infectious diseases, data regarding previous surgeries/operations, your e-pulse information, medications you constantly use, information regarding Covid-19 disease, your medical treatments. Your prescription information, unhealthy habits, body analysis and death information, and other health data and other personal data required for the treatments and applications to be applied to you; To be able to create a patient file, to carry out preventive medicine, examination, medical diagnosis, treatment and care services, to carry out your checks after medical diagnosis and treatment processes, to manage complication processes that may occur, to communicate with you one-on-one, to manage appointment processes, to perform patient satisfaction and demand management, to perform legal and To be able to fulfill contractual obligations, information regarding your health data that must be kept in accordance with the relevant legislation within the specified periods.
to be able to receive consultation services from other relevant specialist physicians when necessary in order to carry out your treatment correctly, to fulfill legal obligations in accordance with the legislation within the scope of health tourism, to plan transfer, accommodation and translator services for patients/clients coming within the scope of health tourism, to announce innovations in medical treatment and practices. To be able to inform third parties about the medical procedure applied, to plan and manage health services and financing, to ensure workplace safety, to fulfill the responsibilities arising from the legal relationship established between the doctor and the patient, to fulfill financial and administrative obligations, to ensure technical and commercial security and public obligations. is processed in order to fulfill it. Your above-mentioned Personal Data and Special Personal Data will be processed in line with the above-mentioned purposes and legislation in order to carry out the examination, preventive medicine, medical diagnosis, treatment and medical practices to be applied to you and to fulfill the obligations related to your treatment. If you do not provide your relevant personal data, the legal obligations imposed on the Physician and the practice that will provide service in your medical treatment will not be fulfilled properly and your treatment and/or recovery processes will not be carried out successfully. Other scopes in which your personal data may be processed are as follows: HR operations, Intra-office operations, Activities with legal, technical and administrative consequences, Strategy, planning and business partners/suppliers, customer management, customer satisfaction, Planning and execution of corporate communication activities, events, planning and execution of in-office training programs, Performance of the Office Workplace Safety, Protection of Worker and Occupational Health and Safety, services, Performance of Technical Service Services, Carrying out collection transactions, Providing customers with product-service promotion, information, personalized advertisements, campaigns and other benefits, sending all kinds of service and commercial electronic messages, survey applications, providing various advantages through statistical analyses, Carrying out studies to improve service quality and providing better service, Issuing invoices in return for our treatments, Procurement of services from external sources, Providing customers with the benefits of expert organizations in order to receive services on issues that are not within their area of ​​expertise and to receive technology services, Utilizing due to the requirements of the office activities. Identity confirmation, Responding to questions and complaints, Taking the necessary technical and administrative measures within the scope of data security, Ensuring financial agreement with relevant business partners and other third parties regarding the products and services offered, Providing the necessary information in line with the requests and inspections of regulatory and supervisory institutions and official authorities, Preserving information regarding data that must be stored pursuant to the relevant legislation, Ensuring inspection regarding the consistency of information, Measuring customer satisfaction, For employees; Creating a personnel file, determining whether the employee is competent to continuously fulfill the requirements of the job, making private health insurance, creating a health file, taking occupational safety measures, making travel plans. For job candidates: Managing and planning the process of evaluating suitability for open positions. Publishing the visual and audio data of the Practice and its employees and stands obtained from the competitions, organizations, fairs, studies and other activities within the scope of its field of activity for the purpose of developing and sharing the work, Fulfilling legal obligations, Execution/follow-up of the Practice's financial reporting and risk management processes, Execution/follow-up of legal affairs, Creation and follow-up of patient records. Planning and execution of the use of machinery and equipment by employees. Planning and execution of procurement transactions. Planning and execution of collection transactions. Planning and execution of the use of the Practice's internet, shared network and computers in accordance with the law. Planning and execution of the Practice's fairs, activities, social projects, product and corporate promotions. The above mentioned purposes are for informational purposes only, and any additional information that may be added by us to enable the Practice to carry out its future operational activities will be announced with the updates. Your Personal Data, depending on the health service provided;
• By coming to the Physician and his/her Office for examination and treatment, and through your health reports, laboratory and imaging results, analyses, health reports and statements regarding your health data that you submit so that a medical evaluation can be made regarding the treatment to be applied to you,
• By filling out the “Patient Information and Consent Form” regarding the treatment to be applied by the Physician and his/her Office,
• Through the communication form you fill out on the corporate website of the Physician and his/her Office,
• Through e-mails you send to the corporate e-mail address of the Physician and his/her Office,
• Through photo/video recordings recorded before, after and/or during the medical procedure applied to you in the Doctor's Office, .Upon your request and when necessary; In order for the Doctor and the Practice to perform your online diagnoses and checks via remote access, by accepting their own Privacy Policies and Foreign Transfer Principles, by using remote connection application service providers (whatsapp/zoom.us/facetime/skype/messanger/google/instagram/facebook etc.) from which you receive service, by means of your written/voice/visual (photo and/or video recording) messages you send to the Doctor and the Practice and the online voice/video calls you establish through these applications,
• By accepting their own Privacy Policies and Foreign Transfer Principles, by sending direct messages to the profile accounts of the Doctor and the Practice on social media accounts whose servers are located abroad (instagram, youtube, facebook, twitter, linkedin etc.) of which you are currently a user, and by commenting on their posts,
• By accepting their own Privacy Policies and Foreign Transfer Principles, by accepting their own Privacy Policies and Foreign Transfer Principles, by means of your social media accounts whose servers are located abroad, of which you are currently a user, It is processed through the information you provide by allowing it to be processed automatically through panels such as “contact us” or “get information” in the promotions and advertisements made by the Doctor and the Clinic through media accounts (instagram, youtube, facebook, twitter, linkedin, google etc.).
Article 5/2 of the KVKK regulates exceptions that enable the lawful processing of personal data. In this context, the clinic may process personal data in the event that one of the other conditions (exceptions) listed below exists, in addition to explicit consent. The basis for personal data processing activity may be only one of the conditions specified below, or more than one of these conditions may be the basis for the same personal data processing activity.
These are: It is clearly foreseen by the laws, It is mandatory to process personal data in order to protect the life or physical integrity of the person who is unable to give his/her consent due to a de facto impossibility or whose consent cannot be recognized as valid, or of another person, It is directly related to the establishment or performance of a contract, The practice fulfills its legal obligation, The personal data owner makes his/her personal data public, Data processing is mandatory for the establishment or protection of a right, Data processing is mandatory for the legitimate interests of the practice, provided that it does not harm the fundamental rights and freedoms of the data owner.
In addition, according to GDPR article 9/2/h, article 6/1/b, article 6/1/f, your data may be processed without requiring an explicit declaration of consent. Situations: In order to carry out examination, medical diagnosis, treatment and care services, your Health Data, which is considered as Special Personal Data, will be processed by the Practice, which is under a confidentiality obligation under the Law, without your explicit consent.
• In order to carry out your checks after medical diagnosis and treatment processes, to be able to communicate with you one-on-one, and to manage appointment processes, your Personal Data will be processed by the Practice without your explicit consent.
• In order to ensure patient satisfaction and demand management, your Personal Data will be processed by the Practice without your explicit consent.
According to GDPR article 6/1/c, your Personal Data will be processed without your explicit consent in the following cases based on legal obligations;
• Creating a patient file.
• Preserving information regarding your health data that must be stored in accordance with the relevant legislation.
• Checking your fee payments and issuing invoices.
• Making tax payments.
• Fulfilling obligations in accordance with the Ministry of Health Legislation.
• Fulfilling obligations in accordance with the Health Tourism Legislation.
• Ensuring your data security.
• Fulfilling legal obligations before Judicial Authorities.
• Fulfilling administrative obligations before Administrative Institutions and Organizations.
PERSONS/ORGANIZATIONS TO WHICH PERSONAL DATA MAY BE TRANSFERRED:
Persons, public institutions and organizations and private public institutions and organizations permitted by the provisions of the legislation, health institutions with which the physician and his/her office have an agreement, and medical laboratories and persons, institutions and organizations in case of consultation. Sensitive personal data may be transferred to places in Turkey and abroad where services are received in order to carry out activities subject to the purposes specified in the legislation we are subject to and secured by confidentiality agreements, to carry out insurance and finance activities and to provide insurance and finance services. Personal and special personal data are stored in a secure environment that is not open to general use
and are never shared with third parties unless there is permission or a legal obligation. Your Personal Data and Sensitive Personal Data collected in accordance with the conditions and purposes included in the Personal Data Processing Conditions specified in Articles 5 and 6 of the KVKK No. 6698; In accordance with Articles 8 and 9 of the LPPD, the Physician and his/her practice may transfer your personal data to third parties and institutions for the purposes of conducting and developing examination, preventive medicine, medical diagnosis, treatment and care services, receiving consultation services from other specialist physicians when necessary, fulfilling administrative obligations related to health tourism legislation, planning transfer, accommodation and translation services for patients coming within the scope of health tourism, communicating with patients, managing check-up appointment processes, planning and managing health services and financing, fulfilling responsibilities arising from the legal relationship established between the physician and the patient, fulfilling financial, legal and administrative obligations, ensuring technical and commercial security and fulfilling public obligations, and promoting the medical services provided, provided that the necessary confidentiality agreements are concluded and all administrative and technical security measures are provided in accordance with the legislation, to the extent sufficient for the realization of the purpose. In this context, your Personal Data processed by the Physician and his/her Practice;
• To other specialist physicians for consultation purposes,
• To Insured Employees,
• To Suppliers,
• To Financial Advisors, Tax and Finance Advisors and Auditors,
• To Legal Advisors,
• To Database (Server) Providers,
• To “Practice Management Software” Service Providers,
• To Web Consultants,
• To Translators,
• To Data Protection Officers,
• To IT Consultants,
• To Tourism Agencies,
• To associations and institutions and organizations such as the Turkish Pharmacists Association, General Directorate of Population, General Directorate of Security and other law enforcement forces, etc.,
• To Public Institutions and Organizations authorized by law,
• To Judicial Authorities.
STORAGE OF PERSONAL DATA
The method of collecting personal data; your personal data can be collected verbally, in writing or electronically through all digital channels such as questions sent to our website, messages, phone calls.
The personal data we obtain is stored securely in a physical or electronic environment for an appropriate period of time in order for the Physician and his/her Practice to perform their activities. Within the scope of these activities, the Physician and his/her Practice comply with the obligations stipulated in all relevant legislation, especially the KVKK, regarding the protection of personal data.
In accordance with the relevant legislation, except for cases where the storage of personal data for a longer period is permitted or made mandatory, in the event that the purposes for which personal data is processed are terminated, the Physician and his/her Practice will delete, destroy or anonymize the data ex officio or upon the request of the data owner and upon the request of the data owners using different techniques that can be used. If personal data is deleted through the methods in question, these data will be destroyed in a way that they cannot be used again and cannot be retrieved.
In cases where the data controller has a legitimate interest, personal data may be stored, provided that the purpose of processing and the periods specified in the relevant laws have expired, provided that they do not harm the fundamental rights and freedoms of the data owners. After the expiration of the aforementioned limitation period, personal data will be deleted, destroyed or anonymized according to the procedure specified above.
MEASURES TAKEN FOR DATA SECURITY
The Practice takes all necessary technical and administrative measures to ensure the appropriate level of security required for the protection of personal data. Article 12(1) of the KVKK. The measures foreseen in Article 1 are as follows: To prevent unlawful processing of personal data, To prevent unlawful access to personal data, To ensure the preservation of personal data.
PROCESSING OF IMAGE RECORDINGS
In order to ensure the general and service security of the facilities and businesses of the building where the clinic is located, the video recording of visitors, employees and other relevant persons is taken in accordance with the basic principles stipulated in the KVKK. PROCESSING OF PERSONAL DATA OF BUSINESS PARTNERS
Within the scope of the activities it has established with business partners such as medical laboratories, product purchase/sale suppliers, the personal data of the employees of the business partners may be processed in order to fulfill the work or to ensure the operation of the service activity with the purposes specified in the law, to fulfill the human resources objectives and policies, and to fulfill the legal and commercial security of mutual work.
APPLICATION PROCEDURE AND RIGHTS
Your rights pursuant to Article 11 of the KVKK; We hereby inform you that by applying to us, you have the right to; a) learn whether your personal data has been processed, b) request information about it if processed, c) learn the purpose of processing and whether it is used in accordance with its purpose, ç) know the third parties to whom it has been transferred domestically/abroad, d) request correction if it has been processed incompletely/incorrectly, e) request deletion/destruction within the framework of the conditions stipulated in Article 7 of the KVKK, f) request notification of the transactions made pursuant to clauses (d) and (e) listed above to the third parties to whom it has been transferred, g) object to the emergence of a result against you due to analysis exclusively by automated systems, ğ) request compensation from our Practice in the event that you suffer damages due to processing in violation of the law.
Your requests in your application will be finalized free of charge within thirty days at the latest, depending on the nature of the request. However, if the process requires an additional cost for the Practice, the fee specified in the tariff specified in the Communiqué on the Procedures and Principles of Application to the Data Controller by the Personal Data Protection Board may be collected. In accordance with Article 13, paragraph 1 of the KVKK, Personal Data Rights Owners may make their request to exercise their specified rights through the methods and information specified in the Communiqué on the Procedures and Principles of Application to the Data Controller published in the Official Gazette dated March 10, 2018 and numbered 30356. Exceptions to the Right to Apply According to Article 28 of the Personal Data Protection Law, it will not be possible for personal data owners to assert their rights in the following matters.
• Processing of personal data for purposes such as research, planning and statistics by making it anonymous with official statistics
• Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, privacy or personal rights or does not constitute a crime
• Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order, economic security
. Processing of personal data by judicial authorities or enforcement authorities regarding investigation, prosecution, trial or execution procedures
According to Article 28/2 of the Personal Data Protection Law; Article 10, which regulates the data controller's obligation to inform, provided that it is in accordance with the purpose and basic principles of the law and is proportionate, Article 11, which regulates the rights of the relevant person, excluding the right to demand compensation for damages, and Article 16, which regulates the obligation to register in the Data Controllers Registry, shall not apply in the following cases:
• Personal data processing is necessary for the prevention of a crime or for a criminal investigation
• Personal data processing made public by the personal data owner himself
• Personal data processing is necessary for the performance of supervisory or regulatory duties by authorized public institutions and organizations and professional organizations with the status of public institution, based on the authority granted by the law, and for disciplinary investigations and prosecutions
• Personal data processing is necessary for the protection of the state's economic and financial interests regarding budget, tax and financial matters
RIGHTS OF DATA SUBJECTS IN ACCORDANCE WITH GDPR As a Data Subject, your Personal Data is also protected under the GDPR. In cases where the GDPR falls within its jurisdiction (European Union citizens or residents of European Union countries), the rights of Data Subjects are as follows;
• Right to Access (GDPR Article 15): The Data Subject has the right to verify whether personal data relating to him/her is being processed by applying to the Clinic, and to learn the details in GDPR Article 15 if personal data is being processed.
• Right to Rectification (GDPR Article 16): The Data Subject has the right to have his/her personal data, which is held by the Practice and has changed, corrected at any time by applying.
• Right to Erasure (GDPR Article 17): The Data Subject has the right to request the deletion of his/her personal data held by the Practice. If the issues specified in Article 17 of the GDPR occur, the Practice will delete your personal data without delay.
• Right to Restriction of Processing (Article 18 of the GDPR):
• If Data Subjects object to the currency of their Personal Data, they have the right to request that the use of the data be restricted until the Practice verifies the accuracy of the Personal Data.
• If the Data Subject requests the deletion of their Personal Data due to the illegality of the processing activity, they have the right to request that the use of the data be restricted until the request is fulfilled.
• If the Data Subject no longer needs their personal data for the purposes of processing, they have the right to request that the use of their data be restricted.
In cases where Data Subjects object to processing activities in accordance with Article 21/1 of the GDPR, they have the right to request that the use of their data be restricted until it is verified whether the Practice’s legitimate reasons for processing outweigh the Data Subject’s legitimate reasons.
• Right to Data Portability (GDPR Article 20): The Data Owner has the right to request that the Personal Data held by the Practice be transferred to another controller at any time, if technically possible. However, this right can be exercised when the data processing is based on consent or in cases required by the contract.
• Right to object (GDP Article 21)
The data owner has the right to object to the processing of Personal Data based on grounds related to his/her particular situation within the scope of GDP Article 6/1 /e and (f).
We would like to inform you that we continue our activities with the awareness that personal data security is at the forefront in all the products and treatments we offer you.
CONSENT and APPROVAL
By reading and accepting this Disclosure Text, you are deemed to have accepted, declared and undertaken that you have full and complete information about the data processing process carried out by the Physician and his/her Practice, that you have learned about your rights regulated by the KVKK and GDPR, and that you have freely and freely consented to the PROCESSING of your Personal Data and Special Personal Data by the Physician and his/her Practice within the scope of this Disclosure Text.