سياسة ملفات الارتباط

PROCESSING AND PROTECTION OF PERSONAL DATA POLICY

1. PURPOSE AND SCOPE

Mansuroglu, EGE Sun Plaza, 295/2. sc. No: 1/F, 35535 Bayraklı/İzmir, Gynecology and Obstetrics Specialist Dr. As Sultan Buğday (to be referred to as a Physician/Clinical/Clinical Office/employer below), in accordance with the Law on the Protection of Personal Data No. 6698, which is regulated as a constitutional right, and the provisions of the European Union General Data Protection Regulation (GDPR); While carrying out our activities, we attach importance to the protection of personal data of all natural persons we come into contact with in any way and to fulfill the requirements of the KVKK in this context.

This Personal Data Protection Policy; personal data, Mansuroğlu, EGE Sun Plaza, 295. Sk. No: 1/F, 35535 Bayraklı/İzmir, Gynecology and Obstetrics Specialist Dr. It has been prepared by Sultan Buğday to inform you about its collection, use, sharing and storage processes. In the process of processing and protecting personal data; The provisions of the relevant legislation in force will be applied with priority.

In this context, the main purpose of this Personal Data Protection and Processing Policy (“Policy”) is; To reveal the rules, measures, duties and responsibilities within the scope of the personal data protection legislation adopted by the physician and his practice with a methodological approach and to ensure transparency in the measures we apply for the protection of personal data in this context.

2. DEFINITIONS AND ABBREVIATIONS

The terms used in the application of this Policy have the meanings given below.

Employees: Refers to the physician and the employees of his practice.

Contact Person: It is the person responsible for following the personal data processing activities within the body of the Physician and his practice and the implementation of the KVK Policies and Procedures on an individual basis.

Personal Data: It means all kinds of information related to an identified or identifiable natural person.

E.g; name, surname, address, telephone number, date of birth, place of birth, eye color, T.R. identification number.

Personal Data Owner: The real person whose personal data is processed. E.g; employee, visitor, customer,

Interested Person

Processing of Personal Data: All kinds of operations performed on personal data, which are fully or partially automated or non-automatic, provided that they are part of any data recording system. E.g; acquire, save, store, change, transfer.

KVK Law: Refers to the Law on Protection of Personal Data No. 6698.

GDPR: European Union General Data Protection Regulation

3. PRINCIPLES OF PROCESSING PERSONAL DATA

Physician and his practice processes personal data in accordance with the procedures and principles stipulated in the KVKK and other laws.

The following principles are complied with in the processing of personal data:

a) Compliance with the law and honesty rules:

The Physician and his practice processes personal data in accordance with the provisions of the legal legislation, the law and the rules of honesty. It informs the personal data owners.

b) Being accurate and up-to-date when necessary:

The Physician and his practice take the necessary measures to ensure that the personal data they process are accurate and up-to-date.

c) Processing for specific, explicit and legitimate purposes:

The Physician and his practice determines the legitimate and lawful purpose of processing personal data clearly and precisely. The Physician and his practice processes personal data in connection with the service they are providing and as much as is necessary for them.

ç) Being connected, limited and proportional to the purpose for which they are processed:

The Physician and his practice processes personal data for the realization of the purposes determined within the scope of the service it provides, and refrains from receiving, processing and storing personal data that is not necessary for the realization of the purpose.

d) Preservation for the period required by the relevant legislation or for the purpose for which they are processed:

The Physician and his practice store personal data in accordance with the provisions of the legal legislation. At the end of the period, personal data is deleted, anonymized or destroyed.

PERSONAL DATA PROCESSING CONDITIONS:

While processing personal data, the Physician and his practice comply with the following conditions in line with the provisions of the KVKK No. 6698:

Personal data cannot be processed without the explicit consent of the person concerned.

Personal data is only processed with the express consent of the data owner/relevant person. In this direction, patients are informed about the subject and their explicit consent based on free will is obtained.

(2) In case of existence of one of the following conditions, it is possible to process personal data without seeking the explicit consent of the data subject:

a) It is clearly stipulated in the laws.

b) It is compulsory for the protection of life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally valid.

c) It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract.

ç) It is mandatory for the data controller to fulfill its legal obligation.

d) The person concerned has been made public by himself.

e) Data processing is mandatory for the establishment, exercise or protection of a right.

f) Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

PROCESSING CONDITIONS OF SPECIAL QUALITY PERSONAL DATA

Physician and his practice complies with the regulations specified in the KVKK No. 6698 in the processing of special quality personal data.

KVKK "ARTICLE 6- (1) Regarding the race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, disguise and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures data and biometric and genetic data are defined as “special quality personal data”.

Private personal data of the Physician and his practice;

Works with the express consent of the person concerned,

Personal data other than health and sexual life are processed without seeking the explicit consent of the person concerned, in cases stipulated by the laws,

Personal data related to health and sexual life are processed without seeking the explicit consent of the person concerned, for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, by persons or authorized institutions and organizations under the obligation of keeping confidentiality. .

METHODS OF COLLECTING AND PROCESSING PERSONAL DATA

In accordance with Articles 4, 5 and 6 of the Law on the Protection of Personal Data, and based on the Personal Data Processing Inventory, which must be regulated within the scope of Articles 5, 7, 9 and 10 of the Regulation and contain the information below, processes personal data of individuals.

Data category

Personal data processing purposes and legal reason

Transferred recipient/recipient groups

Data subject contact groups

The maximum retention period required for the purposes for which personal data is processed

Transfer to foreign countries

Administrative and technical measures taken regarding data security

THIRD PARTIES TO THE PERSONAL DATA TO BE TRANSFERRED BY THE PHYSICIAN AND THE PURPOSE OF THE TRANSFER

With regard to the sharing of personal data with third parties by the Physician and his practice, it carefully complies with the conditions set forth in the KVKK, without prejudice to the provisions of other laws. In this framework, personal data is not transferred to third parties by the Physician and Practice without the explicit consent of the data owner. However, in the presence of one of the following conditions regulated by the KVKK, personal data may be transferred by the Physician and his practice without obtaining the explicit consent of the data owner:

• It is clearly stipulated in the laws,

• It is compulsory for the protection of the life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally recognized,

• It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,

• It is mandatory for the data controller to fulfill its legal obligation,

• It has been made public by the data owner himself,

• Data processing is mandatory for the establishment, exercise or protection of a right,

• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data owner. Provided that adequate precautions are taken; stipulated in the laws in terms of special quality personal data other than health and sexual life, and in terms of special quality personal data related to health and sexual life,

• Protection of public health,

• Preventive medicine,

• Medical diagnosis,

• Carrying out treatment and care services,

• Your personal data may be transferred without obtaining explicit consent for purposes such as planning and management of health services and financing. In the transfer of sensitive personal data, the conditions specified in the processing conditions of this data are complied with.

In addition, cases where your data can be processed without seeking express consent in accordance with article 9/2/h, article 6/1/b, article 6/1/f GDPR:

In order to carry out examination, medical diagnosis, treatment and care services, your Health Data, which is considered as Special Quality Personal Data, will be processed by the Clinic, which is under the obligation to keep confidential as required by law, without your explicit consent.

Your Personal Data will be processed by the Clinic, without your explicit consent, in order to be able to carry out your controls after the medical diagnosis and treatment processes, to communicate with you one-to-one, and to manage the appointment processes.

In order to carry out patient satisfaction and demand management, your Personal Data will be processed by the Clinic without your explicit consent.

Pursuant to legal obligations pursuant to article 6/1/c of GDPR, your Personal Data will be processed without your explicit consent in the following cases;

Creating a patient file.

Preservation of information about your health data, which must be kept in accordance with the relevant legislation.

Issuing invoices by controlling your wage payments.

Execution of tax payments.

Fulfillment of obligations pursuant to Ministry of Health Legislation.

Fulfillment of obligations as per the Health Tourism Legislation.

Ensuring your data security.

Fulfillment of legal obligations before the Judicial Authorities.

Fulfillment of administrative obligations before Administrative Institutions and Organizations.

STORAGE OF PERSONAL DATA UNDER RELATED LEGISLATION

The personal data of the Physician and his practice are safely stored in physical or electronic environment for an appropriate period of time in order for our company to carry out its activities in accordance with the provisions of the KVKK and other relevant laws. First of all, it examines whether there is a period for the storage of personal data and acts in accordance with this period. In the absence of a legal period, the required period is determined and personal data is stored in accordance with this period. When the period expires, personal data is deleted, destroyed and anonymized.

However, in cases where the data controller has a legitimate interest, personal data may be kept until the expiry of the general statute of limitations (ten years) regulated in the Code of Obligations, provided that it does not harm the fundamental rights and freedoms of the data subjects, despite the expiration of the purpose of processing and the periods specified in the relevant laws.

In this context, it provides necessary training to the relevant units within the Physician and Practice and provides awareness.

MEASURES TAKEN FOR DATA SECURITY

The Physician and his practice take all necessary technical and administrative measures to ensure the appropriate level of security required for the protection of personal data.

12 (1) of KVKK. The measures envisaged in the article are:

• To prevent the unlawful processing of personal data,

• To prevent unlawful access to personal data,

• To ensure the protection of personal data.

The measures taken by the Physician and his practice in this context are listed below:

Administrative Measures

• Physician and his practice makes the necessary inspections in order to ensure the implementation of the provisions of the Law.

• In case the processed personal data is obtained by others illegally, the Physician and Practice notifies the relevant person and the Board as soon as possible.

• Regarding the sharing of personal data, framework agreements with the persons to whom personal data are shared, consent forms and the data subject provide data security with explicit consent forms or provisions to be added to the agreements.

• Employs knowledgeable and experienced personnel about the processing of personal data and provides necessary KVK training to its personnel.

Technical Measures

• The Physician and its Practice employs knowledgeable and experienced people to ensure data security and provides the necessary KVK training to its personnel.

• Performs necessary internal controls within the scope of established systems.

• It ensures the provision of the technical infrastructure to prevent and/or monitor the leakage of personal data outside the institution and the creation of relevant matrices.

KVKK of PERSONAL DATA OWNERS11. RIGHTS ACCORDING TO ARTICLE:

Within the framework of Article 11 of the Law on the Protection of Personal Data No. 6698 (KVKK), personal data owners apply to the address of the Physician and Practice;

a-Learning whether personal data is processed,

b- If personal data has been processed, requesting information about it,

c- Learning the purpose of processing personal data and whether they are used in accordance with the purpose,

ç- Knowing the third parties to whom personal data is transferred in the country or abroad,

d- Requesting correction of personal data if it is incomplete or incorrectly processed,

e- Requesting the deletion or destruction of personal data in accordance with the provisions of KVKK and other relevant legislation,

f- In case of correction, deletion or destruction of your personal data, requesting the notification of these transactions to the third parties to whom the personal data has been transferred,

g- Objecting to this result if a result arises against you by analyzing your processed personal data exclusively through automated systems,

ğ- In case you suffer damage due to unlawful processing of personal data, it has the right to demand the compensation of the damage.

RIGHTS OF DATA OWNERS ACCORDING TO GDPR

As the Data Owner, your Personal Data is also protected in accordance with the GDPR. In cases where GDPR is under jurisdiction (European Union citizens or residents of European Union countries), the rights of Data Subjects are as follows;

Right of Access (GDPR Article 15): The data owner has the right to confirm whether the personal data relating to him is processed or not, by applying to the Clinic, and to learn the details in Article 15 of GDPR in case personal data is processed.

Right to Rectification (GDPR Article 16): The Data Owner has the right to have his/her personal data, which is under the responsibility of the Clinic, corrected at any time by applying.

Right to Deletion (GDPR article 17): The Data Owner has the right to request the deletion of his personal data held in the custody of the Clinic. If the issues specified in article 17 of GDPR occur, your personal data will be deleted by the Clinic without delay.

Right to Restriction of Processing (Article 18 GDPR):

If the Data Owners object to the up-to-dateness of their Personal Data, they have the right to request the restriction of the use of the data as the Data Owner, until the accuracy of the Personal Data is confirmed by the Clinic.

In cases where the Data Owner requests the deletion of his Personal Data due to the illegality of the Personal Data processing activity, he has the right to request the restriction of the use of the data until the request is fulfilled.

The Data Owner has the right to request that the use of his data be restricted in cases where his personal data is no longer needed for the purposes of the Clinic's processing.

In cases where the Data Subjects object to the processing in accordance with Article 21/1 of the GDPR, they have the right to request the restriction of the use of their data until it is verified whether the Clinic's legitimate reasons for data processing outweigh the Data Owner's legitimate reasons.

Right to Data Transfer (GDPR article 20): The Data Owner has the right to request the transfer of his Personal Data held in the custody of the Clinic to another controller, if technically possible. However, this right may be exercised when data processing is based on consent or when required by the contract.

.Right of Objection (GDP article 21)

We inform you that we continue our activities with the awareness that personal data security is at the forefront in all our products and services we offer.