PERSONAL DATA PROTECTION LAW (KVKK) INFORMATION NOTICE

KVKK INFORMATION NOTICE

Information Regarding the Law on the Protection of Personal Data

The purpose of the Law on the Protection of Personal Data No. 6698 is to protect individuals’ fundamental rights and freedoms, particularly the privacy of private life, in the processing of personal data, and to regulate the obligations of natural and legal persons processing personal data, as well as the procedures and principles they must comply with.

This information notice regarding the protection of personal data explains our personal data protection and processing policy, and how we collect, transfer, use, and protect your personal data during the services provided by ERC Estetik Turizm Sağlık Hizmetleri Tic. Ltd. Şti. (hereinafter referred to as the “Polyclinic” for short).

In accordance with the Law on the Protection of Personal Data No. 6698 (hereinafter referred to as the “Law” and/or “KVKK” for short) and the applicable legislation, our Polyclinic may process your personal data, in its capacity as the Data Controller, solely within the framework explained below and in compliance with the regulations of the Ministry of Health and other applicable legislation.

IYS Code: 610046 Brand. DR. CINIK

1 - Personal Data Collected by Us

We collect various types of information from our patients within the scope of the healthcare services we provide. The information collected by us is collected in all cases in compliance with the data processing principles and conditions set forth in the Law on the Protection of Personal Data No. 6698. The information we collect from you for the purposes explained in Section 2 below may include the following:

Your Identity Information: Your first name, surname, Turkish ID number, passport number or temporary Turkish ID number, place and date of birth, mother’s name and father’s name, marital status, gender, blood type, insurance and/or patient protocol number, and other identity data that may identify you,

Your Contact Information: Your address, telephone number, email address, and other contact details,

Your voice call recordings kept by customer representatives or patient services in accordance with call center standards, and your personal data obtained when you contact us via email, letter, or other means,
Financial data such as information appearing on credit card slips, billing, and invoice details,

Your private health insurance data and Social Security Institution data for the financing and planning of healthcare services,
Your Health Information: All health information and data obtained during or as a result of the provision of medical diagnosis, treatment, and care services, including but not limited to patient medical reports, diagnostic data, biometric and genetic data, laboratory results, test results, examination data, appointment information, and prescription information,

Your feedback, such as surveys completed by patients, thank-you and complaint letters, and satisfaction results,

Your audio and video recordings obtained from camera recordings continuously maintained in common areas of our Polyclinic as required by applicable legislation,

Your health data and other personal data submitted to or entered into all websites belonging to our Polyclinic.

2 - Purposes of Processing Your Personal Data

Within the scope of the legislation concerning healthcare services, which are a public service, and pursuant to the provisions of Law No. 6698, the personal data collected within the scope of the services provided by our Polyclinic, as the data controller, are processed for various purposes, including:

Fulfilling our legal obligations set forth in the Basic Law on Health Services No. 3359, the Decree-Law No. 663 on the Organization and Duties of the Ministry of Health and Its Affiliated Institutions, the Regulation on the Processing and Privacy of Personal Health Data, and other relevant regulations,
Protecting public health; providing preventive medicine, medical diagnosis, treatment, and care services; and planning and managing healthcare services and their financing,
Planning and managing the operations of our Polyclinic,
Notifying you about your appointment if you make one,
Sharing the requested information with the Ministry of Health and relevant public institutions and organizations in accordance with the applicable legislation,
Analyzing the healthcare services you use and retaining your health data for the purpose of developing and improving healthcare services,
Verifying your identity,
Taking all necessary technical and administrative measures within the scope of data security for the systems and applications used,
Retaining information concerning your health data that must be stored pursuant to the applicable legislation,
Obtaining the necessary information from regulatory and supervisory authorities in accordance with the requests and inspections of official authorities,
Sharing the requested information with private insurance companies within the scope of financing healthcare services,
Carrying out risk management and quality improvement activities,
Measuring patient satisfaction and responding to all questions and complaints within the scope of our healthcare services,
Contacting you to provide information about our services (via email, SMS, or telephone notifications),
Supplying medicines or medical devices,

And, without being limited to these purposes, your personal data may be processed for purposes such as providing, developing, and improving medical diagnosis, treatment, and care services; planning and managing healthcare services and their financing; increasing patient satisfaction; and conducting related research and development activities. Your personal rights will not be infringed during the processing of your data.

3 - Persons and Organizations to Which Your Personal Data May Be Transferred

3.1. In accordance with the applicable legislation, your personal information will be recorded, stored, classified, processed, transferred, and updated in physical and/or electronic environments and, where permitted by the legislation, may be shared with Official Institutions upon request (including Courts, Chief Public Prosecutor’s Offices, Ministries, and all official institutions authorized to request such information), limited to the scope of the request.

3.2. Your personal data, within the scope of Law No. 6698 and other relevant legislation and for the purposes specified above, may be shared, limited to the scope of the request, with;

Institutions or organizations permitted under the Basic Law on Health Services No. 3359, the Decree-Law No. 663 on the Organization and Duties of the Ministry of Health and Its Affiliated Institutions, the Regulation on the Processing and Privacy of Personal Health Data, and other relevant legislation, for the purposes set forth in Section 2 above, provided that all necessary technical and administrative measures are taken to ensure an appropriate level of security in accordance with KVKK and the relevant healthcare legislation,
Private Insurance Companies,
General Directorate of Security and similar law enforcement agencies,
General Directorate of Population and Citizenship Affairs,
Turkish Pharmacists’ Association,
Domestic and international organizations and other third parties from which we receive services and with which we cooperate to carry out our activities,
Our Polyclinic’s attorneys in the event of a possible legal dispute,
Representatives of official institutions authorized to inspect our institutions.

4 - Method and Legal Basis for Collecting Personal Data

Your personal data is collected through any verbal, written, or digital medium, within the scope of the purposes set out above, in order to enable our Polyclinic to fulfill its contractual and legal obligations.

5 - Your Rights Regarding Your Personal Data

To the extent that your personal data is processed by our Polyclinic in the capacity of data controller, pursuant to Article 11 of the Personal Data Protection Law,

To learn whether your personal data has been processed,
To request information regarding its processing if it has been processed,
To learn the purpose of processing and whether it is used in accordance with that purpose,
To know the third parties to whom it has been transferred, and to request its correction if it has been processed incompletely or inaccurately,
Without prejudice to the legal obligation to retain and preserve patient records as required by healthcare legislation, to request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of Law No. 6698,
To request that the actions taken regarding the correction, deletion, or destruction described above be notified to the third parties to whom the data has been transferred,
To object to the emergence of a result against you as a result of the analysis of your data exclusively through automated systems,
To request compensation for damages if you suffer losses due to the unlawful processing of your personal data.
Our Polyclinic will conclude your request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the process incurs an additional cost, a fee based on the tariff determined by the Personal Data Protection Board will be charged by our Polyclinic.

5 - Data Security

As our Polyclinic, we attach the utmost importance to the protection and security of your personal data and would like to state that we take all technical and administrative security measures required by information security standards and procedures; that we act with the awareness that personal data security is a priority in all products and services we offer; that these security measures are implemented by taking every possible risk into account, while also considering technological capabilities; and that all necessary care is taken in this regard.

KVKK Privacy Disclosure Notice