Privacy Policy

DATA PROCESSING POLICY

Personal Data Protection and Processing Policy

The data controller, Özel Cinik Polikliniği (ERC Estetik Turizm Sağlık Hizmetleri Tic. Ltd. Şti.), places great importance on protecting the personal data of its customers, employees, and other individuals with whom it has a relationship, in line with the principles of superior service quality, respect for individual rights, transparency, and integrity, and in accordance with the regulations established by the Personal Data Protection Law. Great importance is attached to patient privacy and to processing and safeguarding all personal data belonging to our patients with the utmost care and in the best possible manner. This policy has been prepared to protect and process the personal data of our patients, as well as their companions, visitors, and the employees of the institutions and organizations with which we cooperate, within the framework of the fundamental principles set forth in the applicable legislation.

The purpose of this Policy is to ensure transparency by informing individuals whose personal data is processed, particularly our patients, companions, visitors, employees, and institution representatives, as well as the employees and representatives of the institutions with which we cooperate and third parties, within the scope of personal data processing activities carried out by our clinic in compliance with the applicable legislation. Within this scope, the necessary administrative and technical measures required for the processing and protection of personal data are taken in accordance with Law No. 6698 and the relevant legislation. Within the scope of this policy, natural persons whose personal data is processed are referred to as Data Subjects, Relevant Persons, or Personal Data Owners.

Explicit Consent: Consent relating to a specific matter, based on being informed and expressed through free will.

Anonymization: The alteration of personal data in such a way that it loses its personal data characteristics and this change cannot be reversed. For example, personal data may be rendered impossible to associate with a natural person through techniques such as masking, aggregation, or data distortion. Personal data may be anonymized for various purposes in accordance with the request and/or consent of the relevant person, provided that this does not violate the scope of the Personal Data Protection Law or explicit consent. Our Clinic will take the necessary measures to ensure that anonymized personal data is not made identifiable through various methods.

Employees, Shareholders, and Representatives of the Institutions with Which We Cooperate: Refers to natural persons, including employees, shareholders, and representatives of institutions with which we have any business relationship, such as business partners and suppliers, without limitation thereto.

Processing of Personal Data: Refers to any operation performed on data, including obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data, whether wholly or partially by automated means or by non-automated means provided that it forms part of any data recording system.

Personal Data: Refers to any information relating to an identified or identifiable natural person. All information that makes a person identifiable is considered personal data; examples include a Turkish Republic Identity Number, name and surname, email address, telephone number, residential address, date of birth, and bank account number.

Special Categories of Personal Data: Data relating to race, ethnic origin, political opinion, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership in an association, foundation or trade union, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, constitute special categories of personal data.

Third Party: Refers to third-party natural persons associated with the aforementioned parties in order to ensure the security of commercial transactions between them or to protect the rights and provide benefits of the aforementioned persons. (For example, employees or representatives of the company from which services are received, companions, etc.)

Data Processor: Refers to the natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by the data controller. For example, the IT company that stores our data.

Data Controller: Refers to the person who determines the purposes and means of processing personal data and manages the location where the data is systematically stored (data recording system).

Under the KVKK, our clinic acts as the data controller and has registered with the VERBİS system. A team (Personal Data Controller Team) has been established within our company. In cases requiring a decision, the Personal Data Controller Team obtains the opinion of a lawyer/legal counsel who is an expert in personal data matters, after which the decision is implemented upon management approval.

The personal data processed may vary depending on the healthcare services provided and is collected through physical and/or digital methods. Special categories of personal data, particularly health data, as well as general categories of personal data collected verbally, in writing or digitally through our patients, physicians, healthcare personnel and other employees, subcontractors and their employees, companies with which we engage in all kinds of commercial activities, our call center, our clinic’s website, online services and similar means, are processed for the purposes set out below and for other purposes that may arise in the future:

Providing medical diagnosis, treatment and care services,
Protecting public health,
Planning and managing preventive healthcare services and their financing,
Informing our patients about appointments
Planning and managing internal procedures,
Conducting analyses to develop and ensure the provision of healthcare services in compliance with legislation,
Carrying out risk management and quality improvement activities,
Conducting research,
Fulfilling legal and regulatory requirements,
Issuing invoices for our services,
Verifying your identity
Verifying your relationship with contracted institutions,
Sharing all information requested by private insurance companies within the scope of healthcare service financing,
Responding to all questions and complaints regarding our healthcare services,
Taking all necessary technical and administrative measures within the scope of data security,
Ensuring financial reconciliation concerning the healthcare services provided to you with our contracted institutions, banks and all public and private organizations collecting healthcare payments,
Sharing the requested information with the Ministry of Health and other public institutions and organizations in accordance with the relevant legislation,
Measuring and increasing patient satisfaction,
Fulfilling purposes such as complying with our contracts and legal obligations.

Categorization of Processed Personal Data

Identity Information: All information concerning an individual's identity contained in documents such as a driver's license, identity card, passport, attorney's identification card, or marriage certificate

Contact Information: Information such as telephone numbers, addresses, residential addresses, and email addresses used to communicate with the data subject

Location Data: Data that clearly belongs to an identified or identifiable natural person, is included in the data recording system, and enables the data subject's location to be determined

Family Members and Relatives Information: Information about the family members and relatives of the personal data subject that clearly belongs to an identified or identifiable natural person, is included in the data recording system, and is processed to protect the legal interests of the relevant Institution and the data subject

Physical Premises: Personal data relating to records and documents such as camera recordings and fingerprint records, as well as visual and audio recordings

Transaction Security Information: Personal data processed to ensure our technical, administrative, legal, and commercial security while carrying out our activities

Financial Information: Personal data processed in relation to information, documents, and records indicating any kind of financial result

Job Applicant Information: Personal data processed concerning individuals who have applied to become employees (CV or résumé information)

Personnel Information: Personal data relating to payroll information, disciplinary investigations, SGK information, employment entry and exit records, asset declarations, résumé information, performance evaluation reports, interview results, the content of the Employment Contract, employment commencement information, and termination information

Legal Proceedings: Personal data processed for the determination and pursuit of our legal receivables and rights, the fulfillment of our obligations, and compliance with our legal obligations

The personal data listed above may be processed within the framework of the provisions of applicable legislation, including the Basic Law on Health Services No. 3359, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and Its Affiliated Institutions, the Regulation on Private Hospitals, the Regulation on Personal Health Data, and the regulations of the Ministry of Health, and may be transferred to the physical archives and information systems of our polyclinic and/or our suppliers.

Our Company undertakes to process personal data in accordance with the following principles:

Complying with the law and the principle of good faith,
Ensuring that personal data is accurate and, where necessary, up to date,
Processing for specific, explicit, and legitimate purposes,
Being relevant, limited, and proportionate to the purposes for which they are processed,
Retaining data for the period stipulated in the relevant legislation or required for the purposes for which it is processed

The data subject's explicit consent is only one of the legal grounds that permits the lawful processing of personal data. In addition to explicit consent, personal data may also be processed when one of the other conditions listed below exists. The basis for a personal data processing activity may be only one of the conditions specified below, or more than one of these conditions may constitute the basis for the same personal data processing activity. If the processed data constitutes sensitive personal data, the following conditions shall apply:

Obtaining the Explicit Consent of the Personal Data Subject,
Explicitly Provided for by Law,
Being Unable to Obtain the Explicit Consent of the Relevant Person Due to Actual Impossibility,
Being directly related to the establishment or performance of the contract,
Being necessary for the Company to fulfill its legal obligation,
Having been made public by the personal data subject,
Being necessary for the processing of data to establish or protect a right,
Being necessary for the processing of data for the legitimate interests of our Company, (The expression “the legitimate interests of the Company” may under no circumstances be contrary to the principles established by the KVKK or the purpose of processing personal data, nor may it constitute an intervention in the essence of a right guaranteed by the Constitution.)

Our Company processes special categories of personal data in the following circumstances, provided that adequate measures determined by the Personal Data Protection Board are taken:

If the personal data subject has given explicit consent, or
If the personal data subject has not given explicit consent; special categories of personal data other than those relating to the health and sexual life of the personal data subject may be processed in the cases stipulated by law,
Special categories of personal data relating to the health and sexual life of the personal data subject may only be processed by persons under a confidentiality obligation or by authorized institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing healthcare services and their financing.

Technical and Administrative Measures

Our Company takes the necessary technical and administrative measures, in accordance with Article 12 of the KVKK and the provisions of the Regulation, the general principles set forth above, this Policy, and the decisions of the Personal Data Protection Board, taking into account the technological capabilities and implementation costs, regarding the matters specified below:

The necessary software and hardware have been identified. Strong passwords are used on computers and email accounts.
The information that must be protected to ensure the confidentiality of customer information has been communicated to our personnel through training, and their responsibilities have been put in writing through employment contracts. (Confidentiality Agreements) This obligation continues after the relevant individuals leave their positions.
The necessary infrastructure has been established for backing up all data.
Employees who can access data on computers have been identified.
Customer files and information are provided only to the relevant individuals themselves, to their relatives for whom they have given written authorization, to the relevant public institutions and organizations within the framework of applicable legislation, and to authorized judicial authorities in judicial matters.
Before personal data processing begins, the Institution fulfills its obligation to inform the relevant individuals.
A personal data processing inventory has been prepared.
The relevant personal data subjects are informed about these matters through texts posted within our polyclinic or otherwise made available to visitors.

Your personal data may be shared, in accordance with the fundamental principles stipulated by the Law and within the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law and for the purposes set forth above, with our polyclinic, the Ministry of Health, its affiliated subordinate units and family medicine centers, private insurance companies (health, pension and life insurance and similar), the Social Security Institution, the General Directorate of Security and other law enforcement agencies, the General Directorate of Population and Citizenship Affairs, the Turkish Pharmacists’ Association, public prosecutors’ offices and courts, laboratories located in Turkey or abroad with which we cooperate for medical diagnosis, medical centers and third parties providing healthcare services, the healthcare institution to which the patient is referred or to which the patient applies personally, representatives duly authorized by you, third parties from whom we receive consultancy services, regulatory and supervisory authorities and official bodies, and our suppliers and support service providers whose services we use or with whom we cooperate, within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law. Your personal data is not shared with foreign countries.

With regard to the personal data processed, the relevant individual has the right to learn whether personal data is being processed, to request information about such processing if it has taken place, to access and request personal health data, to learn whether the data is used in accordance with its purpose, to learn the third parties to whom it has been transferred, to request the correction of data if it has been processed incorrectly, to request the deletion or destruction of personal data, to request that the correction be notified to third parties to whom the data was transferred in the event of incorrect processing, to object to an adverse result arising from analysis through automated systems, and to request compensation for damages incurred due to the unlawful processing of personal data. These rights may be exercised by applying to our Company with a petition.

Our Company carries out personal data processing activities through the use of security cameras and the recording of images when visitors enter and leave the premises. In this context, our polyclinic acts in accordance with the Personal Data Protection Law and security legislation.

Only authorized employees and/or employees of supplier companies have access to records recorded and stored in the digital environment. Camera recordings are retained for 2 months.

This Policy shall be deemed to have entered into force upon its publication on the website.