Clarification Text on Protection of Personal Data

POLICIES

Clarification Text on Protection of Personal Data

Dear visitor

Information has been one of our most important assets throughout history and has been the greatest source of wealth, wisdom and, most importantly, technology. Information is sometimes stored on our desks, sometimes in books, sometimes in papers and sometimes in specially designed systems. Most importantly, information is in the minds of employees. Today, it has become inevitable to collect personal data in order to maintain the services provided by organizations, to provide public services to the public effectively, to develop, distribute and market goods and services. Personal data collected for these reasons must be properly protected regardless of the environment. 

The purpose of this clarification text on the Protection and Processing of Personal Data is to prevent the unlawful disclosure of all kinds of personal data belonging to all real persons associated with our Muayenehan, including persons who benefit from our products and services or who contact our Muayenehan to benefit from them, our employees, employee candidates and business partners, in accordance with the relevant laws and regulations, in accordance with Article 12 of the Personal Data Protection Law, In order to prevent unlawful access to personal data, transfer of personal data or security deficiencies that may occur in any way, the necessary measures have been taken, in this context, as the data controller, in accordance with the legislation published and / or to be published, it takes administrative and technical measures to ensure the highest level of security required for the protection of the personal data of the data subject in accordance with the legislation published and / or to be published, conducts audits or has them done. According to Article 10 of the Law, it is to inform the data subject within the scope of fulfillment of the disclosure obligation.

  1. Data Controller

Pursuant to Law No. 6698 on the Protection of Personal Data, the data controller regarding the processing of your personal data "Beytepe Mah. Kanuni Sultan Süleyman Boulevard 5387. Cad. Mira Ofis No:15A/53 Kat:13 Çankaya/Ankara" Orthodontic Specialist with a practice located at 7380137765, registered to Doğanbey/Ankara Tax Office with the tax number 7380137765 Dr. Dt. Banu Saglam Aydinatay and "Beytepe Mah. Kanuni Sultan Süleyman Boulevard 5387. Cad. Mira Ofis No:15A/53 Kat:13 Çankaya/Ankara" Specialist in Prosthodontics and Prosthodontics with a practice located at 1160083079 and registered to Doğanbey/Ankara Tax Office with the tax number 1160083079 Dr. Dt. Kürşad Aydınatayis.

In the capacity of data controller; your personal data, which are directly and / or indirectly shared with us for the purchase of products or services requested by visiting our workplace and / or our website or by calling our call center or by calling our call center, in connection with the purpose of processing, limited and measured, within the framework of the purpose that requires their processing; can be recorded, stored, retained, reorganized, shared with institutions authorized by law to request this personal data, transferred to domestic or foreign third parties, transferred, classified, deleted at the request of the person concerned and processed in the ways listed in the Law in the cases and conditions stipulated by the Law.

  1. Personal Data to be Processed

Your personal data to be processed by the data controller, as defined in the KVKK "any information relating to an identified or identifiable natural person" meaning your data. Within the scope of the same Law, special categories of personal data are "data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data" refers to.

With the consent of patients/visitors, our practice may obtain, classify, record and store personal or sensitive personal data in whole or in part according to the purpose of obtaining personal data or for the period stipulated by the provisions of the relevant law.  

Accordingly, your personal data categories and their contents, including but not limited to the following, are as follows:

Identity data Name, surname, Turkish ID number, SSI registration number, signature, marital status, identity card serial and sequence number, date of birth, place of birth, ID, driver's license, passport photocopy
Communication data Telephone number, e-mail address, residential address
Finance data Your bank account number, IBAN number, credit card information, billing information 
Insurance Data Your data on private health insurance for the purpose of financing and planning of health services and your Social Security Institution data.
Sensitive personal data (Your health data) All kinds of health data obtained during or as a result of the execution of medical diagnosis, treatment and care services, including but not limited to your laboratory results, test results, examination data, appointment information, check-up information, measurements, drawings, various molds, prescription information.
Audio and visual recordings Two- and three-dimensional photographs and video recordings taken before, during and after the procedure.
Family and relative data Name, surname, contact information of patient relatives, family health information if necessary for patient history
Physical space security Camera footage

You are responsible for informing your family members about the personal data of your family members that you will share with us and, if necessary, obtaining their explicit consent.

  1. Purpose of Processing Personal Data

Your personal data and, in case of explicit consent, your sensitive personal data are processed by the data controller for the purposes and legal reasons specified below, but not limited to these and, if necessary, for similar purposes and reasons, within the personal data processing conditions specified in Articles 5 and 6 of the KVKK and for the purposes and conditions limited to the purposes and conditions in accordance with the principles and periods specified in the VERBIS record of our practice.

In this context, the purpose of processing your personal data:

  • Fulfill our legal obligations,
  • Confirm your identity for the service requirement provided by our practice, 
  • Protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, 
  • Sharing the information requested with the Ministry of Health and other public institutions and organizations in accordance with the relevant legislation, 
  • Planning and managing the internal functioning of the practice and daily operations, 
  • Measuring, increasing and researching patient satisfaction, 
  • Supply of medicines and medical devices, 
  • If you make an appointment, you can be notified about the appointment, 
  • Analyzing and conducting research to improve health services,
  • Participation in campaigns and providing campaign information by our practice, 
  • Ability to design and communicate custom content, tangible and intangible benefits across web and mobile channels,
  • It can be counted under the headings of invoicing.
  1. Method and Legal Grounds for Collection of Personal Data

Your personal data may be collected verbally, in writing or electronically, including GSM technologies, through various methods based on Information Technologies, call center, website, social media channels, mobile applications and similar means. 

In addition, in line with the purposes of processing personal data, personal data are processed based on and limited to at least one of the personal data processing conditions stipulated in Articles 5 and 6 of the Law, in accordance with the general principles and periods specified in the Law and our company's VERBIS record, especially the principles specified in Article 4 of the Law.

Mandatory Principles to be Complied with in the Processing of Personal Data 

  • Processing in accordance with the Law and Good Faith 
  • Ensuring that Personal Data is Accurate and Up-to-Date When Necessary 
  • Processing for Specific, Explicit and Legitimate Purposes 
  • Being relevant, limited and proportionate to the purpose for which they are processed 
  • Preservation for the Period Stipulated in the Relevant Legislation or Required for the Purpose for which they are Processed 

Terms of Processing of Personal Data 

According to Article 5 of the Law, personal data cannot be processed without the explicit consent of the data subject. Explicit Consent of the Personal Data Owner must be related to a specific subject and must be disclosed with free will based on information. In the presence of one of the following conditions, it is possible to process personal data without seeking the explicit consent of the data subject. 

  • a. Explicit Provision in the Law 
  • b. Failure to Obtain the Explicit Consent of the Relevant Person Due to Actual Impossibility 
  • c. Direct Relevance to the Establishment or Performance of a Contract 
  • d. Fulfillment of the Legal Obligation by the Data Controller 
  • e. Publicized by the Relevant Person Himself 
  • f. Data Processing is Mandatory for the Establishment or Protection of a Right 
  • g. Data Processing is Mandatory for the Legitimate Interest of the Data Controller 

Processing of Special Categories of Personal Data 

Article 6 of the Law defines race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership to associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, and biometric and genetic data as sensitive personal data, and it is also stipulated that the processing of sensitive personal data without the explicit consent of the data subject is prohibited. Accordingly; Sensitive personal data are processed by the data controller in accordance with the principles specified in this Clarification Text and by taking all necessary administrative and technical measures, including the procedures and principles to be determined by the Board, and in the presence of the following conditions:

a. Sensitive personal data other than health and sexual life:In cases explicitly stipulated in the laws, it may be processed without seeking the explicit consent of the data subject. In all other cases and circumstances, the explicit consent of the data subject shall be obtained in order to process such special categories of personal data.

b. Sensitive personal data relating to health and sexual life:The data may only be processed by persons or authorized institutions and organizations under the obligation of secrecy for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, without seeking the explicit consent of the person concerned.

Your personal data other than health and sexual life, which are listed among your personal data of special nature, can only be transferred to the real or legal persons listed above without seeking your explicit consent in cases stipulated by law. Your personal data related to health and sexual life can only be transferred to the above-mentioned real or legal persons without seeking your explicit consent in order to protect public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, and to fulfill our legal obligations under the Personal Data Protection Law No. 6698, as well as the Health Services Basic Law No. 3359, the Regulation on Personal Health Data dated 21.06.2019 and other relevant legislation. Electronic Medical Records and Electronic Health Records are also within this scope.

In all other cases and circumstances, the explicit consent of the data subject shall be obtained in order to process such special categories of personal data. In the processing of special categories of personal data, adequate measures determined by the Board must also be taken.

Deletion, Destruction or Anonymization of Personal Data

According to Article 7 of the Law, although it has been processed in accordance with the provisions of this Law and other relevant laws, personal data shall be deleted, destroyed or anonymized by the data controller ex officio or upon the request of the data subject if the reasons requiring its processing disappear. In this context, our practice retains personal data only for the period specified in the relevant legislation or for the period required and necessary for the purpose for which they are processed. In the event that the period expires or the reasons requiring processing disappear, personal data will be destroyed by destruction methods (deletion and/or destruction and/or anonymization) determined in accordance with the periodic destruction periods or the application of the data subject, if any. In personal data processing activities, we act in accordance with the general principles specified in Article 4 of Law No. 6698.

  1. Transfer of Personal Data

The Law stipulates regulations on the transfer of personal data in parallel with the regulations on the Processing of Personal Data. According to Article 8 of the Law: 

Personal data cannot be transferred without the explicit consent of the person concerned. Even without the explicit consent of the personal data owner, if one or more of the following conditions exist, personal data may be transferred to third parties by taking all necessary security measures with due care by our practice and by taking all necessary security measures with the methods stipulated by the Board: 

  • The relevant activities regarding the transfer of personal data are clearly stipulated in the laws, 
  • The transfer of personal data by our practice is directly related and necessary for the establishment or performance of a contract, 
  • The transfer of personal data is mandatory for our practice to fulfill its legal obligation, 
  • Provided that the personal data has been made public by the data owner, the transfer of personal data by our Practice in a limited manner for the purpose of publicization, 
  • The transfer of personal data by our Practice is mandatory for the establishment, use or protection of the rights of our Practice or the data subject or third parties, 
  • Provided that it does not harm the fundamental rights and freedoms of the data owner, it is mandatory to carry out personal data transfer activities for the legitimate interests of our practice, 
  • It is necessary for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid. 

According to Article 9 of the Law, personal data cannot be transferred abroad without the explicit consent of the data subject.

  1. Personal Rights of the Data Subject

As a personal data owner within the scope of Article 11 of KVKK;

  • Learn whether your personal data is being processed,
  • Request information if your personal data has been processed,
  • To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
  • To know the third parties to whom your personal data is transferred domestically or abroad,
  • To request correction of your personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
  • Although it has been processed in accordance with the provisions of Law No. 6698 and other relevant laws, to request the deletion or destruction of your personal data in the event that the reasons requiring its processing disappear and to request notification of the transaction made within this scope to third parties to whom your personal data has been transferred,
  • To object to the occurrence of a result against you by analyzing your processed data exclusively through automated systems,
  • In case you suffer damage due to unlawful processing of your personal data, you have the right to demand compensation for the damage. 

Pursuant to paragraph 1 of Article 13 of the KVKK, as personal data owners, you can submit your requests regarding your rights to our Practice in writing or by other methods determined by the Personal Data Protection Board. You can access the application information text and application form, in which the channels and procedures to submit your application are explained, from our internet address or you can request it from us.

In the event that the personal data owner duly submits his/her request regarding the rights to us, we will finalize the relevant request free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board. In cases where the application is rejected, the answer given is insufficient or the application is not responded to in due time; You can file a complaint to the Personal Data Protection Board within thirty days from the date you learn our answer and in any case within sixty days from the date of application.

For our visitors/patients who are citizens of the European Union and other foreign countries, information and clarification will be made with the help of an English translation of the text or an interpreter upon request.

The present Clarification Text on the Processing of Personal Data, which is prepared in accordance with the provisions of Law No. 6698 and other relevant legislation current as of the date of publication, is submitted for your information.

Sincerely.

Data Controller

Orthodontics Specialist Dr. Dt. Banu Sağlam Aydınatay and Prosthodontist Dr. Dt. Kürşad Aydınatay