Pursuant to the provisions of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the provisions of the European Union General Data Protection Regulation (GDPR), Assoc. Prof. Dr. Serkan Oral, Specialist in Obstetrics, Gynaecology and IVF, located at Feneryolu Mah. Bağdat Cad. No:53/59, Ersoy İş Merkezi, Block B, Floor 5, Kadıköy/Istanbul, and the private practice/clinic operated by him (hereinafter referred to in short as the Physician/Private Practice/Clinic/Employer.), acting in the capacity of Data Controller, hereby inform you of our mutual rights and obligations under the said legal framework, on the basis that your personal information may, within the scope explained below, be recorded, stored, updated, disclosed to third parties where permitted by legislation, transferred, classified and processed in the manners set out in the KVKK and the GDPR.
Within the scope of the applicable legislation, we hereby inform you that, in order to establish the physician–patient relationship and to provide you with healthcare services (diagnosis, treatment, care services and the like) in the interest of the patient and of public health, we will record, store in our archives and process the personal information necessary for this purpose; that under the Law on Private Hospitals, the Regulation on Private Hospitals, the Healthcare Implementation Communiqué, the Regulation on Patient Rights and other legislation, we are obliged, in order to provide you with healthcare services as our Clinic, to record identity, address, telephone, medical history and all other necessary information in order to identify the patient to whom the service is provided, and to prepare all records and documents to be included in the medical patient file that will serve as the basis for processing in electronic or paper form; and that your personal data will be shared with the relevant authorities and persons where requested by the competent authorities, including but not limited to the Ministry of Health of the Republic of Türkiye and the Provincial Health Directorates, Public Health Centres and other units affiliated with the Ministry of Health, the Social Security Institution and, should you use your private health insurance, your insurance company, or where requested by persons appointed by the competent authorities or within the scope of systems such as e-Nabız and similar platforms, or within the scope of the notification and/or reporting obligations imposed upon us.
Your personal data are processed for the purposes of establishing and performing the physician–patient relationship and fulfilling the provisions of the contract; using them in the services we may offer you; recording identity, address, tax number, personal health data and other necessary information in order to identify the person carrying out or requesting the transaction; preparing all records and documents that will serve as the basis for processing in electronic form (internet, mobile and the like) or in paper form; complying with the data retention, reporting and notification obligations prescribed by legislation, the competent institutions and other authorities; carrying out marketing and statistical activities and improving service quality; and offering the requested and other products and services. Your special category personal data are processed in connection with communication, the provision of information and similar processes arising within the contractual relationship.
Your blood group, laboratory and imaging results, test results, allergies, chronic illnesses, venereal diseases, infectious diseases, data relating to surgeries/operations you have previously undergone, your e-Nabız information, medicines you use on an ongoing basis, information relating to Covid-19, your medical treatments, prescription information, habits harmful to health, body analysis and mortality information, together with other health data necessary for the treatments and procedures to be applied to you, and your other personal data, are processed in order to create a patient file; to carry out preventive medicine, examination, medical diagnosis, treatment and care services; to carry out your follow-up examinations after medical diagnosis and treatment processes; to manage any complication processes that may arise; to communicate with you directly; to manage appointment processes; to manage patient satisfaction and requests; to fulfil legal and contractual obligations; to retain, within the prescribed periods, information relating to health data that must be stored under the applicable legislation; to obtain consultation services from other relevant specialist physicians where necessary so that your treatment may be carried out correctly; to fulfil legal obligations in accordance with health tourism legislation; to plan transfer, accommodation and interpreting services for patients/clients arriving within the framework of health tourism; to announce developments relating to medical treatments and procedures; to inform third parties about the medical procedure applied; to plan and manage healthcare services and their financing; to ensure workplace safety; to fulfil the responsibilities arising from the legal relationship established between the physician and the patient; to fulfil financial and administrative obligations; to ensure technical and commercial security; and to fulfil public obligations.
The Personal Data and Special Category Personal Data set out above will be processed in line with the purposes and the legislation stated above, in order to enable the examination, preventive medicine, medical diagnosis, treatment and medical procedures to be applied to you to be carried out, and to enable the obligations relating to your treatment to be fulfilled. Should you fail to provide the relevant personal data, the legal obligations imposed on the Physician and the private practice providing your medical treatment cannot be duly fulfilled, and your treatment and/or recovery processes cannot be conducted successfully.
The other contexts in which your personal data may be processed are as follows: HR operations; internal operations of the private practice; activities with legal, technical and administrative consequences; strategy, planning and management of business partners/suppliers and clients; client satisfaction; the planning and execution of corporate communication activities and events; the planning and execution of in-house training programmes; workplace safety of the private practice; the protection of occupational health and safety; the performance of after-sales services; the provision of technical service; the carrying out of collection transactions; the presentation to clients of product and service introductions, information, personalised advertising, campaigns and other benefits, the sending of all kinds of service-related and commercial electronic messages, surveys and telemarketing applications, and the provision of various advantages by means of statistical analyses; carrying out work to improve service quality and to provide better services; the issuing of invoices in return for our services; the procurement of services from external sources; the provision to clients of the benefits of specialist organisations for the purpose of obtaining services in fields outside our own area of expertise and of obtaining technology services; use arising from the requirements of the activities of the private practice; identity verification; responding to questions and complaints; taking the necessary technical and administrative measures within the scope of data security; ensuring financial reconciliation with business partners and other third parties in relation to the products and services offered; providing the necessary information in line with the requests and inspections of regulatory and supervisory institutions and official authorities; retaining information relating to data that must be stored under the applicable legislation; ensuring the auditing of the consistency of information; measuring client satisfaction. In respect of employees: the creation of a personnel file, the determination of whether the employee remains continuously capable of fulfilling the requirements of the work, the arrangement of private health insurance, the creation of a health file, the taking of occupational safety measures, and the planning of travel. In respect of job candidates: the management and planning of the process of assessing suitability for open positions. The publication, for the purpose of developing and sharing the business, of visual and audio data belonging to the private practice, its employees and its stands, obtained at competitions, organisations, fairs, workshops and other events held within the scope of its field of activity; the fulfilment of legal obligations; the execution and monitoring of the financial reporting and risk management processes of the private practice; the execution and monitoring of legal affairs; the creation and monitoring of visitor records; the planning and execution of employees’ use of machinery and equipment; the planning and execution of sales transactions; the planning and execution of procurement transactions; the planning and execution of collection transactions; the planning and execution of the lawful use of the Clinic’s internet, shared network and computers; the planning and execution of fairs, activities, social projects, and product and corporate promotion of the private practice.
The purposes stated above are for information purposes; any further purposes that may be added by us in order for the private practice to carry out its future operational activities will be announced by way of updates.
Depending on the healthcare service provided, your Personal Data are processed:
by means of the health reports, laboratory and imaging results, test results and the statements you provide concerning your health data, which you submit when attending the Physician and the private practice for examination and treatment so that a medical assessment may be made in relation to the treatment to be applied to you,
by means of your completion of the “Patient Information and Consent Form” relating to the treatment to be applied by the Physician and the private practice,
by means of the contact form you complete on the corporate website of the Physician and the private practice,
by means of the e-mails you send to the corporate e-mail address of the Physician and the private practice,
by means of the photograph/video recordings taken before, after and/or during the medical procedure applied to you within the premises of the Physician and the private practice,
Upon your request and where necessary, by means of the written/audio/visual (photograph and/or video recording) messages you send to the Physician and the private practice, and the online voice/video calls you establish, using the remote connection application service providers (WhatsApp/Zoom.us/FaceTime/Skype/Messenger/Google/Instagram/Facebook and the like) whose services you obtain by accepting their own Privacy Policies and International Transfer Principles, for the purpose of enabling the Physician and the private practice to carry out your diagnosis and follow-up online by means of remote access,
by means of your sending direct messages to, and/or commenting on the posts of, the profile accounts belonging to the Physician and the private practice on social media accounts whose servers are located abroad (Instagram, YouTube, Facebook, Twitter, LinkedIn and the like) of which you are already a user, having accepted their own Privacy Policies and International Transfer Principles,
by means of the information you transmit, by permitting its automatic processing, through panels such as “contact us” or “request information” contained in the promotions and advertisements published by the Physician and the private practice on social media platforms whose servers are located abroad (Instagram, YouTube, Facebook, Twitter, LinkedIn, Google and the like) of which you are already a user, having accepted their own Privacy Policies and International Transfer Principles.
Article 5/2 of the KVKK sets out the exceptions that render the lawful processing of personal data possible. Accordingly, the private practice may also process personal data, without explicit consent, where one of the other conditions (exceptions) set out below is present. The basis of a personal data processing activity may be only one of the conditions set out below, or more than one of these conditions may constitute the basis of the same personal data processing activity.
These are: where it is expressly provided for by law; where it is necessary to process the personal data of a person who is unable to give consent due to actual impossibility or whose consent cannot be given legal validity, in order to protect the life or physical integrity of that person or of another person; where it is directly related to the conclusion or performance of a contract; where it is necessary for the Clinic to fulfil its legal obligation; where the personal data have been made public by the data subject; where processing is mandatory for the establishment or protection of a right; and where processing is mandatory for the legitimate interests of the private practice, provided that it does not harm the fundamental rights and freedoms of the data subject.
Furthermore, pursuant to Articles 9/2/h, 6/1/b and 6/1/f of the GDPR, the circumstances in which your data may be processed without a declaration of explicit consent are as follows:
For the purpose of carrying out examination, medical diagnosis, treatment and care services, your Health Data, which are deemed Special Category Personal Data, will be processed without your explicit consent being sought, by the Clinic, which is under an obligation of professional secrecy by law.
Your Personal Data will be processed by the Clinic without your explicit consent being sought, for the purposes of carrying out your follow-up examinations after medical diagnosis and treatment processes, communicating with you directly and managing appointment processes.
Your Personal Data will be processed by the Clinic without your explicit consent being sought, for the purpose of managing patient satisfaction and requests.
The creation of a patient file.
The retention of information relating to health data that must be stored under the applicable legislation.
The issuing of invoices following verification of your payments.
The fulfilment of tax payments.
The fulfilment of obligations under Ministry of Health legislation.
The fulfilment of obligations under Health Tourism legislation.
Ensuring your data security.
The fulfilment of legal obligations before the Judicial Authorities.
The fulfilment of administrative obligations before Administrative Institutions and Organisations.
These are the persons, public institutions and organisations and private public institutions and organisations permitted by the provisions of the applicable legislation, the polyclinics and medical laboratories with which the physician and his private practice have agreements, and, in the event of a consultation, the relevant persons, institutions and organisations. Special category personal data may be transferred to locations within Türkiye and abroad from which services are obtained, secured by confidentiality agreements, in order to carry out the activities forming the subject of the purposes set out in the legislation to which we are subject, and to carry out insurance and financial activities and to perform insurance and financial services. Personal data and special category personal data are stored in a secure environment that is not open to general access, and are under no circumstances shared with third parties unless permission has been granted or a legal obligation exists.
Your Personal Data and Special Category Personal Data collected in line with the conditions and purposes set out within the scope of the Personal Data Processing Conditions specified in Articles 5 and 6 of Law No. 6698 may be transferred by the Physician and his private practice to third persons and institutions, in compliance with Articles 8 and 9 of the KVKK, to the extent sufficient for the realisation of the purpose, by concluding the necessary confidentiality agreements and by ensuring all administrative and technical security measures required under the legislation, for the purposes of: carrying out and developing examination, preventive medicine, medical diagnosis, treatment and care services; obtaining consultation services from other specialist physicians where necessary; fulfilling administrative obligations relating to health tourism legislation; planning the transfer, accommodation and interpreting services of patients arriving within the framework of health tourism; communicating with patients; managing follow-up appointment processes; planning and managing healthcare services and their financing; fulfilling the responsibilities arising from the legal relationship established between the doctor and the patient; fulfilling financial, legal and administrative obligations; ensuring technical and commercial security; fulfilling public obligations; and promoting the medical services offered.
In this context, your Personal Data processed by the Physician and his private practice will be transferred to:
other specialist physicians for the purpose of consultation,
its insured employees,
its suppliers,
Financial Advisors, Tax and Finance Consultants and Auditors,
Legal Counsel,
Database (Server) Providers,
the “Clinic Management Software” Service Provider,
Web Consultant,
Interpreters,
Data Protection Officer,
IT Consultant,
Tourism Agencies,
Public Institutions and Organisations authorised within the framework of the laws,
the Judicial Authorities.
As regards the method of collection of personal data, your personal data may be collected verbally, in writing or electronically, through all kinds of digital channels such as questions and messages sent to our website and telephone calls.
The personal data we obtain are stored securely in physical or electronic form for an appropriate period, in order to enable the Physician and his private practice to carry out their activities. Within the scope of these activities, the Physician and his private practice act in compliance with the obligations prescribed in all relevant legislation, and in particular the KVKK, concerning the protection of personal data.
Save for cases in which the retention of personal data for a longer period is permitted or required under the relevant legislation, where the purposes for processing personal data have come to an end, the data will be deleted, destroyed or anonymised by the Physician and his private practice, either on their own initiative or upon the request of the data subject and by means of the various techniques that may be employed. Where personal data are deleted by means of the said methods, such data will be destroyed in such a way that they can no longer be used or recovered in any manner.
Where the data controller has a legitimate interest, and provided that the law permits this, personal data may be retained even after the purpose of processing and the periods specified in the relevant laws have come to an end, on condition that the fundamental rights and freedoms of the data subjects are not harmed. Following the expiry of the said limitation period, personal data will be deleted, destroyed or anonymised in accordance with the procedure set out above.
The private practice takes all necessary technical and administrative measures to ensure the appropriate level of security required for the protection of personal data. The measures prescribed in Article 12(1) of the KVKK are as follows: to prevent the unlawful processing of personal data; to prevent unlawful access to personal data; and to ensure the safekeeping of personal data.
Image recordings of visitors, employees and other relevant persons are taken at the entrances to the building in which the private practice is located, by the building itself, in order to ensure the general and service-related security of its facilities and operations, in compliance with the fundamental principles prescribed in the KVKK.
Within the scope of carrying out the activities it has established with business partners such as medical laboratories and suppliers for the purchase and sale of products, the private practice may process personal data relating to the employees of such business partners where this is mandatory for the performance of the work, or for the purposes specified in the law, in order to ensure the functioning of the service activity, to fulfil human resources objectives and policies, and to ensure the legal and commercial security of the mutual working relationship.
We hereby inform you that, pursuant to Article 11 of the KVKK, you have the right, by applying to us, to: a) learn whether your personal data are being processed; b) request information if they have been processed; c) learn the purpose of processing and whether they are used in accordance with that purpose; ç) know the third parties in Türkiye or abroad to whom they have been transferred; d) request their rectification if they have been processed incompletely or inaccurately; e) request their erasure or destruction within the framework of the conditions set out in Article 7 of the KVKK; f) request notification of the transactions carried out pursuant to subparagraphs (d) and (e) above to the third parties to whom the data have been transferred; g) object to a result arising against you as a consequence of the analysis of your data exclusively by automated systems; and ğ) request compensation from our private practice for the damage suffered, should you incur damage as a result of unlawful processing.
The requests contained in your application will be concluded free of charge within thirty days at the latest, depending on the nature of the request. However, should the transaction entail an additional cost for the private practice, the fee set out in the tariff determined by the Personal Data Protection Board in the Communiqué on the Principles and Procedures for Application to the Data Controller may be charged. Pursuant to Article 13, paragraph 1 of the KVKK, holders of personal data rights may submit their request relating to the exercise of the stated rights by means of the methods and information set out in the “Communiqué on the Principles and Procedures for Application to the Data Controller” published in the Official Gazette dated 10 March 2018 and numbered 30356.
Exceptions to the Right of Application: Pursuant to Article 28 of the KVKK, data subjects will not be able to assert their rights in the matters set out below.
• The processing of personal data for purposes such as research, planning and statistics, by anonymising them together with official statistics
• The processing of personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that this does not violate national defence, national security, public safety, public order, economic security, the privacy of private life or personal rights, and does not constitute a criminal offence
• The processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations assigned duties and powers by law to ensure national defence, national security, public safety, public order or economic security
• The processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or enforcement proceedings
Pursuant to Article 28/2 of the KVKK, provided that it is compatible with and proportionate to the purpose and fundamental principles of the Law, Article 10, which governs the data controller’s obligation to inform, Article 11, which governs the rights of the data subject with the exception of the right to claim compensation for damage, and Article 16, which governs the obligation to register with the Data Controllers’ Registry, shall not apply in the following cases:
• Where the processing of personal data is necessary for the prevention of crime or for criminal investigation
• The processing of personal data that have been made public by the data subject themselves
• Where the processing of personal data is necessary for the performance of supervisory or regulatory duties, and for disciplinary investigation and prosecution, by authorised public institutions and organisations and by professional organisations having the status of public institutions, on the basis of the authority conferred by law
• Where the processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budgetary, tax and financial matters
As a Data Subject, your Personal Data are also protected under the GDPR. Where the GDPR applies (citizens of the European Union or residents of European Union countries), the rights of Data Subjects are as follows;
Right of access (GDPR Article 15): The data subject has the right to confirm, by applying to the Clinic, whether personal data concerning them are being processed and, where such personal data are being processed, to learn the details set out in Article 15 of the GDPR.
Right to rectification (GDPR Article 16): The Data Subject has the right, at any time, to apply for the rectification of their personal data held by the Clinic where such data have changed.
Right to erasure (GDPR Article 17): The Data Subject has the right to request the erasure of their personal data held by the Clinic. Should the circumstances set out in Article 17 of the GDPR arise, your personal data will be erased by the Clinic without undue delay.
Right to restriction of processing (GDPR Article 18):
Where Data Subjects contest the accuracy of their Personal Data, they have the right, as Data Subjects, to request the restriction of the use of the data until the accuracy of the Personal Data has been verified by the Clinic.
Where the Data Subject requests the erasure of their Personal Data on the ground that the processing activity is unlawful, they have the right to request the restriction of the use of the data until their request has been fulfilled.
Where the Clinic no longer needs the personal data for the purposes of the processing, the Data Subject has the right to request the restriction of the use of their data.
Where Data Subjects object to the processing activity pursuant to Article 21/1 of the GDPR, they have the right to request the restriction of the use of their data pending verification of whether the Clinic’s legitimate grounds for processing override those of the Data Subject.
Right to data portability (GDPR Article 20): The Data Subject has the right, where technically feasible, to apply at any time for the transfer of their Personal Data held by the Clinic to another controller. However, this right may only be exercised where the processing is based on consent or where it is required by the contract.
Right to object (GDPR ARTICLE 21)
The data subject has the right to object to the processing of Personal Data within the scope of Articles 6/1/(e) and (f) of the GDPR, on grounds relating to their particular situation.
We hereby inform you that we continue our activities in the awareness that the security of personal data is of paramount importance in all the products and services we offer you.
Upon reading and accepting this Privacy Notice, you shall be deemed to have accepted, declared and undertaken that you have been fully and completely informed about the data processing process carried out by the Physician and his private practice, that you have learned your rights secured under the KVKK and the GDPR, and that you consent, of your own free will, to the PROCESSING of your Personal Data and Special Category Personal Data by the Physician and his private practice within the scope of this Privacy Notice.
