PDPL

www.reyhanarikan.com

LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA (KVKK)

INFORMATION AND DISCLOSURE TEXT

As https://reyhanarikan.com, we pay utmost attention to the processing and protection of your personal data. In accordance with the Personal Data Protection Law, Basic Health Services Law, Regulation on Personal Health Data, Regulation on Private Health Institutions Providing Oral and Dental Health Services, Private Hospitals Regulation, Patient Rights Regulation and relevant legislation, as a data controller; all necessary technical and administrative measures are taken to prevent the unlawful processing of personal data, to prevent unlawful access to personal data, and to ensure the preservation of personal data.

Pursuant to Article 10 of the Personal Data Protection Law; we inform you through policies and this disclosure text created to encompass our patients, patient companions, patient relatives, visitors, hospital managers and our employees, candidate employees, suppliers, service providers and their managers and employees, business/solution partners, company partners, candidate employees, interns, public institutions and organizations we are in contact with, and employees of private legal entities and relevant third parties. This disclosure text has been prepared by the data controller https://reyhanarikan.com within the scope of Article 10 of the Personal Data Protection Law (“Law”), Article 5/8 of the Regulation on Personal Health Data, and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

1-Data Controller

“https://reyhanarikan.com” processes your personal data as the “Data Controller” as defined in Article 3 of Law No. 6698 on the Protection of Personal Data.

2-For What Purpose Personal Data Will Be Processed

Your personal data collected in accordance with the Personal Data Protection Law, Basic Health Services Law, Regulation on Personal Health Data, Regulation on Private Health Institutions Providing Oral and Dental Health Services, Private Hospitals Regulation, Patient Rights Regulation and relevant legislation is processed in accordance with the principles stipulated in the law, completely or partially, automatically or in non-automatic ways as part of a data recording system, by obtaining, recording, storing, modifying, reorganizing.

Your personal data is processed in accordance with Articles 4, 5, 6 of the Law and relevant legislation within the scope of company activities for the following purposes:

• Protection of public health, preventive medicine, conducting medical diagnosis, treatment and care services, ensuring the planning and management of healthcare financing,
• In accordance with the relevant legislation to which we are subject, sharing the information we acquire regarding health services with the Ministry of Health, Social Security Institution and other relevant public institutions and organizations, responding to the requests of institutions, making necessary notifications to relevant public institutions and organizations, fulfilling legal obligations,
• Ensuring the preservation of data that must be kept in accordance with legislation within the scope of the health services we provide,
• Confirming your identity, confirming your legal relationship with contracted institutions within the scope of health services provided, ensuring invoicing and financial reconciliation, making notifications to relevant institutions and organizations arising from legislation such as forensic cases,
• Making appointments, creating appointments, making necessary notifications, ensuring patient, patient relatives, visitor satisfaction, tracking request and complaint processes, conducting examinations and evaluations required by health services provided within the scope of our health services,
• Improving company services, maintaining corporate development activities, carrying out advertising and marketing activities, maintaining the company’s finance and accounting, administrative, legal, technical business processes, fulfilling risk management and quality improvement processes,
• Planning and executing human resources processes, fulfilling work application processes, creating personnel files for employees, fulfilling financial obligations, determining company wage policy,
• Establishing and ensuring the performance of contracts made or to be made between our company and patients, suppliers, service providers, employees and consultants in legal relationship, relevant institutions and organizations, third parties,
• The company’s burden of proof as evidence in legal disputes with third parties,
• Ensuring communication between our company and relevant persons and organizations, ensuring necessary contact through our website, online applications, live support services, social media accounts, maintaining processes necessary for you to fill out relevant electronic and physical forms, ensuring transaction security for relevant persons,
• Providing necessary information to regulatory and supervisory official institutions, private law legal entities,
• Ensuring the supply of medical drugs, materials or equipment, invoicing related to services provided, making payment transactions;
• Through closed circuit camera recording system, monitoring the safety of our patients, visitors, employees and relevant third parties, ensuring legal, technical and commercial business security, preventing behaviors of third parties that may constitute crimes, ensuring the physical security of company buildings and annexes and their surroundings,
• In the interest of the company, through the personnel attendance control system, ensuring performance evaluation, work attendance and control, ensuring control of entry and exit of company buildings and annexes within the scope of the employment contract made with employees,

Within the scope of company activities, limited to the above-mentioned purposes, the following personal data is being processed.

• Your Identity Information (Turkish identity / foreign identity number, your name and surname, place and date of birth, your mother’s and father’s names, your marital status, your gender, identity information on passport, foreign identity document, driver’s license, identity information on your population identity document or other population identity information on the identity sharing system, patient number, patient protocol number for patients)
• Your Contact information (Your telephone numbers, contact address, email address, residence, business address)
• Personnel Information (Personal information on contracts filled out by employees, interns, education, diploma information, certificate information, social security registration number information, general health insurance, private health insurance information, SSI employment entry and exit notification, identity information written on family status statement, persons for whom one is responsible for supporting, spouse, child kinship information, family members’ population registry information, bailment document obtained according to the nature of the work, work certificate, resignation, termination, severance and notice compensation payroll, salary payroll information, disciplinary investigation information, service summary, resume information, leave information, profession information, reference information, bank account information, IBAN number information, survey information, personal information obtained within the scope of occupational health and safety, military service information, personnel attendance control system, personal information obtained through personnel cards for the purpose of ensuring entry and exit to relevant units, information on job application forms,)
• Financial Information (Billing and payment information, bank account number, IBAN number, credit card information, private insurance information within the scope of financial payment, policy information, General Health Insurance information, financial information obtained within the scope of notifications to be made to SSI and Ministry of Health, salary payroll, expense advance information, tax identification number, tax office information, personal information on invoices, dispatch notes, signature circulars, delivery-receipt documents, information contained in contract annexes made with third parties)
• Legal Transaction Information (Legal contact and services provided with relevant persons, personal information in correspondence with courts, prosecutor’s offices, mediators, arbitration boards, judicial authorities within the scope of legal disputes, information in lawsuit and execution files, identity, contact, location information entered into the system in legal notifications that must be made to police departments for identity verification purposes for patients and companions, personal information in minutes and forms kept during unfair acts, legal disputes and other situations that occur during the visits of patients, patient relatives, visitors to our hospital, personal information in forms filled out, recorded, obtained and reported through communication, website, call center within the scope of the “White Code Application” created under the Ministry of Health for health workers, information contained in documents issued, transactions made, correspondence within the scope of post-mortem examination, autopsy procedures, forensic medicine)
• Professional experience information (Education status information, school, diploma information, working life, reference information, internship, seminar, hardware used, software, computer knowledge, foreign language knowledge, former workplace, institution information, courses attended, in-service training information, certificates, license information, other information in reported forms, specialization, title, duty information),
• Visual and Audio Records (Your photographs on health reports and documents prepared within the scope of company activities, your voice recordings in conversations with call centers during appointment creation, establishing communication with the company and tracking request complaint processes, photographs on job application forms, forms filled out in electronic and physical environments, printed forms, documents and your official identity documents, your photographs, your images in videos/camera recordings shared on the company website, our social media accounts or in written and visual media, third-party social media platforms for the purposes of protecting public health, conducting medical diagnosis, treatment and care services, promotion, information)
• Physical Space Security Information (Your camera recording information that records images and sounds, security exit log information, information in forms kept, vehicle license plate information),
• Within the scope of company activities, in accordance with the employment contract and the legitimate interests of the company, for promotional, advertising and informational purposes, professional experience, promotion, information, resume and photograph information of employees on the company website, social media accounts, mobile applications, promotional brochures,
• With the explicit consent of the interested party, by persons under obligation of confidentiality or authorized institutions and organizations, photographs and images of patients shared in written and visual media, websites, our social media accounts, personal data for the purposes of protecting public health, preventive medicine, conducting medical diagnosis, treatment and care services, planning and managing healthcare and its financing,
• Request and Complaint Information (Information and records collected from relevant persons from electronic and physical environments, information regarding the evaluation and management process of requests and complaints coming through the internet and social media, online channels, call center)
• Information on Criminal Convictions and Security Measures (Criminal record, conviction information, judicial status information),
• Health Information (For patients, processed within the scope of protecting public health, preventive medicine, conducting medical diagnosis, treatment and care services; examination, all kinds of laboratory, imaging and test results, patient diagnosis, diagnosis, treatment, prescription, medication information, doctor analysis and comments, patient history (anamnesis) information, examination information, diagnosis and prescription information, health reports and all health information obtained within the scope of health services, health status information written on job application forms, health reports for employees, health tests, blood type information, personal health and physical disability status information, health board reports, your personal data regarding diagnosis and treatment procedures are being processed)

In accordance with Law No. 6698 on KVKK, your personal data that you share with our clinic is being processed by our clinic as the subject of all kinds of transactions performed on your personal data by obtaining, recording, storing, modifying, reorganizing, completely or partially, automatically or in non-automatic ways as part of a data recording system. Personal data processed within the scope of company activities is processed in accordance with relevant legislation for the following purposes.

With its purposes, your personal data is processed in accordance with the conditions and purposes determined in accordance with Articles 4, 5 and 6 of the Law. Your personal data will not be used for any purpose other than the activities of our clinic.

3-To Whom and For What Purpose Processed Personal Data May Be Transferred

Your personal data processed by our company is transferred to the real and legal persons written below for the purposes written below in accordance with the relevant legislation to which our company is subject and Articles 8 and 9 of the Personal Data Protection Law:

• To the Ministry of Health, its subordinate units, family medicine centers, Social Security Institution, General Directorate of Security and its affiliated organizations, other law enforcement forces, General Directorate of Population and Citizenship Affairs, Turkish Pharmacists’ Association, Revenue Administration, Tax Offices, all relevant public institutions and organizations, public professional organizations for the purpose of fulfilling legal obligations stipulated in relevant legislation,
• University hospitals, public hospitals, private hospitals, medical faculties, laboratories, medical centers and third parties providing health services, other health institutions in cooperation for the purpose of carrying out medical diagnosis, examination, treatment and referral procedures,
• To persons and organizations from which health services are received, to private insurance companies within the scope of occupational health and safety measures for the purpose of carrying out occupational health and safety processes of relevant persons,
• Based on your explicit consent, for the purposes of protecting public health, conducting medical diagnosis, treatment and care services, promotion and information, your photographs, your images in videos/camera recordings to written and visual media organs, relevant press institutions and organizations, third-party websites, social media platforms,
• To banks, financial institutions, public and private law legal entities, public officials for the purpose of carrying out financial transactions of relevant persons,
• To prosecutor’s offices, courts, mediators, execution offices and relevant legal institutions and organizations upon request and required by legislation, limited to the purpose of the request regarding public safety and legal disputes,
• To software, hardware, informatics and technology companies located domestically and abroad for the purpose of installing computer operating systems and computer programs used within our company, ensuring the security of electronic data, and performing maintenance and repair of programs,
• To “https://reyhanarikan.com“, company partners, group companies, our business/solution partners, our service providers, our suppliers for the purpose of carrying out company activities and fulfilling mutual obligations,
• Together with the relevant groups of persons listed above, to our company’s employees, legal, financial and tax consultants, regulatory and supervisory institutions, auditors and official authorities, relevant ministries, authorized public institutions and organizations, persons, institutions and organizations permitted by payment services legislation provisions,
• For special category personal data, when necessary with explicit consent in accordance with legal regulation, your personal data is transferred in accordance with the legislation and limited to the purpose of transfer, without seeking the explicit consent of the relevant person for the purposes of protecting public health, preventive medicine, conducting medical diagnosis, treatment and care services, planning and managing healthcare and its financing.

4-Transfer of Data Abroad:

In accordance with the principles regulated in Article 4/2 of the Personal Data Protection Law, regarding personal data processed belonging to relevant persons, by obtaining explicit consent texts or in the cases stipulated in Articles 5/2 and 6/3 of the Law without seeking explicit consent, in accordance with the rules in Article 9 of the Law, after foreign countries with adequate protection to be determined by the Personal Data Protection Board (“Board”) are announced, only to persons and organizations resident in these countries, and for countries determined and announced to lack adequate protection, provided that data controllers in Turkey and the relevant foreign country commit in writing to adequate protection and with the necessary permissions obtained from the Personal Data Protection Board for the relevant transfer, it may be transferred limited to company activities. Within the framework of the limits stipulated by legislation, with all necessary measures taken, within the scope of your legal relationship and activity with our company, in accordance with legislation and limited to the purpose of transfer for protecting public health, preventive medicine, conducting medical diagnosis, treatment and care services, planning and managing healthcare and its financing, your personal information belonging to relevant persons such as identity, contact, transaction security, service recipient/customer transaction information, financial information, visual and audio data, health information, sexual life information, genetic data, protocol number, patient number may be transferred abroad through applications used, software programs, website, mobile applications, online services, live support services, social media accounts.

5-Method and Legal Reasons for Collecting Personal Data:

Your personal data; in accordance with the services we provide, the personal data processing purposes stated above; by using software and hardware programs offered in electronic environments, using call center, live support services, our mobile applications, our social media accounts, email channels, filling out forms on the website, creating membership, using online services, taking patient applications, performing registration procedures, preparing printed forms, carrying out medical diagnosis, treatment and health services within the scope of health services, creating personnel files, preparing and performing contracts, processing accounting, finance, financial, legal transaction information, your personal data is processed and collected completely or partially automatically or in non-automatic ways as part of a data recording system. Your personal data and special category personal data; are processed based on the explicit consent of the relevant person in accordance with legal regulations to which our company is subject. Additionally, your personal data is processed based on the following legal reasons without seeking explicit consent. Accordingly; your personal data,

• Due to being explicitly stipulated in laws,
• When necessary for the protection of the life or physical integrity of the person who is unable to express his/her consent due to actual impossibility or whose consent is not legally valid, or of another person.
• When necessary for the processing of personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of contracts between our company and real and legal persons,
• When the personal data has been made public by the relevant person himself/herself,
• When data processing is necessary for the establishment, exercise or protection of a right,
• When data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person,

In accordance with Articles 5 and 6 of the Personal Data Protection Law and Article 5/1-h of the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, it is processed, collected and transferred limited to the stated purposes. Your personal data is stored and kept for the period specified in the relevant legislation within the scope of company activities.

6-Rights of the Personal Data Owner in Accordance with Law No. 6698 KVKK (Right to Apply)

You can submit your requests within the scope of Article 11 of Law No. 6698 on the Protection of Personal Data, which “regulates the rights of the relevant person,” according to the Communiqué on Application Procedures and Principles to the Data Controller(3), as the data controller “https://reyhanarikan.com” at the address “Fahrettin Kerim Gökay Caddesi Sevgili Apt. Kat: 2 No: 84/3, 34724 Kadıköy / Istanbul” by filling out the APPLICATION FORM included in the attachment by the relevant person who is the Personal Data Owner, and personally delivering a signed copy of the form to the company address with identity verification documents, or by sending an email to info@reyhanarikan.com using Secure Electronic Signature, mobile signature, or the Email address you reported to our clinic and registered in our clinic system, with your personal application, with your application through a Notary or through methods determined by the KVKK Institution.

In accordance with Article 11 of the Law; everyone has the right to apply to the data controller and:

• Learn whether personal data is processed,
• Request information about this if personal data has been processed,
• Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• Know the third parties to whom personal data is transferred domestically or abroad,
• Request correction if personal data is incomplete or incorrectly processed,
• Request deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of KVKK,
• Request that these operations be notified to third parties to whom personal data has been transferred in case of correction, deletion, destruction of personal data,
• Object to the emergence of a result against the person by analyzing processed data exclusively through automatic systems,
• Request compensation for damage in case of suffering damage due to unlawful processing of personal data.

In accordance with Article 13/1 of Law No. 6698 on KVKK, you must submit your applications to exercise the above-mentioned rights to our Company in writing or through the above-mentioned methods determined by the KVKK Institution. Our Company will conclude your requests in the application, according to the nature of the request, as soon as possible and within thirty days at the latest, free of charge. However, if the transaction requires an additional cost, the fee in the tariff determined by the Board will be requested. In this context, if a written response is given to the relevant person’s application, no fee will be charged for up to ten pages, and a 1 TL processing fee will be charged for each page over ten pages. If the answer to the application is to be given on electronic recording media such as CD, flash drive, the fee that may be requested by our company will not exceed the cost amount required by the recording medium.