Scope:
This policy, titled Personal Data Protection and Privacy Policy, has been prepared by Dr. Ceyhun Aydoğan to explain the set of rules regarding the processing of personal data and to provide the necessary information.
Definitions:
- Personal Data: Any information related to an identified or identifiable natural person.
- Sensitive Personal Data: Data concerning an individual’s race, ethnic origin, political opinion, philosophical beliefs, religion, sect, or other beliefs, clothing and appearance, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
- Explicit Consent: Consent given freely, based on information and related to a specific subject.
- Anonymization: The process of rendering personal data unidentifiable, even when matched with other data, making it impossible to associate it with any identified or identifiable individual.
- Processing of Personal Data: Any operation performed on personal data, including collection, recording, storage, retention, modification, rearrangement, disclosure, transfer, acquisition, accessibility, classification, or prevention of use, whether through automated or non-automated means, provided that it is part of a data recording system.
- Data Subject: The natural person whose personal data is processed.
- Data Recording System: A recording system where personal data is processed according to specific criteria.
- Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
- Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller.
- Contact Person: The individual responsible for implementing procedures and acting as the point of contact before the Board.
- KVKK: The Personal Data Protection Law No. 6698, published in the Official Gazette on April 7, 2016, and dated March 24, 2016.
- KVKK Working Group: The contact person authorized by Dr. Ceyhun Aydoğan.
- Board: The Personal Data Protection Board.
- Authority: The Personal Data Protection Authority.
- Policy: Dr. Ceyhun Aydoğan’s Personal Data Protection and Privacy Policy.
- Personal Health Data: Any information concerning the physical and mental health of an identified or identifiable person, as well as data related to healthcare services provided to that person.
- Deletion of Personal Data: The process of making personal data inaccessible and unusable for relevant users in any way.
- Destruction of Personal Data: The process of making personal data inaccessible, irretrievable, and unusable by anyone.
- Periodic Destruction Process: The automatic deletion, destruction, or anonymization of personal data at regular intervals when all conditions for processing personal data, as specified in the law, cease to exist.
References:
The Personal Data Protection Law (“KVKK”) and related regulations, including Law No. 6698, published in the Official Gazette on April 7, 2016.
Changes:
This policy will be updated with a revision number in accordance with amendments to relevant legislation. Changes take effect on the date the updated policy is published.
Purpose:
As a healthcare provider authorized for international health tourism, Dr. Ceyhun Aydoğan processes the personal data of patients, employees, suppliers, visitors, job applicants, and individuals in contact via other means or channels as a Data Controller under KVKK, ensuring compliance with legal requirements. The purpose of this policy is to inform relevant individuals about data processing activities, promote transparency, and ensure the protection of personal data.
General Principles of Personal Data Processing:
Dr. Ceyhun Aydoğan processes personal data within the scope of the purposes outlined in the Purposes of Personal Data Processing section of this policy, adhering to the following principles:
- Compliance with the law and principles of fairness,
- Accuracy and, where necessary, updating,
- Processing for specified, explicit, and legitimate purposes,
- Relevance, limitation, and proportionality to processing purposes,
- Retention for the period required by relevant legislation or necessary for processing purposes.
Personal Data Processed by Dr. Ceyhun Aydoğan:
Personal data is processed under strict security measures and respect for privacy, in compliance with Articles 5 and 6 of KVKK. In cases where personal data is processed for medical diagnosis, treatment, and care services by individuals bound by confidentiality obligations under Article 6/3, explicit consent is not required. However, for other purposes, data is processed only with explicit consent from the data subject.
Personal data processed within the scope of this policy varies depending on the nature of the relationship between Dr. Ceyhun Aydoğan and the data subject, the communication channels used, and the intended purpose. The types of personal data processed include:
- Identifying information (e.g., name, surname, Turkish ID number, age, occupation, title, employment information, education level, gender, criminal record, career history, IBAN),
- Identification documents (e.g., photocopies of ID cards, passports, and driver’s licenses, temporary Turkish ID numbers, birth date, place of birth, ID number, blood type, registry number, volume number, family sequence number, and photographs),
- Contact details (e.g., address, email, phone and fax numbers, social media accounts, and communication records such as call logs and emails),
- Visual and audio data (e.g., security camera footage and voice recordings),
- Financial data related to payment and collection activities,
- Health data (e.g., medical history, diagnosis, blood type, health reports, treatment details),
- Pre- and post-operation patient photographs.
Purposes of Personal Data Processing:
The collected personal data is processed by Dr. Ceyhun Aydoğan to enable the provision of diagnostic and treatment services and ensure the efficient operation of business processes, in accordance with Articles 5 and 6 of the Law, for the following purposes:
- Identity verification,
- Scheduling, reminding, modifying, and notifying patients about appointments and services,
- Patient assessment and diagnosis,
- Outpatient and inpatient treatment,
- Medical supply and medication provision for patient care,
- Preoperative preparation and surgical procedures,
- Conducting necessary medical tests and examinations,
- Managing medication and material preparation and control processes,
- Performing diagnostic imaging and related medical procedures,
- Monitoring treatment processes and creating medical records,
- Managing patients’ personal belongings and providing storage services,
- Managing financial transactions for healthcare services,
- Performing accounting and financial operations,
- Retaining data in compliance with legal requirements,
- Handling patient requests and complaints,
- Following up and managing legal procedures,
- Complying with official institution requests and benefiting from health tourism incentives and supports,
- Managing business processes with contracted private insurance companies and other institutions,
- Ensuring information security,
- Conducting audits and ethical compliance activities by regulatory and professional institutions,
- Conducting market research, promotion, and information activities related to the services provided,
- Obtaining and evaluating patient feedback regarding services,
- Ensuring workplace security,
- Utilizing anonymized data for academic research, scientific studies, and educational purposes in peer-reviewed journals, national and international conferences, and seminars.
Transfer of Personal Data:
Your collected personal and special category personal data may be transferred, in line with the purposes stated above, in accordance with the relevant provisions of the Turkish Commercial Code No. 6102, Tax Procedure Law No. 213, Turkish Civil Code No. 4721, Code of Obligations No. 6098, Basic Law on Health Services No. 3359, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and Its Affiliated Institutions, and the Personal Data Protection Law No. 6698 (KVKK), the Private Hospitals Regulation, the Regulation on the Processing and Protection of Personal Health Data, the Regulation on International Health Tourism and Tourist Health, as well as other applicable legislation.
Within these legal frameworks, your personal data may be shared, in a limited and necessary manner, with our employees, doctors, healthcare professionals we collaborate with, suppliers, service providers, legal advisors, legally authorized public institutions, and private individuals authorized by law. The transfer of personal data is carried out in accordance with the processing conditions outlined in Articles 5 and 6 of the KVKK, and the rules regarding data transfer specified in Articles 8 and 9.
For the purposes of carrying out provisioning and invoicing processes related to the services provided, ensuring access to health, travel, complication, and similar insurances, and managing payment transactions for treatment expenses, your personal data may be transferred to affiliated institutions, insurance companies, hospitals, or authorized representatives of the affiliated institutions.
With your explicit consent, your relevant health data and other personal data may be shared with your specified relatives or third parties upon your request and limited to that request. Additionally, if you provide explicit consent, we may contact you via email and social media applications.
Collection of Personal Data:
Your personal data is collected through our computer systems, tablets, customer information management software, website-based online services, as well as emails, WhatsApp, and social media applications. Additionally, data is gathered through physical health forms, postal mail, courier services, and face-to-face meetings.
Your personal data is processed in compliance with Articles 5 and 6 of the KVKK, based on the necessity of processing for the establishment and performance of service agreements, fulfillment of legal obligations, exercise or protection of rights, and legitimate interests.
Health data, however, is processed by persons subject to a confidentiality obligation for the purposes of medical diagnosis, treatment, and healthcare services, as well as health service planning and management, under Article 6/3 of the KVKK.
Retention Period of Personal Data:
Personal data is retained for the legally required periods within the institution of Dr. Ceyhun Aydoğan and for as long as necessary to fulfill the purposes stated in this policy. Once the retention period ends, and the purpose of processing is no longer applicable, personal data is deleted, destroyed, or anonymized.
Rights of the Data Subject Under KVKK:
As a personal data owner, in accordance with Article 11 of the KVKK, you have the following rights:
- To learn whether your personal data has been processed,
- To request information regarding processed personal data,
- To learn the purpose of processing and whether the data is used in accordance with its purpose,
- To know the third parties to whom personal data is transferred within Turkey or abroad,
- To request the correction of incomplete or incorrect personal data and to request notification of such corrections to third parties with whom the data has been shared,
- To request the deletion or destruction of personal data in cases where the reasons for processing no longer exist, even if the data was processed in accordance with the law, and to request notification of this to third parties to whom the data has been transferred,
- To object to decisions made solely based on automated processing that produce unfavorable consequences for you,
- To demand compensation in case you suffer damage due to the unlawful processing of personal data.
Minors:
Individuals under the age of 18 must visit the website under the supervision of a parent or legal guardian. They should not share any personal data without parental supervision. Personal data of individuals under 18 is collected only upon the request of the legal guardian with parental authority.
Personal Data Security:
Dr. Ceyhun Aydoğan prioritizes the confidentiality and security of personal data. Necessary technical and administrative security measures are taken to protect personal data from unauthorized access, damage, loss, or disclosure.
Responsibility:
The KVKK Working Group is responsible for implementing and executing the requirements of this policy. The designated contact person is responsible for managing all communications with the Personal Data Protection Authority (KVKK Board).
Enforcement and Review:
This policy comes into effect on the date of publication. The KVKK Working Group is responsible for keeping the procedures up to date.
Revision History:
Revision No: 00
Document Publication Date: 21.09.2024