1. PURPOSE OF THE POLICY
This Personal Data Protection and Processing Policy (“Policy”) has been prepared by Dr. Ekrem Keskin (“Data Controller”) in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and applicable legislation concerning the protection of personal data.
The purpose of this Policy is to explain the principles and procedures adopted regarding the collection, processing, storage, protection, transfer, retention and destruction of personal data processed in connection with medical services, patient management, administrative activities and other professional activities.
The Data Controller attaches importance to the protection of the privacy and security of personal data belonging to patients, prospective patients, visitors, employees, service providers, business partners and other relevant persons.
2. SCOPE OF THE POLICY
This Policy applies to personal data processed by Dr. Ekrem Keskin through physical, electronic, verbal, written or other means.
The Policy may apply to, including but not limited to:
Patients and prospective patients,
Patient relatives and authorized representatives,
Visitors,
Employees and prospective employees,
Suppliers and service providers,
Business partners,
Consultants and professional advisors,
Persons communicating with the clinic or physician through digital channels.
Personal data may be processed through patient forms, medical records, consultation records, telephone communications, e-mail, websites, online forms, messaging applications, invoices, payment records, photographs, video recordings and other communication or information systems.
3. CATEGORIES OF PERSONAL DATA PROCESSED
Depending on the nature of the relationship and the services provided, the following categories of personal data may be processed:
3.1 Identity Information
Name and surname,
Date of birth,
Nationality,
Turkish ID number where legally required,
Passport information,
Other identification information.
3.2 Contact Information
Telephone number,
E-mail address,
Residential or correspondence address,
Emergency contact information,
Communication records.
3.3 Health Information
Where necessary for the provision of healthcare services:
Medical history,
Diagnosis and treatment information,
Examination findings,
Laboratory and imaging results,
Medications and allergies,
Previous surgical procedures,
Current and previous medical conditions,
Pre-operative and post-operative information,
Photographs and other medical images,
Other information concerning the physical and mental health of the patient.
Health data constitutes special categories of personal data under Article 6 of KVKK and is processed with the required level of care and in accordance with applicable legislation.
3.4 Financial Information
Where relevant:
Payment information,
Invoice information,
Transaction records,
Bank/payment information where legally and operationally necessary.
3.5 Visual and Audio Information
Where applicable and subject to the relevant legal requirements:
Photographs,
Medical photographs,
CCTV recordings,
Video recordings,
Audio recordings where legally permitted and necessary.
3.6 Communication Records
Information arising from communications with patients or other relevant persons, including:
E-mail correspondence,
Telephone communication records,
Written correspondence,
Online consultation records,
Messages sent through communication applications.
4. PURPOSES OF PROCESSING PERSONAL DATA
Personal data may be processed for the following purposes, where legally permitted:
Providing medical examination, diagnosis, treatment and healthcare services;
Planning and managing medical procedures and appointments;
Creating and maintaining patient medical records;
Monitoring pre-operative and post-operative processes;
Ensuring patient safety and continuity of healthcare;
Performing laboratory, imaging and other medical examinations;
Managing communication with patients and prospective patients;
Preparing quotations, invoices and payment records;
Fulfilling accounting and financial obligations;
Complying with legal and regulatory obligations;
Fulfilling obligations towards the Ministry of Health and other competent authorities;
Managing insurance or reimbursement processes where applicable;
Protecting the security of patients, employees, visitors and facilities;
Managing complaints, requests and legal processes;
Receiving professional services such as accounting, legal, IT and technical support;
Maintaining information security and preventing unauthorized access;
Conducting quality and service improvement activities;
Fulfilling other purposes permitted or required under applicable legislation.
5. METHODS OF COLLECTING PERSONAL DATA
Personal data may be collected through:
Face-to-face consultations and medical examinations,
Patient registration and consent forms,
Medical records,
Telephone calls,
E-mail,
Website and online forms,
Messaging applications,
Documents provided by patients,
Laboratory and healthcare institutions,
Insurance companies where applicable,
Payment and invoicing systems,
Authorized representatives,
Legally authorized public institutions and organizations.
Personal data is collected through lawful and appropriate methods and, where required, based on the relevant legal ground under KVKK.
6. LEGAL BASES FOR PROCESSING PERSONAL DATA
Personal data may be processed based on one or more of the legal conditions specified under KVKK, including where applicable:
Explicitly provided for by law,
Necessary for the establishment or performance of a contract,
Necessary for compliance with a legal obligation,
Necessary for the establishment, exercise or protection of a right,
Necessary for the legitimate interests of the Data Controller, provided that fundamental rights and freedoms are not harmed,
Made public by the data subject,
Necessary for the protection of the life or physical integrity of a person where the relevant conditions under KVKK are met,
Explicit consent of the data subject where required.
Special categories of personal data, including health data, are processed only where one of the conditions permitted under Article 6 of KVKK is satisfied.
7. PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA
Dr. Ekrem Keskin processes personal data in accordance with the following principles:
Processing personal data lawfully and fairly;
Ensuring that personal data is accurate and, where necessary, up to date;
Processing personal data for specific, explicit and legitimate purposes;
Processing personal data in a relevant, limited and proportionate manner;
Retaining personal data only for the period required by the applicable legislation or the purpose of processing;
Taking appropriate technical and administrative measures to protect personal data.
8. SECURITY OF PERSONAL DATA
Appropriate technical and administrative measures are implemented to protect personal data against:
Unauthorized access,
Unauthorized disclosure,
Loss,
Destruction,
Alteration,
Unauthorized copying,
Data breaches,
Other unlawful processing activities.
Access to personal data is limited to persons who require such access for legitimate professional or operational purposes.
Persons and service providers who have access to personal data may be subject to confidentiality obligations and appropriate contractual or administrative measures.
In the event of a personal data breach, the necessary actions shall be taken in accordance with KVKK and applicable regulations.
9. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA
Health information and other special categories of personal data are processed with particular care.
Access to such information is limited to authorized persons whose access is necessary for medical, administrative or legally permitted purposes.
Special categories of personal data shall not be processed beyond the purposes and legal conditions permitted under applicable legislation.
10. TRANSFER OF PERSONAL DATA
Where legally permitted and necessary for the relevant purpose, personal data may be transferred to:
The Ministry of Health and other competent public authorities,
Hospitals and healthcare institutions,
Laboratories and diagnostic service providers,
Insurance companies where applicable,
Legal, financial and accounting advisors,
Information technology and technical service providers,
Payment and financial service providers,
Authorized representatives,
Courts, law enforcement authorities and other competent public institutions,
Other parties where transfer is legally required or permitted.
Where international transfers of personal data are necessary, such transfers shall be carried out only in accordance with the applicable provisions and safeguards of KVKK concerning transfers of personal data abroad.
11. CCTV AND SECURITY RECORDINGS
For security purposes, CCTV systems may be used within areas where legally permitted.
CCTV recordings may be processed for purposes including:
Ensuring physical security,
Protecting patients, employees and visitors,
Preventing unauthorized access,
Protecting property,
Investigating security incidents,
Fulfilling legal obligations.
CCTV recordings are accessed only by authorized persons and are retained for the period necessary for the relevant purpose and in accordance with applicable legislation.
12. RETENTION OF PERSONAL DATA
Personal data is retained for the period required by applicable legislation or for the period necessary to fulfill the purpose for which it was collected.
Different retention periods may apply depending on the type and nature of the personal data.
When the legal retention period expires or the purpose requiring the retention of personal data ceases to exist, the relevant data shall be deleted, destroyed or anonymized in accordance with applicable legislation.
13. DELETION, DESTRUCTION AND ANONYMIZATION
Where personal data is no longer required to be retained under applicable legislation or the purpose of processing no longer exists, the data may be:
Deleted,
Destroyed, or
Anonymized,
in accordance with the procedures and principles established under KVKK and applicable legislation.
14. RIGHTS OF DATA SUBJECTS
Under Article 11 of KVKK, data subjects may have the right to:
Learn whether their personal data has been processed;
Request information regarding the processing of their personal data;
Learn the purpose of processing and whether the data is used in accordance with that purpose;
Know the third parties to whom personal data has been transferred domestically or abroad, where applicable;
Request correction of incomplete or inaccurate personal data;
Request deletion or destruction of personal data under the conditions specified by law;
Request notification of correction, deletion or destruction to third parties to whom personal data has been transferred, where applicable;
Object to a result arising against them through the analysis of processed data exclusively by automated systems, where applicable;
Request compensation for damages arising from unlawful processing of personal data.
15. EXERCISE OF DATA SUBJECT RIGHTS
Data subjects may submit their requests concerning their personal data in accordance with the procedures and requirements specified under KVKK.
Applications should contain sufficient information to identify the applicant and clearly explain the request.
Requests shall be evaluated and responded to within the periods and in accordance with the procedures prescribed by applicable legislation.
16. CONFIDENTIALITY
Dr. Ekrem Keskin considers the confidentiality of patient and personal information to be an essential principle.
Personal data obtained during medical examinations, consultations, treatments and other professional activities shall be handled confidentially and shall only be disclosed where legally permitted or required.
17. POLICY UPDATES
This Policy may be reviewed and updated when necessary due to changes in legislation, regulatory requirements, technological developments, organizational processes or data processing activities.
The latest version of the Policy shall be made available through the appropriate communication channels.
18. EFFECTIVE DATE
This Policy enters into force on:
Dr. Ekrem Keskin