PERSONAL DATA PROCESSING AND PROTECTION POLICY

“KVKK“

1. PURPOSE AND SCOPE

Kültür Mah. As the practice run by Aesthetic, Plastic and Reconstructive Surgery Specialist Prof. Dr. Ufuk Bilkay at Cumhuriyet Blv. No: 135/11 Konak-İZMİR (hereafter referred to as Physician/Clinic/Practice/employer), in accordance with the Personal Data Protection Law No. 6698, which is regulated as a constitutional right, and in accordance with the provisions of the European Union General Data Protection Regulation (GDPR); While carrying out our activities, we attach importance to the protection of the personal data of all real persons we come into contact with in any way and to fulfill the requirements in the KVKK in this context.

This Personal Data Protection Policy: Kültür Mah. It has been prepared by Prof. Dr. Ufuk Bilkay, Aesthetic, Plastic and Reconstructive Surgery Specialist at Cumhuriyet Blv. No: 135/11 Konak-İZMİR, in order to inform you about the processes of collection, use, sharing and storage. In the process of processing and protecting personal data; The relevant legislative provisions in force will be applied with priority.

In this context, the main purpose of this Personal Data Protection and Processing Policy (“Policy”) is; To reveal the rules, measures, duties and responsibilities within the scope of the personal data protection legislation adopted by the physician and his/her practice with a methodological approach and to ensure transparency in the measures we implement for the protection of personal data in this context.

2. DEFINITIONS AND ABBREVIATIONS

The terms used in the implementation of this Policy have the meanings given below.

Employees: Refers to the employees of the physician and his/her practice.

Contact Person: The person responsible for monitoring the personal data processing activities within the Physician and the Private Practice/Clinic and the implementation of KVK Policies and Procedures on an individual basis.

Personal Data: It refers to all kinds of information regarding an identified or identifiable natural person.

For example; name, surname, address, telephone number, date of birth, place of birth, eye color, T.R. identification number.

Personal Data Subject: The real person whose personal data is processed. For example; employee, visitor, customer, person of interest

Processing of Personal Data: All kinds of operations performed on personal data by fully or partially automated means or by non-automatic means provided that it is part of any data recording system. For example; to obtain, record, store, change, transfer.

KVK Law: It refers to the Personal Data Protection Law No. 6698.

GDPR: European Union General Data Protection Regulation

3. PRINCIPLES OF PROCESSING OF PERSONAL DATA

The physician and his/her practice store personal data in accordance with the legal regulations. At the end of the period, personal data is deleted, anonymized or destroyed.

TERMS OF PROCESSING OF PERSONAL DATA:

When processing personal data, the Physician and the Private Practice/Clinic comply with the following conditions in line with the provisions of KVKK No. 6698:

• Personal data cannot be processed without the explicit consent of the relevant person. Personal data is processed only with the explicit consent of the data subject/data subject. In this regard, patients are informed about the subject and their explicit consent based on free will is obtained.
• In case one of the following conditions exists, it is possible to process the personal data of the relevant person without requiring his/her explicit consent: a) It is clearly stipulated in the law. b) It is necessary for the protection of the life or physical integrity of the person who is unable to express his consent due to actual impossibility or whose consent is not given legal validity. c) It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or execution of a contract. has been made public by the person himself. e) Data processing is mandatory for the establishment, exercise or protection of a right. f) Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person.

CONDITIONS FOR PROCESSING SPECIAL PERSONAL DATA

The Physician and the Private Practice/Clinic complies with the regulations specified in the processing of special personal data specified in KVKK No. 6698.

KVKK “ARTICLE 6- (1) Data regarding people’s race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data are defined as personal data of special nature”.

Processing of sensitive personal data is prohibited. However, processing of this data;

a) The relevant person has explicit consent,

b) It is clearly foreseen in the law,

c) It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity,

ç) It is in accordance with the personal data made public by the relevant person and with the will to make it public,

d) It is mandatory for the establishment, use or protection of a right,

e) It is necessary for the protection of public health, the execution of preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons or authorized institutions and organizations under the obligation of confidentiality,

f) It is mandatory to fulfill legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,

g) Foundations, associations and other non-profit organizations or entities established for political, philosophical, religious or trade union purposes, provided that they comply with the legislation they are subject to and their purposes, are limited to their fields of activity and are not disclosed to third parties; It is directed to current or former members and members or people who are in regular contact with these organizations and entities,

is possible.

METHODS OF COLLECTION AND PROCESSING OF PERSONAL DATA

It processes personal data of real persons based on the Personal Data Processing Inventory, which must be prepared in accordance with Articles 4, 5 and 6 of the Personal Data Protection Law and within the scope of Articles 5, 7, 9 and 10 of the Regulation and must contain the following information.

• Data category
• Personal data processing purposes and legal reason
• Transferred recipient/recipient groups
• Data subject groups
• Maximum retention period of personal data required for the purposes for which they are processed
• Transfer to foreign countries
• Administrative and technical measures taken regarding data security

The physician and his/her practice carefully comply with the conditions set out in KVKK regarding the sharing of personal data with third parties, without prejudice to the provisions of other laws. In this context, personal data is not transferred to third parties by the Physician and the Private Practice/Clinic without the explicit consent of the data subject. However, personal data may be transferred by the Physician and the Private Practice/Clinic without obtaining the explicit consent of the data subject, if one of the following conditions regulated by the KVKK is met:

• It is clearly stipulated in the law,
• It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity,
• It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
• It is mandatory for the data controller to fulfill its legal obligation,
• The data has been made public by the owner himself,
• Data processing is mandatory for the establishment, exercise or protection of a right,
• It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. Provided that adequate precautions are taken; In terms of special personal data other than health and sexual life, your personal data may be transferred without explicit consent for purposes such as protection of public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and financing, in terms of special personal data regarding health and sexual life. In the transfer of special personal data, the conditions specified in the processing conditions of this data are complied with.
• Protection of public health,
• Preventive medicine,
• medical diagnosis,
• Carrying out treatment and care services,
• Your personal data may be transferred without explicit consent for purposes such as planning and management of health services and financing. In the transfer of special personal data, the conditions specified in the processing conditions of this data are complied with.

Additionally, in accordance with GDPR article 9/2/h, article 6/1/b, article 6/1/f, your data may be processed without requiring an explicit consent statement:

In order to carry out examination, medical diagnosis, treatment and care services, your Health Data, which is considered Special Personal Data, will be processed without your explicit consent by the Clinic, which is under the obligation of confidentiality in accordance with the Law.

• In order to achieve patient satisfaction and demand management, your Personal Data will be processed by the clinic without your explicit consent.

Pursuant to legal obligations in accordance with GDPR article 6/1/c, your Personal Data will be processed without your explicit consent in the following cases;

• Creating a patient file.
• Preserving information regarding your health data that must be kept in accordance with the relevant legislation.
• Checking your fee payments and issuing invoices.
• Execution of tax payments.
• Fulfillment of obligations in accordance with the Ministry of Health Legislation.
• Fulfilling obligations in accordance with Health Tourism Legislation.
• Ensuring your data security.
• Fulfillment of legal obligations before the Judicial Authorities.

Fulfillment of administrative obligations before Administrative Institutions and Organizations.

STORAGE OF PERSONAL DATA UNDER RELEVANT LEGISLATION

Physician and the Private Practice/Clinic personal data are stored securely in physical or electronic environment for an appropriate period of time in order for our company to carry out its activities in accordance with the provisions of KVKK and other relevant laws. First of all, it examines whether there is a period for storing personal data and acts in accordance with this period. If there is no legal period, the required period is determined and personal data is stored in accordance with this period. When the period expires, personal data is deleted, destroyed and anonymized.

However, in cases where the data controller has a legitimate interest, personal data may be stored until the end of the general limitation period (ten years) regulated in the Code of Obligations, provided that the fundamental rights and freedoms of the data subjects are not harmed, even though the purpose of processing and the periods specified in the relevant laws have expired.

In this context, it provides the necessary training and awareness to the relevant units within the Physician and the Private Practice/Clinic.

PRECAUTIONS TAKEN FOR DATA SECURITY

The physician and his/her practice take all necessary technical and administrative measures to ensure the appropriate level of security required to protect personal data.

12(1) of KVKK. The measures foreseen in the article are as follows:

• To prevent unlawful processing of personal data,
• To prevent unlawful access to personal data,
• To ensure the preservation of personal data.

The precautions taken by the physician and his/her practice in this context are listed below:

Administrative Measures

• The Physician and the Private Practice/Clinic carry out the necessary inspections to ensure the implementation of the provisions of the Law.
• If the processed personal data is obtained by others through illegal means, the Physician and the Private Practice/Clinic shall notify the relevant person and the Board of this situation as soon as possible.
• Regarding the sharing of personal data, it ensures data security through framework agreements, consent forms and data subject explicit consent forms or provisions added to the contracts with the persons with whom the personal data is shared.
• It employs personnel who are knowledgeable and experienced about the processing of personal data and provides the necessary KVK training to its personnel.

Technical Measures

• The Physician and the Private Practice/Clinic employ knowledgeable and experienced people to ensure data security and provide the necessary KVK training to his staff.
• It carries out the necessary internal controls within the scope of the established systems.
• It ensures the provision of technical infrastructure and the creation of relevant matrices to prevent and/or monitor the leakage of personal data outside the institution.

KVKK11 OF PERSONAL DATA OWNERS. RIGHTS ACCORDING TO ARTICLE:

Within the framework of Article 11 of the Personal Data Protection Law No. 6698 (KVKK), personal data subjects can apply to the address of Physician and the Private Practice/Clinic;

a- Learning whether personal data has been processed, b- Requesting information if personal data has been processed, c- Learning the purpose of processing personal data and whether they are used in accordance with the purpose, d- Knowing the third parties to whom personal data has been transferred domestically or abroad, d- Requesting correction of personal data if they have been processed incompletely or incorrectly, e- Requesting the deletion or destruction of personal data in accordance with the provisions of KVKK and other relevant legislation, f- In case of correction, deletion or destruction of your personal data, these processes will affect your personal data. g- To request notification to third parties to whom your personal data has been transferred, g- To object to a result against you if a result arises against you by analyzing your processed personal data exclusively through automatic systems, g- To request compensation for the damage if you suffer damage due to the unlawful processing of personal data.

RIGHTS OF DATA SUBJECTS ACCORDING TO GDPR

As a Data Subject, your Personal Data is also protected in accordance with the GDPR. In cases where GDPR falls within the jurisdiction (European Union citizens or residents of European Union countries), the rights of Data Subjects are as follows;

• Right of Access (GDPR article 15): The data subject has the right to confirm by contacting Kinik whether personal data relating to him/her is being processed or not, and to learn the details in GDPR article 15 in case personal data are processed.
• Right to Correction (Article 16 of GDPR): The Data Subject has the right to have his/her changed personal data, which is under the responsibility of the Clinic, corrected at any time.
• Right to Deletion (GDPR article 17): The Data Subject has the right to request the deletion of his personal data held by the Clinic. If the issues specified in Article 17 of the GDPR occur, your personal data will be deleted by the Clinic without delay.
• Right to Restriction of Processing (Article 18 GDPR):
• If Data Subjects object to the up-to-dateness of their Personal Data, they, as the Data Subject, have the right to request the restriction of the use of the data until the accuracy of the Personal Data is confirmed by the Clinic.
• In cases where the Data Subject requests the deletion of his Personal Data due to the illegality of the Personal Data processing activity, he has the right to request the restriction of the use of the data until his request is fulfilled.
• The Data Subject has the right to request the restriction of the use of his/her data in cases where his/her personal data is no longer needed for the purposes of processing of the Clinic.

In cases where Data Subjects object to processing in accordance with Article 21/1 of the GDPR, they have the right to request the restriction of the use of their data until it has been verified whether the legitimate reasons of the Clinic for processing outweigh the legitimate reasons of the Data Subject.

• Right to Data Transfer (Article 20 of the GDPR): The Data Subject has the right to request, at any time, the transfer of his Personal Data held by the Clinic to another controller, if technically possible. However, this right can be exercised when data processing is based on consent or when required by contract.
• Right to object (Article 21 GDPR)

The data subject has the right to object to the processing of Personal Data within the scope of Article 6/1/e and (f) of the GDPR, on grounds related to his or her particular situation.

We would like to inform you that we continue our activities with the awareness that personal data security is at the forefront in all the products and services we offer to you.

Do you have a question about aesthetics?

My team and I will be happy to answer all your questions.