INFORMATION TEXT ON THE PROCESSING OF PERSONAL DATA

“Information Text”

In accordance with the provisions of the Personal Data Protection Law No. 6698 (“KVKK”) and the European Union General Data Protection Regulation (GDPR), Kültür Mah. As the Practice/Clinic (hereinafter briefly referred to as Physician/Practice/Clinic/Employer) run by Aesthetic, Plastic and Reconstructive Surgery Specialist Prof. Dr. Ufuk Bilkay at Cumhuriyet Blv.No:135/11 Konak-İZMİR, as the Data Controller, your personal information is processed within the framework explained below; It will be recorded, stored, updated, disclosed to third parties where permitted by the legislation, transferred, classified and processed in the ways listed in KVKK and GDPR, and we inform you about our mutual rights and obligations within the scope of the said legal regulation.

Within the scope of the legal legislation, we will record and store and process in our archives your personal information necessary to establish the Physician-Patient relationship and to provide you with health services (diagnosis, treatment, care services, etc.) in line with the patient’s benefit and public health. -Identity, address, telephone, medical history and all other necessary information to determine the patient’s information so that we, as our Clinic, can provide you with health services within the scope of the Private Hospitals Law, Private Hospitals Regulation, Health Practice Communiqué, Patient Rights Regulation and other legislation. save; We are obliged to organize all records and documents in the medical patient file that will be the basis for the transaction in electronic or paper media, -For the purpose of public health and preventive medicine services, the Ministry of Health of the Republic of Turkey, Provincial Health Directorates, Public Health Centers and other units affiliated to the Ministry of Health, the Social Security Institution and your insurance company in case you use your private health insurance, if requested by the competent authorities, especially but not limited to these institutions, if requested by the persons appointed by the competent authorities or within the scope of e-pulse and similar systems established, or if requested by the notification uploaded to us. We inform you that your personal data will be shared with the relevant authorities and persons within the scope of our and/or reporting obligation.

PURPOSES OF PROCESSING OF PERSONAL DATA, METHODS OF COLLECTION AND LEGAL REASONS

To use your personal data in the establishment and execution of the doctor-patient relationship and the fulfillment of the contractual provisions, and in the services we can offer you; To record other necessary information, including identity, address, tax number and personal health data, in order to identify the information of the person who carries out the transaction; To organize all records and documents that will be the basis for the transaction in electronic (internet/mobile etc.) or paper media; To comply with the information storage, reporting and information obligations stipulated by the legislation, competent institutions and other authorities; In order to increase the service quality through marketing and statistical activities, to offer requested / other products / services, and your special personal data are processed for communication, providing information and similar processes within the contractual relationship.

Your blood type, laboratory and imaging results, analyses, allergies, chronic diseases, venereal diseases, infectious diseases, data regarding previous surgeries/operations, your heart rate information, medications you constantly use, information regarding Covid-19 disease, medical treatments, prescription information, habits harmful to health, body analysis and death information, and other health data and other personal data required for the treatments and applications to be applied to you; To be able to create a patient file, to carry out preventive medicine, examination, medical diagnosis, treatment and care services, to carry out your checks after medical diagnosis and treatment processes, to manage complication processes that may occur, to communicate with you one-on-one, to manage appointment processes, to perform patient satisfaction and demand management, to fulfill legal and contractual obligations, to preserve information regarding your health data that must be kept in accordance with the relevant legislation within the specified periods, to receive consultation services from other relevant specialist physicians when necessary in order to carry out your treatment correctly, To be able to fulfill legal obligations in accordance with the legislation within the scope of health tourism, to plan the transfer, accommodation and translator services of patients/clients coming within the scope of health tourism, to announce innovations in medical treatment and practices, to inform third parties about the applied medical procedure, to plan and manage health services and their financing, to ensure workplace safety, to fulfill the responsibilities arising from the legal relationship established between the doctor and the patient, to fulfill financial and administrative obligations, to ensure technical and commercial security and to fulfill public obligations. is being processed.

Your above-mentioned Personal Data and Special Personal Data will be processed in line with the above-mentioned purposes and legislation in order to carry out the examination, preventive medicine, medical diagnosis, treatment and medical practices to be applied to you and to fulfill the obligations related to your treatment. If you do not provide your relevant personal data, the legal obligations imposed on the Physician and practice that will provide service in your medical treatment will not be fulfilled properly and your treatment and/or recovery processes will not be carried out successfully.

Other scopes where your personal data may be processed are as follows: HR operations, In-office operations, Activities with legal, technical and administrative consequences, Strategy, planning and business partners/supplier, customer management, customer satisfaction, Planning and execution of corporate communication activities and events, Planning and execution of in-office training programs, Practice Workplace Safety, Worker and Occupational Health and Safety Protection, Performance of after-sales services, Technical Service Execution of Services, Carrying out collection transactions, To customers; Providing product-service promotion, information, personalized advertising, campaigns and other benefits, sending all kinds of service and commercial electronic messages, survey applications, providing various advantages through statistical analysis, Carrying out studies to improve service quality and providing better service, Issuing invoices for our services, Procuring services from external sources, Offering the benefits of expert organizations to customers in order to receive services and technology services on subjects that are not in their field of expertise, Due to the requirements of the practice activities Identity verification, responding to questions and complaints, taking the necessary technical and administrative measures within the scope of data security, providing financial reconciliation regarding the products and services offered with relevant business partners and other third parties, providing the necessary information in line with the requests and inspections of regulatory and supervisory institutions and official authorities, maintaining information regarding the data that must be kept in accordance with the relevant legislation, ensuring auditing on the consistency of information, measuring customer satisfaction, in terms of employees; Creating a personnel file, determining whether the person is competent to fulfill the requirements of the job on a permanent basis, making private health insurance, creating a health file, taking occupational safety measures, making travel plans. In terms of employee candidates: Managing and planning the process of evaluating suitability for open positions. Publishing the visual and audio data of the Practice and its Employees and stands obtained in competitions, organizations, fairs, studies and other events within the scope of the field of activity, for the purpose of developing and sharing the business, Fulfilling legal obligations Bringing, Execution/monitoring of practice financial reporting and risk management transactions, Execution/tracking of legal affairs, Creation and tracking of visitor records. Planning and execution of employees’ machine and equipment usage. Planning and execution of sales transactions. Planning and execution of Supply Transactions. Planning and execution of collection transactions. Planning and execution of clinical internet, shared network and computer usage in accordance with the law. Practice fairs, activities, social projects, product and corporate planning, execution, promotion,

The mentioned purposes are for informational purposes only, and anything else that may be added by us in order for the Practice to carry out its future operational activities will be announced through updates.

Your Personal Data, depending on the health service provided;

• By coming to the Physician and his Office for examination and treatment, through your health reports, laboratory and imaging results, analyses, health reports and statements you make regarding your health data, so that a medical evaluation can be made regarding the treatment to be applied to you,
• By filling out the “Patient Information and Consent Form” regarding the treatment to be applied by the Physician and the Private Practice/Clinic,
• Through the contact form you fill out on Hekim Muayenehane’s corporate website,
• Through e-mails sent to the corporate e-mail address of the Physician and the Private Practice/Clinic,
• Through photo/video recordings recorded before, after and/or during the medical procedure performed on you in the Physician’s Office,
• Upon your request and when necessary; In order for the Physician and the Private Practice/Clinic to carry out your diagnosis and controls online through remote access, your written/audio/visual (photo and/or video recording) messages you send to the Physician and the Private Practice/Clinic (photo and/or video recording) using the remote connection applications service providers (whatsapp/zoom.us/facetime/skype/messanger/google/instagram/facebook etc.) from which you receive service by accepting their Privacy Policies and International Transfer Policies, and the online messages you establish through these applications. through your voice/video calls,
• By sending direct messages to the profile accounts of the Physician and the Private Practice/Clinic on social media accounts (instagram, YouTube, Facebook, Twitter, Linkedin, etc.) whose servers are located abroad, of which you are already a user, by accepting their Privacy Policy and International Transfer Principles, and/or by commenting on their posts,
• It is processed through the information you transfer by allowing it to be processed automatically through panels such as “contact us” or “get information” in the promotions and advertisements made by the Physician and the Private Practice/Clinic through social media accounts (instagram, YouTube, Facebook, Twitter, Linkedin, Google, etc.) of which you are already a user by accepting their Privacy Policy and International Transfer Principles.

5/2 of KVKK. Exceptions that enable the lawful processing of personal data are regulated in the article. In this regard, apart from explicit consent, the practice may also process personal data in case of the presence of one of the other conditions (exceptions) listed below. The basis for personal data processing may be only one of the conditions listed below, or more than one of these conditions may be the basis for the same personal data processing activity.

These are: Explicitly Provided in Laws, Processing of personal data of a person who is unable to express his/her consent due to actual impossibility or whose consent cannot be given validity is mandatory in order to protect his or another person’s life or physical integrity, Being Directly Related to the Establishment or Performance of the Contract, Fulfilling the Legal Obligation of the Clinic, Publicizing the Personal Data of the Personal Data Subject, Data Processing is Necessary for the Establishment or Protection of a Right. These are cases where data processing is mandatory for the legitimate interest of the practice, provided that it does not harm the fundamental rights and freedoms of the data subject.

Additionally, in accordance with GDPR article 9/2/h, article 6/1/b, article 6/1/f, your data may be processed without requiring an explicit consent statement:

In order to carry out examination, medical diagnosis, treatment and care services, your Health Data, which is considered Special Personal Data, will be processed without your explicit consent by the Clinic, which is under the obligation of confidentiality in accordance with the Law.

• Your Personal Data will be processed by the Clinic, without your explicit consent, in order to carry out your checks after medical diagnosis and treatment processes, to communicate with you one-on-one, and to manage appointment processes.
• In order to achieve patient satisfaction and demand management, your Personal Data will be processed by the Clinic without your explicit consent.

Pursuant to legal obligations in accordance with GDPR article 6/1/c, your Personal Data will be processed without your explicit consent in the following cases;

• Creating a patient file.
• Preserving information regarding your health data that must be kept in accordance with the relevant legislation.
• Checking your fee payments and issuing invoices.
• Execution of tax payments.
• Fulfillment of obligations in accordance with the Ministry of Health Legislation.
• Fulfilling obligations in accordance with Health Tourism Legislation.
• Ensuring your data security.
• Fulfillment of legal obligations before the Judicial Authorities.
• Fulfillment of administrative obligations before Administrative Institutions and Organizations.

PERSONS/ORGANIZATIONS TO WHICH PERSONAL DATA CAN BE TRANSFERRED:

The persons permitted by the provisions of the legal legislation are public institutions and organizations, private public institutions and organizations, polyclinics and medical laboratories with which the physician and his office have an agreement, and in case of consultation, relevant persons, institutions and organizations. Special personal data, on the other hand, can be transferred to domestic and foreign locations where services are received, in order to carry out activities subject to the purposes specified in the legislation to which we are subject, and to carry out insurance and finance activities and to provide insurance and finance services, which are secured by confidentiality agreements. Personal and special personal data; It is stored in a secure environment that is not open to public use and is never shared with third parties unless authorized or under a legal obligation.

Your Personal Data and Special Personal Data collected in line with the conditions and purposes specified in the Personal Data Processing Conditions specified in Articles 5 and 6 of KVKK No. 6698; In accordance with Articles 8 and 9 of KVKK, the physician and his office carry out and develop examination, preventive medicine, medical diagnosis, treatment and care services, receive consultation services from other specialist physicians when necessary, fulfill administrative obligations regarding health tourism legislation, plan the transfer, accommodation and interpreter services of patients coming within the framework of health tourism, communicate with patients, manage control appointment processes, plan and manage health services and financing, take responsibility for responsibilities arising from the legal relationship established between the doctor and the patient. For the purposes of fulfilling financial, legal and administrative obligations, ensuring technical and commercial security and fulfilling public obligations, and promoting the medical services offered; To the extent that it is sufficient to achieve the purpose, it may be transferred to third parties and institutions by signing the necessary confidentiality agreements and providing all necessary administrative and technical security measures in accordance with the legislation.

In this context, your Personal Data processed by the Physician and the Private Practice/Clinic;

• To other specialist physicians for consultation,
• Insured Employees,
• To its suppliers,
• Financial Advisors, Tax and Finance Consultants and Auditors
• Legal Advisor
• Database (Server) Providers
• “Clinic Management Software” Service Provider
• Web Consultant
• translators
• Data Protection Officer
• IT Consultant
• Tourism Agencies
• Public Institutions and Organizations authorized within the framework of the law,
• It will be transferred to the Judicial Authorities.

STORAGE OF PERSONAL DATA

Personal data collection method: Your personal data may be collected verbally, in writing or electronically through all digital channels such as questions sent to our website, messages, telephone calls.

The personal data we obtain is stored securely in physical or electronic environment for an appropriate period of time in order for the Physician and the Private Practice/Clinic to carry out their activities. Within the scope of the activities in question, the physician and his/her practice comply with the obligations stipulated in all relevant legislation, especially the KVKK, regarding the protection of personal data.

In accordance with the relevant legislation, except for cases where it is allowed or required to keep personal data for a longer period of time, in case the purposes of processing personal data are terminated, the data will be deleted, destroyed or anonymized by the Physician and the Private Practice/Clinic ex officio or upon the request of the data subject and the different techniques that can be used. If personal data is deleted via these methods, this data will be destroyed so that it cannot be used again and cannot be recovered.

In cases where the data controller has a legitimate interest, personal data may be stored, provided that the law permits this, even though the purpose of processing and the periods specified in the relevant laws have expired, provided that the fundamental rights and freedoms of the data subjects are not harmed. After the aforementioned limitation period expires, personal data will be deleted, destroyed or anonymized according to the procedure specified above.

PRECAUTIONS TAKEN FOR DATA SECURITY

The practice takes all necessary technical and administrative measures to ensure the appropriate level of security required to protect personal data. 12(1) of KVKK. The measures stipulated in the article are as follows: To prevent unlawful processing of personal data, to prevent unlawful access to personal data, to ensure the preservation of personal data.

PROCESSING OF IMAGE RECORDS

In order to ensure the general and service security of the building and the clinic where the practice is located, the images of visitors, employees and other relevant persons are taken at the entrance of the building in accordance with the basic principles stipulated in KVKK.

PROCESSING OF PERSONAL DATA OF BUSINESS PARTNERS

Within the scope of carrying out the activities established with business partners such as clinics, medical laboratories, product purchase/sale suppliers, personal data regarding the employees of the business partners may be processed in order to ensure the functioning of the service activity for the purposes specified in the law, to fulfill the human resources objectives and policies, and to ensure the legal and commercial security of mutual work.

APPLICATION PROCEDURE AND RIGHTS

Your rights in accordance with Article 11 of KVKK; By contacting us, your personal data; a) to learn whether it has been processed or not, b) to request information about it if it has been processed, c) to learn the purpose of processing and whether it is used in accordance with its purpose, d) to know the third parties to whom it has been transferred domestically/abroad, d) to request correction if it has been processed incompletely/incorrectly, e) to request its deletion/destruction within the framework of the conditions stipulated in Article 7 of the KVKK, f) to request that the third parties to whom it has been transferred be notified of the transactions made in accordance with paragraphs (d) and (e) above, g) We hereby inform you that you have the right to object to the emergence of a result against you due to being analyzed exclusively by automatic systems, g) to request compensation from our Practice in case you suffer damage due to unlawful processing.

Your requests in your application will be finalized free of charge within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost for the Practice, the fee in the tariff determined by the Personal Data Protection Board in the Communiqué on the Procedures and Principles of Application to the Data Controller may be charged. In accordance with the 1st paragraph of Article 13 of the KVKK, Personal Data Right Owners can submit their requests for exercising their stated rights in the article “About the Procedures and Principles of Application to the Data Controller” published in the Official Gazette No. 30356 dated 10 March 2018. It can be done using the methods and information specified in the notification.

Exceptions to the Right to Apply: In accordance with Article 28 of the Personal Data Protection Law, personal data subjects will not be able to assert their rights on the following issues.

• Processing of personal data for purposes such as research, planning and statistics by anonymizing them with official statistics
• Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defence, national security, public security, public order, economic security, privacy of private life or personal rights or constitute a crime.
• Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defence, national security, public security, public order and economic security.
• Processing of personal data by judicial authorities or enforcement authorities regarding investigation, prosecution, trial or enforcement proceedings

In accordance with Article 28/2 of the KVK Law; Provided that it is in accordance with and proportionate to the purpose and basic principles of the law, Article 10, which regulates the data controller’s obligation to inform, Article 11, which regulates the rights of the data subject, except for the right to request compensation for damage, and Article 16, which regulates the obligation to register in the Data Controllers Registry, do not apply in the following cases:

• Processing of personal data is necessary for the prevention of crime or criminal investigation
• Processing of personal data made public by the personal data subject
• Processing of personal data is necessary for the execution of auditing or regulatory duties and disciplinary investigation and prosecution by public institutions and organizations and professional organizations that are public institutions, based on the authority granted by the law.
• Personal data processing is necessary to protect the economic and financial interests of the state regarding budget, tax and financial matters.

RIGHTS OF DATA SUBJECTS ACCORDING TO GDPR

As a Data Subject, your Personal Data is also protected in accordance with the GDPR. In cases where GDPR falls within the jurisdiction (European Union citizens or residents of European Union countries), the rights of Data Subjects are as follows;

• Right of Access (GDPR article 15): The data subject has the right to confirm by contacting Kinik whether personal data relating to him/her is being processed or not, and to learn the details in GDPR article 15 in case personal data are processed.
• Right to Correction (Article 16 of GDPR): The Data Subject has the right to have his/her changed personal data, which is under the responsibility of the Clinic, corrected at any time.
• Right to Deletion (GDPR article 17): The Data Subject has the right to request the deletion of his personal data held by the Clinic. If the issues specified in Article 17 of the GDPR occur, your personal data will be deleted by the Clinic without delay.
• Right to Restriction of Processing (Article 18 GDPR):
• If Data Subjects object to the up-to-dateness of their Personal Data, they, as the Data Subject, have the right to request the restriction of the use of the data until the accuracy of the Personal Data is confirmed by the Clinic.
• In cases where the Data Subject requests the deletion of his Personal Data due to the illegality of the Personal Data processing activity, he has the right to request the restriction of the use of the data until his request is fulfilled.
• The Data Subject has the right to request the restriction of the use of his/her data in cases where his/her personal data is no longer needed for the purposes of processing of the Clinic.
• In cases where Data Subjects object to processing in accordance with Article 21/1 of the GDPR, they have the right to request the restriction of the use of their data until it has been verified whether the legitimate reasons of the Clinic for processing outweigh the legitimate reasons of the Data Subject.
• Right to Data Transfer (Article 20 of the GDPR): The Data Subject has the right to request, at any time, the transfer of his Personal Data held by the Clinic to another controller, if technically possible. However, this right can be exercised when data processing is based on consent or when required by contract.
• Right to object (ARTICLE 21 GDPR)

The data subject has the right to object to the processing of Personal Data within the scope of Article 6/1/e and (f) of the GDPR, on grounds related to his/her special situation.

We would like to inform you that we continue our activities with the awareness that personal data security is at the forefront in all the products and services we offer to you.

CONSENT AND APPROVAL

By reading and accepting this Information Text, you are deemed to have accepted, declared and undertaken that you have full and complete information about the data processing process carried out by the Physician and the Private Practice/Clinic, that you have learned your rights under the KVKK and GDPR, and that you have given your free will to the PROCESSING of your Personal Data and Special Personal Data by the Physician and the Private Practice/Clinic within the scope of this Information Text.

Do you have a question about aesthetics?

My team and I will be happy to answer all your questions.