Privacy Notice

MUSTAFA KARATAŞ PRIVATE POLYCLINIC PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

This is an English translation of the Turkish “Kişisel Verilerin İşlenmesine İlişkin Aydınlatma Metni”. In case of any discrepancy, the Turkish version shall prevail.

This privacy notice has been prepared in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) in order to inform data subjects about the procedures and principles for processing the Personal Data of patients/clients who apply to MUSTAFA KARATAŞ PRIVATE POLYCLINIC, which is owned by MUSTAFA KARATAŞ SAĞLIK VE ÖZEL POLİKLİNİK HİZMETLERİ PAZARLAMA TİC. LTD. ŞTİ. (hereinafter “MUSTAFA KARATAŞ PRIVATE POLYCLINIC”) and operates under the responsibility of its medical director DR. MUSTAFA KARATAŞ.

Ensuring the security of patients’/clients’ Personal Data is one of the priorities of MUSTAFA KARATAŞ PRIVATE POLYCLINIC, owned by MUSTAFA KARATAŞ SAĞLIK VE ÖZEL POLİKLİNİK HİZMETLERİ PAZARLAMA TİC. LTD. ŞTİ. For this reason, MUSTAFA KARATAŞ PRIVATE POLYCLINIC takes the necessary security measures in compliance with the applicable legislation in order to process patients’/clients’ Personal Data securely and to prevent any unlawful access to or leakage of this data.

DATA CONTROLLER

Your Personal Data will be processed under the KVKK by MUSTAFA KARATAŞ PRIVATE POLYCLINIC, located at “Halaskargazi Mah. Vali Konağı Cad. No:73/6 Şişli/İstanbul” and operating under the responsibility of its medical director DR. MUSTAFA KARATAŞ. MUSTAFA KARATAŞ SAĞLIK VE ÖZEL POLİKLİNİK HİZMETLERİ PAZARLAMA TİC. LTD. ŞTİ., with Mersis No. 0609036309700014, is the “DATA CONTROLLER” within the scope of the KVKK.

The compliance process for the protection of Personal Data under the KVKK at MUSTAFA KARATAŞ PRIVATE POLYCLINIC has been carried out with the advice and guidance of a specialised law firm, with responsibility for implementation remaining with the Data Controller.

YOUR PERSONAL DATA TO BE PROCESSED

Your Personal Data and Special Categories of Personal Data listed below will be processed by MUSTAFA KARATAŞ PRIVATE POLYCLINIC lawfully, in a manner that is relevant, limited and proportionate to the purpose of processing, in observance of the principles of fairness and transparency, accurately and up to date, and with all technical and administrative measures required by the legislation to ensure data security; in line with the basic principles in Article 4 of the KVKK, the Personal Data Processing Conditions and Purposes in Articles 5 and 6 of the KVKK, and within the purposes set out in this Privacy Notice.

1- IDENTITY DATA: Your name, surname, Turkish ID number and/or passport number and/or temporary Turkish ID number, identity details, passport details, place and date of birth, marital status, gender, occupation, signature and other identity data that can identify you.

2- CONTACT DATA: Your address (residence/workplace), telephone numbers (the home/work landline and/or mobile numbers you provide), e-mail address, IP address, social media accounts and other contact data.

3- HEALTH DATA: Your blood type, imaging results, test results, allergies, chronic diseases, sexually transmitted diseases, infectious diseases, data on surgeries/operations you have previously undergone, medications you use regularly, information on Covid-19, medical treatments, prescription information, body analysis and measurement data, skin analysis data, habits harmful to health and other health data required for the treatments and procedures to be applied to you.

4- PHOTOGRAPH/VIDEO IMAGES AND AUDIO DATA: Image and audio recording data in photographs and/or videos recorded before, during and/or after a medical procedure, and image data recorded by closed-circuit security cameras for workplace security.

5- FINANCIAL DATA: Your bank account number, IBAN, credit card details, billing and invoice information and other financial data.

PURPOSES FOR WHICH YOUR PERSONAL DATA IS PROCESSED

Your Personal Data is processed by MUSTAFA KARATAŞ PRIVATE POLYCLINIC in accordance with the KVKK for the purposes of: creating a patient file; carrying out examination, preventive medicine, medical diagnosis, treatment, medical procedures and care services; performing your follow-up checks after medical diagnosis and treatment; managing possible complications; contacting you directly; managing appointments; managing patient satisfaction and requests; fulfilling legal and contractual obligations; retaining information on your health data that must be kept under the relevant legislation for the specified periods; obtaining consultation from other relevant specialist physicians when necessary for your treatment to be carried out correctly; fulfilling legal obligations under the legislation on International Health Tourism; planning transfer, accommodation and interpreting services for health tourist patients/clients; announcing innovations in medical treatments and procedures; informing third parties about the medical services offered; planning and managing healthcare services and their financing; ensuring workplace security; fulfilling responsibilities arising from the legal relationship between doctor and patient; fulfilling financial and administrative obligations; ensuring technical and commercial security; and fulfilling public obligations.

Your Personal Data will be processed by MUSTAFA KARATAŞ PRIVATE POLYCLINIC under the KVKK in the following situations and conditions:

• Identity Data will be processed in order to carry out examination, preventive medicine, medical diagnosis, treatment and care services, to create a patient file, to manage patient satisfaction and requests, and to plan transfer, accommodation and interpreting services for health tourist patients/clients.
• Contact Data will be processed in order to perform your follow-up checks after medical diagnosis and treatment and to manage appointments; and, provided that you give explicit consent, it may also be processed to promote, inform about and announce innovations in medical treatments and procedures and to send greetings and congratulations on special occasions.
• Health Data will be processed in order to carry out your medical treatments and medical aesthetic procedures successfully, to obtain consultation from another specialist physician when deemed necessary during your treatment, to create a patient file, to retain information on your health data that must be kept under the relevant legislation for the required period, and to fulfil legal obligations under the applicable Health Law and Health Tourism legislation.
• Photograph, Video and Audio Recording Data will be processed by MUSTAFA KARATAŞ PRIVATE POLYCLINIC in order to observe and manage the treatment process and to ensure workplace security; and, provided that you give explicit consent, it may also be processed to inform third parties about the medical procedure applied to you and for medical promotion.
• Financial Data will be processed in order to check your payments, issue invoices and refund any overpayment.
• Transfer and Accommodation Data will be processed in order to plan transfer and accommodation services for foreign patients/clients coming within the scope of health tourism.

The personal data listed above will be processed for the purposes and in accordance with the legislation stated above, so that your medical treatment can be carried out and the obligations relating to your treatment can be fulfilled. If you do not provide the relevant personal data, the legal obligations of MUSTAFA KARATAŞ PRIVATE POLYCLINIC, which will provide your medical treatment, cannot be properly fulfilled and your treatment and/or recovery processes cannot be carried out successfully.

METHOD OF COLLECTING PERSONAL DATA

Your Personal Data and Special Categories of Personal Data will be collected, depending on the healthcare service provided by MUSTAFA KARATAŞ PRIVATE POLYCLINIC, through:

• The health reports, laboratory and imaging results, test results and statements regarding your health data that you submit when you visit MUSTAFA KARATAŞ PRIVATE POLYCLINIC for examination and treatment, so that a medical assessment of the treatment to be applied to you can be made,
• The “Patient Information and Consent Form” you complete regarding the treatment to be applied by MUSTAFA KARATAŞ PRIVATE POLYCLINIC,
• The contact form you fill in on the corporate website of MUSTAFA KARATAŞ PRIVATE POLYCLINIC, www.coolclinic.com.tr, and on the corporate website of its medical director DR. MUSTAFA KARATAŞ, www.drmustafakaratas.com,
• E-mails you send to the corporate e-mail address of the medical director DR. MUSTAFA KARATAŞ ([email protected]),
• Photograph/video recordings taken before, after and/or during the medical procedure applied to you at MUSTAFA KARATAŞ PRIVATE POLYCLINIC,
• Upon your request and where necessary, written/audio/visual (photograph and/or video) messages you send to MUSTAFA KARATAŞ PRIVATE POLYCLINIC and/or DR. MUSTAFA KARATAŞ, and online voice/video calls you make, using remote communication service providers whose Privacy Policies and International Transfer Principles you have accepted (WhatsApp/Zoom/FaceTime/Skype/Messenger/Google/Instagram/Facebook etc.), so that your diagnosis and follow-up checks can be carried out online by MUSTAFA KARATAŞ PRIVATE POLYCLINIC,
• Direct messages you send to, and/or comments you make on posts of, the profile accounts of MUSTAFA KARATAŞ PRIVATE POLYCLINIC and/or Dr. MUSTAFA KARATAŞ on social media platforms whose servers are located abroad and of which you are already a user, having accepted their Privacy Policies and International Transfer Principles (Instagram, YouTube, Facebook, Twitter, LinkedIn etc.),
• Information you transfer by allowing automatic processing through panels such as “contact us” or “get information” in promotions and advertisements of DR. MUSTAFA KARATAŞ and/or MUSTAFA KARATAŞ PRIVATE POLYCLINIC on social media platforms whose servers are located abroad and of which you are already a user, having accepted their Privacy Policies and International Transfer Principles (Instagram, YouTube, Facebook, Twitter, LinkedIn, Google etc.),
• Log recording devices (firewall) used within the technical measures required by legislation, if you wish to join the wireless internet network (Wi-Fi) at MUSTAFA KARATAŞ PRIVATE POLYCLINIC as a guest user,
• Closed-circuit security cameras without audio recording, used to ensure workplace security within the legitimate interest of MUSTAFA KARATAŞ PRIVATE POLYCLINIC,

and will be processed in accordance with the KVKK so that MUSTAFA KARATAŞ PRIVATE POLYCLINIC can fully and properly fulfil its contractual and legal obligations throughout examination, medical diagnosis, treatment and care services.

PURPOSE, METHOD AND LEGAL BASIS OF PROCESSING YOUR PERSONAL DATA

Your Personal Data may be processed by natural or legal persons authorised by MUSTAFA KARATAŞ PRIVATE POLYCLINIC in the capacity of “DATA PROCESSOR”, by means of verbal, written, camera and photograph recordings, with the necessary technical and administrative security measures, by keeping records in physical and electronic media, and, where required by the relevant provisions of the KVKK, subject to your explicit consent.

CASES REQUIRING YOUR EXPLICIT CONSENT

Pursuant to Article 5/1 of the KVKK, your Personal Data may be processed in the following cases only with your explicit consent:

• Sending you SMS and/or e-mail messages and contacting you by mobile phone in order to promote, announce and inform you about innovations in the medical services provided by MUSTAFA KARATAŞ PRIVATE POLYCLINIC will only be possible with your explicit consent.
• Sharing photograph and/or video recordings taken before, during and/or after a medical procedure to observe the progress of treatment on the social media accounts (Instagram, YouTube, Facebook, Twitter, LinkedIn etc.) and corporate websites of MUSTAFA KARATAŞ PRIVATE POLYCLINIC and/or Dr. MUSTAFA KARATAŞ will only be possible with your explicit consent.
• Since sharing your data through service providers whose servers are located abroad is considered an “international transfer”, and international transfer requires “explicit consent”, your explicit consent will be obtained in such cases. However, YOUR EXPLICIT CONSENT SHALL BE DEEMED TO HAVE BEEN GIVEN in the following cases:
  • If you send written/audio messages and/or photograph/video recordings to, or make voice/video calls with, MUSTAFA KARATAŞ PRIVATE POLYCLINIC and/or DR. MUSTAFA KARATAŞ, or request remote examination/diagnosis by being contacted in this way, using service providers whose servers are located abroad and of which you are already a user, having accepted their Privacy Agreements and International Transfer Principles (WhatsApp/Zoom/FaceTime/Skype/Messenger/Google/Instagram/Facebook etc.); you are deemed to have given explicit consent to the processing of the Personal Data and Special Categories of Personal Data you share with MUSTAFA KARATAŞ PRIVATE POLYCLINIC through these applications in line with the KVK Privacy Notice and privacy principles of MUSTAFA KARATAŞ PRIVATE POLYCLINIC, to being contacted through these applications, and to the transfer of your data abroad under the policies of these applications that you have previously accepted.
  • If you request to be contacted through e-mail service providers whose servers are located abroad and of which you are already a user, having accepted their Privacy Policy and International Transfer Principles (Hotmail, Gmail, Yahoo etc.); you are deemed to have given explicit consent to MUSTAFA KARATAŞ PRIVATE POLYCLINIC processing the Personal Data and Special Categories of Personal Data shared in the messages in line with its KVK Privacy Notice and privacy principles, and to the transfer of your data abroad under the policies of these service providers that you have previously accepted.
  • If you respond to advertisements and promotions of MUSTAFA KARATAŞ PRIVATE POLYCLINIC and/or Dr. MUSTAFA KARATAŞ published on social media service providers whose servers are located abroad (Facebook, Instagram, Google, WhatsApp etc.); the data you have allowed to be processed automatically and transferred abroad by accepting the Privacy and International Transfer Principles of the relevant social media service provider will be transferred by that provider to MUSTAFA KARATAŞ PRIVATE POLYCLINIC and will be processed and retained by MUSTAFA KARATAŞ PRIVATE POLYCLINIC in line with this Privacy Notice and its privacy principles. In such cases, you are deemed to have accepted the Privacy Notice and privacy principles of MUSTAFA KARATAŞ PRIVATE POLYCLINIC and the processing of your Personal Data and Special Categories of Personal Data accordingly, and to have given explicit consent for MUSTAFA KARATAŞ PRIVATE POLYCLINIC to reach and contact you through the contact details you have provided.
  • If you send a direct message to the profile account of MUSTAFA KARATAŞ PRIVATE POLYCLINIC and/or DR. MUSTAFA KARATAŞ on social media platforms whose servers are located abroad and of which you are already a user, having accepted their Privacy Policies and International Transfer Principles (Instagram, YouTube, Facebook, Twitter, LinkedIn etc.); you are deemed to have given explicit consent for MUSTAFA KARATAŞ PRIVATE POLYCLINIC to process your data in line with its KVK Privacy Notice and privacy principles and to contact you through the relevant application.

CASES IN WHICH YOUR DATA MAY BE PROCESSED WITHOUT EXPLICIT CONSENT

Pursuant to Article 6/3 of the KVKK:

• Your Health Data, which is considered a Special Category of Personal Data, will be processed without seeking your explicit consent by MUSTAFA KARATAŞ PRIVATE POLYCLINIC, which is under a legal obligation of confidentiality, in order to carry out examination, medical diagnosis, treatment and care services.

Pursuant to Article 5/2/c of the KVKK:

• Your Personal Data will be processed by MUSTAFA KARATAŞ PRIVATE POLYCLINIC without seeking your explicit consent in order to perform your follow-up checks after medical diagnosis and treatment, contact you directly and manage appointments.

Pursuant to Article 5/2/f of the KVKK, based on our legitimate interests:

• Your Personal Data will be processed by MUSTAFA KARATAŞ PRIVATE POLYCLINIC without seeking your explicit consent in order to manage patient satisfaction and requests.

Pursuant to Articles 5/2/a and 5/2/ç of the KVKK, based on legal obligations, your Personal Data will be processed without your explicit consent in the following cases:

• Creating a patient file.
• Retaining information on your health data that must be kept under the relevant legislation.
• Checking your payments and issuing invoices.
• Fulfilling tax payments.
• Fulfilling obligations under Ministry of Health legislation.
• Fulfilling obligations under Health Tourism legislation.
• Ensuring the security of your data.
• Fulfilling legal obligations before judicial authorities.
• Fulfilling administrative obligations before administrative institutions and organisations.

TRANSFER OF YOUR PERSONAL DATA, AND TO WHOM AND FOR WHAT PURPOSE IT WILL BE TRANSFERRED

Your Personal Data collected in line with the conditions and purposes within the Personal Data Processing Conditions in Articles 5 and 6 of KVKK No. 6698 may be transferred by MUSTAFA KARATAŞ PRIVATE POLYCLINIC, in accordance with Articles 8 and 9 of the KVKK, to third parties and institutions in Turkey as well as abroad, to the extent necessary to achieve the purpose, by signing the necessary Confidentiality Agreements and ensuring all administrative and technical security measures, to our business partners and other third parties with whom we cooperate to develop or carry out services for the purposes of: carrying out and developing examination, preventive medicine, medical diagnosis, treatment and care services; obtaining consultation from other specialist physicians when necessary; fulfilling administrative obligations under Health Tourism legislation; planning transfer, accommodation and interpreting services for health tourist patients; communicating with patients; managing follow-up appointments; planning and managing healthcare services and their financing; fulfilling responsibilities arising from the legal relationship between doctor and patient; fulfilling financial, legal and administrative obligations; ensuring technical and commercial security; fulfilling public obligations; and promoting the medical services offered and informing third parties from a medical perspective. Within this scope, your Personal Data processed by MUSTAFA KARATAŞ PRIVATE POLYCLINIC may be transferred to:

• Other specialist physicians for consultation,
• Its insured employees,
• Its suppliers:
  • Financial Advisors, Tax and Finance Consultants and Auditors
  • Legal Counsel
  • Database (Server) Providers
  • “Clinic Management Software” Service Provider
  • Web/Promotion Consultant
  • Interpreters
  • IT Consultant
  • Travel Agencies
• Public Institutions and Organisations authorised by law,
• Judicial Authorities.

PERSONAL DATA RETENTION PERIOD

Your Personal Data will be retained by MUSTAFA KARATAŞ PRIVATE POLYCLINIC to the extent and for as long as it is legally obliged to retain it. Documentation and retention obligations arise from local commercial, tax and health regulations. The table below shows the retention periods for your Personal Data.

AGE LIMIT FOR DATA SUBJECTS UNDER THE LEGISLATION

Under the KVKK, patients/clients may personally consent to the processing of their personal data provided that they are at least 18 years old. For patients/clients under this age limit, consent must be given by their legal representatives.

WITHDRAWAL OF CONSENT

If you give consent to MUSTAFA KARATAŞ PRIVATE POLYCLINIC for the processing of your Personal Data, you may withdraw the consent you have given for the above purposes under Article 5/1 of the KVKK at any time. Your consent will be withdrawn once you submit your withdrawal statement to our contact address below in the manner described below.

RIGHTS OF DATA SUBJECTS UNDER THE KVKK

Under Article 11 of the KVKK, natural persons whose Personal Data is processed have the right to:

• Learn whether their personal data is processed,
• Request information if their personal data has been processed,
• Learn the purpose of processing and whether the data is used in line with that purpose,
• Know the third parties in Turkey or abroad to whom personal data is transferred,
• Request correction of personal data if it is incomplete or inaccurate, and request that third parties to whom the data has been transferred be notified of this,
• Request deletion or destruction of personal data if the reasons for processing no longer exist, even though it was processed in accordance with the KVKK and other relevant laws, and request that third parties to whom the data has been transferred be notified of this,
• Object to a result against them arising from the analysis of processed data exclusively through automated systems,
• Claim compensation for damages if they suffer damage due to unlawful processing of their personal data.

If you wish to exercise any of the rights listed above, you may submit your written application, clearly stating which of the rights under Article 11 of the KVKK you wish to exercise, bearing your wet signature and accompanied by documents proving your identity, in person to MUSTAFA KARATAŞ PRIVATE POLYCLINIC at “Halaskargazi Mah. Vali Konağı Cad. No:73/6 Şişli-İstanbul/Türkiye”, send it through a notary public, send it to “[email protected]” signed with a secure electronic signature, or send it by other methods specified in the KVKK. Under the “Communiqué on the Procedures and Principles of Application to the Data Controller”, your application must include your name and surname, signature, Turkish ID number/passport number/temporary Turkish ID number, residential or business address, e-mail address, telephone and fax number, and the subject of your request.

MUSTAFA KARATAŞ PRIVATE POLYCLINIC will conclude the request free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. However, if the process requires an additional cost, the fee in the tariff set by the Personal Data Protection Board will be charged.

CONSENT AND APPROVAL

By reading and accepting this Privacy Notice, you are deemed to have accepted, declared and undertaken that you are fully informed about the data processing carried out by MUSTAFA KARATAŞ PRIVATE POLYCLINIC, that you have learned your rights under the KVKK, and that you consent of your own free will to the PROCESSING of your Personal Data and Special Categories of Personal Data by MUSTAFA KARATAŞ PRIVATE POLYCLINIC within the scope of this Privacy Notice.

You have the right not to accept this Privacy Notice after reading it.

MUSTAFA KARATAŞ SAĞLIK VE ÖZEL POLİKLİNİK HİZMETLERİ PAZARLAMA TİC. LTD. ŞTİ. hereby gives this notice in its capacity as “DATA CONTROLLER” under the KVKK.

Kind regards.