Personal Data Protection (KVKK) Notice | Prof. Dr. Murat Kılıç

PATIENT AND PATIENT RELATIVE INFORMATION NOTICE

As the practice of Prof. Dr. Murat Kılıç, we pay the utmost attention to the security of your personal data. With this awareness, our practice attaches great importance to processing and safeguarding all personal data of patients and their relatives in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”). Fully aware of this responsibility, we process your personal data as the “Data Controller” as defined in the KVKK, in the manner explained below and within the limits prescribed by legislation.

With this notice, we aim to fulfil our obligation under Article 10 of the KVKK to inform you about the purposes for which your personal data are processed, the legal grounds for processing, and your rights.

1. Data Controller and Representative

Your personal data collected under the KVKK may be processed, within the scope described below, by the practice of Prof. Dr. Murat Kılıç, located at “Dr. Mustafa Enver Bey Caddesi No:1/1 Kat: 6 Daire: 603, Alsancak / İzmir” , as the data controller.

2. Personal Data We Process

The personal data of you and of your child under your custody collected by the practice of Prof. Dr. Murat Kılıç are as indicated in the table, without being limited to them.

Identity Data	Patient's full name, Turkish ID number, passport number, signature, mother's name, father's name, date of birth, gender, photograph
Contact Data	Telephone (mobile/landline) number, full address, country, city, e-mail address
Private Health Insurance Data	Data relating to private health insurance, for the purpose of financing and planning healthcare services.
Other Data	Legal correspondence documents, notifications such as appointment details and satisfaction results, and other personal data
Family and Patient Relative Data	Patient relatives' full name, Turkish ID number, address, telephone, e-mail, signature, private health insurance records
Physical Premises Security	Indoor camera recordings
Special Categories of Personal Data	Health data; laboratory test result reports, photographs/videos relating to the complaint (data sent via WhatsApp and similar applications), information on past operations, past treatments, medication use, weight, height, prescriptions, laboratory results, examination notes (epicrisis), and, without being limited to these, any health data obtained during or as a result of medical diagnosis, treatment and care services

3. Purposes for Which Personal Data Will Be Processed

According to Article 5 of the KVKK, titled conditions for processing personal data, personal data cannot, as a rule, be processed without the explicit consent of the data subject. However, where one of the following conditions exists, personal data may be processed without the explicit consent of the data subject:

It is expressly provided for by law.
It is necessary for the protection of the life or bodily integrity of the person who is unable to give consent due to actual impossibility, or whose consent is not legally recognised, or of another person.
Processing of the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of the contract.
It is mandatory for the data controller to be able to fulfil its legal obligation.
The data have been made public by the data subject himself or herself.
Data processing is mandatory for the establishment, exercise or protection of a right.
Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

According to Article 6 of the KVKK, titled conditions for processing special categories of personal data, data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are special categories of personal data. As a rule, processing special categories of personal data without the explicit consent of the data subject is prohibited. However, data necessary for the protection of health, medical diagnosis, treatment or the management of healthcare services are not prohibited if they are processed only by persons who are subject to a duty of confidentiality.

In addition, your special categories of personal data relating to health and sexual life may be processed without explicit consent only for the purposes of protecting public health, preventive medicine, carrying out medical diagnosis, treatment and care services, and planning and managing healthcare services and their financing.

Under the laws of the Republic of Turkey, where explicit consent is required, we may process the personal data of individuals under the age of 18 with the consent of the minor's parent or guardian.

Your personal data and the personal data of your child under your custody may be processed by our practice within the personal data processing conditions set out in Articles 5 and 6 of the KVKK referred to above, and for the purposes listed below.

Your personal data and the personal data of your child under your custody are processed by the data controller in line with the purposes and legal grounds specified below, which are not limited to them and, where necessary, for similar purposes and grounds, within the personal data processing conditions set out in Articles 5 and 6 of the KVKK, and limited to purposes and conditions consistent with the principles and periods specified in our practice's VERBİS registration.

The purposes of processing in this context are set out below.

Fulfilling our legal obligations under legislation
Verifying your identity as required by the services provided by our practice
Protection of public health, preventive medicine, carrying out medical diagnosis, treatment and care services, and planning and management of healthcare services and their financing
Providing information to authorised persons, institutions and organisations
Retaining information on health data that must be kept under the relevant legislation,
Planning and managing the internal operation of the practice and its daily operations
Measuring, increasing and researching patient satisfaction
Being able to notify you about appointments and managing appointment processes
Carrying out analysis and research in order to improve healthcare services
Sharing information requested by contracted institutions/organisations, primarily private insurance companies, and identity verification, within the scope of financing healthcare services
Enabling invoicing
Carrying out emergency management processes
Carrying out information security processes
Carrying out activities in compliance with legislation
Carrying out finance and accounting affairs
Ensuring the security of physical premises
Follow-up and handling of legal affairs
Carrying out goods/services procurement processes
Carrying out goods/services after-sales support services
Carrying out retention and archiving activities
Carrying out contract processes
Follow-up of requests/complaints
Ensuring the security of the data controller's operations
Creating and keeping visitor records
Carrying out patient and patient relative relationship management processes
Carrying out processes aimed at patient satisfaction
Carrying out activities in compliance with legislation
Follow-up and handling of legal affairs
Carrying out communication activities
Carrying out/auditing business activities
Collecting and evaluating suggestions for improving business processes
Carrying out business continuity activities
Improving healthcare services
Carrying out diagnosis and treatment processes

4. To Whom and for What Purpose Processed Personal Data May Be Transferred

According to Article 8 of the KVKK, titled transfer of personal data, personal data cannot be transferred without the explicit consent of the data subject.

In cases where personal data may be processed without the explicit consent of the data subject, they may also be transferred to third parties without explicit consent. Likewise, provided that adequate measures are taken, special categories of personal data other than data relating to health and sexual life may also be transferred without the explicit consent of the data subject in cases provided for by law. Personal data relating to health and sexual life, on the other hand, may be transferred without the explicit consent of the data subject only for the purposes of protecting public health, preventive medicine, carrying out medical diagnosis, treatment and care services, and planning and managing healthcare services and their financing, and only by persons under a duty of confidentiality or by authorised institutions and organisations. For this reason, because we provide preventive medicine and other healthcare services, we process our patients' health data without obtaining explicit consent.

All your other personal data we process by obtaining your explicit consent.

In short, personal data will be processed lawfully and in good faith, in connection with the purposes of processing, in a limited and proportionate manner, accurately and kept up to date, and for specified, explicit and legitimate purposes.

The provisions of other laws concerning the transfer of personal data are reserved.

Your personal data processed in accordance with the regulations set out above;

In order for the business units to carry out the work necessary to let the relevant persons benefit from the services offered by our practice and to carry out the related business processes, to plan and implement our practice's scientific strategies, to ensure the legal, technical and commercial security of persons in a relationship with our practice, and for the purposes set out in Article 3 of this information notice; persons/institutions and/or organisations permitted by Law No. 3359 on Basic Health Services, Decree-Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions, Law No. 6698 on the Protection of Personal Data, the Regulation on the Processing of Personal Health Data and Ensuring Privacy, and other relevant legislation; private insurance companies, the Ministry of Health and its affiliated sub-units, the Social Security Institution, the General Directorate of Security and other law enforcement forces, the General Directorate of Population Affairs, the Turkish Pharmacists' Association, courts and all kinds of judicial authorities, other third parties, representatives you have authorised, lawyers to whom you have given power of attorney on the matter, third parties from whom we receive consultancy, including tax and financial advisers and auditors, regulatory and supervisory bodies, our service providers, suppliers, persons from whom we receive accounting services, and other domestic organisations and third parties, may be transferred, limited to the personal data processing conditions and purposes set out in Article 8 of the KVKK.

5. Method and Legal Basis of Collecting Personal Data

Your personal data and the personal data of your child under your custody are collected by our practice through different channels and on the basis of different legal grounds, namely in written, verbal, visual and electronic form, through the cameras in our practice, e-mail and similar channels, and are stored in physical or electronic form.

The personal data collected may also be processed for the purposes set out in Articles (3.) and (4.) of this notice, within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of the KVKK, and may also be transferred, limited to the personal data processing conditions and purposes set out in Article 8 of the KVKK.

6. Retention Period of Personal Data

According to Article 7 of the KVKK, even if personal data have been processed in accordance with this law and other relevant laws, where the reasons requiring their processing cease to exist, they are deleted, destroyed or anonymised by the data controller ex officio or upon the request of the data subject. In this context, our practice retains personal data only for the period specified in the relevant legislation or for as long as is mandatory and necessary for the purpose for which they are processed. The special categories of personal data of your child under your custody that must be retained by law will be kept for 15 (fifteen) years. In addition, camera recordings for physical security purposes of you and your child under your custody will be kept for 1 (one) month, and identity and contact data and private health insurance data will be kept for 10 (ten) years following the end of the treatment processes. Upon expiry of the period or when the reasons requiring processing cease to exist, personal data will be destroyed by the destruction methods (deletion and/or destruction and/or anonymisation) determined in accordance with the periodic destruction schedules or the application of the data subject, if any. In personal data processing activities, we act in accordance with the general principles set out in Article 4 of the KVKK. You may withdraw at any time the consent you have given for the processing of personal data other than data that must be processed by law.

7. Rights of the Data Subject Listed in Article 11 of Law No. 6698

If, as a data subject, you submit your requests concerning your rights to our practice by the methods set out below, our practice will conclude the request free of charge as soon as possible and at the latest within thirty days, depending on the nature of the request, in accordance with the second paragraph of Article 13 of the KVKK. However, if the procedure requires an additional cost, our practice may charge the fee set out in the tariff determined by the Personal Data Protection Board.

In this context, data subjects have the right to:

Learn whether personal data are being processed,
Request information if their personal data have been processed,
Learn the purpose of processing personal data and whether they are used in accordance with that purpose,
Know the third parties to whom personal data are transferred, domestically or abroad,
Request correction of personal data if they have been processed incompletely or incorrectly, and request that the action taken in this context be notified to the third parties to whom the personal data have been transferred,
Request the deletion or destruction of personal data where the reasons requiring their processing cease to exist, even though they were processed in accordance with the KVKK and other relevant laws, and request that the action taken in this context be notified to the third parties to whom the personal data have been transferred,
Object to the emergence of a result against themselves through the analysis of the processed data exclusively by automated systems,
Request compensation for damage if they suffer harm because personal data have been processed in violation of the law.

8. Ways to Submit Your Requests under the KVKK

In accordance with the first paragraph of Article 13 of the KVKK, you may submit your request to exercise the rights set out above to our practice in writing. In this framework, the channels and procedures through which you can submit your written application to our practice under Article 11 of the KVKK are explained below:

To exercise the rights set out above, you may submit your request, containing your explanations regarding the right under Article 11 of the KVKK that you wish to exercise, together with the necessary information identifying you, by means of the “Application Form” that you can obtain from our practice; by coming in person to “Dr. Mustafa Enver Bey Caddesi No:1/1 Kat: 6 Daire: 603, Alsancak / İzmir” and handing it over, or by sending it through a notary or by the other methods specified in Law No. 6698.

I have read the above text. I have been informed about my rights.

Patient's Full Name:

Parent/Guardian Full Name:

Date:

Signature: