This information notice has been prepared, pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK") under Turkish law and the European Union General Data Protection Regulation ("GDPR"), in order to inform data subjects of the procedures and principles regarding the processing of the Personal Data of patients/clients who apply to GENART TEDAVİ VE SAĞLIK HİZMETLERİ LTD. ŞTİ. ("Private Dr. Sibel Esin Polyclinic").
Ensuring the security of the Personal Data of patients/clients is one of the primary objectives of Private Dr. Sibel Esin Polyclinic. For this reason, in compliance with applicable legislation, Private Dr. Sibel Esin Polyclinic takes the necessary security measures to ensure that the Personal Data of patients/clients is processed securely and to prevent any unlawful access to or leakage of such data.
Data Controller
Your Personal Data will be processed, within the scope of KVKK No. 6698 and the GDPR, by Private Dr. Sibel Esin Polyclinic, owned by GENART TEDAVİ VE SAĞLIK HİZMETLERİ LTD. ŞTİ., operating at the address "Levent Mah. Sülünlü Sok. No:2 Beşiktaş/İstanbul/Türkiye". GENART TEDAVİ VE SAĞLIK HİZMETLERİ LTD. ŞTİ., with Mersis No. 0720045849400014, is deemed the "Data Controller" under the KVKK and the "Controller" under the GDPR.
Private Dr. Sibel Esin Polyclinic has engaged a law firm specializing in Personal Data Protection as its "Data Protection Officer" for the purposes of the GDPR, and the compliance process regarding the Protection of Personal Data within Private Dr. Sibel Esin Polyclinic under the KVKK and the GDPR has been carried out under the advice and guidance of the specialist law firm, with the responsibility for implementation resting with the Data Controller.
Your Personal Data to Be Processed
The Personal Data set out below will be processed by Private Dr. Sibel Esin Polyclinic in accordance with the fundamental principles set out in Article 4 of the KVKK and Article 5 of the GDPR, within the scope of the Personal Data Processing Conditions and Purposes set out in Articles 5 and 6 of the KVKK and Articles 6 and 9 of the GDPR, and within the purposes set out in this Information Notice; lawfully, in a manner connected, limited and proportionate to the purpose of processing, observing the principles of fairness and transparency, accurately and up to date, and by taking all technical and administrative measures required by legislation to ensure data security.
- 1. YOUR IDENTITY INFORMATION: Your first and last name, T.R. Identity Number and/or Passport Number and/or Temporary T.R. Identity Number, place and date of birth, marital status, gender, occupation, signature and other identity data that identifies you.
- 2. YOUR CONTACT INFORMATION: Your address (residence/workplace), telephone number (your home/workplace landline and/or mobile telephone numbers), e-mail address, IP address, social media accounts and other contact data.
- 3. YOUR HEALTH INFORMATION: Your blood type, laboratory and imaging results, test results, allergies, chronic diseases, venereal diseases, communicable diseases, data relating to any previous surgeries/operations, medications you regularly use, information regarding Covid-19, your medical treatments, prescription information, hormonal information, body analysis and measurement information, skin analysis information, habits harmful to health, and other health data required for the treatment and procedures to be applied to you.
- 4. YOUR GENETIC INFORMATION: Your data relating to your genetic structure, such as genetic samples/specimens, genetic findings and analysis results.
- 5. YOUR PHOTOGRAPHS AND VIDEO IMAGES: Photographs and/or videos taken before, during and/or after a medical procedure.
- 6. YOUR FINANCIAL INFORMATION: Your bank account number, IBAN number, credit card information, billing and invoice information and other financial data.
- 7. YOUR TRANSFER AND ACCOMMODATION INFORMATION: If you are a Health Tourist arriving under International Health Tourism, your transfer information, round-trip flight ticket information, hotel accommodation information.
Purposes for Which Your Personal Data Is Processed
Your Personal Data is processed by Private Dr. Sibel Esin Polyclinic, in compliance with the KVKK and the GDPR, for the purposes of: being able to create a patient file, conducting examination, preventive medicine, medical diagnosis, treatment and care services, providing personalized treatment services in line with your genetic data, carrying out your check-ups following the medical diagnosis and treatment processes, managing any complications that may arise, being able to communicate with you directly, managing appointment processes, carrying out patient satisfaction and request management, fulfilling legal and contractual obligations, retaining information relating to your health data that must be retained pursuant to the relevant legislation for the periods specified, obtaining, where necessary, consultation services from other relevant specialist physicians in order to ensure that your treatment is carried out correctly, fulfilling legal obligations in accordance with the legislation on International Health Tourism, planning the transfer and accommodation services of patients/clients arriving within the scope of Health Tourism, announcing innovations relating to medical treatments and procedures, informing third parties from a medical perspective regarding the medical procedure applied, planning and managing health services and their financing, fulfilling the responsibilities arising from the legal relationship established between the physician and the patient, fulfilling financial and administrative obligations, ensuring technical and commercial security, and fulfilling public obligations.
Your Personal Data will be processed by Private Dr. Sibel Esin Polyclinic under the KVKK and the GDPR in the following circumstances and conditions:
Your Identity Data; will be processed for the purpose of conducting examination, preventive medicine, medical diagnosis, treatment and care services, creating a patient file, carrying out patient satisfaction and request management, and planning the transfer and accommodation services of patients/clients arriving within the scope of Health Tourism.
Your Contact Information; will be processed for the purpose of carrying out your check-ups following the medical diagnosis and treatment processes and managing appointment processes, and may also be processed, provided that you give your explicit consent, for the purpose of promoting, informing about and announcing innovations relating to medical treatments and procedures, reminding you of upcoming appointment dates in the case of ongoing treatments, and for greetings and celebrations on special occasions.
Your Health Information; will be processed for the purpose of successfully carrying out your medical treatments, obtaining, where deemed necessary during your treatment process, consultation from another specialist physician, creating a patient file, retaining information relating to your health data that must be retained pursuant to the relevant legislation within the specified period, and fulfilling legal obligations under the applicable Health Law and Health Tourism Legislation.
Your Genetic Information; will be processed for the purpose of carrying out your genetic tests in order to provide personalized treatment and preventive medicine services in accordance with your genetic data, and creating a patient file.
Your Photograph, Video and Audio Recording Information; will be processed by Private Dr. Sibel Esin Polyclinic for the purpose of observing and managing the treatment process, and may also be processed, provided that you give your explicit consent, for the purpose of informing third parties about the medical procedure applied to you.
Your Financial Data; will be processed for the purpose of controlling your fee payments, issuing invoices, and refunding any excess fee payments.
Your Transfer and Accommodation Information; will be processed for the purpose of planning the transfer and accommodation services of patients/clients arriving within the framework of International Health Tourism.
Your Personal Data and Special Category Personal Data set out above will be processed for the purposes and in accordance with the legislation set out above, in order to carry out your personalized treatment in line with the examination, preventive medicine, medical diagnosis and genetic data to be applied to you, and to fulfill the obligations relating to your treatment. If you fail to provide the relevant personal data, the legal obligations imposed on Private Dr. Sibel Esin Polyclinic, which will provide services for your medical treatment, will not be duly fulfilled, and your treatment and/or recovery processes will not be able to be carried out successfully.
Method of Collecting Personal Data
Your Personal Data, in connection with the health service provided by Private Dr. Sibel Esin Polyclinic, will be collected;
- Through your health reports, laboratory and imaging results, test results and statements you provide regarding your health data, submitted for the purpose of medical evaluation relating to the treatment to be applied to you, by coming to Private Dr. Sibel Esin Polyclinic for examination and treatment purposes,
- Through genetic samples and specimens taken from you so that authorized institutions can carry out your genetic tests within the scope of providing personalized treatment and preventive medicine services,
- Through your completion of the "Patient Information and Consent Form" relating to the treatment to be applied by Private Dr. Sibel Esin Polyclinic,
- Through the contact form you fill out on Private Dr. Sibel Esin Polyclinic's corporate website,
- Through electronic mail you send to Private Dr. Sibel Esin Polyclinic's corporate e-mail address,
- Through the photograph/video recordings taken by Private Dr. Sibel Esin Polyclinic before, after and/or during the medical procedure applied to you,
- At your request and where necessary; through the written/audio/visual (photograph and/or video recording) messages you send to Private Dr. Sibel Esin Polyclinic and/or Dr. Sibel Esin, and the online audio/video calls you establish, using remote connection application service providers (whatsapp/zoom.us/facetime/skype/messenger/google/instagram/facebook, etc.) whose services you use by accepting their Privacy Policies and Cross-Border Transfer Principles, for the purpose of enabling Private Dr. Sibel Esin Polyclinic to carry out remote diagnosis and check-ups online,
- Through direct messages you send to, and/or comments you make on, the profile accounts of Private Dr. Sibel Esin Polyclinic and/or Dr. Sibel Esin on social media accounts (Instagram, YouTube, Facebook, Twitter, LinkedIn, etc.) whose servers are located abroad, which you are currently a user of, by accepting their Privacy Policies and Cross-Border Transfer Principles,
- Through the information you provide by allowing it to be processed automatically, by accepting the Privacy and Cross-Border Transfer Principles of the relevant service providers, via panels such as "contact us" or "get information" contained in the promotions and advertisements made by Dr. Sibel Esin and/or Private Dr. Sibel Esin Polyclinic on social media service providers (Instagram, YouTube, Facebook, Twitter, LinkedIn, Google, etc.) whose servers are located abroad, which you are currently a user of,
and will be processed in accordance with the KVKK and the GDPR for the purpose of enabling Private Dr. Sibel Esin Polyclinic to fully and duly perform its contractual and legal obligations throughout the examination, preventive medicine, medical diagnosis, treatment and care services.
Purpose, Method and Legal Basis of the Processing of Your Personal Data
Your Personal Data may be processed by natural or legal persons authorized by Private Dr. Sibel Esin Polyclinic, in the capacity of "DATA PROCESSOR"; verbally, in writing, by camera and photographic recording, and recorded and retained in physical and electronic form together with the necessary technical and administrative security measures, and where required by the relevant provisions of the KVKK and the GDPR, your explicit consent will also be obtained.
Circumstances Requiring the Obtaining of Your Explicit Consent Statement
Pursuant to Article 6(1)(a) of the GDPR and Article 5(1) of the KVKK, your Personal Data may be processed in the circumstances set out below only if your explicit consent is obtained;
Sending SMS messages and/or e-mails to you and establishing mobile communication with you for the purpose of promoting, announcing and informing you about innovations relating to the medical services provided by Private Dr. Sibel Esin Polyclinic will only be possible with your explicit consent.
In order for Private Dr. Sibel Esin Polyclinic to provide you with personalized treatment and preventive medicine services in accordance with your genetic data, the transfer of the genetic samples and specimens obtained from you to an authorized laboratory/healthcare institution for the necessary genetic tests, and, since your genetic tests may need to be carried out at laboratories abroad where required, the transfer of your genetic data abroad where necessary, will only be possible with your explicit consent.
The sharing, on Private Dr. Sibel Esin Polyclinic's social media accounts (Instagram, YouTube, Facebook, Twitter, LinkedIn, etc.) and on its corporate website, of your photograph and/or video recordings taken before, during and/or after a medical procedure for the purpose of observing the progress of the treatment, will only be possible with your explicit consent.
Since the sharing of your data through service providers whose servers are located abroad will be considered a "cross-border transfer" and since a "condition of explicit consent" applies to cross-border transfers, your explicit consent will be obtained in such cases. However, in the following circumstances, since there will be no cross-border transfer carried out by Private Dr. Sibel Esin Polyclinic, YOUR EXPLICIT CONSENT WILL NOT BE SOUGHT, AND YOUR EXPLICIT CONSENT WILL HAVE BEEN OBTAINED BY THE SERVICE PROVIDER OF WHICH YOU ARE A USER;
In the event that, by accepting its Privacy Agreement and Cross-Border Transfer Principles, you use service providers whose servers are located abroad (whatsapp/zoom.us/facetime/skype/messenger/google/instagram/facebook, etc.) of which you are currently a user, to send Private Dr. Sibel Esin Polyclinic and/or Dr. Sibel Esin written/audio messages and/or photograph/video recordings/test, laboratory or imaging results, or to make audio/video calls, or to be contacted by this means to receive remote examination/diagnosis services or to request treatment information; by accepting the policies of the applications in question, you shall be deemed to have consented to your Personal Data and Special Category Personal Data shared with Private Dr. Sibel Esin Polyclinic through these applications being processed in accordance with the KVK Information Notice and Privacy Principles to be communicated to you via Private Dr. Sibel Esin Polyclinic's application, and shall be deemed to have given explicit consent to the relevant service provider for the transfer of your data abroad pursuant to the previously accepted policies of these applications, whose servers are located abroad.
In cases where, by accepting its Privacy Policy and Cross-Border Transfer Principles, you request to be contacted through electronic mail service providers whose servers are located abroad (Hotmail, Gmail, Yahoo, etc.) of which you are currently a user; you shall be deemed to have consented to Private Dr. Sibel Esin Polyclinic processing the Personal Data and Special Category Personal Data shared in such correspondence in accordance with its own KVK Information Notice and Privacy Principles, and shall be deemed to have given explicit consent to your mail service provider for the transfer of your data abroad pursuant to the previously accepted policies of these service providers, whose servers are located abroad.
In cases where you respond to advertisements and promotions published by Private Dr. Sibel Esin Polyclinic and/or Dr. Sibel Esin on social media service providers whose servers are located abroad (Facebook, Instagram, Google, WhatsApp, etc.); the data you have permitted to be processed automatically and transferred abroad, by accepting the Privacy and Cross-Border Transfer Principles of the relevant social media service providers, will be transferred by the relevant social media service provider to Private Dr. Sibel Esin Polyclinic and will be processed and retained by Private Dr. Sibel Esin Polyclinic in accordance with its own Information Notice and Privacy Principles, which you are deemed to have automatically read. In such cases, you shall be deemed to have accepted Private Dr. Sibel Esin Polyclinic's Information Notice and Privacy Principles and the processing of your Personal Data and Special Category Personal Data accordingly.
In the event that you send a direct message to the profile account of Private Dr. Sibel Esin Polyclinic and/or Dr. Sibel Esin on social media accounts (Instagram, YouTube, Facebook, Twitter, LinkedIn, etc.) whose servers are located abroad, of which you are currently a user, by accepting their Privacy Policies and Cross-Border Transfer Principles; you shall be deemed to have consented to Private Dr. Sibel Esin Polyclinic processing your data in accordance with its own KVK Information Notice and Privacy Principles.
Circumstances in Which Your Data May Be Processed Without Requiring Your Explicit Consent
Pursuant to Article 9(2)(h) of the GDPR and Article 6(3) of the KVKK;
For the purpose of carrying out examination, medical diagnosis, treatment and care services, your Health Data, which is considered Special Category Personal Data, will be processed by Dr. Sibel Esin, who is bound by an obligation of confidentiality under the Law, without your explicit consent being required.
Pursuant to Article 6(1)(b) of the GDPR and Article 5(2)(c) of the KVKK;
For the purpose of carrying out your check-ups following the medical diagnosis and treatment processes, communicating with you directly, and managing appointment processes, your Personal Data and your Genetic Data, which is considered Special Category Personal Data, will be processed by Private Dr. Sibel Esin Polyclinic without your explicit consent being required.
Pursuant to Article 6(1)(f) of the GDPR and Article 5(2)(f) of the KVKK, on the basis of our legitimate interests;
For the purpose of carrying out patient satisfaction and request management, your Personal Data will be processed by Private Dr. Sibel Esin Polyclinic without your explicit consent being required.
Pursuant to Article 6(1)(c) of the GDPR, and Articles 5(2)(a) and 5(2)(ç) of the KVKK, on the basis of legal obligations, your Personal Data will be processed without your explicit consent being obtained in the following circumstances;
- Creation of a patient file.
- Retention of information relating to your health data that must be retained pursuant to the relevant legislation.
- Controlling your fee payments and issuing invoices.
- Fulfillment of tax payment obligations.
- Fulfillment of obligations under Ministry of Health legislation.
- Fulfillment of obligations under Health Tourism legislation.
- Ensuring your data security.
- Fulfillment of legal obligations before Judicial Authorities.
- Fulfillment of administrative obligations before Administrative Institutions and Organizations.
Transfer of Your Personal Data and the Purposes for and Parties to Whom It Will Be Transferred
Your Personal Data and Special Category Personal Data, collected within the scope of the Personal Data Processing Conditions and purposes set out in Articles 5 and 6 of KVKK No. 6698 and Articles 6 and 9 of the GDPR; may be transferred by Private Dr. Sibel Esin Polyclinic, in compliance with Articles 8 and 9 of the KVKK and Articles 45 and 49 of the GDPR, to the third parties and institutions listed below, to the extent sufficient for the purpose to be achieved, by executing the necessary confidentiality agreements and by ensuring all administrative and technical security measures required by legislation, for the purposes of carrying out and developing your examination, preventive medicine, medical diagnosis, treatment and care services and your personalized treatment in accordance with your genetic data, obtaining, where necessary, consultation services from other specialist physicians, having your genetic tests carried out at authorized laboratories and healthcare institutions, fulfilling administrative obligations relating to health tourism legislation, planning the transfer and accommodation services of patients arriving under health tourism, informing third parties from a medical perspective regarding the health services provided, communicating with patients, planning and managing the financing of health services, fulfilling the responsibilities arising from the legal relationship established between the physician and the patient, fulfilling financial, legal and administrative obligations, ensuring technical and commercial security, and fulfilling public obligations. In this context, your Personal Data and Special Category Personal Data processed by Private Dr. Sibel Esin Polyclinic may be transferred to the following;
- Its Insured Employees,
- Other specialist physicians for consultation purposes,
- Its Suppliers,
- Certified Public Accountants, Tax and Finance Advisors and Auditors,
- Legal Counsel,
- Laboratory Centers,
- Database (Server) Providers,
- "Clinic Management Software Program" Service Providers,
- Web Consultant,
- Translators/Interpreters,
- Data Protection Officer,
- IT Consultant,
- Tourism Agencies,
- Public Institutions and Organizations authorized within the framework of the laws,
- Judicial Authorities.
Personal Data Processing Period
Your Personal Data will be retained by Private Dr. Sibel Esin Polyclinic to the extent and for the period it is legally obliged to retain such data. The documentation and retention obligations arise from the relevant local norms relating to commercial, tax and health legislation. The table below sets out the retention periods for your Personal Data.
- Your Identity Information: 20 Years After the End of the Service Provided to the Person Receiving the Service
- Your Contact Information: 20 Years After the End of the Service Provided to the Person Receiving the Service
- Your Health Information: 20 Years After the End of the Service Provided to the Person Receiving the Service
- Your Genetic Information: 20 Years After the End of the Service Provided to the Person Receiving the Service
- Your Photograph and Video Information: 20 Years After the End of the Service Provided to the Person Receiving the Service
- Your Financial Information: 5 Years After the End of the Service Provided to the Person Receiving the Service
Data Subject Age Limit Under the Legislation
Under the KVKK, patients/clients who have completed at least 18 years of age may personally give their consent to the processing of their personal data. The consent of patients/clients under this age must be given by their legal representatives.
Under the GDPR, nationals of European Union countries and patients/clients residing in European Union countries may personally give their consent to the processing of their personal data, provided that they are at least 16 years of age or the age limit stipulated in their country. The consent of patients/clients under this age must be given by their legal representatives.
Withdrawal of Consent
In the event that you give consent to Private Dr. Sibel Esin Polyclinic regarding the processing of your Personal Data, we hereby inform you that, pursuant to Article 6(1)(a) of the GDPR and Article 5(1) of the KVKK, you may withdraw the consent you have given for the purposes set out above at any time. Your consent will be withdrawn once you communicate your statement of withdrawal to our contact address specified below, in the manner specified below.
Rights of Data Subjects Under the GDPR
As a Data Subject, your Personal Data is also protected under the GDPR. In cases falling within the jurisdiction of the GDPR (nationals of European Union countries or persons residing in European Union countries), the rights of Data Subjects are as follows;
Right of Access (GDPR Article 15): The data subject has the right to confirm, by applying to Private Dr. Sibel Esin Polyclinic, whether or not personal data concerning them is being processed, and, where such personal data is being processed, to learn the details set out in Article 15 of the GDPR.
Right to Rectification (GDPR Article 16): The Data Subject has the right to apply at any time to have their personal data held by Private Dr. Sibel Esin Polyclinic, which has changed, corrected.
Right to Erasure (GDPR Article 17): The Data Subject has the right to request the erasure of their personal data held by Private Dr. Sibel Esin Polyclinic. Where the circumstances set out in Article 17 of the GDPR arise, your personal data will be erased by Private Dr. Sibel Esin Polyclinic without undue delay.
Right to Restriction of Processing (GDPR Article 18):
- Where Data Subjects contest the accuracy of their Personal Data, they have the right, as Data Subjects, to request that the use of their data be restricted until Private Dr. Sibel Esin Polyclinic has verified the accuracy of the Personal Data.
- Where the Data Subject requests the erasure of their Personal Data on the grounds that the processing activity is unlawful, they have the right to request that the use of the data be restricted until their request is fulfilled.
- Where Private Dr. Sibel Esin Polyclinic no longer needs the Data Subject's personal data for the purposes of processing, the Data Subject has the right to request that the use of their data be restricted.
- Where Data Subjects object to the processing activity pursuant to Article 21(1) of the GDPR, they have the right to request that the use of their data be restricted until it is verified whether Private Dr. Sibel Esin Polyclinic's legitimate grounds for processing the data override the legitimate grounds of the Data Subject.
Right to Data Portability (GDPR Article 20): Where technically feasible, the Data Subject has the right to apply at any time to have their Personal Data held by Private Dr. Sibel Esin Polyclinic transferred to another controller. However, this right may only be exercised where the processing is based on consent or is required by contract.
Right to Object (GDPR Article 21):
- The Data Subject has the right to object, on grounds relating to their particular situation, to the processing of Personal Data, including profiling, carried out under points (e) or (f) of Article 6(1) of the GDPR. Private Dr. Sibel Esin Polyclinic may not process the Personal Data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or for the establishment, exercise or defense of legal claims.
- Where the Data Subject's Personal Data is processed for direct marketing purposes, the Data Subject has the right to object at any time to the processing of their personal data for such purposes, including profiling to the extent that it is related to such direct marketing.
- Where the Data Subject objects to the processing of Personal Data for direct marketing purposes, the Personal Data will no longer be processed for such purposes.
Rights of Data Subjects Under the KVKK
The rights held by natural persons whose personal data is processed, pursuant to Article 11 of the KVKK, are as follows;
- Learning whether their personal data is being processed,
- Requesting information if their personal data has been processed,
- Learning the purpose for which their personal data is processed and whether it is used in accordance with such purpose,
- Knowing the third parties, within the country or abroad, to whom their personal data has been transferred,
- Requesting the correction of their personal data if it has been processed incompletely or incorrectly, and requesting that the transactions carried out in this regard be notified to third parties to whom the personal data has been transferred,
- Requesting the erasure or destruction of their personal data if, despite having been processed in accordance with the KVKK and other relevant legal provisions, the reasons requiring its processing have ceased to exist, and requesting that the transactions carried out in this regard be notified to third parties to whom the personal data has been transferred,
- Objecting to the emergence of a result against themselves through the exclusively automated analysis of the processed data,
- Requesting compensation for damages suffered as a result of the unlawful processing of personal data.
Should you wish to exercise any of the rights listed above, please submit your written application, clearly and unambiguously specifying which of the rights under the provisions of the GDPR relating to data subject rights or which right under Article 11 of the KVKK you wish to exercise, wet-signed and accompanied by documents proving your identity, either in person at the address "Levent Mah. Sülünlü Sok. No:2 Beşiktaş/İstanbul/Türkiye", which is also set out on the corporate website of Private Dr. Sibel Esin Polyclinic, or by sending it via notary public, or by signing it with a secure e-signature and sending it to the clinic's corporate e-mail address, or by any other means specified in the KVKK. Pursuant to the "Communiqué on the Procedures and Principles of Application to the Data Controller", your application must include your full name, signature, T.R. Identity Number/Passport Number/Temporary T.R. Identity Number, address of residence or workplace, e-mail address, telephone and fax number, and the subject matter of your request.
Private Dr. Sibel Esin Polyclinic will conclude the request, depending on its nature, as soon as possible and within thirty (30) days at the latest, free of charge. However, if the transaction requires an additional cost, the fee set by the Personal Data Protection Board will be charged.
Consent and Approval
By reading and accepting this Information Notice, you are deemed to acknowledge, declare and undertake that you have full and complete knowledge of the data processing carried out by Private Dr. Sibel Esin Polyclinic, that you have learned of your rights under the KVKK and the GDPR, and that you give your free and voluntary consent to the PROCESSING of your Personal Data and Special Category Personal Data by Private Dr. Sibel Esin Polyclinic within the scope of this Information Notice.
You have the right not to accept this Information Notice after reading it.
GENART TEDAVİ VE SAĞLIK HİZMETLERİ LTD. ŞTİ. hereby declares itself, under the KVKK, the "DATA CONTROLLER", and under the GDPR, the "CONTROLLER".
Introduction
GENART TEDAVİ VE SAĞLIK HİZMETLERİ LTD. ŞTİ. ("PRIVATE DR. SİBEL ESİN POLYCLINIC") attaches the utmost importance to protecting the fundamental rights and freedoms of individuals in the protection and processing of personal data, taking as its foundation the right to privacy set out in Article 20 of the Constitution. Within this framework, PRIVATE DR. SİBEL ESİN POLYCLINIC takes care to protect and process personal data lawfully in accordance with Law No. 6698 on the Protection of Personal Data ("KVKK") and the European Union General Data Protection Regulation ("GDPR"), and acts with this understanding in all its planning and activities.
Ensuring the security of individuals' Personal Data is one of PRIVATE DR. SİBEL ESİN POLYCLINIC's foremost objectives. For this reason, in order to process individuals' Personal Data securely and to prevent any unlawful access to or leakage of such data, PRIVATE DR. SİBEL ESİN POLYCLINIC takes the necessary security measures in compliance with the applicable legislation.
1.1 Purpose of the Policy
The purpose of the Personal Data Protection and Processing Policy ("Policy") is to inform Data Subjects, in accordance with the purposes of KVKK and GDPR, of PRIVATE DR. SİBEL ESİN POLYCLINIC's obligations and the procedures and principles it will observe in protecting and processing personal data that are processed wholly or partly by automated means, or that form part of a data recording system even if processed by non-automated means. In line with the purpose of the Policy, PRIVATE DR. SİBEL ESİN POLYCLINIC aims to ensure full compliance with the legislation in the personal data protection and processing activities it carries out, and to protect Data Subjects' right to privacy and data security.
1.2 Scope of the Policy
This Policy has been prepared for, and will be applied within the scope of, Customers (Patients/Clients), Employees, Employee Candidates, and Visitors, provided they are natural persons. The purpose of PRIVATE DR. SİBEL ESİN POLYCLINIC in publishing this Policy on its website is to inform Data Subjects about its personal data protection and processing activities and data security. This Policy shall not apply to legal entities, regardless of their capacity.
This Policy shall apply to the Data Subjects specified above where their personal data are processed wholly or partly by automated means, or by non-automated means provided they form part of a data recording system, by PRIVATE DR. SİBEL ESİN POLYCLINIC. This Policy shall not apply where the data in question does not fall within the scope of "Personal Data" as defined below, or where the personal data processing activity carried out by PRIVATE DR. SİBEL ESİN POLYCLINIC is not carried out by the means specified above.
1.3 Definitions
The concepts used in the application of this Policy have the meanings set out below.
1.4 Entry into Force of the Policy
The principles of the Policy, prepared by PRIVATE DR. SİBEL ESİN POLYCLINIC and entered into force on 01.12.2021, are published on PRIVATE DR. SİBEL ESİN POLYCLINIC's corporate websites and made available to Data Subjects.
Protection of Personal Data — Security of Personal Data
PRIVATE DR. SİBEL ESİN POLYCLINIC takes all necessary administrative and technical measures to store personal data securely and to prevent the unlawful processing of and access to personal data, in accordance with KVKK and GDPR, in order to ensure an appropriate level of security. The administrative and technical measures taken regarding the security of personal data are set out in detail in Private Dr. Sibel Esin Polyclinic's Personal Data Retention and Destruction Policy.
Audit
PRIVATE DR. SİBEL ESİN POLYCLINIC carries out and commissions the necessary audits in order to ensure the regularity and continuity of the data security measures described above. The technical measures taken by PRIVATE DR. SİBEL ESİN POLYCLINIC are audited by authorized persons on a periodic basis every six months, while administrative measures are audited by persons authorized by PRIVATE DR. SİBEL ESİN POLYCLINIC.
Confidentiality
PRIVATE DR. SİBEL ESİN POLYCLINIC takes all necessary administrative and technical measures to ensure that the Data Processor does not disclose to others, or use for purposes other than the processing purpose, personal data learned within the scope of its duties, in violation of KVKK, GDPR, and the provisions of the Policy. In this context, Clinic employees are informed and trained on KVKK, GDPR, and the Policy, and confidentiality agreements are signed as part of the recruitment processes of relevant employees. Likewise, policies are communicated to Suppliers and Data Processors providing outsourced services, and Confidentiality Undertakings are obtained from them.
Unauthorized Disclosure of Personal Data
In the event that personal data processed by PRIVATE DR. SİBEL ESİN POLYCLINIC are obtained by others through unlawful means, PRIVATE DR. SİBEL ESİN POLYCLINIC carries out the necessary procedures to notify the Data Subject and the Personal Data Protection Board of this situation within the periods determined by the Board. If deemed necessary by the Personal Data Protection Board, this situation shall be announced on the Board's website or by another method deemed appropriate by the Board.
Observance of the Legal Rights of Data Subjects
PRIVATE DR. SİBEL ESİN POLYCLINIC observes all legal rights of data subjects arising from the application of the Policy and the Law, and takes all necessary measures to protect these rights.
Protection of Special Categories of Personal Data
Data concerning a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, constitute special categories of personal data. PRIVATE DR. SİBEL ESİN POLYCLINIC is aware that Special Categories of Personal Data are of a nature that, if learned by others, may cause the Data Subject to suffer harm or discrimination, and for this reason it meticulously takes the adequate measures determined by the Board in order to protect such personal data, which are processed lawfully. In this context, it has a separate, systematic, clearly defined, manageable, and sustainable policy (the Security Policy for Special Categories of Personal Data).
Processing and Transfer of Personal Data — General Principles
Personal Data are processed by PRIVATE DR. SİBEL ESİN POLYCLINIC in accordance with the procedures and principles set out in KVKK, GDPR, and this Policy. PRIVATE DR. SİBEL ESİN POLYCLINIC complies with the following principles when processing personal data.
Lawfulness, Fairness, and Transparency
PRIVATE DR. SİBEL ESİN POLYCLINIC processes personal data in accordance with the relevant legislation and the requirements of the principle of fairness, and uses it within these limits. In accordance with the principle of fairness, PRIVATE DR. SİBEL ESİN POLYCLINIC takes into account the interests and reasonable expectations of data subjects while pursuing its data processing objectives. It acts in a manner that prevents outcomes that the Data Subject would not expect and should not be expected to anticipate. Under this principle, it also ensures that the relevant data processing activity is transparent to the data subject, and acts in accordance with its notification and warning obligations.
Accuracy and, Where Necessary, Currency
PRIVATE DR. SİBEL ESİN POLYCLINIC ensures that the personal data it processes are accurate and up to date, taking into account the fundamental rights and legitimate interests of Data Subjects. In this context, it carefully considers matters such as ensuring that the sources from which the data is obtained are certain, confirming its accuracy, and assessing whether it needs to be updated. PRIVATE DR. SİBEL ESİN POLYCLINIC always keeps open the channels that will ensure the data subject's information is accurate and up to date. Keeping personal data accurate and up to date protects the interests of PRIVATE DR. SİBEL ESİN POLYCLINIC as well as being necessary for the protection of the Data Subject's fundamental rights and freedoms.
Processing for Specified, Explicit, and Legitimate Purposes
PRIVATE DR. SİBEL ESİN POLYCLINIC determines the purpose of data processing clearly and precisely, and ensures that this purpose is lawful. The lawfulness of the purpose means that the personal data processed by PRIVATE DR. SİBEL ESİN POLYCLINIC is connected to and necessary for the healthcare services it provides. PRIVATE DR. SİBEL ESİN POLYCLINIC does not process data for purposes other than those it has stated. Accordingly, it exercises care to comply with the principles of certainty and clarity in the legal transactions and texts in which its personal data processing purposes are explained.
Relevance, Limitation, Proportionality, and Necessity in Relation to the Purposes for Which They Are Processed
PRIVATE DR. SİBEL ESİN POLYCLINIC ensures that the personal data it processes is suitable for achieving the specified purposes, and avoids processing data that is not related to or not needed for the achievement of the purpose. PRIVATE DR. SİBEL ESİN POLYCLINIC does not collect or process personal data for purposes that do not currently exist and are only contemplated for the future. It also limits the data processed strictly to what is necessary for achieving the purpose. Under the principle of proportionality, it establishes a reasonable balance between the data processing activity and the purpose sought to be achieved.
Retention for the Period Stipulated by the Relevant Legislation or Required for the Purpose for Which the Data Is Processed
Where the relevant legislation stipulates a period for the retention of data, PRIVATE DR. SİBEL ESİN POLYCLINIC complies with such periods; otherwise, it retains personal data only for the period required for the purpose for which it is processed. If there is no longer a valid reason for PRIVATE DR. SİBEL ESİN POLYCLINIC to retain a given personal data item further, that data is deleted, destroyed, or anonymized. The procedures relating to the retention and destruction of personal data are set out in detail in Private Dr. Sibel Esin Polyclinic's Personal Data Retention and Destruction Policy.
Compliance with the Principles of Integrity and Confidentiality
Personal data are processed by PRIVATE DR. SİBEL ESİN POLYCLINIC with the necessary technical and administrative measures taken to prevent loss, destruction, or damage, or to ensure an appropriate level of security relating to the protection of personal data.
Compliance with the Principle of Accountability
PRIVATE DR. SİBEL ESİN POLYCLINIC has fulfilled its obligation to comply with the rules on the protection of personal data in its processing activities, and will be able to submit, in the event of any complaint or ex officio investigation, documents proving to the supervisory authorities that these measures have been taken.
Conditions for the Processing of Personal Data
PRIVATE DR. SİBEL ESİN POLYCLINIC does not process personal data without the Data Subject's explicit consent. Personal data may be processed without seeking the Data Subject's explicit consent only where one of the following conditions exists:
Being Explicitly Provided for by Law
PRIVATE DR. SİBEL ESİN POLYCLINIC may process personal data without seeking the Data Subject's explicit consent in cases explicitly provided for by law.
Being Mandatory for the Protection of the Life or Physical Integrity of the Person Concerned or of Another Person Who Is Unable to Express Consent Due to Actual Impossibility or Whose Consent Is Not Legally Valid
PRIVATE DR. SİBEL ESİN POLYCLINIC may process personal data without seeking explicit consent in cases where consent cannot be expressed or is not valid, in order to protect the life or physical integrity of individuals.
Being Necessary for the Processing of Personal Data Belonging to the Parties to a Contract, Provided That It Is Directly Related to the Establishment or Performance of the Contract
Where it is mandatory to process personal data belonging to the parties to a contract, directly related to the establishment or performance of that contract, PRIVATE DR. SİBEL ESİN POLYCLINIC may, in the ordinary course of business and limited to this purpose, process the Data Subject's personal data without seeking explicit consent.
Being Mandatory for Private Dr. Sibel Esin Polyclinic to Fulfil Its Legal Obligation
PRIVATE DR. SİBEL ESİN POLYCLINIC, as Data Controller, may process the Data Subject's personal data without seeking explicit consent where it is mandatory to do so in order to fulfil its legal obligations.
Having Been Made Public by the Data Subject Themselves
PRIVATE DR. SİBEL ESİN POLYCLINIC may process personal data that has been made public by the Data Subject themselves — that is, disclosed to the public in any manner — limited to the purpose of such disclosure, on the grounds that the legal interest requiring protection in the processing of such data, which has thereby become knowable to everyone, is deemed to have ceased to exist.
Data Processing Being Mandatory for the Establishment, Exercise, or Protection of a Right
PRIVATE DR. SİBEL ESİN POLYCLINIC may process the Data Subject's personal data without seeking explicit consent where data processing is mandatory for the establishment, exercise, or protection of a legitimate legal right.
Data Processing Being Mandatory for Our Clinic's Legitimate Interests, Provided That It Does Not Harm the Fundamental Rights and Freedoms of the Data Subjects
PRIVATE DR. SİBEL ESİN POLYCLINIC may process the Data Subject's personal data in cases where processing of personal data is mandatory for its legitimate interests, provided this does not harm the Data Subject's fundamental rights and freedoms protected under KVKK, GDPR, and the Policy. PRIVATE DR. SİBEL ESİN POLYCLINIC exercises the necessary care to comply with the fundamental principles relating to the protection of personal data and to observe the balance of interests between PRIVATE DR. SİBEL ESİN POLYCLINIC and personal data subjects. A legitimate interest means an interest that is lawful, sufficiently significant to be weighed against the Data Subject's fundamental rights and freedoms, specific, and currently existing. PRIVATE DR. SİBEL ESİN POLYCLINIC takes additional protective measures to prevent harm to the Data Subject's rights. A reasonable balance is maintained between our Clinic's interest and the fundamental rights and freedoms of the data subject.
Conditions for the Processing of Special Categories of Personal Data
PRIVATE DR. SİBEL ESİN POLYCLINIC does not process special categories of personal data without the Data Subject's explicit consent. Special categories of personal data may be processed without seeking the data subject's explicit consent only where one of the following conditions exists:
Being Explicitly Provided for by Law
The Data Subject's special categories of personal data, other than data relating to health and sexual life, may be processed without seeking the Data Subject's explicit consent in cases explicitly provided for by law.
For the Purpose of Protecting Public Health, Conducting Preventive Medicine, Medical Diagnosis, Treatment, and Care Services, and Planning and Managing Healthcare Services and Their Financing
The Data Subject's special categories of personal data relating to health and sexual life may be processed by persons under an obligation of confidentiality or by authorized institutions and organizations, for the purpose of protecting public health, conducting preventive medicine, medical diagnosis, treatment, and care services, and planning and managing healthcare services and their financing.
Conditions for the Transfer of Personal Data
PRIVATE DR. SİBEL ESİN POLYCLINIC, while taking the necessary security measures, may transfer personal data to third parties based on and limited to one or more of the personal data processing conditions specified below, in accordance with Articles 8 and 9 of KVKK and Articles 45 and 49 of GDPR:
- The Data Subject's explicit consent exists,
- There is an explicit provision in the laws regarding the transfer of personal data,
- The transfer of personal data is mandatory for the protection of the life or physical integrity of the Data Subject or of another person, and the person concerned is unable to express consent due to actual impossibility or their consent is not legally valid,
- The transfer of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract,
- The transfer of personal data is mandatory for PRIVATE DR. SİBEL ESİN POLYCLINIC to fulfil its legal obligation,
- The personal data has been made public by the Data Subject,
- The transfer of personal data is mandatory for the establishment, exercise, or protection of a right,
- The transfer of personal data is mandatory for PRIVATE DR. SİBEL ESİN POLYCLINIC's legitimate interests, provided this does not harm the Data Subject's fundamental rights and freedoms.
Special categories of personal data may be transferred based on and limited to one of the following conditions, provided that adequate measures are taken:
- The data subject's explicit consent exists,
- Where the data subject's special categories of personal data other than health and sexual life data are concerned, there is an explicit provision in the laws regarding the transfer of such data.
- Where the data subject's special categories of personal data relating to health and sexual life are concerned, such data may be transferred by persons under an obligation of confidentiality or by authorized institutions and organizations, for the purpose of protecting public health, conducting preventive medicine, medical diagnosis, treatment, and care services, and planning and managing healthcare services and their financing.
Categories of Personal Data and Groups of Data Subjects
Categories of Personal Data
Personal data are categorized by PRIVATE DR. SİBEL ESİN POLYCLINIC as follows when processed:
Groups of Data Subjects
Only natural persons may benefit from the protection afforded by this Policy and the Law. Personal data subjects within this scope are grouped as follows:
Method and Legal Basis for Collecting Personal Data
Method of Collecting Personal Data
Your Personal Data are processed by natural or legal persons authorized by PRIVATE DR. SİBEL ESİN POLYCLINIC, acting as "DATA PROCESSOR," through verbal, written, camera, and photographic recording, kept in physical and electronic form, and, where required by KVKK and GDPR, upon obtaining your explicit consent.
- Job application forms,
- Personnel information forms,
- Various documents submitted to PRIVATE DR. SİBEL ESİN POLYCLINIC,
- Mail and e-mails sent to PRIVATE DR. SİBEL ESİN POLYCLINIC,
- Corporate telephones,
- Photo/video recordings,
- Websites,
- Patient Consent/Information Forms,
- Test results,
- Genetic samples and specimens,
- Genetic test results,
- Health information forms,
- Service providers whose servers are located abroad (WhatsApp/Instagram/Facebook/Messenger/LinkedIn/YouTube/zoom.us/Google/Hotmail/Yahoo, etc.).
Legal Basis for the Collection of Personal Data
PRIVATE DR. SİBEL ESİN POLYCLINIC collects personal data based on one of the legal grounds specified below, pursuant to Articles 5 and 6 of the Law and Articles 6 and 9 of GDPR:
- The explicit consent of the data subject,
- Being explicitly provided for by law;
- The personal data having been made public by the data subject themselves,
- The processing of personal data belonging to the parties to a contract being necessary, provided that it is directly related to the establishment or performance of the contract,
- Where the Data Subject's special categories of personal data relating to health and sexual life are concerned, this being for the purpose of protecting public health, conducting preventive medicine, medical diagnosis, treatment, operation, and care services, and planning and managing healthcare services and their financing,
- This being mandatory for PRIVATE DR. SİBEL ESİN POLYCLINIC to fulfil its legal obligation,
- Data processing being mandatory for the establishment, exercise, or protection of a right,
- Data processing being mandatory for PRIVATE DR. SİBEL ESİN POLYCLINIC's legitimate interests, provided this does not harm the fundamental rights and freedoms of the data subjects.
Purposes of Processing Personal Data
6.1 Matching of Data Subject Groups with the Processing Purposes of Personal Data Categories
The matching of the data subject groups defined and scoped above with the processing purposes of the personal data categories is presented below:
Employee Candidate
Data Categories: Identity, Contact, Personnel, Professional Experience
Processing Purposes: Conducting Emergency Management Processes, Conducting Information Security Processes, Conducting Employee Candidate Selection and Placement Processes, Conducting Employee Candidates' Application Processes, Conducting Communication Activities
Patient/Client
Data Categories: Identity, Contact, Financial, Customer Transaction, Health Data, Biometric Data, Genetic Data
Processing Purposes: being able to create a patient file, being able to carry out examination, preventive medicine, medical diagnosis, treatment, operation, and care services, being able to provide personalized treatment services in line with your genetic data, being able to conduct your genetic tests and provide personalized treatment and preventive medicine services in line with your genetic data, being able to carry out health check-ups after medical diagnosis, treatment, and operation processes, being able to communicate directly with patients, being able to manage appointment processes, being able to carry out patient satisfaction and request management, being able to fulfil legal and contractual obligations, being able to retain, for the periods specified, information relating to your health data required to be kept pursuant to the relevant legislation, being able to obtain, when necessary, a consultation from another relevant specialist physician in order for treatments to be carried out correctly, being able to fulfil legal obligations in accordance with the legislation on health tourism, being able to plan the transfer and accommodation services of patients/clients coming within the scope of health tourism, being able to announce innovations relating to medical treatments and applications, being able to inform third parties, from a medical standpoint, about the medical procedures applied, being able to carry out promotional and marketing activities relating to the medical applications performed within the framework of the International Health Tourism Incentive legislation, being able to plan and manage healthcare services and their financing, being able to fulfil the obligations arising from the legal relationship established between the physician and the patient, being able to fulfil financial and administrative obligations, being able to ensure technical and commercial security, and being able to fulfil public obligations.
Employee
Data Categories: Identity, Contact, Personnel, Financial, Health, Visual and Audio Information
Processing Purposes: Conducting Emergency Management Processes, Conducting Information Security Processes, Fulfilment of Obligations Arising from the Employment Contract and Legislation for Employees, Conducting Fringe Benefits and Interests Processes for Employees, Conducting Occupational Health/Safety Activities, Conducting Risk Management Processes, Conducting Activities in Compliance with the Legislation, Conducting/Auditing Business Activities, Organization and Event Management
Visitor
Data Categories: Transaction Security
Processing Purposes: Conducting Emergency Management Processes, Conducting Information Security Processes
6.2 Personal Data Processing Activities Carried Out in Physical Premises
In order to ensure the security of our Clinic, entries and exits are recorded, and an appointment tracking system is used. Data processing activities carried out by employees are performed within the authorization matrix established by PRIVATE DR. SİBEL ESİN POLYCLINIC, and the necessary confidentiality agreements are signed with employees.
Personal Data Processing Activities Carried Out on the Website
The traffic information of online visitors to our website is automatically processed for the purpose of carrying out information security processes. Furthermore, pursuant to Law No. 5651 and other applicable legislation, hosting providers are under an obligation to record and retain website traffic information.
6.4 Personal Data Processing Activities Carried Out via Communication Channels
Communications made through channels such as telephone and e-mail are monitored and recorded by PRIVATE DR. SİBEL ESİN POLYCLINIC for the purpose of conducting/auditing business activities and following up on requests/complaints.
Data Subjects are required to use these channels only within the scope of business activities.
Purposes of Transferring Personal Data and the Persons/Organizations to Whom They Are Transferred
Purposes of Transferring Personal Data
PRIVATE DR. SİBEL ESİN POLYCLINIC transfers personal data, within the framework of the conditions set out in Articles 8 and 9 of KVKK and Articles 45 and 49 of GDPR, limited to the following purposes:
- Being able to carry out examination, preventive medicine, medical diagnosis, treatment, operation, and care services,
- Being able to manage complication processes,
- Being able to obtain consultation,
- Being able to fulfil obligations required by Ministry of Health legislation,
- Being able to fulfil obligations required by International Health Tourism legislation,
- Being able to meet the transportation, accommodation, and interpreter needs of Health Tourist patients,
- Fulfilment of administrative obligations before Provincial and District Health Directorates,
- Being able to inform third parties, from a medical standpoint, about the healthcare services provided,
- Being able to carry out promotional and marketing activities for the healthcare services provided within the scope of International Health Tourism Incentive legislation,
- Conducting Employee Candidate Selection and Placement Processes,
- Conducting Employee Candidates' Application Processes,
- Fulfilment of Obligations Arising from the Employment Contract and Legislation for Employees,
- Conducting Fringe Benefits and Interests Processes for Employees,
- Conducting Activities in Compliance with the Legislation,
- Conducting Finance and Accounting Operations,
- Conducting/Auditing Business Activities,
- Conducting Business Continuity Activities,
- Conducting Risk Management Processes,
- Being able to ensure and audit data security,
- Conducting Contract Processes,
- Providing Information to Authorized Persons, Institutions, and Organizations.
Persons/Organizations to Whom Personal Data Are Transferred
PRIVATE DR. SİBEL ESİN POLYCLINIC may transfer personal data, limited to the data subject groups and data required by the purpose of transfer, and by applying all administrative and technical security measures required by the legislation, to the following persons and organizations:
- Other specialist physicians for the purpose of consultation,
- Its insured employees,
- Its suppliers,
- Financial advisors, tax and finance consultants, and auditors,
- Legal counsel,
- Laboratory centers,
- Database (server) providers,
- "Clinic Management Software System" service providers,
- Interpreters,
- Web consultant,
- Data protection officer,
- IT consultant,
- Tourism agencies,
- Public institutions and organizations authorized under the laws,
- Judicial authorities.
Destruction of Personal Data and Retention Periods
Destruction of Personal Data
Saving the provisions of other laws regarding the destruction of personal data, PRIVATE DR. SİBEL ESİN POLYCLINIC deletes, destroys, or anonymizes the personal data it has processed in accordance with KVKK and other legal provisions, in accordance with the Personal Data Retention and Destruction Policy, either ex officio or upon the request of the data subject, when the reasons requiring its processing cease to exist.
Deletion of personal data refers to the process of rendering personal data inaccessible and unusable in any way for the relevant users.
Destruction of data refers to the process of rendering personal data inaccessible, irretrievable, and unusable by anyone in any way whatsoever.
Anonymization of data refers to the process of rendering personal data incapable, under any circumstances, of being associated with an identified or identifiable natural person, even when matched with other data, through techniques such as masking, removing variables, or generalization.
Retention Periods for Personal Data
PRIVATE DR. SİBEL ESİN POLYCLINIC retains personal data for the periods stipulated by the laws and other applicable legislation. Where no retention period is stipulated by the laws and other applicable legislation, personal data is retained, in accordance with Private Dr. Sibel Esin Polyclinic's Personal Data Retention and Destruction Policy, for the period required for the purpose of processing that personal data, and is thereafter deleted, destroyed, or anonymized within the framework of periodic destruction periods.
The Personal Data Subject's Rights Under KVKK and GDPR — The Data Subject's Rights Under GDPR
As a Data Subject, your Personal Data are also protected under GDPR. In cases falling within the jurisdiction of GDPR (European citizens or residents of Europe), the rights of Data Subjects are as follows:
Right of Access (GDPR Article 15): The data subject has the right to confirm, by applying to PRIVATE DR. SİBEL ESİN POLYCLINIC, whether personal data relating to them is being processed, and, if such personal data is being processed, to learn the details set out in GDPR Article 15.
Right to Rectification (GDPR Article 16): The Data Subject has the right, at any time, to apply to us to have any changed personal data relating to them, held by PRIVATE DR. SİBEL ESİN POLYCLINIC, rectified.
Right to Erasure (GDPR Article 17): The Data Subject has the right to request the erasure of personal data relating to them held by PRIVATE DR. SİBEL ESİN POLYCLINIC. Where the circumstances set out in GDPR Article 17 arise, your personal data will be deleted by PRIVATE DR. SİBEL ESİN POLYCLINIC without undue delay.
Right to Restriction of Processing (GDPR Article 18):
- Where the Data Subject contests the accuracy of the Personal Data, the Data Subject has the right to request the restriction of the use of the data until PRIVATE DR. SİBEL ESİN POLYCLINIC has verified the accuracy of the Personal Data.
- Where the processing of Personal Data is unlawful and the Data Subject opposes the erasure of the Personal Data, the Data Subject has the right to request the restriction of the use of the data instead.
- Where PRIVATE DR. SİBEL ESİN POLYCLINIC no longer needs your personal data but we wish to establish or exercise our rights, the Data Subject has the right to request the restriction of the use of the data.
- Where the Data Subject has objected to the processing activity pursuant to GDPR Article 21(1), the Data Subject has the right to request the restriction of the use of the data pending verification of whether PRIVATE DR. SİBEL ESİN POLYCLINIC's legitimate grounds override those of the Data Subject.
Right to Data Portability (GDPR Article 20): Where technically feasible, the Data Subject has the right, at any time, to apply to us and request that the Personal Data held by PRIVATE DR. SİBEL ESİN POLYCLINIC be transferred to another controller. However, this right may be exercised only where the processing of the data is based on your consent or is required by the contract.
Right to Object (GDPR Article 21):
- The Data Subject has the right to object, on grounds relating to their particular situation, to the processing of Personal Data, including profiling, carried out under Article 6(1)(e) or (f) of GDPR. PRIVATE DR. SİBEL ESİN POLYCLINIC may not process your Personal Data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject, or for the establishment, exercise, or defence of legal claims.
- Where Personal Data is processed for direct marketing purposes, the Data Subject has the right to object at any time to the processing of Personal Data for such marketing, including profiling to the extent that it is related to such direct marketing.
- Where the Data Subject objects to the processing of Personal Data for direct marketing purposes, the Personal Data shall no longer be processed for such purposes.
The Data Subject's Rights Under KVKK
The rights held by natural persons whose Personal Data is processed, pursuant to Article 11 of KVKK, are as follows:
- To learn whether personal data is being processed,
- To request information regarding the processing of personal data, if any,
- To learn the purpose of processing the personal data and whether it is used in accordance with its purpose,
- To know the third parties to whom personal data is transferred, domestically or abroad,
- To request the rectification of personal data if it is processed incompletely or incorrectly, and to request that the transaction carried out in this context be notified to the third parties to whom the personal data has been transferred,
- To request the erasure or destruction of personal data where the reasons requiring its processing cease to exist, even though it has been processed in accordance with KVKK and other relevant legal provisions, and to request that the transaction carried out in this context be notified to the third parties to whom the personal data has been transferred,
- To object to the emergence of a result against the person themselves through the analysis of processed data exclusively by automated systems,
- To request the compensation of damages suffered due to the unlawful processing of personal data.
Where Data Subjects wish to exercise any of the rights listed above, they may submit their written application, clearly and unambiguously indicating which of the rights specified in Article 11 of KVKK they wish to exercise, wet-signed and accompanied by documents proving their identity, in person to PRIVATE DR. SİBEL ESİN POLYCLINIC's address, may send it via notary public, or may sign it with a secure e-signature and send it to PRIVATE DR. SİBEL ESİN POLYCLINIC's corporate e-mail address, or may send it via other methods specified in KVKK. Applications must include, pursuant to the "Communiqué on the Procedures and Principles of Application to the Data Controller," the applicant's full name, signature, Turkish ID number/passport number/temporary ID number, residential or business address, e-mail address, telephone and fax numbers, and the subject of the request.
PRIVATE DR. SİBEL ESİN POLYCLINIC will conclude the request free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. However, where the transaction requires an additional cost, a fee shall be charged in accordance with the tariff determined by the Personal Data Protection Board.
Effective Date: 01.12.2021
Update Date: 01.12.2021
