CLARIFICATION TEXT ON PERSONAL DATA PROCESSING
This text has been prepared for the purpose of clarification regarding the processing of personal data by the data controller within the scope of the Personal Data Protection Law No. 6698.
Our purpose is to ensure that your personal data are legally collected, stored, shared with public institutions and organizations stipulated by the law, and to take the highest level of security measures possible to protect your confidentiality.
Pursuant to Article 10 of the Personal Data Protection Law No. 6698 and in line with your satisfaction, our aim is to inform you in the most transparent way about the collection of your personal data, the purposes of processing them, with whom these are shared, legal reasons and your rights.
Data Controller
Pursuant to Personal Data Protection Law No. 6698, your personal data will be collected and may be processed by EBR SAĞLIK HİZMETLERİ TİC.LTD.ŞTİ. as data controlled within the scope described below.
OUR FIELDS OF ACTIVITY:
HEALTH AND TOURISM SERVICES
* To establish and operate private hospitals, polyclinics,
dispensaries, laboratories, health centers and facilities, health cabins, maternity homes, dental (oral health) and prosthetic treatment centers to provide all kinds of health services.
* To establish diagnostic and treatment centers, physiotherapy, rehabilitation units within the hospital to serve for human health, to establish and operate check-up centers within the hospital
- To provide all kinds of medical assistance, examination, health and medical services and to ensure their organization. To employ specialist physicians related to its subject.
- To scan tomography, computed tomography and scintigraphy, measure bone density, perform mammography, scan all kinds of X-ray graphics, MRI, echo, perform ultrasonography and doppler, perform magnetic resonance imaging, perform all kinds of endoscopy, make all kinds of medical diagnosis, examinations and analyzes related to radioactive substances and materials provided that the necessary permission is obtained from official institutions.
- To establish and operate medical analysis laboratories.
- By establishing facilities for the development of health services, it may establish, acquire, operate, have operated facilities for hotels, motels, resorts, timeshares, educational, recreational and entertainment venues, restaurants, cafeterias, sanitary baths, saunas, summer and winter sport facilities, rent, repair, lease such facilities, may provide consultancy services in the field of health, and provide services for health tourism.
- To establish, operate, rent and lease physical therapy, oncology, hemodialysis and medical rehabilitation units.
- To establish, operate and have operated all kinds of private hospitals, inpatient diagnostic and treatment centers, dental laboratories and research laboratories, clinics and polyclinics related to oral and dental health, to rent and lease facilities established in this regard.
- To open, operate, equip, rent or lease examination offices, clinics, hospitals for eye health services, to carry out and have carried out domestic and international patient attendance works.
- To evaluate physical, mental and social care needs in the field of home care services, to support protection, maintenance and utilization of daily activities
at the highest level; To follow up the medical care planned by the health team for the elderly, disabled and people with health problems in need of care, to identify the problems related to the practice of medical care, to inform the professionals accordingly, to assist them with their treatments and to accompany them when necessary.
- To support family members, to inform the family about relevant health issues when necessary, to evaluate living spaces in terms of accident risk and safety, and to ensure that necessary arrangements are made.
- To feed in accordance with the nutrition program recommended by the dietitian, to monitor weight and to evaluate changes with healthcare team members.
- To assist with daily personal care such as oral and dental care. To
carry out personal care and cleaning practices for bedridden, ill and disabled people.
- It may employ physicians, assistants, nurses and all other health teams related to its subject, dispatch them to other health institutions, and employ health personnel contractually or freely in its own facilities and other health facilities. m. To carry out and have carried out ambulance services.
- To make agreements for diagnosis and treatment with companies abroad related to its subject, to give and receive representation, agency, to participate in tenders related to its subject.
- To make investments for all kinds of healthcare facilities and medical devices and to operate them,
- To purchase, import and lease vehicles such as ambulances, helicopters and airplanes required to transport patients both at domestically and internationally.
- To provide all kinds of medical intervention, diagnosis, treatment and health services
- To establish and operate diagnostic and treatment units and laboratories and training units providing health services.
- To open, operate, rent, lease, purchase and if required, sell private hospitals, private polyclinics and private health facilities.
- To import, export, market, perform wholesale and retail trade of medical devices, tools and equipment as well as spare parts and accessories used in hospitals, health centers, clinics.
- To import, export and market machinery, devices, tools and equipment used in the field of healthcare services.
- To plan and organize all kinds of health activities, to provide domestic and international consultancy, representation and agency services.
- To carry out scientific researches in order to produce services for its customers in the healthcare centers and hospitals to be established by the company, to establish training units at all levels in accordance with the provisions of the applicable legislation and to procure the personnel to be employed there from domestic and abroad.
- To organize all kinds of seminars, conferences and meetings inside and outside the health field and to participate in fairs.
- To perform wholesale trade of all kinds of pharmaceutical materials.
- To provide contact lens, cosmetic lens wearing and application services, and
other works written in the articles of association.
a) Methods and Legal Reasons for Obtaining Personal Data
Your personal data is collected electronically or physically. Your personal data collected for the legal reasons specified in the Law may be processed and shared within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law.
Personal data may be collected by the data controller from our customers, employees, potential customer candidates, employee candidates, business partners and suppliers, etc. in categories such as identity details, contact details, customer information, customer transaction information, transaction security information, legal transaction and compliance information and marketing and sales information.
b) Purposes of Processing Personal Data
The personal data we collect within the scope of the services we provide to you are processes for various purposes and information stated below:
Your personal data is processed in order to fulfill our legal obligations set forth in Health Services Fundamental Law no. 3359, Decree Law no. 663 on Organization and Duties of the Ministry of Health and Affiliated Organizations, Regulation on Processing of Personal Health Data and Ensuring Privacy and other relevant regulations, to protect public health, to conduct protective medicine, medical diagnosis, treatment and maintenance services, to plan and manage healthcare services and financing, to plan and execute the activities required to customize the products and services offered by the data controller according to the likes, usage habits and needs of the relevant persons within the framework of the personal data processing conditions set out in articles 5 and 6 of the Law and to recommend and promote these to the relevant persons, to allow the relevant work departments to carry out works and conduct relevant business processes in order to ensure that relevant persons benefit from the products and services offered and that the commercial activities are conducted to carry out the relevant business processes, to plan and execute commercial and/or business strategies and to ensure the legal, technical and commercial-business safety of the relevant persons with a business relation.
In case the subjects are defined separately:
- To determine and verify your identity in order to prevent your Personal Data from being acquired by others,
- To perform public health protection, preventive medicine, medical diagnosis, treatment and care services, to plan and manage health services and financing,
- To supply medicines and/or medical equipment and/or devices specific to you,
- To be able to inform you about an appointment, provide information and/or remind you of an appointment
- To perform risk management and quality improvement activities,
- To fulfill legal and regulatory requirements,
- To share and respond to the information obtained with the Ministry of Health and other public institutions and organizations in accordance with the legislation,
- To question your entitlement with the institutions/organizations that are contracted with the hospital or to provide financial reconciliation with these institutions regarding the health services offered to you,
- To share information and authentication requested by contracted institutions/organizations, especially private insurance companies, within the scope of financing health services,
- To issue invoices for the services we provide,
- To take all necessary technical and administrative measures within the scope of data security of hospital systems and applications,
- To analyze your use of health services and store your health data, to respond to your questions or complaints about our services in order to develop and improve the health services we provide to you,
- To provide the necessary information in accordance with the demands and audits of regulatory and supervisory agencies and official authorities,
- To store information about your health-related data that should be kept in accordance with the relevant legislation,
- To comply with internal policies and principles,
- To measure and improve your patient satisfaction after receiving health services,
- To conduct special promotional and information activities for you and to ensure your benefit, to contact with you for providing information about our services,
- To execute and develop medical diagnosis, treatment and maintenance services, to plan and manage health services and financing, to increase and investigate patient satisfaction and relevant causes without limitation to the abovementioned.
Your Personal Data obtained and processed in accordance with the relevant legislation can be transferred to EBR SAĞLIK HİZMETLERİ TİC.LTD.ŞTİ. information systems and stored under protection both in digital and physical information.
c) Parties to whom Personal Data may be Shared and Purposes of Sharing
Your personal data may be shared with the Company’s business partners and suppliers, legally authorized institutions and organizations, legally authorized natural and legal persons within the scope of the personal data processing conditions and purposes set out in articles 8 and 9 of the Law in order to plan and execute the activities required to customize the products and services offered by the data controller according to the likes, usage habits and needs of the relevant persons and to recommend and promote these to the relevant persons, to allow the relevant work departments to carry out works and conduct relevant business processes in order to ensure that relevant persons benefit from the products and services offered and that the commercial activities are conducted to carry out the relevant business processes, to plan and execute commercial and/or business strategies and to ensure the legal, technical and commercial-business safety of the relevant persons with a business relation with the Company.
d) Rights of Data Owners and Exercise of These Rights
As personal data owners, in the event you submit your requests regarding your rights specified below to the Company by the methods specified under the title of Exercise of Rights by Data Owners, your requests will be evaluated and concluded by our Company as soon as possible and in any case within 30 (thirty) days.
In accordance with Article 11 of the Law, you have the following rights as personal data owner:
- To learn whether your personal data have been processed or not,
- To request information regarding the personal data if they are processed,
- To learn the purpose of your data processing and whether this data is used for intended purposes,
- To know the third parties to whom your personal data are transferred in country or abroad,
- To request correction of personal data if it is incomplete or improperly processed, and to request notification of third parties to whom personal data of processed about the procedure performed within this scope,
- To request deletion or destruction of personal data in case the reasons necessitating their processing cease to exist, despite personal data has been processed in accordance with Law and relevant other law provisions, and to request notification of the operations made within this context to third parties to whom your personal data has been transferred,
- To object to the emergence of a result to the detriment of the person himself/herself by analyzing your processed data exclusively via automated systems,
- To request compensation if you suffer damage due to unlawful processing of your personal data.
- 2nd clause of article 28 of the Law lists the conditions where the data owners do not have the right to claim, and within this scope, the aforementioned rights shall not be exercised for the data if;
- Processing of personal data is necessary for the prevention of crime or criminal investigation,
- Processing personal data publicized by the person concerned,
- Processing of personal data is necessary for the execution of supervisory or regulatory duties and disciplinary investigation or prosecution by the public institutions and organizations and professional organizations in the nature of public institutions, which are authorized by law,
- Processing of personal data is necessary for protection of economic and financial benefits of the State regarding budget, tax and financial issues.
- Since the data will be outside the scope of the Law in the following cases pursuant to paragraph 1 of Article 28 of the Law, the requests of the data owners will not be processed in terms of this data:
- Processing the personal data for the purposes of investigation, planning and statistics by anonymizing with official statistics.
- Processing the personal data by judicial or enforcement authorities in relation to the investigation, proceedings, litigation or execution procedures.
Exercise of Rights by Data Owners
In order to use the abovementioned rights,
the data owners can make an application by one of the following methods with the documents to authenticate the identity of the relevant data owner:
A petition shall be filled and its originally signed copy shall be sent to the address EBR SAĞLIK HİZMETLERİ TİC.LTD.ŞTİ. MERKEZ MH HASAT SK KAMARA 52/1 ŞİŞLİ – ISTANBUL TÜRKİYE by hand, via notary or by registered letter with return receipt,
The form shall be signed by secure electronic signature set out within the scope of Electronic Signature Law no. 5070 and sent to the address ebru.coskun.3@hs01.kep.tr by registered electronic mail,
- Following a method envisaged by the Personal Data Protection Board.
- The Company shall respond to the data owners who wish to exercise the said rights within the limits stipulated in the Law within a maximum of thirty (30) days as stipulated in the Law. In order for third parties to request an application in the name of personal data owners, a special power of attorney, issued by a notary public in the name of the person applying for the data owner and granted by the same, shall be submitted.
- Although data owner applications are processed free of charge as a rule, fees can be charged based on the fee tariff stipulated by the Personal Data Protection Board.
- The Company may request information from the relevant person in order to determine whether the applicant is the owner of personal data, and may ask questions to the personal data owner in order to clarify the issues specified in the application.
Legal Reasons Requiring Storage
Personal data processed within the framework of the commercial activities shall be stored for the period stipulated in the relevant legislation. Within this scope, personal data shall be stored for the durations prescribed within the framework of;
· Personal Data Protection Law No. 6698,
· Turkish Code of Obligations no. 6098,
· Public Servants Law no. 657,
· Social Security and General Health Insurance Law no. 5510,
· Regulating Broadcasting in the Internet and Fighting Against Crimes Committed through Internet Broadcasting Law no. 5651,
· Public Financial Management Law no. 5018,
· Occupational Health and Safety Law No. 6331,
· Right to Information Law no. 4982,
· Exercising the Right to Petition Law no. 3071,
· Labor Law no. 4857,
· Regulation on Health and Safety Measures to be Taken in Workplace Buildings and Annexes,
· Other secondary regulations in force pursuant to these laws.
Reasons Requiring Destruction
Personal data shall be deleted, destructed or ex officio deleted, destructed or anonymized by the Institution upon the request of the relevant person in following cases:
· Amendment or abolition of the relevant legislation provisions that form the basis of processing
· Absence of the purpose that requires processing or storage,
· In cases where the processing of personal data takes place only in accordance with the explicit consent condition, withdrawal of the relevant person’s consent,
· The Authority accepting the application made by the relevant person regarding the deletion and destruction of personal data within the framework of their rights pursuant to article 11 of the Law,
· In the event that the request made by the relevant person for deletion, destruction or anonymization of the personal data is rejected, the response is found insufficient or no response is given within the duration prescribed in the law, the relevant person submitting a complaint to the Board and the Board approving this request,
· In the event that the minimum duration required to store the personal data is expired and there are no conditions to justify further storage of personal data.