KVKK Information Text

LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA
PATIENT INFORMATION TEXT

As Hastanem Yanımda Sağlık Hizmetleri A.Ş. (hereinafter referred to as "Company" and/or "Data Controller"), we show maximum sensitivity regarding the privacy of private life within the framework of laws and ethical boards. For this reason, we consider it a necessity to inform the parties in accordance with Law No. 6698 on the Protection of Personal Data (hereinafter referred to as "KVKK").

1. Who is the Data Controller?

We inform you that as Hastanem Yanımda Sağlık Hizmetleri Anonim Şirketi, we process your personal data in our capacity as the data controller in accordance with KVKK and relevant legislation.

2. Purposes of Data Processing

Personal data of real persons are processed in accordance with the principles of legality and honesty as stated in Article 4 of KVKK, accuracy and currency, for specific, clear, and legitimate purposes, in connection with the purpose for which they are processed, limited and proportional, and in parallel with the duration necessary for the purpose for which they are processed as stipulated in relevant legislation.

3. Categories of Processed Personal Data

In accordance with KVKK and relevant legislation, your personal data in the categories of identity, communication, customer transaction, marketing, transaction security, legal transaction, health information, and finance will be processed within the framework of the purposes and legal reasons specified in this Information Text under Law No. 6698 on the Protection of Personal Data.

Data Category

 

Processed Data

Identity

Full Name, TCKN, Customer ID, Gender, Date of Birth.

Communication

Email Address, Phone Number, Communication Address.

Customer Transaction

Request Information, Appointment Information, Service History Information.

Marketing

Cookies, Surveys.

Transaction Security

Device Operating System and Version, Device Type, Device ID, Hardware Model, IP Address, User Transaction Records, Password Information.

Legal Transaction

Information in the Case File in Case of Dispute, Notifications, Information in Correspondence with Judicial and Administrative Authorities, Contracts.

Health Information

Weight, Height, Family Health History, Health History, Other Health Information Recorded by You in Our System, Consultations You Have Had with Doctors within the Scope of Remote Health Services.

Finance

Card Information and Payment Information Related to Possible Payments.

Risk Management

Information processed for managing commercial, technical, and administrative risks.

Visual and Audio Records

Visual Meeting Records, Audio Records, etc.

Location

Location information of where you are (can be obtained through processing the IP information of the device you entered into the system).

Genetic Data

Genetic Data, etc. if provided by the patient.

4. Reasons and Purposes for Processing Personal Data
The personal data mentioned above, including Identity, Communication, Location, Customer Transaction, Marketing, Transaction Security, Legal Process, Finance, Risk Management, Visual and Auditory Data, are processed in accordance with Article 5 of the KVKK;

  • Clearly provided for by laws
  • It is necessary to protect the life or physical integrity of a person who is unable to disclose their consent due to actual impossibility or whose consent is not legally recognized.
  • It is necessary to process personal data belonging to the parties of a contract, provided it is directly related to the establishment or performance of the contract.
  • It is mandatory for the data controller to fulfill a legal obligation.
  • The data has been made public by the relevant person themselves.
  • Data processing is mandatory for the establishment, use, or protection of a right.
  • Provided that it does not harm the fundamental rights and freedoms of the relevant person, it can be processed without your explicit consent if one of the situations requiring data processing for the legitimate interests of the data controller exists.

The Health, Sexual Life, Genetic Data among your personal data are considered sensitive personal data. These data can only be processed without the explicit consent of the individual by persons or authorized institutions and organizations who are bound by the obligation of confidentiality for the purpose of protecting public health, preventive medicine, conducting medical diagnosis, treatment, and care services, and planning and managing healthcare services and financing.

Additionally, your personal data may be processed for the purposes of managing customer satisfaction and loyalty processes, planning human resources processes, conducting performance evaluation processes and disciplinary activities, tracking contracts and legal affairs, carrying out finance and accounting operations, determining salary policies, managing emergency management processes, ensuring business, system, and service continuity, conducting business, system, and service activities, receiving and evaluating proposals for the improvement of business, system, and service processes, information security, conducting assignment processes and access permissions, conducting internal audit activities, managing organizations and events, carrying out communication activities, ensuring compliance with regulations, ensuring the security of data controller operations, risk management, providing information to authorized persons/institutions/organizations, conducting management activities, managing service procurement processes, providing post-sales support services, managing service sales processes, managing service operation processes, conducting customer relationship management processes, carrying out activities aimed at customer satisfaction, managing service marketing processes, conducting marketing analysis studies, conducting performance evaluation processes, conducting storage and archiving activities, conducting social responsibility and civil society activities, managing supply chain, conducting contract processes, conducting sponsorship activities, conducting strategic planning activities, tracking requests/complaints, conducting advertising/campaign activities, providing remote healthcare services, conducting medical diagnosis, treatment, and care services, protecting public health, preventive medicine, conducting medical diagnosis, treatment, and care services, fulfilling the necessary obligations regarding the Regulation on the Provision of Remote Health Services and other relevant regulations, can be processed limited to these purposes. Your personal data can also be transferred to physical archives and information systems and stored in both digital and physical environments.

5. Who Personal Data May Be Transferred To and for What Purpose

As the data controller, we only transfer the data we process for the purposes mentioned below to the specified groups of persons domestically.

Transferred Person Group

 

Purpose of Transfer

Our Accountants
  • Conducting financial and accounting transactions.
  • Conducting activities in accordance with regulations.
  • Conducting management activities.
  • Fulfilling obligations arising from the service relationship.
  • Risk management.
  • Conducting internal audit activities.
  • Ensuring the security of data controller operations.
  • Informing authorized persons/institutions/organizations.
  • Necessary for the legitimate interest of the data controller.
  • Directly related to the establishment or performance of a contract.
  • Establishing, using, or protecting a right.
  • Information security.

Our Lawyers
  • Conducting and following up legal transactions.
  • Planning and executing contract processes.
  • Conducting activities in accordance with regulations.
  • Conducting management activities.
  • Fulfilling obligations arising from the service relationship.
  • Risk management.
  • Conducting internal audit activities.
  • Ensuring the security of data controller operations.
  • Informing authorized persons/institutions/organizations.
  • Necessary for the legitimate interest of the data controller.
  • Directly related to the establishment or performance of a contract.
  • Establishing, using, or protecting a right.
  • Information security.

Authorized Persons, Institutions, and Organizations
  • Conducting activities in accordance with regulations.
  • Conducting management activities.
  • Risk management.
  • Necessary for the legitimate interest of the data controller.
  • Informing authorized persons/institutions/organizations.
  • Information security.

Suppliers/Our Business Partners
  • Planning organizational processes.
  • Conducting advertising/campaign activities.
  • Ensuring the security of data controller operations.
  • Risk management.
  • Informing authorized persons/institutions/organizations.
  • Conducting management activities.
  • Conducting service procurement processes.
  • Conducting post-sale support services.
  • Conducting service sales processes.
  • Conducting service operation processes.
  • Conducting customer relationship management processes.
  • Conducting activities aimed at customer satisfaction.
  • Managing service marketing processes.
  • Conducting marketing analysis studies.
  • Ensuring compliance with the policies and procedures of the company and the group of companies it is affiliated with.
  • Supply chain management.
  • Conducting activities in accordance with regulations.
  • Necessary for the legitimate interest of the data controller.
  • Directly related to the establishment or performance of a contract.
  • Establishing, using, or protecting a right.
  • Information security.

Doctors and Healthcare Institutions Registered in Our System
  • Conducting service activities.
  • Conducting post-sale support services.
  • Conducting service sales processes.
  • Conducting service operation processes.
  • Conducting customer relationship management processes.
  • Conducting activities aimed at customer satisfaction.
  • Managing service marketing processes.
  • Conducting marketing analysis studies.
  • Conducting performance evaluation processes.
  • Conducting activities in accordance with regulations.
  • Necessary for the legitimate interest of the data controller.
  • Directly related to the establishment or performance of a contract.
  • Establishing, using, or protecting a right.
  • Information security.
  • Informing authorized institutions, organizations, and persons.
  • Ensuring the security of data controller operations.
  • Providing remote healthcare services, conducting treatment and care services, protecting public health, preventive medicine, medical diagnosis, medical consultation, conducting treatment and care services, planning and managing healthcare services and financing in accordance with the Regulation on the Provision of Remote Health Services and other relevant legislation.

 

6. Methods of Collecting Your Personal Data

Your personal data is obtained automatically and non-automatically, verbally, in writing, or electronically, based on the legal reasons specified in section (4) of this text and to fulfill the purposes stated. These methods include:

Filling out a form by the relevant person, sending an email, contacting via phone call, visiting the website (cookie collection), creating a record through the website, communicating via message, contacting through social media platforms, conducting a video consultation with an authorized physician for the provision of remote healthcare services, and manually taken notes during the conducted consultations.

7. Your Rights Under Article 11 of the KVKK
Under the KVKK and relevant legislation, regarding your personal data;

  1. Learn whether personal data is processed,
  2. Request information regarding personal data if it has been processed,
  3. Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
  4. Know third parties to whom personal data is transferred, domestically or abroad,
  5. Request correction of personal data if it is incomplete or inaccurately processed,
  6. Request deletion or destruction of personal data under the conditions set forth in Article 7 of the KVKK,
  7. Request that the transactions carried out according to (e) and (f) be notified to third parties to whom personal data has been transferred,
  8. Object to the occurrence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,
  9. Request compensation for the damage in case of a damage arising from the unlawful processing of personal data.

8. Exercise of Legal Rights Regarding Personal Data

You can submit your requests regarding your personal data through the following channels or other methods that will be determined by the Board in the future, in accordance with the “Communiqué on the Principles and Procedures of Application to the Data Controller”.

Application Method

Application Address

Application Information

In person or via notary with a signed, handwritten letter and a valid identification document belonging to you

Kurtuluş Mah. Vatan Cad. No: 53/9, 26090, Odunpazarı/Eskişehir

The envelope must be marked “Application Under KVKK”

With your registered electronic mail (KEP) address

hastanemyanimda@hs01.kep.tr

 

The subject of the email must state “Application Under KVKK”

By email, including a secure electronic signature or mobile signature

info@hastanemyanimda.com

 

The subject of the email must state “Application Under KVKK”

By the email registered in our system

info@hastanemyanimda.com

 

The subject of the email must state “Application Under KVKK”

 

If you are applying on behalf of another person, along with your own identification information;

  1. You must share a copy of the population registry document or relevant document that shows your relationship and authority with the person you are the guardian of,
  2. In other cases, you must share a copy of the special power of attorney with the application attachment.

According to the “Communiqué on the Principles and Procedures of Application to the Data Controller,” the following information must be included in the application:

  1. Name, surname, and signature if written,
  2. For Turkish citizens, the T.C. identity number; for foreigners, nationality, passport number, or identity number if available,
  3. Address of the place of residence or workplace for notification,
  4. If available, the electronic mail address, phone, and fax number for notification,
  5. Subject of the request

Changes and Updates

This clarification text has been prepared in accordance with the Law No. 6698 on the Protection of Personal Data and relevant legislation. Necessary changes may be made to the mentioned clarification text in line with changes in the relevant legal legislation and/or the Company’s purposes and policies regarding personal data processing. In case of changes, new texts will be presented to you through appropriate channels.

You can access the most up-to-date version of the Clarification Text at https://www.hastanemyanimda.com/ and from our IOS and Android mobile applications.