Clarification Text on the Law on the Protection of Personal Data (Privacy Policy)
As Assoc. Prof. Dr. Macit Bitargil, we consider patient privacy and the security of personal data as a natural part of the confidentiality obligation required by the medical profession. This clarification text has been prepared in accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“KVKK”) and the Communiqué on Principles and Procedures to be Followed in Fulfillment of the Obligation to Inform.
This clarification text covers our patients, patients’ relatives, and legal representatives who benefit from the services we provide at our private clinic and contracted hospitals, individuals who contact us to make an appointment or obtain information, and users who visit our website.
Processed Personal Data
Identity information: Name, surname, Republic of Turkey ID number (passport number for foreign patients), date of birth, gender.
Contact information: Phone number, e-mail address, residential/business address, and when necessary, contact information of the patient’s relative.
Health data (special categories of personal data): Complaints and medical history, examination findings, laboratory, Doppler ultrasound and other imaging results, diagnosis, treatment, intervention and surgery information, prescription and medication information, epicrisis (discharge summary) and medical reports.
Visual data: Pre-treatment and post-treatment photographs taken for the purpose of monitoring the treatment process.
Financial information: Payment and invoice details, self-employment receipt details, private health insurance information.
Customer transaction information: Appointment records, requests, questions, and complaints; WhatsApp, e-mail, telephone, and social media correspondence.
Transaction security and digital data: IP address, browser and device information, cookie data, website usage statistics.
Purposes of Processing Personal Data
Your personal data is processed for the purposes of creating, reminding, and managing appointments; carrying out preventive medicine, medical diagnosis, treatment, and care services; monitoring the treatment process and keeping patient records; coordinating the treatment process with contracted hospitals, laboratories, and imaging centers; responding to your questions, requests, and complaints; verifying your identity; executing payment, invoicing, and self-employment receipt transactions; conducting provision and reimbursement processes with private insurance companies; fulfilling obligations arising from health legislation and providing information to authorized institutions; protecting rights in legal disputes; ensuring information security; operating, securing, and improving the website; and carrying out promotional, advertising, and informational activities exclusively in the presence of your explicit consent.
Method and Legal Grounds for Collecting Personal Data
Your personal data is collected verbally, in writing, or electronically, through automated or partially automated means; face-to-face at the clinic and contracted hospitals, via the forms you fill out and documents you submit, through the contact and appointment forms on our website, via WhatsApp, telephone, e-mail, and our social media accounts, as well as through cookies and similar technologies on our website.
Your general personal data (identity, contact, financial, and transaction information) is processed within the scope of Article 5/2 of the KVKK based on the legal grounds that it is explicitly stipulated in the laws, is directly related to the establishment or performance of a contract, is mandatory for the data controller to fulfill its legal obligation, is mandatory for the establishment, exercise, or protection of a right, and is mandatory for the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms.
Your health data is processed without seeking your explicit consent by the physician under the obligation of confidentiality, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment, and care services, as well as planning and managing health services and their financing, pursuant to Article 6/3 of the KVKK. Your health data is processed by taking adequate measures determined by the Personal Data Protection Board.
Transactions based on your explicit consent: Sharing your pre- and post-treatment photographs or testimonials on our website and social media accounts, using them in scientific publications and presentations in a way that may identify you, and using marketing and advertising cookies as well as sending promotional messages are carried out solely with your separately obtained explicit consent. You may withdraw your explicit consent at any time; withdrawal does not affect the lawfulness of the processing carried out prior to the withdrawal.
Transfer of Personal Data
Your personal data may be transferred, limited and proportionate to the purposes stated above and in accordance with the conditions set forth in Articles 8 and 9 of the KVKK; to our contracted hospitals (Acıbadem Fulya Hospital, Liv Hospital Vadistanbul) and the laboratories and imaging centers we work with in order to carry out the treatment process, to the Ministry of Health and its affiliated units, to the Social Security Institution when necessary and other legally authorized public institutions and organizations, to prosecutor’s offices and courts upon request, to private health insurance companies, to our lawyers in legal disputes, to our certified public accountant, and to suppliers from whom we receive website, hosting, and IT services. Your health data is under no circumstances shared with third parties for marketing or advertising purposes.
Retention Period
Your personal data is retained for the period required by the purpose of processing and for the retention periods stipulated in the relevant legislation. Patient records and health data are, as a rule, kept for at least 20 years in accordance with health legislation. Financial records are retained for the periods stipulated in the tax legislation. Personal data whose retention period has expired is deleted, destroyed, or anonymized.
Children’s Personal Data
Personal data belonging to our patients under the age of 18 is processed within the knowledge of their parents or legal guardians; where explicit consent is required, consent is obtained from the parent or legal guardian.
Data Security
We take the necessary technical and administrative measures within the scope of Article 12 of the KVKK in order to prevent the unlawful processing of and unlawful access to your personal data, and to ensure the safeguarding of your data. These measures include authorization restrictions, keeping access logs, encryption, secure backup, and the confidentiality obligation of personnel. In the event that your personal data is obtained by others through unlawful means, this situation will be notified to the Personal Data Protection Board and the affected individuals in accordance with the legislation.
Your Rights as a Data Subject
By applying to the Data Controller pursuant to Article 11 of the KVKK, you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in accordance with its purpose; know the third parties to whom it is transferred domestically or abroad; request correction if it is incomplete or incorrectly processed; request its deletion or destruction within the framework of Article 7 of the KVKK; request notification of these transactions to third parties to whom your personal data has been transferred; object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems; and demand compensation for the damage in case you suffer damage due to the unlawful processing of your personal data.
Since health data is required by legislation to be kept for a certain period of time, requests for deletion and destruction regarding such data are evaluated by taking into account the retention obligations in the relevant health legislation.
In case of any changes in your personal data, we kindly ask you to inform us so that your records can be kept up to date.
Application Method
You may submit your requests regarding your rights, in accordance with the Communiqué on the Principles and Procedures for the Request to Data Controller, in person with a wet-signed petition or via a notary public to our address stated above, or from your e-mail address registered in our system to
[email protected]. Your application must clearly state your name, surname, Republic of Turkey ID number (or passport number), address for service or e-mail address, and the subject of the request.
Your applications will be concluded free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request. If the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.
