The protection of personal data is among the most important priorities of BALAT AESTHET?C CENTER HEALTH TOURISM AND TRADE LIMITED COMPANY. The necessary sensitivity is shown about the security of personal data, great importance is attached to patient privacy and to the protection of all kinds of personal data belonging to our patients by processing them in the best possible way and with care. In addition to our patients, our companions, visitors, all our employees and the employees of the institutions and organizations we cooperate with; According to the Law on the Protection of Personal Data No. 6698 and the regulation on the Processing and Ensuring the Privacy of Personal Health Data and the relevant legislation, protecting personal data has been adopted as a corporate policy within the framework of the following basic principles.

 

  • Processing personal data in accordance with the law and good faith,
  • Keeping personal data accurate and up-to-date when necessary,
  • Processing personal data for specific, explicit and legitimate purposes,
  • Processing personal data in connection with the purpose for which they are processed, limited and measured,
  • To keep personal data for the period stipulated in the relevant legislation or required for the purpose for which they are processed,
  • Clarifying and informing personal data owners,
  • To establish the necessary system for personal data owners to exercise their rights,
  • Taking the necessary measures in the protection of personal data,
  • In transferring personal data to third parties in line with the requirements of the purpose of processing, acting in accordance with the relevant legislation and KVK Board regulations,
  • To show the necessary sensitivity to the processing and protection of personal data of special nature,
  • Deletion and destruction of personal data in accordance with the law in a defined form and time

 

Purpose

 

The main purpose of this Policy is to make statements about the personal data processing activity carried out by BALAT AESTHET?C CENTER HEALTH TOURISM AND TRADE LIMITED COMPANY.in accordance with the law and what is done for the protection of personal data, and in this context, our patients, visitors, employees and institution officials, employees, shareholders and officials of the institutions we cooperate with and third parties, especially personal data of our Clinic? to ensure transparency by informing the persons processed by ?The personal data processed by BALAT AESTHET?C CENTER HEALTH TOURISM AND TRADE LIMITED COMPANY. may vary depending on the health services provided, but are collected by automatic or non-automatic methods. Our patient representatives, physicians, health professionals, etc. employees, subcontractor companies and their employees and companies engaged in all kinds of commercial activities; Special quality personal data and general quality personal data, especially health data collected verbally, in writing or electronically through our call center, website, online services and similar means, can be processed for the following purposes.

Carrying out medical diagnosis, treatment and care services, protection of public health, planning and management of preventive medicine health services and their financing; to inform our patients about the appointment; planning and managing the internal procedures of our clinic, conducting analysis with the aim of improving health services; training and developing our employees, protecting our employees’ personal processes and legal rights, monitoring and preventing abuse and unauthorized transactions; carrying out risk management and quality improvement activities; conducting research; fulfillment of legal and regulatory requirements; billing for our services; confirm your identity; Confirming your relationship with the institutions contracted with our clinic; sharing any information requested by private insurance companies within the scope of financing health services; to respond to any questions or complaints regarding our health services; Taking all necessary technical and administrative measures within the scope of data security of the systems and applications of our clinic; analyse your use of health services and store your health data for the purpose of developing and improving the health services we provide to you; to retain information on your health data, which must be retained in accordance with the relevant legislation; financial reconciliation with our contracted institutions, banks and all institutions (public and private) for which health expenses are collected regarding the health services provided to you; sharing the information requested with the Ministry of Health and other public institutions and organizations in accordance with the relevant legislation; measuring patient satisfaction, increasing patient satisfaction.

Personal data are collected and processed in all kinds of verbal, written or electronic media for the purposes mentioned above and in order to provide health services within the determined legal framework and to? fulfill the contracts and legal obligations of BALAT AESTHET?C CENTER HEALTH TOURISM AND TRADE LIMITED COMPANY.as required.

Scope

 

This Policy; It covers the personal data of our patients, companions, visitors, institution officials, employees, employees, employees, employees, employees of persons, organizations and institutions with whom we have all kinds of legal relations, shareholders and officials, and third parties processed by automatic or non-automatic means.

Name, surname, Turkish Identity number, passport number or temporary Turkish Identity number, place and date of birth, gender, marital status, clinic-specific protocol number and other identification data identifying patients; financial data such as address, telephone number, electronic mail address, etc. contact data, payment and billing information; audio and digital information that may be obtained by electronic or non-electronic means; general and special quality personal data, especially personal health data obtained during the execution of all medical diagnosis, examination, treatment and care services; data on private health insurance and Social Security Institution data for the purpose of financing and planning health services, health and identity data sent through websites, all visual (digital and non-digital) records

The scope of application of this policy according to the groups of personal data owners may be the entire Policy (such as our patients); there may be only some provisions (e.g. only our employees, suppliers, etc.)

When the call center or website is used to use online services, personal data may also be processed on the in-house intranet, training, participation in events organized by the hospital or when visiting internet pages.

Definitions

 

Explicit Consent: Consent related to a specific subject, based on being informed and explained with free will

Anonymization: It is the modification of personal data in such a way that it loses its personal data quality and this situation cannot be recovered. For example, masking, aggregation, data corruption, etc. techniques to make personal data unassociative with a real person

Employees, Shareholders and Officials of the Institutions We Cooperate with: Real persons working in the institutions with which our clinic has all kinds of business relations (such as business partners, suppliers, but not limited to), including the shareholders and officials of these institutions,

Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, preserving, changing, rearranging, disclosure, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system

Personal Data Owner: The natural person whose personal data is processed. For example, patients and staff

Personal Data: Any information relating to an identified or identifiable natural person. Therefore, the processing of information related to legal entities is not covered by the Law. For example, name, surname, TCKN, e-mail, address, date of birth, credit card number, bank account number, etc.

Patient: A person who applies to our clinic for examination, treatment and receives outpatient or inpatient treatment

Special Quality Personal Data: Data related to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data are data of special nature

Authority of the Authority: The General Manager of the Authority and other authorized natural persons

Third Party: Third-party natural persons who are associated with our clinic in order to ensure the security of commercial transactions between the above-mentioned parties or to protect the rights of such persons and to obtain benefits (for example, employees or officials of the company from which the service is received, Accompanying Person, etc.)

Data Processor: It is the natural and legal person who processes personal data on behalf of the data controller based on the authority given by him/her. For example, the IT company that keeps the data of our clinic, all the employees who enter the patient data into the system

Data Controller: The person who determines the purposes and means of processing personal data and manages the place where the data is kept systematically (data recording system)

Visitor: Real persons who have entered the physical areas owned by our clinic for various purposes or who have visited our websites

 

Implementation of Policy and Related Legislation

 

The processing and protection of personal data is carried out within the framework of the relevant legal regulations in force. BALAT AESTHET?C CENTER HEALTH TOURISM AND TRADE LIMITED COMPANY. Personal Data Protection Policy has been prepared in accordance with the current regulations.

The policy has been established by integrating with BALAT AESTHET?C CENTER HEALTH TOURISM AND TRADE LIMITED COMPANY.applications within the framework of the rules set forth by the relevant legislation ?. It carries out the necessary preparations by adhering to the validity periods stipulated in the KVK Law. The above-mentioned personal data may be processed within the framework of the provisions of the Basic Law on Health Services No. 3359, the Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Organizations, the Regulation on Private Hospitals, the Regulation on the Processing of Personal Health Data and the Protection of Privacy and the regulations of the Ministry of Health, etc., and will be transferred to the physical archives and information systems of our clinic and / or suppliers. As a result, personal data will be protected in both digital and physical environment in accordance with the legal periods defined in the corporate procedures.

Ensuring the Security of Personal Data

 

Our clinic takes the necessary technical and administrative measures to ensure the optimum level of security in order to prevent the unlawful processing of the personal data it processes and to ensure the protection of the data, and in this context, it carries out or has the necessary audits carried out.

The actions and measures taken by our clinic to ensure “data security” in accordance with Article 12 of the KVK Law are stated below.

  • Our clinic takes technical and administrative measures according to technological facilities and application cost to ensure that personal data is processed in accordance with the law. Employees are informed that they cannot disclose the personal data they have learned to anyone else contrary to the provisions of KVKK and cannot use them other than for the purpose of processing and that this obligation will continue after they leave their duties and the necessary commitments are taken from them accordingly.
  • Our clinic takes technical and administrative measures to prevent imprudent or unauthorized disclosure, access, transfer or any other unlawful access of personal data.
  • Our clinic increases awareness as data processing institutions such as business partners and suppliers to whom it has transferred personal data in order to prevent unlawful processing of personal data, to prevent unlawful access to data and to ensure the lawful retention of data.
  • The obligations that our clinic has to comply with while processing personal data as a data controller and the obligation to comply with the legal, administrative and technical measures developed in this regard Contracts are concluded in accordance with the nature of the activity they carry out in data processing to the data processing institutions that our clinic is in contact with in various capacities such as suppliers and business partners
  • Our clinic conducts or has the necessary inspections carried out within its own structure. The results of these audits are reported to the relevant department within the scope of the internal functioning of the Authority and necessary activities are carried out to improve the measures taken.
  • Our clinic carries out the system that ensures that if the personal data processed in accordance with Article 12 of the KVK Law is obtained by others through illegal means, this situation is reported to the relevant personal data owner and the KVK Board as soon as possible.

 

Data Subject Rights; Claiming Rights, Communication Channels and Evaluation of Data Owners’ Requests

?

Our clinic carries out the necessary channels, internal functioning, administrative and technical arrangements in accordance with Article 13 of the KVK Law in order to evaluate the rights of personal data owners and to provide the necessary information to personal data owners.

In the event that personal data owners submit their requests regarding the rights listed below to our Clinic in writing with a personal application and with a special authorized power of attorney, our Clinic concludes the request free of charge as soon as possible and within thirty days at the latest according to the nature of the request. Personal data owners;

  • To learn whether personal data is processed or not,
  • If their personal data has been processed, to request information about it,
  • To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
  • To know the third parties to whom personal data are transferred at home or abroad,
  • Requesting the correction of personal data if it is incomplete or incorrectly processed,
  • Requesting the deletion or destruction of personal data,
  • In case of correction, deletion or destruction of personal data, to request that these transactions be notified to third parties to whom personal data are transferred,
  • To object to the occurrence of a result against the person himself by analyzing the processed data exclusively by means of automated systems,
  • In case of damage due to unlawful processing of personal data, it has the right to request the removal of the damage.
  • ?

In accordance with Article 13, paragraph 1 of the KVK Law, the request for the exercise of the above-mentioned rights must be forwarded to our Clinic (data controller) “in writing”.

In order to exercise the rights specified within the framework of the KVK, together with the necessary information to identify the identity and explanations for the rights to be used, the request should be forwarded to our Clinic by specifying which right is related to the use of Article 11 of the Law; It will enable the application for the request to be answered more quickly and effectively.

Protection of Personal Data of Special Nature

 

BALAT AESTHET?C CENTER HEALTH TOURISM AND TRADE LIMITED COMPANY. meticulously protects personal data with its technical and administrative facilities. The security measures taken by our clinic are provided at the optimum level by considering the technological facilities and possible risks.

A group of personal data is defined as “special quality personal data” in the KVK Law due to the risk of causing victimization or discrimination of persons when processed unlawfully.

These data are; race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing and clothing, association, foundation or union membership, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

We act with sensitivity in the protection of the above-defined data determined as “special quality” by the KVK Law and processed in accordance with the law.

 

Clarification and Information of the Personal Data Owner

 

In accordance with Article 10 of the KVK Law, it enlightens the personal data owners during the acquisition of personal data. In this context, our Clinic clarifies the identity of our Clinic during the acquisition of personal data to the personal data owners, the purpose for which the personal data will be processed, to whom and for what purpose the processed personal data can be transferred, the method and legal reason for collecting personal data and the rights of the personal data owner within the scope of Article 11 of the KVK Law.

 

Article 20 of the Constitution establishes that everyone has the right to be informed about the personal data concerning him/her. Accordingly, in Article 11 of the KVK Law, “requesting information” is also counted among the rights of the personal data owner. In this context, our clinic provides the necessary information in case the personal data owner requests information in accordance with the articles 20 of the Constitution and 11 of the KVK Law.

 

Our clinic provides accountability and transparency to personal data owners and related persons in personal data processing activities by announcing the corporate policy on the protection of personal data through various public documents. In addition, the relevant people of our clinic; It also informs people about their own activities and the articles in the law by different methods, especially when they apply for “explicit consent”.

 

Processing of Personal Data

 

Our clinic, in accordance with Article 20 of the Constitution and Article 4 of the KVK Law, in the processing of personal data; accurate and up-to-date, in accordance with the law and honesty rules; pursuing specific, clear and legitimate purposes; It carries out personal data processing activities in a purpose-related, limited and measured manner.

Our clinic retains personal data for the period stipulated in the laws or required by the purpose of personal data processing.

In accordance with Article 20 of the Constitution and Article 5 of the KVK Law, our clinic processes personal data based on one or more of the conditions in Article 5 of the KVK Law on the processing of personal data.

Our clinic acts in accordance with the regulations stipulated in terms of the processing of personal data of special nature in accordance with Article 6 of the KVK Law.

In accordance with Articles 8 and 9 of the KVK Law, our clinic acts in accordance with the regulations stipulated in the law and set forth by the KVK Board on the transfer of personal data.

Processing of Personal Data in Accordance with the Principles Stipulated in the Legislation

Processing in Accordance with the Law and the Rule of Honesty

 

Our clinic; In the processing of personal data, it acts in accordance with the principles introduced by legal regulations and the general rule of trust and honesty. Our clinic takes into account the requirements of proportionality in the processing of personal data, does not use personal data outside the purpose.

Ensuring Personal Data is Accurate and, Where Necessary, Up-to-Date

 

Our clinic; taking into account the fundamental rights of personal data owners and their own legal interests, it takes the necessary measures to ensure that the personal data it processes are accurate and up-to-date.

Processing for Specific, Explicit and Legitimate Purposes

 

Our clinic clearly and precisely determines the purpose of processing personal data that is legitimate and in accordance with the law. Our clinic processes personal data in connection with the service it provides and to the extent necessary for them. The purpose for which personal data will be processed by our clinic is notified before the personal data processing activity begins.

Being Relevant, Limited and Proportionate to the Purpose for which they are Processed

 

Our clinic processes personal data in a manner conducive to the realization of the specified purposes and avoids the processing of personal data that is not related to or is not needed for the realization of the purpose. For example, personal data processing activities are not carried out to meet the needs that may arise later.

Retention for the Period Stipulated in the Relevant Legislation or Required for the Purpose for which they are Processed

 

Our clinic retains personal data only for the period specified in the relevant legislation or required for the purpose for which they are processed. In this context, our Clinic first determines whether a period of time is foreseen for the storage of personal data in the relevant legislation, acts in accordance with this period if a period is determined, and if a period is not determined, stores the personal data for the period required for the purpose for which they are processed. At the end of the period or if the reasons requiring processing disappear, the personal data are deleted, destroyed or anonymized by our Clinic.

Terms of Processing Personal Data

 

The protection of personal data is a constitutional right. In accordance with the third paragraph of Article 20 of the Constitution, personal data may only be processed in the cases stipulated by the law or with the explicit consent of the person. Our clinic is in this direction and in accordance with the Constitution; processes personal data only in the cases stipulated in the law or with the explicit consent of the person.

Although the legal bases for the processing of personal data by our clinic vary, all kinds of personal data processing activities are carried out in accordance with the general principles specified in Article 4 of the Law No. 6698.

The explicit consent of the personal data owner is only one of the legal bases that allow the processing of personal data in accordance with the law. Apart from explicit consent, personal data may also be processed in the presence of one of the other conditions written below. The basis of the personal data processing activity may be only one of the following conditions, and more than one of these conditions may be the basis of the same personal data processing activity. In the event that the processed data is personal data of special nature; the following conditions apply.

  • Explicit Consent of the Personal Data Owner
  • Explicitly Stipulated in the Laws
  • Failure to Obtain the Explicit Consent of the Person Concerned Due to Actual Impossibility
  • Direct Involvement in the Conclusion or Performance of the Contract
  • Fulfillment of the Legal Obligation of the Institution
  • Personal Data Owner’s Public Disclosure of Personal Data
  • Data Processing is Mandatory for the Establishment or Protection of a Right
  • Data Processing is Mandatory for the Legitimate Interest of Our Clinic

 

Processing of Personal Data of Special Nature

 

In the processing of personal data determined by our clinic as “special quality” by the KVK Law, the regulations stipulated in the KVK Law are acted in accordance with sensitivity.

In Article 6 of the KVK Law, a number of personal data that risk causing victimization or discrimination to individuals when processed unlawfully are determined as “of special quality”. These data are; race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing and clothing, association, foundation or union membership, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

In accordance with the KVK Law, our Clinic; personal data of special nature are processed in the following cases, provided that adequate measures are taken to be determined by the KVK Board:

 

  • If there is explicit consent of the personal data owner, or
  • If there is no explicit consent of the personal data owner;
  • Personal data of special nature other than the health and sexual life of the personal data owner, in the cases stipulated by law,
  • The personal data of special nature related to the health and sexual life of the personal data owner are processed only by the persons under the obligation of confidentiality or authorized institutions and organizations for the purpose of protecting public health, conducting preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.

 

Transfer of Personal Data

 

Our clinic can transfer the personal data and special quality personal data of the personal data owner to third parties (third party companies, institutions, group companies, third real persons) in the country and abroad by taking the necessary security measures in line with the personal data processing purposes in accordance with the law. In this direction, our clinic acts in accordance with the regulations stipulated in Article 8 of the KVK Law.

Your personal data, within the scope of the Law and other legislation and for the purposes stated above, BALAT AESTHET?C CENTER HEALTH TOURISM AND TRADE LIMITED COMPANY. Medical Centers, Group Companies, Universities, Ministry of Health, affiliated sub-units and family medicine centers, private insurance companies (health, pension and life insurance and the like), Social Security Institution, General Directorate of Security and other law enforcement agencies, General Directorate of Population,? The Pharmacists Association of Turkey, the courts and all public institutions and organizations provided that they are not bound by this, laboratories in the country or abroad with which we cooperate for medical diagnosis, medical centers and third parties providing health services, the health institution to which the patient is referred or to whom the patient himself or she referres, your authorized representatives, the institution to which you are affiliated and / or the institution you are working with,? third parties to whom we receive consultancy including lawyers, tax consultants and auditors, regulatory and supervisory institutions and official authorities, companies within the group of companies to which our Hospital is affiliated and/or systems at home or abroad, our suppliers, support service providers and business partners whose services we benefit from or cooperate with (you can contact our Clinic in writing for more detailed information)? can be shared.

?

Personal Data Received for Physical Space Security

 

Building, Facility Entrances and Personal Data Processing Activities Carried Out in the Building Facility and Website Visitors

In carrying out camera monitoring activities for security purposes by our clinic, we act in accordance with the regulations in the KVKK.

In the buildings and facilities of our clinic, personal data processing activities are carried out for monitoring the entry and exit of patients, personnel, visitors and supplier company employees with security cameras.

By using security cameras and recording guest entrances and exits, personal data processing activities are carried out by our Clinic. In this context, our clinic acts in accordance with the Constitution, KVK Law and other relevant legislation.

The video recordings of our visitors and the sound recordings are taken where necessary through the camera monitoring system at the entrances of the building, facility and inside the facility of our clinic.

Our clinic, within the scope of monitoring activities with security cameras; to improve the quality of the service provided, to ensure its reliability, to ensure the safety of the institution, patients and employees and to protect the interests of patients in relation to the health care and other services they receive.

The camera monitoring activity carried out by our clinic is carried out in accordance with the Law on Private Security Services and related legislation.

The records recorded and maintained in the digital environment are only accessible to the authorized employees of the institution and / or the employees of the supplier company. Live camera images can be monitored by outsourced security tasks.

Camera recordings are kept for 1 month.

In accordance with Article 12 of the KVK Law, necessary technical and administrative measures are taken by our clinic to ensure the security of the personal data obtained as a result of the camera monitoring activity.

Conditions for Deletion, Destruction and Anonymization of Personal Data

 

Although it has been processed in accordance with the provisions of the relevant law as regulated in Article 138 of the Turkish Criminal Code and Article 7 of the KVK Law, the personal data shall be deleted, destroyed or anonymized in accordance with the relevant procedures of our Clinic or upon the request of the personal data owner in case the reasons requiring the processing disappear.

In this context, our Clinic trains and assigns relevant business units to fulfill its relevant obligation and increases their awareness.

The personal data owners in question are enlightened in this context while obtaining the names and surnames of the persons coming to the buildings of our clinic or through the texts hung before the Institution or otherwise made available to the guests.

Ensuring security by our clinic and for the purposes specified in this Policy; Our clinic can provide internet access to our visitors who request it during their stay in our buildings and facilities. In this case, the log records related to internet access are recorded in accordance with the Law No. 5651 and the governing provisions of the legislation regulated in accordance with this Law; these records are processed only when requested by authorized public institutions and organizations or in order to fulfill our relevant legal obligation in the audit processes to be carried out within the Institution.

Only a limited number of employees of the Authority have access to the log records obtained within this framework. The employees of the Authority who have access to the aforementioned records access these records only for use in the request or audit processes from the authorized public institutions and organizations and share them with the legally authorized persons. A limited number of people who have access to the records declare that they will protect the confidentiality of the data they access with a confidentiality undertaking.

Our clinic owns websites on its websites; to ensure that visitors to such sites carry out their visits to the sites in a manner appropriate to the purposes for which they visit; Internet movements within the site are recorded by technical means in order to be able to show them customized content and to carry out online promotional activities.

Detailed explanations regarding the protection and processing of personal data related to these activities carried out by our clinic are included in the “Website Privacy Policy” texts of the relevant websites.

Enforcement of the Policy

 

BALAT AESTHET?C CENTER HEALTH TOURISM AND TRADE LIMITED COMPANY. Personal Data Protection and Processing Policy ?enters into force on 17.03.2023. In the case of renewal of all or certain articles of the Policy, the effective date of the Policy is the date on which that article is revised for the renewed item.