PERSONAL DATA PROTECTION LAW NO. 6698 CLARIFICATION TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

Dear Visitor,

The purpose of this Clarification Text on the Protection and Processing of Personal Data is to inform all real persons related to our Polyclinic — including but not limited to individuals who benefit from or intend to benefit from our products and services, employees, employee candidates, and business partners — within the scope of our obligation to inform pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“Law”).

In this context, as the data controller, our Polyclinic takes all necessary administrative and technical measures at the highest level to ensure the protection of personal data in accordance with the Law and published and/or future legislation, in order to prevent unlawful disclosure, access, transfer, or any possible data security breaches of personal data pursuant to Article 12 of the Law, and conducts or commissions necessary audits accordingly.

1. Data Controller

Pursuant to the Personal Data Protection Law No. 6698, the data controller regarding the processing of your personal data is **BİLMED Ear, Nose and Throat Diagnosis, Treatment and Health Services Limited Company (“MABE POLYCLINIC”)**, registered with the ………………… Tax Office under tax number ………………… and located at “……………………………………”.

As the data controller, we hereby declare that your personal data, shared with us directly and/or indirectly through visiting our Polyclinic and/or website, contacting or being contacted by our call center, may be processed in a manner that is connected, limited, and proportionate to the purpose of processing. Within this scope, your personal data may be recorded, stored, preserved, reorganized, shared with legally authorized institutions, transferred domestically or abroad under the conditions stipulated by the Law, assigned, classified, deleted upon request of the data subject, and otherwise processed as specified in the Law.

2. Processed Personal Data

Personal data processed by the data controller refers to any information relating to an identified or identifiable natural person as defined under the Law. Special categories of personal data include data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, association, foundation or trade union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

With the consent of patients/visitors, our Polyclinic may fully or partially obtain, classify, record, and retain personal and special categories of personal data for the purpose of processing or for the periods stipulated by applicable legislation.

Accordingly, personal data categories processed by our Polyclinic include, but are not limited to, the following:

Identity Data

Name and surname, Turkish ID number, Social Security number, signature, marital status, ID card serial number, date and place of birth, identity card, driver’s license, profession, passport copy.

Contact Data
Phone number, email address, residential address.
Financial Data
Bank account number, IBAN, invoicing details.

Insurance Data

Private health insurance information and Social Security Institution records for the purpose of financing and planning health services.

Special Categories of Personal Data (Health Data)

Laboratory results, test results, examination data, appointment information, check-up data, measurements, drawings, molds, prescription data, and all health- and sexual-life-related personal data obtained during or as a result of medical diagnosis, treatment, and care services.

Visual and Audio Records

2D and 3D photographs and video recordings taken before, during, and after procedures.
Family and Relative Data
Names, surnames, contact details of patient relatives, and family health data where required for medical history.
Physical Space Security
Camera recordings.

3. Purpose of Processing Personal Data

Your personal data and, where explicit consent is given, your special categories of personal data are processed in accordance with Articles 5 and 6 of the Law, within the scope of our VERBİS registration, and limited to the purposes below:

* Fulfillment of legal obligations,

* Verification of identity for service provision,

* Protection of public health; execution of preventive medicine, medical diagnosis, treatment, and care services; planning and management of healthcare services and financing,

* Sharing required information with the Ministry of Health and other public authorities,

* Planning and management of internal operations,

* Measuring and improving patient satisfaction,

* Procurement of pharmaceuticals and medical devices,

* Informing patients about appointments,

* Conducting analysis and research to improve healthcare services,

* Informing about campaigns organized by our Polyclinic,

* Designing and delivering customized content and benefits via web and mobile channels,

* Issuing invoices.

4. Method and Legal Basis for Collection of Personal Data

Your personal data may be collected verbally, in writing, or electronically through call centers, websites, social media platforms, mobile applications, and similar channels.

Personal data are processed based on at least one of the conditions stipulated in Articles 5 and 6 of the Law, in compliance with the principles set forth in Article 4 of the Law and our VERBİS registration.

Principles of Processing Personal Data

* Lawfulness and fairness

* Accuracy and up-to-date data

* Specific, explicit, and legitimate purposes

* Relevance, proportionality, and limitation

* Retention for the period required by legislation or processing purpose

5. Transfer of Personal Data

Pursuant to Articles 8 and 9 of the Law, personal data may not be transferred without explicit consent, except where legally permitted. Personal data may be transferred domestically to third parties where required for contractual obligations, legal compliance, protection of rights, public interest, or legitimate interests, provided necessary security measures are taken.

Personal data may not be transferred abroad without explicit consent, unless the conditions stipulated under Article 9 of the Law are met.

6. Rights of the Data Subject

Pursuant to Article 11 of the Law, data subjects have the right to:

* Learn whether personal data are processed,

* Request information regarding processed data,

* Learn the purpose of processing and whether data are used accordingly,

* Know third parties to whom data are transferred domestically or abroad,

* Request correction of incomplete or inaccurate data,

* Request deletion or destruction of personal data where processing reasons cease,

* Object to adverse outcomes arising from automated processing,

* Request compensation for damages incurred due to unlawful processing.

Applications may be submitted in writing or through methods determined by the Personal Data Protection Board. The application form and details can be accessed at ………………………….. or requested from our Polyclinic.

Requests will be concluded free of charge within 30 days. If additional costs arise, fees determined by the Board may be charged.

This Clarification Text has been prepared in accordance with the current provisions of Law No. 6698 and relevant legislation and is hereby presented for your information.

Sincerely,

BİLMED Ear, Nose and Throat Diagnosis, Treatment and Health Services Ltd. Co.
“MABE POLYCLINIC”