This is an English translation of the Turkish Patient Information Notice prepared under Law No. 6698 on the Protection of Personal Data (KVKK). In case of any discrepancy, the Turkish version prevails.
Patient Information Notice on the Protection of Personal Data
This Information Notice has been prepared by the Data Controller, Op. Dr. Serkan Barışkan (the “Data Controller”), in accordance with Law No. 6698 on the Protection of Personal Data (the “Law”), to inform you about the personal data obtained from you, the purposes for which it is processed, the methods and legal grounds of its collection, the transfer of your personal data and your rights under the Law. Should a situation arise that requires the processing of personal data not covered by this Information Notice, you will be informed separately and your explicit consent will be requested.
Your Personal Data
As the Data Controller, we process the following personal data within the scope of the processing purposes set out in this Information Notice.
- Identity data: Your name and surname, Turkish ID number, passport number, place and date of birth, gender, marital status
- Contact data: Your address, telephone number, e-mail address
- Financial data: Payment and invoice details, financial information, private health insurance and Social Security Institution (SGK) information
- Health data: Laboratory and imaging results, test and examination results, examination data, medications you use, previous surgeries and treatment history, chronic illnesses, prescription information, allergies and other health data contained in your patient file
- Visual and audio data: Photographs, videos and other visual and audio recordings, security camera footage
- Name, surname, Turkish ID number, address and telephone details of a relative of the patient to be contacted when necessary
- Travel data: Within the scope of international health tourism: flight details, boarding pass, tour route, frequent-flyer card number, accommodation details, visa information, passport copy/scan, passport number
- Signature data: Wet signature, e-signature data
Purposes of Processing Your Personal Data
The personal data listed above are processed by the Data Controller for the following purposes:
- Fulfilling our legal obligations under the Basic Law on Health Services No. 3359, Decree-Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions, the Regulation on Private Health Institutions Providing Outpatient Diagnosis and Treatment, Law No. 6698 on the Protection of Personal Data, the Regulation on the Processing of Personal Health Data and Ensuring Privacy, and other relevant legislation,
- Protection of public health, preventive medicine, medical diagnosis, and the provision of treatment and care services,
- Planning and managing health services and their financing,
- Providing you with information about your appointment if you make one,
- Planning and managing the internal operations of the practice,
- Carrying out analyses to improve our services,
- Invoicing,
- Verifying your identity,
- Ensuring the security of the practice,
- Verifying your relationship with contracted institutions (insurers, SGK, etc.),
- Responding to and providing information upon requests of the Ministry of Health and other public institutions and, where necessary, law enforcement and judicial authorities in accordance with the law,
- Responding to your questions or complaints about our services,
- Analysing your use of health services in order to improve the services we offer,
- Where your separate informed explicit consent is obtained before and after a procedure, sharing visual records (photographs, videos) of the medical procedures performed on domestic/international platforms, on our website and/or our social media accounts in order to show the medical treatment process,
- Ensuring compliance with the internal policies and principles of the practice,
- Measuring and improving patient satisfaction after you receive health services,
- Procuring medicines, medical equipment or medical devices,
- Informing you about new treatment methods,
- Planning and carrying out corporate communication activities,
- Complying with other data retention, reporting and notification obligations required by legislation, regulatory bodies and other authorities,
- Communicating with patients and their relatives,
- Contacting the relevant persons in emergencies.
Method and Legal Grounds of Collection and Retention Period
The personal data covered by this Information Notice are collected, for the purposes listed above, by automated or non-automated means through camera footage, telephone recordings, application forms, information you personally provide to us during examination, appointment and treatment, tests, analyses, laboratory and imaging results carried out for treatment, and information received from public institutions and organisations.
Your personal data are processed for the purposes set out in this Information Notice where your explicit consent has been obtained and, in the absence of explicit consent, on the legal grounds that retention is expressly provided for by legislation, that it is directly related to the conclusion and performance of a contract, that it is necessary for the establishment, exercise or protection of a right, that it is mandatory for the legitimate interests of the Data Controller provided that it does not harm your fundamental rights and freedoms, or that it is necessary to fulfil legal obligations under the relevant legislation, as well as for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.
Your personal data are retained for as long as your treatment continues and, taking into account the retention and limitation periods set out in the relevant legislation, for 10 years from the end of your treatment.
Transfer of Your Personal Data
Subject to all necessary technical and administrative measures to ensure an appropriate level of security in accordance with the Law and the relevant health legislation, the personal data listed in this Information Notice may be transferred to private insurance companies, SGK, lawyers or law firms for the handling of legal matters, financial advisers for the conduct of finance and accounting operations, and domestic or foreign organisations/consultants/business partners/collaborators/suppliers with which we have a contractual relationship and from which we receive assistance/support/consultancy services in order to carry out the medical, financial, social media, promotional and similar activities of the practice, within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the Law.
Your Rights Under the Law and Applications to the Data Controller
Pursuant to Article 11 of Law No. 6698, you have the right to:
- Learn whether your personal data are being processed,
- Request information if your personal data have been processed,
- Learn the purpose of processing and whether the data are used in accordance with that purpose,
- Know the third parties in Turkey or abroad to whom your personal data are transferred,
- Request the correction of your personal data if they are incomplete or inaccurately processed,
- Request the deletion or destruction of your personal data under the conditions set out in Article 7 of Law No. 6698, and request that the actions taken in this respect be notified to the third parties to whom your personal data have been transferred,
- Object to a result to your detriment arising from the analysis of the processed data exclusively by automated systems,
- Claim compensation for damages if you suffer harm due to the unlawful processing of your personal data.
You may submit your applications regarding the rights listed above by completing the “Application Form to the Data Controller under the Law on the Protection of Personal Data”, available on our website www.serkanbariskan.com and at the Data Controller’s premises, and:
- Delivering a signed copy in person or sending it via a notary public to Çamlık Caddesi, Kınıklı Cd. No:76 D:Kat 1, 20150 Denizli, Türkiye,
- Sending it to [email protected] with a secure electronic or mobile signature, via a registered electronic mail (KEP) address, or via the e-mail address registered in our system.
Acknowledgement
Pursuant to Article 10 of the Law titled “Data Controller’s Obligation to Inform”, I have read and understood this Information Notice prepared about by whom and for what purpose my personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal grounds of collection, and my rights under Article 11 of the Law, and I have been informed in detail on these matters by Op. Dr. Serkan Barışkan, as the data controller, or by the person(s) authorised in this respect. I have understood the matters set out in this Information Notice and I consent to them.
Patient Explicit Consent Form on the Protection of Personal Data
Under Law No. 6698 on the Protection of Personal Data, I have read and understood the Information Notice prepared by the Data Controller regarding by whom and for what purpose my personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal grounds of collection, and my rights under the Law, and I have been informed in detail about the process of protecting my personal data by the data controller or the authorised person(s) appointed for this purpose.
In this context, I consent to my personal data and special categories of personal data, as well as the personal and special categories of personal data to be provided by my relative(s) where applicable, being, by the Data Controller, for the purposes set out in the Patient Information Notice on the Protection of Personal Data:
- Recorded,
- Processed,
- Stored,
- Shared,
- Modified,
- Updated,
- Periodically reviewed,
- Reorganised,
- Classified,
- Retained,
- Transferred to the business partners listed in the Information Notice prepared by the Data Controller, to authorised public institutions and organisations, to companies from which support services are received in order to carry out activities, to relevant persons/institutions and organisations within the framework of legal obligations and restrictions, to the lawyers of the Data Controller/practice, and, where requested under the relevant legislation, to judicial authorities or law enforcement,
- Transferred abroad in order to fulfil the purposes set out in the Information Notice prepared by the Data Controller,
and I declare that I have been informed and enlightened on the subject in a manner leaving no room for doubt, and I give my approval with my explicit consent.