GDPR

7 SAĞLIK MEDİKAL ANONİM ŞİRKETİ
DATA SUBJECT/ OWNER
EXPLICIT CONSENT DECLARATION FORM

I have read and understood, over a wide period of time, the entire Clarification Text on the Personal Data Protection Law of 7 SAĞLIK MEDİKAL ANONİM ŞİRKETİ regarding the processing of my personal data, which I shared with 7 SAĞLIK MEDİKAL ANONİM ŞİRKETİ. In addition, I was informed about which personal data are processed and how, and I was informed that I can withdraw my express consent at any time without any limitations.

Within the scope of KVKK and GDPR and other relevant legislation, in line with the purposes set forth in article “b” titled “What Your Personal Data Will Be Processed and For What Purpose The Personal Data Will Be Processed” of “7 SAĞLIK MEDİKAL ANONİM ŞİRKETİ Clarification Text on the Personal Data Protection Law”, KVKK article 4 and Transfer of personal data specified in the relevant articles of KVKK and GDPR,

that my personal data will be processed – recorded – stored – stored – classified – transferred to prosecutors’ offices, courts and all kinds of judicial authorities in accordance with the legislation, if requested in matters related to public security and legal disputes that may arise – transferred to authorized public institutions and organizations within the scope of the above-mentioned purposes in order to provide information to the relevant public officials – transferred to the sent institutions and organizations in case of a referral – transferred to the health institutions and organizations that you cooperate with for medical diagnosis and treatment – transferred to laboratories, to business partners, to company partners – transferred to private insurance companies, to law firms, to financial advisors – and officials and transferred to all consultants within the scope of the third parties you receive consultancy,

in accordance with the “General Principles” specified in the content of Article 5 of the GDPR and the provisions of Articles 5 and 6 of the KVKK and the “Conditions and Purposes of Processing of Personal Data” specified in the Articles 6 and 9 of the GDPR. I expressly consent to the transfer and process of the data within the framework of the terms and conditions of my own free will, as a result of detailed reading and information.

Clarification Text on the Personal Data Protection Law

7 SAĞLIK MEDİKAL ANONİM ŞİRKETİ (will be referred to as “THE COMPANY”) takes the highest possible security measures in order to ensure that your personal data is collected, stored and shared in accordance with the law and to protect your privacy.

Our aim is to inform you in the most transparent way about the way your personal data is collected, the purposes of processing, shared persons, legal reasons and your rights, taking into account your satisfaction in accordance with The Personal Data Protection Law No. 6698 (KVKK) and General Data Protection Regulation (GDPR).

This clarification text aims to enlighten the data owners about the procedures and principles regarding the processing and storage of personal data of patients, clients, workers and other persons who apply or will apply to THE COMPANY.

a) The Data Processor/ Controller

In accordance with the KVKK and GDPR, your personal data will be collected and processed by THE COMPANY operating at the address Mecidiyeköy Mah. Büyükdere Cad. Stad Han. Blok No:85 İç Kapı No:7 Şişli/ İSTANBUL, with tax identification number 0012328575 established in accordance with Turkish Law as the data controller, within the scope described below.

b) What Your Personal Data Will Be Processed and For What Purpose The Personal Data Will Be Processed
Your personal and private data specified below, in accordance with the principles set forth in the KVKK and GDPR, in line with the conditions and purposes of processing personal data and the scope of the purposes stated in the clarification text; it is processed by THE COMPANY by taking the administrative and technical measures in the legislation in a legal, up-to-date, accurate, transparent, measured, data security manner.

1- Within the scope of your Identity Information: Your name, surname, TR identity number, passport number or temporary TR identity number, your Blue Card Number if any, and your residence-work-citizenship information for similar foreign nationals, your place and date of birth, your marital status, gender, signature, insurance number and other relevant identification data by which we can identify you,

2- Within the scope of your Contact Information: Your address, telephone number, e-mail address and other relevant contact data, your voice call records kept by customer representatives or patient services in accordance with call center standards, your personal data obtained when you contact THE COMPANY and its employees via e-mail, letter or other related means,

3- Within the scope of your Accounting-Based Information: Your financial data such as your bank account number, IBAN number, credit card information, billing information, your private health insurance data for the purpose of financing and planning health services, and your Social Security Institution data,

4- Your camera footage images available in THE COMPANY for security and inspection purposes, and your images and audio data in the photos or videos recorded before, after or during a medical, aesthetic, beauty or health-related procedure, your vehicle license plate information in case of parking,

5- Within the scope of your Health Information: All your current and past ailments, laboratory results, test results, examination data, appointment information, check-up information, epicrisis report information, information about alcohol use and ailments, imaging results, complaint and story information, vaccination information, surgery, your operation information, your personal data regarding all kinds of health and sexual life obtained during or as a result of medical diagnosis, treatment and care services, including but not limited to your prescription information,

6- In the case of a job application to THE COMPANY, all your other personal data, including the CV, which is mandatorily provided by THE COMPANY in this regard, and if you are THE COMPANY employee or related employee, all your personal data related to your service contract and work inclination,

7- If you are a Health Tourist coming to THE COMPANY in line with International Health Tourism: your transfer information, flight ticket round-trip information, hotel accommodation information will be processed.

Your personal data obtained by THE COMPANY can be fully or partially recorded, stored, , changed, updated, periodically checked, rearranged, classified, maintained for the period required for the purpose for which they are processed or stipulated in the relevant law, for the following purposes:

– Purpose of providing the products and services of THE COMPANY, fulfilling our obligations to you, arranging records and documents, and fulfilling information storage, reporting, informing, tax and other obligations stipulated by local and international legal regulations.

– To protect public health – to carry out preventive medicine, medical diagnosis, treatment and care services – to plan and manage health services and financing – to inform you about the appointment if you make an appointment – to carry out risk management and quality improvement activities – to deal with private insurance companies within the scope of financing health services sharing the information obtained – developing medical diagnosis, treatment and care services – planning and managing health services and financing – increasing patient satisfaction, researching – analyzing your use of health services and storing your health data in order to develop and improve the health services offered by THE COMPANY – to be able to plan the transfer and accommodation services of a Health Tourist coming to THE COMPANY in line with International Health Tourism,

– To comply with internal policies and procedures, including those linked to auditing, finance and accounting, invoicing and collections, computing systems, data and website hosting, business continuity and records, document and print management,

– To communicate with you for information processing requirements, its system structure, the necessity of information processing support services received, and to provide you with the necessary information regarding these services and products,

– Measuring and increasing customer satisfaction – complaint management, receiving your opinions and suggestions about new services and products – receiving your problem or error notifications – informing you about products and services, complaints and requests,

– Processing your payment transactions – suggesting products and services that may be of interest to you – communication, optimization, auditing, risk management and control, promotion, analysis, identifying interests, scoring, profiling,

-To comply with the obligations of sharing information, storing information, reporting and informing stipulated by Republic Of Turkey Ministry of Health and relevant public institutions – fulfilling the requirements of the contracts – fulfilling the legal obligations of THE COMPANY regarding the use of these services,

-For the purposes of personal data processing conditions set forth in the KVKK and GDPR, in order to comply with applicable laws and regulatory obligations, including anti-money laundering and anti-terrorism laws, to comply with the legal process, and to examine, evaluate and respond to requests from official and state authorities.

c) To Whom and For What Purpose the Processed Personal Data Can Be Transferred

Your personal data collected; carrying out any medical application or operation or post or pre-care services by THE COMPANY – Obtaining consultation services from a specialist when necessary – Fulfilling administrative obligations regarding International Health Tourism – Accommodation of Health Tourist consultants or patients coming in line with International Health Tourism, carrying out and planning transfer, interpreter and related services – communicating with patients – planning and managing health services and financing – Managing THE COMPANY activities in line with the International Health Tourism Promotion legislation – Fulfilling the responsibilities arising from the legal relationship established between the doctor and the patient – financial, technical, legal and fulfillment of all administrative obligations – the realization of the other objectives mentioned above can be transferred to the following in a limited way;

– THE COMPANY’s business partners – suppliers – shareholders – affiliates – our other business partners with whom we cooperate to develop or carry out health services for the above-mentioned purposes – other third parties – Electronic Health Records systems in order to carry out the necessary work and ensure the security in accordance with the purpose of processing,

– To persons or organizations permitted by the Tax Procedure Law, the Social Security Institution legislation, the Court of Accounts, the Law on the Prevention of Laundering of Proceeds of Crime, the Law on the Prevention of Money Laundering, the Turkish Commercial Code, the Code of Obligations and other legislation,

– To legally authorized public institutions and organizations, administrative and legal authorities, private insurance companies,

– To foreign companies and affiliates.,

– To third parties from whom we consult, including our authorized representatives, attorneys, tax and finance or legal advisers and auditors,

– To real or legal persons – program partner institutions and organizations – institutions that we have contracted to send the messages we send to our customers, from whom we receive services and cooperate in product and service comparison, analysis, evaluation and the realization of the above-mentioned purposes.

d) Method and Legal Reason for Personal Data Collection

Your personal data is applied through THE COMPANY General Directorate, through contracted websites; The COMPANY, in particular, with other institutions that we provide or receive support services to, real or legal persons with whom transactions are made under all kinds of legislation or contracts, verbal, written or electronic media such as our website and mobile application, call centers, social media accounts or other channels that may occur in the future, it is collected by THE COMPANY for the purposes stated above within the framework of the legal legislation, within the scope of the performance of the contract.

e) Environments Where Personal Data Is Stored

Personal data stored with our company are kept in a recording environment that is suitable for the nature of the data and our legal obligations. The recording media used for the storage of personal data are generally printed media, local digital media, cloud environments, and electronic media. However, some data may be kept in a different environment than the ones shown here, due to their special qualities or our legal obligations. In any case, our company acts as a data controller and processes and protects personal data in accordance with the legislation, Personal Data Processing, Protection and Privacy Policy and this Personal Data Retention and Disposal Policy.

f) Storage of Personal Data

Your personal data will be stored for the period or to the extent that our company is obliged to keep it in accordance with the KVKK, GDPR and the Personal Data Processing Protection Policy and will be destroyed by taking into account the provisions and periods in the relevant legislation.

g) Personal Data Storage Periods

1- The storage period for the Identity Information and Contact Information is 10 years from the end of the service provided.

2- The storage period for Health Information is 1 year from the end of the service provided.

3- The storage period for Employee Personal Registry File, Enforcement File, Court File Records, Records Related to Social Security Legislation, Records Related to Occupational Health and Safety Legislation, Records Regarding Service Providers is 10 years from the end of the service relationship.

4- The storage period for Other Records Retained under the Labor Law is 5 years from the end of the service relationship.

5- The storage period for financial information is 5 years.

6- The storage period for internal correspondence, e-mail correspondence, log record data is 10 years.

7- The storage period for Camera Records and Visitor Data is 1 month following the end of the activity.

8- The storage period for Photo, Video and Audio Recording Information is 2 years.

h) Circumstances Requiring Explicit Consent Statement

Pursuant to article 5 of the KVKK and article 6 of the GDPR, the personal data of the data owner can be processed in the following cases, provided that the explicit consent of the data owner is obtained. We remind you that if you give your consent to THE COMPANY regarding the processing of your Personal Data, you can withdraw your consent at any time in accordance with the above-mentioned purposes, pursuant to Article 6 of GDPR and Article 5 of the KVKK.

1- Sending messages or e-mails to you through the applications for the purpose of promoting and informing you about the innovations related to the services offered by THE COMPANY and mobile communication can only be carried out by obtaining your express consent.

2- Sharing your photos or video recordings, taken before – after – during the any medical, aesthetic, beauty or health-related procedure, in order to observe the status of the relevant transaction, on social media user accounts and corporate websites of THE COMPANY, can only be done with your express consent.

3- As a result of the sharing of your data through service providers whose servers are located abroad, your express consent will be required in such cases, since explicit consent is required for this sharing abroad. In the following cases, your explicit consent will not be sought, since there will be no international transfer by THE COMPANY, and your explicit consent will be deemed to have been obtained by the service provider of which you are a user;

4- If you send a written or audio message, photo or video recording to THE COMPANY or to the service providers used by THE COMPANY by accepting their Confidentiality Agreement and International Transfer Policy, using the service providers whose servers you are a user and whose servers are located abroad, and social media accounts, If you make a video call and request to receive remote examination diagnosis service in this way: You have accepted the processing of your Personal Data and Private Personal Data that you share with THE COMPANY through these applications in accordance with the Clarification Text on the Protection of Personal Data of THE COMPANY and the Privacy Principles, and through the applications mentioned by you, You have given your consent to be contacted and given your explicit consent to the aforementioned applications for the transfer of your data abroad in accordance with the policies you have previously accepted of these applications whose servers are located abroad.

5- If you accept their Privacy Policy and International Transfer Policy and request to be contacted via e-mail service providers whose servers you are a user and whose servers are located abroad; You expressly consent to the processing of your Personal Data and Private Personal Data shared in the messages sent to THE COMPANY in accordance with the Clarification Text on the Protection of Personal Data and the Privacy principles of THE COMPANY, and to the transfer of your data abroad in accordance with the previously accepted policies of these service providers whose servers are located abroad.

6- If you accept their Privacy Policy and International Transfer Policy and send a direct message to the profile account of THE COMPANY whose server you are a user and whose server is located abroad; You are deemed to have given your express consent for THE COMPANY to operate in accordance with the Clarification Text on the Protection of Personal Data and the principles of Confidentiality and to communicate with you through the relevant application.

i) Rights Of The Data Subject According To GDPR

If the Personal Data Subject is a citizen of the European Union or residing in the European Union country, the data subject also has the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability and the right to object, which are listed in Articles 15-16-17-18-20-21 of GDPR.

j) Rights Of The Data Subject According To Article 11 of KVKK

If you submit your requests regarding your rights as personal data owners through the methods set out below, THE COMPANY will finalize the request as soon as possible and within thirty days at the latest, depending on the nature of the request. Up to ten pages will not be charged for a reply. A transaction fee of 1 Turkish Lira will be charged for each page over ten pages. If the response to the application is given in a recording medium such as a CD or Flash Memory, the fee that may be requested by our company will not exceed the cost of the recording medium.

Everyone, in connection with herself/himself, has the right to;

a) Learn whether or not her/his personal data have been processed;

b) Request information as to processing if her/his data have been processed;

c) Learn the purpose of processing of the personal data and whether data are used in accordance with their purpose;

d) Know the third parties in the country or abroad to whom personal data have been transferred;

e) Request rectification in case personal data are processed incompletely or inaccurately;

f) Request deletion or destruction of personal data within the framework of the conditions set forth under article 7 of KVKK;

g) Request notification of the operations made as per indents (e) and (f) to third parties to whom personal data have been transferred;

h) Object to occurrence of any result that is to her/his detriment by means of analysis of personal data exclusively through automated systems;

i) Request compensation for the damages in case the person incurs damages due to unlawful processing of personal data by applying to the data controller.

Your request regarding the exercise of your rights under the KVKK mentioned above must be made in Turkish and in writing. You can send it by using a registered electronic mail (KEP) address, secure electronic signature or notary channel. Only information about the applicant will be given in the applications, and it will not be possible to obtain information about other family members and third parties. THE COMPANY reserves the right to verify your identity before replying.
In your application;

a) Your name, surname and, if the application is written, your signature,

b) For citizens of the Republic of Turkey, your TR identity number, if you are a foreigner, your nationality, passport number or your identity number, if any,

c) Your place of residence or workplace address for notification,

ç) Your e-mail address, telephone and fax number, if any, for notification,

d) Your subject of request,

It is mandatory to be present, and if any, relevant information and documents must be attached to the application.

You can deliver your applications that you want to make in writing, by attaching the necessary documents, to the “Mecidiyeköy Mah. Büyükdere Cad. Stad Han. Blok No:85 İç Kapı No:7 Şişli/ İSTANBUL” address of THE COMPANY as the data controller, or send them through a notary public. You can also sign the application form with a “secure electronic signature” and send it to the registered electronic mail (KEP) address of the hospital. You can access the application form in Turkish Language here. In order to benefit from the application rights in the provisions of the KVKK for your applications in a foreign language, you can send it to the Company address or registered mail address with the approval of the translator.

You can also contact the COMPANY via … phone number or … e-mail address in order to get information on any subject.

According to the nature of your request, information and documents that will allow identification must be provided to us completely and accurately. In case the requested information and documents are not provided properly, there may be problems in the full and qualified conduct of the researches to be carried out by THE COMPANY based on your request. In this case, THE COMPANY declares that it reserves its legal rights. For this reason, your application should be sent completely and in a way that includes the requested information and documents according to the nature of your request.