Personal Data Protection Law

INFORMATION TEXT ON PROCESSING PERSONAL DATA

This information text has been prepared in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK” and the European Union General Data Protection Regulation (“GDPR” included in the Turkish Law legislation, in order to inform data owners about the procedures and principles regarding the processing of Personal Data belonging to patients/clients who apply to the clinic operating under the ownership of Prof. Dr. Arda LEMBET.

Providing the security of the Personal Data of patients/clients is one of the primary goals of Prof. Dr. Arda LEMBET. Therefore, in order to process the Personal Data of patients/clients securely and to prevent any unlawful access or leakage to these data, the necessary security measures are taken by Prof. Dr. Arda LEMBET in accordance with the current legislation.

DATA CONTROLLER

Your Personal Data will be processed by Prof. Dr. Arda LEMBET, operating at the address “Bağdat Caddesi 225 Palmiye İş Merkezi 3. Kat 34730 Göztepe/Kadıköy/İstanbul” within the scope of KVKK numbered 6698. Prof. Dr. Arda LEMBET. is considered as the “Data Controller” within the scope of KVKK and the “Data Controller” within the scope of GDPR.

Prof. Dr. Arda LEMBET has contracted with a law firm with Personal Data Protection Expertise as the “Data Protection Officer” within the scope of GDPR, and the Compliance Process Regarding the Protection of Personal Data within the scope of KVKK and GDPR within the clinic has been carried out under the consultancy and guidance of the expert law firm, with the responsibility of implementation belonging to the Data Controller.

YOUR PERSONAL DATA TO BE PROCESSED

Your Personal Data specified below will be processed by Prof. Dr. Arda LEMBET in accordance with the basic principles set forth in Article 4 of the KVKK and Article 5 of the GDPR, in accordance with the Personal Data Processing Conditions and Purposes specified in Articles 5 and 6 of the KVKK and Articles 6 and 9 of the GDPR, and within the scope of the purposes set forth in this Disclosure Text; in a lawful manner, in connection with the purpose of processing, limited and proportionate, observing the principle of justice and transparency, in an accurate and up-to-date manner, by taking all kinds of technical and administrative measures foreseen in the legislation in order to ensure data security.

1-YOUR IDENTITY INFORMATION: Your name, surname, T.R. Identity Number and/or Passport Number and/or Temporary T.R. Your ID Number, ID information, passport information, place and date of birth, marital status, gender, profession, signature and other identity data that can identify you.

2-YOUR CONTACT INFORMATION: Your address (residence/workplace), telephone number (your home/workplace landline and/or mobile phone numbers you have reported), e-mail address, IP address, social media accounts and other communication data.

3-YOUR HEALTH INFORMATION: Your blood type, laboratory and imaging results, tests, allergies, chronic diseases, venereal diseases, infectious diseases, data regarding previous surgeries/operations, medications you use regularly, information regarding Covid-19 disease, medical treatments, prescription information, skin analysis data, body measurement analysis data, health-harming habits and other health data required for the treatments and applications to be applied to you.

4- YOUR PHOTO AND VIDEO IMAGES AND VOICE DATA: Your image and voice recording data in photos and/or videos recorded before, during and/or after medical procedures, and your image and voice data recorded by security cameras under closed circuit recording for the purpose of ensuring workplace security.

5- YOUR FINANCIAL INFORMATION: Your bank account number, IBAN number, credit card information, billing and invoice information and other financial data.

6- YOUR TRANSFER AND ACCOMMODATION INFORMATION: If you are a Health Tourist coming within the scope of International Health Tourism, your transfer information, round-trip flight ticket information, hotel accommodation information.

FOR WHAT PURPOSES IS YOUR PERSONAL DATA PROCESSED

Your Personal Data; To be able to create a patient file, to carry out your examination, medical diagnosis, treatment and care services, to carry out your check-ups after the medical diagnosis and treatment processes, to manage the complication processes that may occur, to communicate with you one-on-one, to manage the appointment processes, to carry out patient satisfaction and demand management, to fulfill legal and contractual obligations, to preserve the information regarding your health data that must be kept in accordance with the relevant legislation within the specified periods, to request from other relevant specialist physicians when necessary in order for your treatment to be carried out correctly.

In order to receive consultation services, to fulfill legal obligations in accordance with the legislation within the scope of health tourism, to plan transfer, accommodation, and interpreter services for patients/clients coming within the scope of health tourism, to announce innovations regarding medical treatment and practices, to inform 3rd parties medically about the applied medical procedure, to plan and manage health services and financing, to ensure workplace safety, to fulfill responsibilities arising from the legal relationship established between the doctor and the patient, to fulfill financial and administrative obligations, to ensure technical and commercial security and to fulfill public obligations, Prof. Dr. Arda LEMBET processes your Personal Data in accordance with KVKK and GDPR.

Your Personal Data may be processed by Prof. Dr. Arda LEMBET will process it within the scope of KVKK and GDPR:

• Your Identity Data; will be processed in order to carry out examination, preventive medicine, medical diagnosis, treatment and care services, to create a patient file, to perform patient satisfaction and demand management, to plan the transfer, accommodation and interpreter services of patients/clients within the scope of Health Tourism.

• Your Contact Information; will be processed in order to carry out your checks after medical diagnosis and treatment processes, to manage appointment processes and may also be processed, provided that you give your explicit consent, to introduce, inform and announce innovations regarding medical treatment and practices and to congratulate and celebrate on special occasions.

• Your Health Information; It will be processed in order to successfully perform your medical treatments and medical aesthetic applications, to receive consultation from another specialist physician if deemed necessary during your treatment process, to create a patient file, to preserve the information regarding your health data that must be stored in accordance with the relevant legislation within the specified period, and to fulfill the legal obligations within the scope of the current Health Law and Health Tourism Legislation.

• Your Photo, Video and Voice Recording Information; It will be processed by Prof. Dr. Arda LEMBET in order to observe and manage the treatment process, to ensure workplace safety, and also, provided that you give your explicit consent, it may be processed for the purpose of informing 3rd parties about the medical procedure applied to you and to make medical promotions.

• Your Financial Data; It will be processed for the purpose of checking your payment and issuing invoices and refunding any excess fees.
• Your Transfer and Accommodation Information; will be processed for the purpose of planning the transfer and accommodation services of patients/clients coming within the framework of health tourism.

Your personal data specified above will be processed in accordance with the purposes and legislation specified above in order to perform your medical treatment and fulfill the obligations related to your treatment. If you do not provide your relevant personal data, Prof. Dr. Arda LEMBET, who will provide services in your medical treatment, will not be able to fulfill the legal obligations undertaken and your treatment and/or recovery processes will not be carried out successfully.

METHOD OF COLLECTION OF PERSONAL DATA

Your Personal Data, Depending on the health service provided by Prof. Dr. Arda LEMBET;

• For examination and treatment purposes, Prof. Dr. By coming to Arda LEMBET and submitting your health reports, laboratory and imaging results, tests, health reports and statements regarding your health data so that a medical evaluation can be made regarding the treatment to be applied to you,

• By filling out the “Patient Information and Consent Form” regarding the treatment to be applied to you by Prof. Dr. Arda LEMBET,

• By visiting Prof. Dr. Arda LEMBET’s corporate website (https://drardalembet.com) and filling out the communication form on this page,

• By sending electronic mails to Prof. Dr. Arda LEMBET’s corporate e-mail address ([email protected]),

• By Prof. Dr. By means of photo/video recordings recorded before, after and/or during the medical procedure applied to you by Arda LEMBET,

• Upon your request and when necessary; In order for your online diagnosis and checks to be made by Prof. Dr. Arda LEMBET via remote access, you may accept their Privacy Policies and Foreign Transfer Principles and receive service from remote connection application service providers (whatsapp/zoom.us/facetime/skype/messa)nger/google/instagram/facebook etc.) and through your written/voice/visual (photo and/or video recording) messages you send and your online voice/video calls you establish through these applications,

• By sending direct messages to the profile accounts of Prof. Dr. Arda LEMBET on social media accounts (instagram, youtube, facebook, twitter, linkedin etc.) whose servers are located abroad, of which you are currently a user by accepting their Privacy Policy and Foreign Transfer Policy, and/or by commenting on their posts,

• By accepting their Privacy Policy and Foreign Transfer Policy, and through social media accounts (instagram, youtube, facebook, twitter, linkedin, google etc.) whose servers are located abroad, of which you are currently a user by accepting their Privacy Policy and Foreign Transfer Policy, and through Prof. Dr. Through the information you have transferred by allowing it to be processed automatically through panels such as “contact us” or “get information” in the promotions and advertisements made by Arda LEMBET,

• In case you want to join the existing wireless internet network (wi-fi) belonging to Prof. Dr. Arda LEMBET as a guest user, through log-recording devices (firewall) used within the scope of technical measures taken in accordance with the legislation,

• Within the scope of Prof. Dr. Arda LEMBET’s legitimate interest, through security cameras with closed-circuit recording, voice recording feature, for the purpose of ensuring workplace security,

will be collected and processed in accordance with the KVKK and GDPR in order for Prof. Dr. Arda LEMBET to fully and properly fulfill its contractual and legal obligations during examination, medical diagnosis, treatment and care services.

PURPOSE, METHOD AND LEGAL REASON FOR PROCESSING YOUR PERSONAL DATA

Your Personal Data may be processed by •     Prof. Dr. Arda LEMBET’s authorized real or legal persons as “Data Processor/Processor”; by recording verbally, in writing, by camera and photograph, by keeping records in physical and electronic environment with necessary technical and administrative security measures, and by obtaining your explicit consent in cases stipulated by the relevant provisions of KVKK and GDPR.

CIRCUMSTANCES WHERE YOUR EXPRESS CONSENT DECLARATION MUST BE OBTAINED

According to GDPR Article 6/1/a and KVKK Article 5/1, your Personal Data may be processed only by obtaining your explicit consent in the cases specified below;

• Prof. Dr. Sending you SMS messages and/or e-mails and establishing mobile communication for the purpose of introducing, announcing and informing you about innovations in medical services provided by Arda LEMBET will only be possible with your explicit consent.

• Sharing your photographs and/or video recordings taken before, during and/or after a medical procedure in order to observe the development of the treatment on Prof. Dr. Arda LEMBET’s social media accounts (instagram, youtube, facebook, twitter, linkedin etc.) and corporate websites will only be possible with your explicit consent.

• Since sharing your data through service providers whose servers are located abroad will be considered as “transfer abroad” and there is an “explicit consent requirement” for transfer abroad, your explicit consent will be obtained in such cases.

However, in the following cases, Prof. Dr. Since there will be no overseas transfer by Arda LEMBET, YOUR EXPRESS CONSENT WILL NOT BE REQUIRED, YOUR EXPRESS CONSENT WILL BE OBTAINED BY THE SERVICE PROVIDER YOU ARE A USER OF;

• By accepting his Privacy Agreement and International Transfer Principles, by using service providers whose servers are located abroad (whatsapp/zoom.us/facetime/skype/messanger/google/instagram   /facebook etc.) that you are currently a user of, in case you send written/voice messages and/or photo/video recordings to Prof. Dr. Arda LEMBET or make an audio/video call or request to receive remote examination/diagnosis service by being contacted in this way; You accept the policies of the mentioned applications and you will be able to receive remote examination/diagnosis service from Prof. Dr. You have accepted the processing of your Personal Data and Special Personal Data that you share with Arda LEMBET in accordance with the KVK Information Text and Privacy Principles to be sent to you through the application belonging to Prof. Dr. Arda LEMBET and you have given your express consent to the relevant service provider for the transfer of your data abroad in accordance with the policies you have previously accepted for these applications whose servers are located abroad.

• In cases where you have accepted their Privacy Policy and International Transfer Principles and requested to be contacted through electronic mail service providers (Hotmail, gmail, yahoo etc.) whose servers are located abroad that you are currently a user of;You have accepted that Prof. Dr. Arda LEMBET will process your Personal Data and Special Personal Data shared in the messages in accordance with its own KVK Information Text and Privacy Principles and you have given your explicit consent to your mail service provider for the transfer of your data abroad in accordance with the policies you have previously accepted by these service providers whose servers are located abroad.

• In cases where you apply for advertisements and promotions published by Prof. Dr. Arda LEMBET on social media service providers whose servers are located abroad (facebook, instagram, Google, whatsapp etc.); your data, which you have accepted the Privacy and International Transfer Principles of the relevant social media service providers and allowed to be automatically processed and transferred abroad, will be transferred to Prof. Dr. Arda LEMBET by the relevant social media service provider and will be automatically processed and stored by Prof. Dr. Arda LEMBET in accordance with its own Information Text and Privacy Principles that you are currently reading. In such cases; You accept the Privacy Policy and Disclosure Text of Arda LEMBET and the processing of your Personal Data and Special Personal Data accordingly.

• If you accept their Privacy Policy and International Transfer Policy and send a direct message to the profile account of Prof. Dr. Arda LEMBET, which is currently a user of social media accounts located abroad (instagram, youtube, facebook, twitter, linkedin, etc.); You agree that Arda LEMBET will process your data in accordance with its own KVK Information Text and Privacy Principles.

SITUATIONS WHERE YOUR DATA MAY BE PROCESSED WITHOUT EXPRESS CONSENT DECLARATION:

In accordance with GDPR article 9/2/h and KVKK article 6/3;

• In order to carry out examination, medical diagnosis, treatment and care services, Prof. Dr. Arda LEMBET, who is under a confidentiality obligation as per the Law, will process your Health Data, which is considered as Special Personal Data, without your explicit consent.

In accordance with GDPR article 6/1/b and KVKK article 5/2/c;

• In order to carry out your checks after medical diagnosis and treatment processes, to be able to communicate with you one-on-one and to manage appointment processes, Prof. Dr. Your Personal Data will be processed by Arda LEMBET without your explicit consent.

In accordance with GDPR article 6/1/f and KVKK article 5/2/f, based on our legitimate interests;

• In order to ensure patient satisfaction and request management, Prof. Dr. Arda LEMBET will process your Personal Data without your explicit consent.

In accordance with the legal obligations in accordance with GDPR article 6/1/c, KVKK article 5/2/a and KVKK 5/2/ç, your Personal Data will be processed without your explicit consent in the following cases;

• Creating a patient file.
• Preserving information regarding your health data that must be stored in accordance with the relevant legislation.
• Checking your fee payments and issuing invoices.
• Performing tax payments.
• Performing obligations in accordance with the Ministry of Health Legislation.
• Performing obligations in accordance with the Health Tourism Legislation.
• Ensuring your data security.
• Performing legal obligations in the presence of judicial authorities.
• To fulfill administrative obligations before administrative institutions and organizations.

TRANSFER OF YOUR PERSONAL DATA AND FOR WHAT PURPOSE, TO WHOM IT WILL BE TRANSFERRED

Your Personal Data collected in accordance with the conditions and purposes within the scope of Personal Data Processing Conditions specified in Articles 5 and 6 of the KVKK No. 6698 and Articles 6 and 9 of the GDPR; In accordance with Articles 8 and 9 of the KVKK and Articles 45 and 49 of the GDPR, Prof. Dr. Arda LEMBET’s purposes are to carry out and develop examination, medical diagnosis, treatment and care services, to receive consultation services from other specialist physicians when necessary, to fulfill administrative obligations related to health tourism legislation, to plan transfer, accommodation and translation services of patients coming within the framework of health tourism, to communicate with patients, to manage control appointment processes, to plan and manage health services and financing, to fulfill responsibilities arising from the legal relationship established between the doctor and the patient, to fulfill financial, legal and administrative obligations, to ensure technical and commercial security and to fulfill public obligations, to promote the offered medical services; to the extent sufficient for the realization of the purpose, by signing the necessary confidentiality agreements, by providing all administrative and technical security measures in accordance with the legislation, and by providing the 3rd party companies specified below.

may transfer to individuals and institutions.

In this context, your Personal Data processed by Prof. Dr. Arda LEMBET;

• To other specialist physicians for consultation purposes,
• To insured employees,
• To suppliers,
• Credit advisors, tax and finance advisors and auditors
• Legal advisors
• Database (server) providers
• “Clinical Management Software Program” service providers
• Web consultants
• Translators
• Data Protection Officers
• IT consultants
• Tourism agencies
• Public institutions and organizations authorized by law
• Will be transferred to judicial authorities.

PERSONAL DATA PROCESSING PERIOD

Your Personal Data, Prof. Dr. It will be stored by Arda LEMBET to the extent and for as long as it is legally obliged to store it. Documentation and storage obligations arise from local norms regarding trade, tax and health legislation. The table below shows the storage periods for your Personal Data.

AGE LIMIT OF DATA SUBJECTS WITHIN THE FRAMEWORK OF LEGISLATION

Within the scope of KVKK, patients/clients can give their personal consent for the processing of their personal data provided that they are at least 18 years old. The consent of patients/clients who are under this age limit must be given by their legal representatives.

Within the scope of GDPR, citizens of European Union countries and patients/clients residing in European Union countries can give their personal consent for the processing of their personal data provided that they are at least 16 years old or the age limit required in their country. The consent of patients/clients under this age must be given by their legal representatives.

WITHDRAWAL OF CONSENT

If you give consent to Prof. Dr. Arda LEMBET regarding the processing of your Personal Data, we hereby inform you that you may withdraw the consent you have given for the purposes specified above at any time in accordance with GDPR 6/1/a and KVKK 5/1. Your consent will be withdrawn if you send your declaration of withdrawal of consent to our contact address specified below, as specified below.

RIGHTS OF DATA SUBJECTS UNDER GDPR

As Data Subjects, your Personal Data is also protected under GDPR. In cases where the GDPR falls within its jurisdiction (European Union citizens or residents of European Union countries), Data Subjects have the following rights;

• Right of Access (GDPR Article 15): The data subject has the right to request from Prof. Dr. Arda LEMBET whether or not personal data concerning him/her is processed. The Data Owner has the right to verify by contacting Dr. Arda LEMBET and to learn the details in GDPR Art. 15 in case of processing of personal data.

• Right to Rectification (GDPR Art. 16):The Data Owner has the right to have his/her personal data in his/her possession and changed by contacting Prof. Dr. Arda LEMBET corrected at any time.

• Right to Erasure (GDPR Art. 17):The Data Owner has the right to request the deletion of his/her personal data in his/her possession by Prof. Dr. Arda LEMBET. In case of occurrence of the issues specified in GDPR Art. 17, Prof. Dr. Arda LEMBET will delete your personal data without delay.

• Right to Restrict Processing (GDPR Article 18):

• In case Data Owners object to the currency of their Personal Data, they have the right to request the restriction of the use of the data until the accuracy of the Personal Data is confirmed by Prof. Dr. Arda LEMBET.
• In cases where the Data Owner requests the deletion of their Personal Data due to the illegality of the processing activity, they have the right to request the restriction of the use of the data until the request is fulfilled.
• In cases where Prof. Dr. Arda LEMBET no longer needs their personal data for the purpose of processing, the Data Owner has the right to request the restriction of the use of their data.
• In cases where Data Owners object to the processing activity in accordance with Article 21/1 of the GDPR, Prof. Dr. Arda LEMBET has the right to request the restriction of the use of his/her data until it is verified whether the legitimate reasons for processing the data outweigh the legitimate reasons of the Data Owner.

• Right to Data Portability (GDPR Article 20): The Data Owner has the right to request the transfer of his/her Personal Data held by Prof. Dr. Arda LEMBET to another controller at any time, if technically feasible. However, this right may be exercised when data processing is based on consent or in cases required by contract.

• Right to Object (GDPR Article 21):

• The Data Subject has the right to object to the processing of Personal Data, including profiling, within the scope of points (e) or (f) of Article 6(1) GDPR, on grounds related to his/her particular situation. Prof. Dr. Arda LEMBET cannot process Personal Data unless it can demonstrate a strong legitimate reason that overrides the Data Owner’s interests, rights and freedoms or the establishment, exercise or protection of a legal right.

• In cases where the Data Owner’s Personal Data is processed for direct marketing purposes, the Data Owner has the right to object at any time to the processing of his/her Personal Data for this purpose, including profiling to the extent that it is related to such direct marketing.

• If the Data Owner objects to the processing of Personal Data for direct marketing purposes, the Personal Data will no longer be processed for such purposes.

RIGHTS OF DATA OWNERS IN ACCORDANCE WITH LPPD

The rights of natural persons whose Personal Data is processed pursuant to Article 11 of LPPD are as follows;

• To learn whether personal data has been processed,
• To request information if personal data has been processed,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request correction of personal data if it is processed incompletely or incorrectly and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
• To request deletion or destruction of personal data if the reasons requiring processing are eliminated despite the fact that it has been processed in accordance with the provisions of the KVKK and other relevant laws and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
• To object to the emergence of a result against the person by analyzing the processed data exclusively through automated systems,
• To request compensation for the damages incurred due to the processing of personal data against the law requesting the removal of the above-mentioned rights.

In case you have any rights or requests that you wish to exercise from among the rights listed above; You may submit your written application, in which you clearly and understandably state which of the articles regarding the rights of the data owner in the GDPR and the rights specified in Article 11 of the KVKK you wish to exercise, in a signed form and accompanied by documents proving your identity, in person by coming to the branch address “Bağdat Caddesi 225 Palmiye İş Merkezi 3. Kat 34730 Göztepe/Kadıköy/İstanbul” which is also listed on the corporate websites of Prof. Dr. Arda LEMBET, by hand, by sending it through a notary or by signing it with a secure e-signature and sending it to the e-mail address [email protected] or by other methods specified in the KVKK. In your applications, you may include your name-surname, signature, T.R. Identity Number/Passport Number/temporary T.R. Identity Number, residence or workplace address, e-mail address, telephone and fax number, the elements of the request are mandatory in accordance with the “Communiqué on the Procedures and Principles of Application to the Data Controller”.

Prof. Dr. Arda LEMBET will finalize the request free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. However, if the process requires an additional cost, the fee determined by the Personal Data Protection Board will be charged.

CONSENT and APPROVAL

When you read and accept this Information Text, you are deemed to have accepted, declared and undertaken that you have full and complete information about the data processing process carried out by Prof. Dr. Arda LEMBET, that you have learned your rights stipulated by the KVKK and GDPR, and that you have freely and freely consented to the processing of your Personal Data and Special Personal Data by Prof. Dr. Arda LEMBET within the scope of this Information Text.

You have the right not to accept the Information Text after reading it.

Prof. Dr. Arda LEMBET, is reporting as “DATA CONTROLLER” within the scope of KVKK and “CONTROLLER” within the scope of GDPR.

Best regards.