CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL AND SPECIAL CATEGORIES OF PERSONAL DATA

This clarification text has been prepared by Göl Sağlık Hizmetleri Ticaret Limited Şirketi (“Center”) as the Data Controller. It is of utmost importance for the Center to take the necessary measures for the processing and protection of personal and sensitive personal data. With this awareness, the primary purpose of the Center is to process all kinds of personal data by protecting the privacy of patients, patient relatives and companions; personnel relatives, personnel candidates and personnel candidate reference persons, suppliers, service recipients and shareholders; in accordance with the law and in accordance with the rules of honesty, in connection with the purposes of processing, limited, measured, accurate and up-to-date, for specific, clear and legitimate purposes. Within this framework, the Center processes your personal and sensitive personal data under the conditions detailed below and within the limits determined by the specified legislation.

According to the Law No. 6698 on the Protection of Personal Data (“Law”), data processing refers to all types of operations performed on data starting from the first acquisition of data by fully or partially automatic means or by non-automatic means, provided that it is part of any data recording system.

PERSONAL AND SPECIAL CATEGORIES OF PERSONAL DATA PROCESSED BY THE CENTER

Personal and sensitive personal data are obtained and processed by the Center from patients receiving treatment at the Center, their relatives and companions; Center personnel candidates and reference persons in the resumes of these personnel candidates and their relatives; suppliers and service recipients who have a business relationship with the Center, as well as from the shareholders of the Center through verbal, written, visual or electronic means through call center, website, physical locations and similar channels.

In cases where you request services and/or information and documents from the Center as a patient, patient’s relative and/or companion in accordance with the Center’s field of service and activity; Personal data collected under the categories of Identity, Communication, Finance, Insurance Transactions and Professional Experience, as well as blood group, patient medical reports, including the dialysis report mandatory for hemodialysis application, test results and all kinds of Health Data and Biometric Data obtained during and as a result of the execution of examination, diagnosis, medical diagnosis, treatment, care and accompaniment services, including but not limited to, fingerprint and palm special quality personal data; Personal data of patients’ relatives and companions collected under the categories of Identity and Communication are processed.

In cases where you are a party to the contractual relationship established or to be established with the Center with one of the titles of the Center, personnel / personnel candidate and / or personnel relative, or in cases where you request any kind of service and / or information and documents offered by the Center; verbally, in writing, visually, or electronically through call center, website, physical locations and similar channels; Personal data of personnel and personnel candidates; Personal data collected under the categories of Identity, Communication, Finance, Professional Experience and Personnel, and all kinds of Health Data, including ECG and chest radiograph results to be routinely performed, obtained from the blood group and health report of the personnel; All kinds of Health Data, including blood type and ECG and chest X-ray results to be routinely performed, obtained from the health report, criminal record report, Criminal Conviction and Security Measure Data and fingerprints, which have the characteristics of Biometric Data, personal data of special nature; Health Data of the foreign substance used and health problem information provided by the relevant persons within the scope of the service contract to be concluded with the Center, and personal data of the relatives of the personnel; Personal data collected under the categories of Identity and Professional Experience.

As a result of the activities carried out by the Center, personal data of suppliers within the scope of the Identity and Contact categories; personal data of service recipients within the scope of the Identity, Contact, Customer Transaction and Finance categories; personal data of shareholders within the scope of the Identity, Contact, Management Information and Finance categories and blood group special quality data within the scope of the Health Data category are processed.

PURPOSES OF PROCESSING PERSONAL AND SPECIAL CATEGORIES OF PERSONAL DATA

The Center processes your personal and sensitive personal data within the framework of the data economy principles stipulated in the Law and in accordance with the personal data processing conditions specified in Articles 5 and 6 of the Law, only in cases where it is necessary for the service provided, as a result of obtaining explicit consent, legal obligations and contracts to which we are a party, and in cases where the Center has a legitimate interest.

Personal and sensitive personal data are collected by the Center in accordance with the Social Security and General Health Insurance Law No. 5510, Law on the Practice of Medicine and Medical Sciences, Labor Law No. 4857, Health Services Basic Law No. 3359, Occupational Health and Safety Law No. 6331, Regulation on Dialysis Centers, Social Security Fulfillment of legal obligations within the framework of the provisions of the Health Implementation Communiqué of the Institution, Patient Rights Regulation, the contract between the Social Security Institution and the Center and other legislation regulating the health services provided by the Center, protection of public health, provision, development and improvement of health services, analyzing the use of health services, issuing invoices for the services provided, taking all necessary administrative and technical measures to ensure data security of the Center’s systems and applications, ensuring compliance with the internal policies and principles of the Center, fulfilling legal procedures, planning and managing the internal functioning of the Center and daily operations, The data is processed for the purposes of fulfilling risk management and quality improvement activities, fulfilling legal and regulatory requirements, providing necessary communication, providing the necessary information in line with the requests and audits of regulatory and supervisory institutions and official authorities, providing the most appropriate treatment service at the Center, performing, planning and financing this service, fulfilling risk management and quality improvement activities, fulfilling legal and regulatory requirements, sharing the data obtained with authorized public institutions and organizations and responding to requests, maintaining information on health data that must be kept.

The purpose of processing personal data of relatives and companions is to provide communication when necessary for the protection of patient health and the realization of treatment.

The purpose of processing personal data relating to the relatives of the personnel is to ensure communication when necessary and to make the necessary applications for the personnel to exercise their fringe benefits. The purpose of processing personal data of personnel candidates is to plan corporate communication activities and to carry out human resources processes. The purpose of processing personal data related to personnel candidate reference persons is to confirm the reference shown by the personnel candidate, to evaluate its suitability for the position applied for, to obtain and verify information about past experiences.

Personal data relating to the Center’s suppliers and service recipients are processed for the purposes of making and completing contracts for the supply of goods and services and determining authorization, and data relating to the Center’s shareholders are processed for the purposes of making the necessary official applications on behalf of the Center, carrying out management activities and contract processes.

TRANSFER OF PERSONAL AND SENSITIVE PERSONAL DATA

The Center may transfer the personal and sensitive personal data of the personal data owner to third parties by ensuring that all technical and administrative measures are taken to ensure the necessary and appropriate level of security in line with the Law, the Regulation on Personal Health Data, the Personal Data Security Guide prepared by the Personal Data Protection Authority and the decisions taken by the Personal Data Protection Board (“Board”) and the relevant health legislation and the processing purposes listed above, provided that the exemption cases in the first paragraph of Article 28 are reserved, provided that the regulations stipulated in Articles 8 and 9 of the Law are complied with.

Personal and sensitive personal data of patients are transferred to public institutions and organizations such as the Ministry of Health and its sub-units, the Pharmacists Association of Turkey and the Social Security Institution within the framework of the provisions of the aforementioned other legislation regulating the health services provided by the Center. In addition, through the software supplier company used in order to fulfill the obligations arising from the Social Security Institution service procurement contract, to the SSI and MEDULA, to the E-Nabız system, to the central health data systems of the Ministry of Health in order to fulfill the responsibilities to the Ministry as a hemodialysis center affiliated to the Ministry of Health, to the central health data systems of the Ministry of Health in order to fulfill the obligations stipulated by the SSI and the Ministry of Health. In order to fulfill its responsibilities to the Ministry, the Center transfers data to the central health data systems of the Ministry of Health, to the laboratory contracted to perform the tests required in the diagnosis and treatment processes of the patient in accordance with the obligations stipulated by the SSI and the Ministry of Health, to the medical center contracted to take and report chest radiographs, and to the health institution to which the patient will be transferred in order to carry out the transfer of the patient to another health institution. Data can be transferred to private insurance companies in order to collect the fee for the service received at the Center and to the relevant institution or organization in case the fee is collected from the institution or organization where the patient works.

Personal data belonging to patient relatives and companions may be transferred to public institutions and organizations such as the Social Security Institution and the Ministry of Health and its sub-units in order to fulfill legal obligations when necessary.

Only personal data of the personnel’s relatives, which are mandatory to be transferred, may be transferred to the Social Security Institution and relevant institutions and organizations.

Personal data of shareholders may be transferred to Social Security Institution, Ministry of Health and its sub-units, Edirne Chamber of Commerce Registry Directorate and related banks.

Personal data belonging to suppliers may be transferred to the Social Security Institution, the Ministry of Health and its affiliated sub-organizations; personal data belonging to service recipients may be transferred to the Social Security Institution.

In addition to the aforementioned, personal and special categories of personal data belonging to the data subjects may be transferred to, but not limited to, judicial units; third parties from whom services are received, including the Center’s attorneys, tax consultants, financial advisors and auditors; representatives authorized by the data subject or legal representative, if any; Center shareholders and other persons, institutions and organizations when necessary.

TRANSFER OF PERSONAL AND SENSITIVE PERSONAL DATA ABROAD

In accordance with the principles set out in the second paragraph of Article 4 of the Law, the Center may send personal and sensitive personal data of the data subjects to foreign countries that are declared to have adequate protection by the Board by obtaining their explicit consent or under the conditions stipulated in the second paragraph of Article 5 and the third paragraph of Article 6 of the Law; in the absence of adequate protection, to foreign countries where the data controllers in Turkey and in the relevant foreign country undertake adequate protection in writing and where the Board has permission, within the limits stipulated by the legislation, by taking the necessary measures; Within the scope of the legal relationship and activity with the Center, the protection of public health, preventive medicine, diagnosis, medical diagnosis, treatment and care services in accordance with the legislation in cases where data processing is mandatory for the Center to fulfill its legal obligation and for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned, In the event that it is necessary to process personal data belonging to the contracting parties for the planning and management of health services and financing and for the establishment or performance of a contract, limited to the purpose of transfer, personal and sensitive personal information belonging to the relevant persons through means such as applications, software programs, website, electronic mail system can transfer data to foreign health and insurance institutions abroad and service provider organizations that need to be shared due to medical necessity, without seeking explicit consent.

METHOD OF COLLECTION OF PERSONAL AND SPECIAL CATEGORIES OF PERSONAL DATA AND LEGAL GROUNDS

The Center may collect personal and special categories of personal data for the above-mentioned purposes during, during and/or after the patient’s arrival at the Center; verbally, in writing, visually or electronically by means of telephone and similar communication tools, online through the Social Security Institution system, from the records shared if a private insurance company is used, from the records shared if the patient comes to the Center with a referral and / or from the records of other institutions and organizations if they are delivered personally, by electronic mails and call records sent through the records of other institutions and organizations; from other groups of persons, for the above-mentioned purposes, verbally, in writing, visually or electronically by telephone and similar means of communication, electronic mails sent, call records, through written, printed and similar channels such as the Center’s website, by automatic and/or non-automatic methods

The Center collects and stores personal and sensitive personal data in physical and/or digital environment. The personal and sensitive personal data collected may vary depending on the nature of the service provided by the Center. In this context, the legal reasons for collecting personal data are; the collection of personal and sensitive personal data is stipulated in the relevant laws, the Center’s ability to fully and duly fulfill its contractual and legal obligations, the Center has a legitimate interest in processing and storing this data, and obtaining explicit consent in cases where it can be processed with the explicit consent of the data owner in the Law, and in accordance with the third paragraph of Article 6 of the Law. Pursuant to the third paragraph of Article 6 of the Law; for the protection of public health, preventive medicine, diagnosis, medical diagnosis, treatment and care services, planning and management of health services and financing, it is processed by persons or authorized institutions and organizations under the obligation of confidentiality.

RIGHTS OF THE OWNER OF PERSONAL AND SPECIAL CATEGORIES OF PERSONAL DATA

Within the scope of the Law, the data subject may apply to the Center acting in the capacity of data controller;

a) Learn whether personal data is being processed,
b) Request information if personal data has been processed,
c) To learn the purpose of processing personal data and whether they are used in accordance with their purpose,

ç) To know the third parties to whom personal data are transferred domestically or abroad,

d) To request correction of personal data in case of incomplete or incorrect processing,
e) Request deletion or destruction of personal data,
f) To request notification of the transactions made pursuant to Articles (d) and (e) to third parties to whom personal data are transferred,
g) To object to the emergence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems,

h) In case of damage due to unlawful processing of personal data, it has the right to demand the compensation of the damage.

APPLICATION TO THE DATA CONTROLLER

In the application made in cases where there is or may be any violation of rights, the requests in this application shall be concluded by the Center free of charge within 30 days at the latest, depending on the nature of the request. If the transaction requires additional costs for the Center, the fee in the tariff shown in the “Communiqué on the Procedures and Principles of Application to the Data Controller” may be applied by the Board.

The information that must be included in the application, provided that the conditions in Article 5 of the “Communiqué on the Procedures and Principles of Application to the Data Controller” are complied with, is as follows;

Applicant’s name, surname, date of birth, telephone number, residential or workplace address for notification, e-mail address for notification, if any,
T.R. Identification Number of the applicant; nationality, passport number or identification number, if any, for foreigners
If the application is made about someone else’s data, the information specified in the above article regarding this person,
The nature and date of the relationship of the applicant or the person on whose behalf the application is made with the organization,
Demand issue,
The method of delivery for the response to the request (by e-mail, by postal delivery to the address provided under the above clause, or by hand delivery),
Request Date,
Signature of the applicant.

The application can be hand-delivered to the authorized person at the Center as detailed below, or it can be sent to the address or e-mail address specified below.

If an application is submitted, the Center may make additional verifications such as calling the applicant or sending an e-mail to the applicant in order to verify the identity of the applicant and protect his/her rights.

CONTACT INFORMATION

Title : Göl Sağlık Hizmetleri Ticaret Limited Şirketi

MERSIS No :

Address : Ostim Mahallesi 1302. Cadde No:14 Serhatkent / ANKARA

Telephone :

E-mail :

CONTACT PERSON (REPRESENTATIVE)

Name-Surname :

Telephone :