Information Society Services

Privacy Notice on the Protection and Processing of Personal Data

As Sardes Özel Sağlık Hizmetleri Ticaret A.Ş., in accordance with Personal Data Protection Law No. 6698 (“KVKK”), we carry out the collection, purpose of use, processing, transfer and retention period of personal data, and bear responsibility for data privacy and protection activities, within the scope of the relevant law and legislation. To this end, we take security measures at the highest level and inform you about your rights; we attach great importance to the security of your personal data. We retain all personal data shared by our patients with due regard to patient privacy and in such a way as to take all technical and administrative measures necessary to ensure an appropriate level of security for your personal data.

This Information on the Protection of Personal Data explains our personal data protection and processing policy: how we collect, use, transfer and protect your personal data while providing our services.

1. Identity of the Data Controller

Pursuant to Personal Data Protection Law No. 6698, which entered into force on 7 April 2016 (referred to in this Privacy Notice as the “KVK Law”), your personal data may be processed by Sardes Özel Sağlık Hizmetleri Ticaret A.Ş. (referred to in this Privacy Notice as “Sardes”) as the data controller within the scope described below.

2. Purposes and Legal Grounds for Processing Your Personal Data

Articles 5 and 6 of the KVK Law set out the conditions for the processing of personal data and special category personal data. Special category personal data are listed exhaustively in the Law and comprise data relating to a person’s race, ethnic origin, political opinion, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data. Article 5 of the Law sets out the conditions for processing personal data that are not special category data, while the conditions for processing special category data are regulated in Article 6.

Conditions under which personal data that are not special category data may be processed pursuant to Article 5 of the KVK Law:

• The data subject has given explicit consent.
• Data processing is expressly provided for by law.
• Processing of the relevant data is mandatory for the protection of the life or bodily integrity of the person, or of another person, who is unable to express their consent due to actual impossibility or whose consent is not legally valid.
• Processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract.
• Data processing is mandatory for the data controller to fulfil its legal obligation.
• The personal data have been made public by the data subject themselves.
• Data processing is mandatory for the establishment, exercise or protection of a right.
• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Conditions under which special category personal data may be processed pursuant to Article 6 of the KVK Law:

• The data subject has given explicit consent,
• For special category personal data other than data relating to health and sexual life (data relating to a person’s race, ethnic origin, political opinion, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, criminal conviction and security measures, as well as biometric and genetic data), processing is provided for by law.
• Within the framework of these conditions, your personal data are archived, processed and used, in electronic or physical media and within the scope of the stated purposes, by taking the necessary security, confidentiality and legal measures, for:
• Fulfilling our legal obligations under the relevant legal regulations,
• Protecting public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning and management of health services and their financing,
• Providing you with information about your appointment if you make one,
• Planning and managing the internal operations of Sardes,
• Carrying out analyses to improve our services,
• Invoicing,
• Verifying your identity,
• Verifying your relationship with contracted institutions,
• Responding to requests from the Ministry of Health and other public institutions and organisations in accordance with the applicable legislation,
• Responding to your questions or complaints about our services,
• Analysing your use of health services in order to improve the services we offer,
• Ensuring compliance with the internal policies and principles of Sardes,
• Measuring and increasing patient satisfaction after you receive health services,
• Contacting you to provide information about our services,
• The supply of medicines or medical devices.

Furthermore, your personal data will never be used for any commercial purpose other than the activities listed above and the cases required by the relevant legislation.

3. Personal Data Collected by Sardes

We collect various information from our patients within the framework of the health services we provide. This information is in all cases collected in accordance with the data processing principles and conditions set out in Personal Data Protection Law No. 6698 (“KVKK”). The information we collect from you within the scope of the purposes of processing personal data may include the following:

• Your name and surname,
• Your Turkish Republic identity information and passport number,
• Your place and date of birth,
• Your gender,
• Your address,
• Your telephone number,
• Your e-mail address,
• The patient protocol number assigned to you by Sardes,
• Your financial data, such as payment and billing information,
• Your private health insurance or Social Security Institution data,
• Your biometric data within the scope of services financed by the Social Security Institution,
• Your health data, including but not limited to your examination, X-ray and tomography data and prescription information,
• Your voice recording if you contact us,
• Your image recorded by the closed-circuit camera system during your visit to our hospitals,
• Your vehicle licence plate data if you use the car park/valet service,
• Your health data and identity information shared when you use the online services on our websites https://izmircanhastanesi.com/ and http://canhospitals.com/,
• Your other data shared when you contact us by e-mail, through the call centre or through other channels.

4. Persons and Organisations to Which Your Personal Data May Be Transferred and Purposes of Transfer

Fulfilling our legal obligations under the Basic Law on Health Services No. 3359, Decree Law No. 663 on the Organisation and Duties of the Ministry of Health and Its Affiliated Institutions, the Regulation on Private Hospitals, the Regulation on the Processing of Personal Health Data and the Protection of Privacy, and other related regulations;

Ensuring that all technical and administrative measures necessary to ensure an appropriate level of security are taken in accordance with the KVKK and the related health legislation, and that the necessary work is carried out by the relevant units so that the relevant persons can benefit from the products and services offered by our Institution through the use of your personal data,

Transfer, in line with the purposes listed in Article 2 of this privacy notice, including the performance of our Institution’s administrative and economic activities, ensuring and supervising physical security in the buildings belonging to our Institution, conducting legal, financial and administrative compliance processes and carrying out financial, legal and administrative affairs, to institutions or organisations permitted by the relevant legislation (Turkish Medical Association, İzmir Provincial Health Directorate, Turkish Dental Association, Social Security Institution, etc.); all Ministries and judicial authorities; private insurance companies; our direct/indirect domestic/foreign shareholders, subsidiaries and/or affiliates; auditors; consultants; business partners; domestic/foreign organisations from which we obtain services under contract or with which we cooperate in order to carry out our activities; and other third parties, within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the KVK Law,

5. Method and Legal Grounds of Personal Data Collection

Your personal data are collected so that our services can be provided in line with the purposes stated above and so that our institution can fully and accurately fulfil its contractual and statutory responsibilities in this context. Your collected personal data may be processed and transferred for the purposes set out in Articles 2 and 4 of this text, within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of the KVK Law.

Within the legal grounds stated above, your personal data are collected through all kinds of verbal (all kinds of statements, etc.), written (tests, job application forms, contact forms, patient consent forms, etc.) or electronic means, including call centre conversations, the identity document you present, the website, social media accounts, our institution’s website and mobile applications, as well as the existing camera recording systems.

6. Your Rights Regarding Your Personal Data

Pursuant to Article 11 of the KVK Law, by applying to the data controller, the data subject has the right, with respect to themselves, to:

• Learn whether your personal data are processed,
• Request information if your personal data have been processed,
• Learn the purpose of processing your personal data and whether they are used in accordance with that purpose,
• Know the third parties in Türkiye or abroad to which your personal data are transferred,
• Request the rectification of your personal data if they are incomplete or inaccurately processed, and request that the operations carried out in this context be notified to the third parties to which your personal data have been transferred,
• Request the erasure or destruction of your personal data if the reasons requiring their processing cease to exist, even though they have been processed in accordance with the KVK Law and other relevant legal provisions, and request that the operations carried out in this context be notified to the third parties to which your personal data have been transferred,
• Object to a result to your detriment arising from the analysis of the processed data exclusively through automated systems,

and to request compensation for damages if you suffer damage due to the unlawful processing of your personal data.

Pursuant to paragraph 1 of Article 13 of the KVK Law, you may submit your applications regarding the rights stated above, containing the information necessary to identify you and your explanations regarding the right you wish to exercise among the rights set out in Article 11 of the KVK Law, as follows:

You may deliver them in person, together with documents identifying you, to the address 8019/16 Sok. No:18 Çiğli/İZMİR,

You may send them through a notary public or by the other methods specified in the KVK Law,

You may send the relevant form, signed with a secure electronic signature, to the e-mail address iletisim@izmircanhastanesi.com. Depending on the nature of your request, your applications will be concluded free of charge within thirty days at the latest; however, if an additional cost arises, our Institution reserves the right to charge you a fee according to the tariff to be determined by the Personal Data Protection Board.

Explicit Consent Statement on the Processing, Use and Sharing of Personal Data

Dear Data Subject,

Pursuant to Personal Data Protection Law No. 6698 (“KVKK”), any information that serves to make the identity of a natural person identified or identifiable falls within the scope of personal data.

In this context, your personal data will be processed, stored, retained and updated where necessary by Sardes Özel Sağlık Hizmetleri Ticaret A.Ş. in its capacity as Data Controller under its Privacy Notice, may be disclosed/transferred to third parties in the cases specified in the Privacy Notice and within legislative and legal limits, and may be processed in the ways specified in the KVK Law. Pursuant to Article 11 of the KVK Law, by applying to our institution, you have the right, with respect to your personal data, to:

1. Learn whether they are processed,
2. Request information if they have been processed,
3. Learn the purpose of processing and whether they are used in accordance with that purpose,
4. Know the third parties in Türkiye or abroad to which they are transferred,
5. Request rectification if your data are incomplete or inaccurately processed,
6. Request their erasure/destruction within the framework of Article 7 of the KVK Law,
7. Request compensation for damages if you suffer damage due to their unlawful processing.

Within the scope of Personal Data Protection Law No. 6698 (the “Personal Data Law”);

• We hereby inform you that, pursuant to the “Regulation on the Processing of Personal Health Data and the Protection of Privacy”, as Sardes Özel Sağlık Hizmetleri Ticaret A.Ş., in our capacity as data controller, we will record, store in our archives and process the personal information necessary to provide you with health services (diagnosis, treatment, care services, etc.) in the interest of the patient and of public health,
• that, as a health institution under the relevant legislation, in order to provide you with health services, we are obliged to record identity, address, telephone, medical history and all other necessary information to identify the patient receiving the service, and to prepare all records and documents to be kept in the medical patient file forming the basis of processing in electronic or paper form,
• and that your personal data will be shared with the relevant authorities and persons if requested by the competent authorities, in particular your insurance company if you use your private health insurance, if requested by persons appointed by the competent authorities or within the scope of e-Nabız and similar systems that have been established, or within the scope of the notification and/or reporting obligations imposed on us.
• I accept, declare and undertake that I have read and examined the above information text and the Privacy Notice of Sardes Özel Sağlık Hizmetleri Ticaret A.Ş. on the date stated below, that I accept all the matters stated knowingly and with understanding, and that, of my own free will, I give my explicit consent to the processing, use and transfer of my personal data within the scope defined in the KVK Law.

This Consent Statement remains valid unless I declare it invalid in writing.