Personal Data Protection

İZMİR ÖZEL CAN HASTANESİ ANONİM ŞİRKETİ (hereinafter referred to as “İzmir Özel Can Hastanesi” or the “Hospital”) is located at Ataşehir Mah. 8019/16 Sok. No:18 Çiğli/İZMİR.

İzmir Özel Can Hastanesi is a legal entity acting as a data controller within the scope of Personal Data Protection Law No. 6698 (hereinafter referred to as the “KVK Law”).

Data subjects are the natural persons whose personal data are collected, processed and transferred for the purposes set out below, in accordance with KVK Law No. 6698 and the other legislation to which İzmir Özel Can Hastanesi is subject.

İzmir Özel Can Hastanesi exercises the utmost care regarding the security of personal data. With this awareness, the personal data of data subjects are processed and stored in compliance with KVK Law No. 6698 and the other legislation constituting the secondary regulations of the Law.

This Policy aims to ensure that the arrangements to be introduced by İzmir Özel Can Hastanesi for compliance with the KVK Law, within the framework of the fundamental principles explained below, are effectively implemented within İzmir Özel Can Hastanesi by its shareholders, officers, employees and business partners.

In line with the fundamental arrangements provided for in this Policy, all administrative and technical measures will be taken within the operations of İzmir Özel Can Hastanesi with respect to the processing and protection of personal data, the necessary internal procedures will be established and all training required to raise awareness will be provided. All measures necessary for shareholders, officers, employees and business partners to comply with KVKK processes will be taken, and appropriate and effective audit mechanisms will be established.

This Policy sets out the fundamental principles to be observed in all these processes and the obligations of İzmir Özel Can Hastanesi for directing its internal operations in accordance with the arrangements introduced by the KVK Law. The compliance activities that İzmir Özel Can Hastanesi will carry out regarding the protection of personal data will be regulated through internal procedures established within the framework of the KVK Law and the related legislation. All employees of İzmir Özel Can Hastanesi are obliged to act in accordance with the arrangements introduced by this Policy, the KVK Law and all other related legislation while performing their duties.

In the event of non-compliance with this Policy and the related legislation, in addition to the criminal and legal liability provided for by the legislation, sanctions may be applied at İzmir Özel Can Hastanesi depending on the nature of the incident, up to and including termination of the employment contract for just cause within the framework of the legislation governing working life.

Within the scope of the KVK Law, İzmir Özel Can Hastanesi will have the capacity of data controller and will register with the VERBİS system. Paragraph 1 of Article 11 of the Regulation provides that “The obligations of legal entities established in Türkiye as data controllers under the Law shall be fulfilled by the body authorised to represent and bind the legal entity in accordance with the provisions of the relevant legislation, or by the person or persons specified in the relevant legislation. The body authorised to represent the legal entity may assign one or more persons with respect to the obligations to be fulfilled for the implementation of the Law.”

The persons to whom the management and representation of the company have been delegated by the Board of Directors, within limits determined in accordance with the relevant articles of the Turkish Commercial Code (TTK), are responsible, under the TTK, the Turkish Code of Obligations (TBK) and the Turkish Criminal Code (TCK), for transactions and acts performed within the limits of their authority. In particular, before law enforcement,

public prosecutors’ offices, public institutions and courts, they have been elected as authorised to represent the company and to give statements.

The Director of each department will be obliged to audit whether the Relevant Users in the departments act in accordance with this Policy and the Disposal Policy prepared within the framework of the Law and the Regulation, and to report to the Board of Directors and the Executive Board.

İzmir Özel Can Hastanesi accepts that, in line with Article 4 of the KVK Law, it will process the personal data falling within the scope of this Policy in accordance with the following principles:

3.1. Compliance with the law and the rule of good faith

İzmir Özel Can Hastanesi accepts that, in its capacity as data controller and as a prudent merchant, it will carry out its personal data processing activities in compliance with all legislation in force and to enter into force, in particular the Constitution and the KVK Law, and in accordance with the rule of good faith set out in Article 2 of the Civil Code.

3.2. Accuracy and being kept up to date

In its personal data processing activities, İzmir Özel Can Hastanesi takes all measures necessary to ensure that personal data are accurate and up to date, to the extent technically possible.

In line with the requests that the relevant person notifies to İzmir Özel Can Hastanesi in its capacity as data controller, and in the cases that İzmir Özel Can Hastanesi itself deems necessary, the administrative and technical mechanisms established by İzmir Özel Can Hastanesi will be operated to correct inaccurate or outdated personal data and to verify their accuracy.

3.3. Processing for specified, explicit and legitimate purposes

Personal data are processed lawfully by İzmir Özel Can Hastanesi, limited to the requirements of the relevant legislation and the services provided or to be provided, and the purpose of processing personal data is determined clearly and definitively before the processing of the data begins.

3.4. Processing data in a manner that is relevant, limited and proportionate to the purposes for which they are processed

Personal data are processed by İzmir Özel Can Hastanesi in a manner relevant and limited to the purposes of processing and to the extent necessary to achieve those purposes. In this context, the fundamental rule is to avoid processing personal data that are unrelated to, and not needed for, the purpose of processing.

3.5. Processing limited to the period provided for by the legislation or required by the purpose of processing

Personal data are retained for the periods provided for by the relevant legislation or for the period required by the purpose for which the data are processed.

At the end of the period provided for by the legislation or the period required by the purpose of processing, personal data are erased, destroyed or anonymised by İzmir Özel Can Hastanesi. The necessary administrative and technical measures will be taken to prevent data from being retained after the required period has ended.

The conditions for processing personal data are regulated by the KVK Law, and personal data are processed by İzmir Özel Can Hastanesi in accordance with the conditions set out below.

4.1. Conditions for the Processing of Personal Data

Except for the exceptions listed in the KVK Law, İzmir Özel Can Hastanesi processes personal data only by obtaining the explicit consent of the data subjects.

Where any of the following cases listed in the Law exists, personal data may be processed even without the explicit consent of the data subject:

• It is expressly provided for by law,
• It is mandatory for the protection of the life or bodily integrity of the person, or of another person, who is unable to express their consent due to actual impossibility or whose consent is not legally valid,
• Processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract.
• It is mandatory for the data controller to fulfil its legal obligation,
• The data have been made public by the data subject themselves,
• Data processing is mandatory for the establishment, exercise or protection of a right,
• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

4.2. Conditions for the Processing of Special Category Personal Data

İzmir Özel Can Hastanesi exercises particular care in the processing of special category personal data, the protection of which is believed to be of more critical importance for data subjects in various respects. In this context, such data are not processed without the explicit consent of the data subjects, provided that the adequate measures determined by the Board are taken.

However, special category personal data other than data relating to health and sexual life may be processed without the explicit consent of the data subject in the cases provided for by law. Data relating to health and sexual life, on the other hand, may be processed without obtaining explicit consent, provided that adequate measures are taken and any of the following grounds exists:

• Protection of public health,
• Preventive medicine,
• Medical diagnosis,
• Provision of treatment and care services,
• Planning and management of health services and their financing.

İzmir Özel Can Hastanesi processes the personal data of natural persons in accordance with the KVK Law and on the basis of the Personal Data Processing Inventory, which must be prepared within the scope of Articles 5, 7, 9 and 10 of the Regulation and must contain the information set out below.

Although this Policy does not contain a separate heading titled Personal Data Processing Inventory, where the following information is included under this heading and the subsequent headings, the relevant articles shall be deemed to constitute the “Personal Data Processing Inventory”.

1. Purposes of personal data processing,
2. Data category
3. The recipient group or groups to which the data are transferred
4. Data subject groups
5. Association of data categories with data subject groups
6. Personal data intended to be transferred to foreign countries
7. Measures taken regarding data security
8. The maximum period necessary for the purposes for which the personal data are processed

5.1. Data Subject Groups

5.2. Data Categorisation

5.3. Purposes of Collecting and Processing the Personal Data of Data Subjects in the Data Subject Groups

İzmir Özel Can Hastanesi processes the personal data of its shareholders and officers in order to carry out the activities described in the Introduction, within the framework of its legal obligations arising from the Turkish Commercial Code, the Tax Procedure Law, the Labour Law and other related legislation. These personal data are obtained from the records kept by official institutions concerning İzmir Özel Can Hastanesi, the minutes of the company’s general assembly and board of directors meetings, and the documents kept in relation to the company’s corporate and management processes.

İzmir Özel Can Hastanesi records the data falling within the data category of the authorised natural persons of tenants operating in the independent units of the hospital under a lease agreement, in order to ensure the performance of the lease agreement between the parties, to ensure that all tenants act in accordance with the rules owing to the data controller’s obligation to maintain the general security and order of the hospital, and, in the event of a breach of contractual obligations, to be able to serve notices, initiate enforcement and legal proceedings and take other measures to ensure performance in accordance with the contract.

The personal data of tenants in the hospital are obtained through the lease agreement, addenda, supplementary agreements, protocols, e-mail correspondence and business cards provided by the tenants themselves.

İzmir Özel Can Hastanesi records the data of the authorised natural persons of the suppliers and subcontractors that assist in carrying out the hospital’s activities, and of the natural-person employees assigned by those suppliers and subcontractors, in order to check whether they perform their duties and to maintain the order of the company’s activities. The personal data of suppliers and subcontractors are obtained through e-mails sent and received as a result of communication with them, telephone calls, and the transfer of business card and website information.

İzmir Özel Can Hastanesi requests and processes the personal data of its staff and interns in order to carry out their Social Security Institution (SGK) registration and to complete the documents required to be kept in their personnel files under the Labour Law and the Occupational Health and Safety Law in force. These personal data are obtained, at the recruitment and job application stage, through the CVs and job application forms provided with their explicit consent, the CV viewing methods offered by human resources software providing candidate pool services (such as Kariyer.net and LinkedIn), and the answers they give, with their consent, to the questions asked during the interview.

İzmir Özel Can Hastanesi requests and processes the personal data of natural persons who apply for a job in order to contact them for interview purposes during the recruitment process and to determine during the interview whether the person’s qualifications and experience match the open position. These personal data are obtained when applicants send their CVs to the human resources department with their explicit consent, when they answer the questions asked during the interview with their consent, or through the CV viewing methods offered by human resources software providing job posting and candidate pool services (such as Kariyer.net and LinkedIn).

İzmir Özel Can Hastanesi records the data of the employees and authorised natural persons of the business partners with which it cooperates, within the framework of the purposes for which the business partnership was established. It records the personal data of these persons in order to ensure and supervise that the services obtained from goods and service suppliers and necessary for carrying out the commercial activities of the shopping centre are provided at İzmir Özel Can Hastanesi. These personal data are obtained from signed contracts, invoices sent, device delivery reports, e-mail correspondence, communication by telephone and other means, and business cards.

The licence plate information, the information contained in the complaint and request form, and the identity information of all visitors coming to the campus where İzmir Özel Can Hastanesi operates are obtained in order to ensure the security of the campus where the hospital operates. Where persons call the Call Center or the relevant departments of the hospital to submit their requests and complaints, their voice recordings are processed to ensure service quality. Data provided by persons at the desk, at the information desk or on the Wi-Fi login screen are processed to ensure service quality, carry out activities and for security reasons. Images of persons visiting the İzmir Özel Can Hastanesi campus for whatever reason are obtained by means of 24/7 security camera recording.

5.4. Association of Data Subject Groups with the Data Categories Relating to Them

İzmir Özel Can Hastanesi may transfer the personal data of data subjects to third parties and institutions within the scope of the personal data processing conditions set out in Articles 5 and 6 of KVK Law No. 6698, limited to the purposes specified in this Policy and in compliance with Articles 8 and 9 of the KVK Law.

The scope of the persons to whom transfers are made, referred to above, and the purposes of data transfer are set out below. These persons and institutions are:

• Affiliated institutions and organisations and business partners of İzmir Özel Can Hastanesi,
• Suppliers/tenants/subcontractors of İzmir Özel Can Hastanesi
• Shareholders of İzmir Özel Can Hastanesi,
• Officers of İzmir Özel Can Hastanesi,
• Public institutions and organisations legally authorised to obtain information,
• Private law legal entities legally authorised to obtain information.

İzmir Özel Can Hastanesi may transfer personal data to foreign countries declared by the KVK Board to provide adequate protection (“Foreign Country with Adequate Protection”) or, where adequate protection is not available, to foreign countries where the data controllers in Türkiye and in the relevant foreign country have undertaken adequate protection in writing and the KVK Board has given its permission (“Foreign Country Where a Data Controller Undertaking Adequate Protection Is Located”).

In this respect, İzmir Özel Can Hastanesi acts in accordance with the provisions of Article 9 of the KVK Law.

7.1. Transfer of Personal Data Abroad

In line with legitimate and lawful personal data processing purposes, İzmir Özel Can Hastanesi may transfer personal data to Foreign Countries with Adequate Protection or Foreign Countries Where a Data Controller Undertaking Adequate Protection Is Located if the data subject has given explicit consent or, where the data subject has not given explicit consent, if any of the following cases exists:

• If there is an explicit provision in the laws regarding the transfer of the personal data,
• If it is mandatory for the protection of the life or bodily integrity of the data subject or another person and the data subject is unable to express their consent due to actual impossibility or their consent is not legally valid;
• If the transfer of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract,
• If the transfer of personal data is mandatory for İzmir Özel Can Hastanesi to fulfil its legal obligation,
• If the personal data have been made public by the data subject,
• If the transfer of personal data is mandatory for the establishment, exercise or protection of a right,
• If the transfer of personal data is mandatory for the legitimate interests of İzmir Özel Can Hastanesi, provided that it does not harm the fundamental rights and freedoms of the data subject

7.2. Transfer of Special Category Personal Data Abroad

Exercising due care, taking the necessary security measures and taking the adequate measures prescribed by the KVK Board, İzmir Özel Can Hastanesi may, in line with legitimate and lawful personal data processing purposes, transfer the special category data of the data subject to Foreign Countries with Adequate Protection or Foreign Countries Where a Data Controller Undertaking Adequate Protection Is Located in the following cases.

• If the data subject has given explicit consent, or
• If the data subject has not given explicit consent;
  • The data subject’s special category personal data other than data relating to health and sexual life (data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, criminal conviction and security measures, as well as biometric and genetic data), in the cases provided for by law,

  As a rule, the personal data obtained by İzmir Özel Can Hastanesi are not shared abroad. The personal data of foreign nationals, of Turkish nationals living abroad, or of persons who come to İzmir Özel Can Hastanesi through companies established in a foreign country may be shared with the relevant public institution, insurance company or intermediary institutions and organisations.

The personal data we obtain are stored securely in physical or electronic media for an appropriate period so that İzmir Özel Can Hastanesi can carry out its medical and commercial activities.

Within the scope of these activities, İzmir Özel Can Hastanesi acts in accordance with the obligations regarding the protection of personal data provided for in all relevant legislation, in particular the KVK Law.

Except in cases where the relevant legislation permits or requires personal data to be stored for a longer period, when the purposes of processing personal data have ceased, the personal data will be erased, destroyed or anonymised by İzmir Özel Can Hastanesi ex officio or upon the request of the relevant persons.

Where personal data are erased by these methods, the data will be disposed of in such a way that they can never be used again or retrieved.

However, in cases where the data controller has a legitimate interest, even though the purpose of processing and the periods specified in the relevant laws have ended, personal data may be retained until the expiry of the limitation periods set out in the Code of Obligations or other legislation concerning İzmir Özel Can Hastanesi, provided that this does not harm the fundamental rights and freedoms of the data subjects. After the expiry of the said limitation period, the personal data will be erased, destroyed or anonymised.

In accordance with the conditions set out in the KVK Law, İzmir Özel Can Hastanesi takes the technical and administrative measures necessary to ensure an appropriate level of security in order to prevent the unlawful processing of the personal data it processes, to prevent unlawful access to the data and to ensure the preservation of the data, and in this context carries out, or has carried out, the necessary audits.

If, despite all technical and administrative measures having been taken, the processed personal data are obtained by third parties by unlawful means, İzmir Özel Can Hastanesi notifies the relevant units of this situation as soon as possible.

9.1. Technical Measures

• Technical measures in line with technological developments are taken, and the measures taken are updated periodically, and
• Technical access and authorisation solutions are put into use in accordance with the legal compliance requirements determined for each business unit.
• Access rights are restricted and authorisations are reviewed regularly.
• The technical measures taken are checked periodically, matters posing a risk are re-evaluated and the necessary technological solutions are developed.
• Software and hardware including virus protection systems and firewalls are installed.
• Personnel with expertise in technical matters are employed, and system vulnerabilities are monitored.
• Applications in which personal data are collected undergo regular security scans to detect security vulnerabilities. Any vulnerabilities found are remediated
• Personal data are destroyed in such a way that they cannot be recovered and leave no audit trail. Through penetration tests, the risks, threats, vulnerabilities and any weaknesses concerning our Company’s information systems are identified and the necessary measures are taken.
• The necessary measures are taken for the physical security of our Company’s information systems equipment, software and data.
• Procedures for access authorisations and the allocation of roles are established and implemented, an authorisation matrix is applied, access is logged and inappropriate access is kept under control, and disposal processes in line with the retention and disposal policy are defined and implemented. Backup programs that ensure the secure storage of personal data are used.
• Information systems are kept up to date, and strong passwords are used in electronic media in which personal data are processed.
• Through information security incident management and the results of real-time analyses, risks and threats that may affect the continuity of information systems are continuously monitored.
• Session logs are kept. To ensure the security of information systems against environmental threats, hardware and software measures (firewalls, network access control, systems that block malicious software, etc.) are taken.
• Risks relating to the prevention of unlawful processing of personal data are identified, technical measures appropriate to these risks are taken and technical checks of the measures taken are performed.
• Access procedures are established within the Company, and reporting and analysis are carried out regarding access to personal data.
• Access to storage areas containing personal data is logged, and inappropriate access or access attempts are kept under control.
• The Company takes the necessary measures to ensure that erased personal data are inaccessible and non-reusable for the relevant users.
• The Company has established an appropriate system and infrastructure for notifying the relevant person and the Board if personal data are unlawfully obtained by others.
• Passwords are used in electronic media in which personal data are processed. Data backup programs that ensure the secure storage of personal data are used.
• Access to personal data stored in electronic or non-electronic media is restricted in accordance with access principles.
• Users are required to use a unique username and password when logging in to the systems.
• A separate policy has been established for the security of special category personal data. Employees involved in special category personal data processing have been trained on special category personal data security, confidentiality agreements have been concluded, and the authorisations of users with access rights to the data have been defined.
• Adequate security measures are taken for the physical environments in which special category personal data are processed, stored and/or accessed, and unauthorised entry and exit are prevented by ensuring physical security.
• If special category personal data need to be transferred by e-mail, they are transferred in encrypted form using a corporate e-mail address or a registered electronic mail (KEP) account. If they need to be transferred via media such as portable memory, CD or DVD, they are encrypted. If they need to be transferred on paper, the necessary measures are taken against risks such as the theft or loss of the documents or their being seen by unauthorised persons, and the documents are sent in “confidential” format.

9.2. Administrative Measures

• Employees are trained on the technical measures to be taken to prevent unlawful access to personal data.
• Employees are given training on the KVK Law by the Legal Counsel.
• Processes for access to and authorisation for personal data within İzmir Özel Can Hastanesi are designed and implemented in accordance with the legal compliance requirements for the processing of personal data on a business-unit basis.
• İzmir Özel Can Hastanesi has added clauses to all documents that govern its relationship with its staff and contain personal data, stating that the obligations provided for by the KVK Law must be complied with for the lawful processing of personal data, that personal data must not be disclosed, that personal data must not be used unlawfully, and that the confidentiality obligation regarding personal data continues even after the termination of the employment contract with İzmir Özel Can Hastanesi; failure of staff to comply with these obligations requires the application of sanctions that may extend to termination of the employment contract, and this is specifically regulated in the İzmir Özel Can Sağlık Grubu Code of Conduct Directive.
• Employees are informed that they may not disclose personal data they learn to others in breach of the provisions of the KVK Law or use them for purposes other than processing, and that this obligation continues after they leave their position, and the necessary undertakings are obtained from them accordingly.
• Provisions are added to the contracts concluded by İzmir Özel Can Hastanesi with the persons to whom personal data are lawfully transferred, stating that the persons to whom personal data are transferred will take the necessary security measures to protect personal data and will ensure compliance with these measures within their own organisations.
• If the processed personal data are obtained by others by unlawful means, İzmir Özel Can Hastanesi notifies the relevant person and the Board of this situation as soon as possible.
• İzmir Özel Can Hastanesi employs staff who are knowledgeable and experienced in the processing of personal data and provides its staff with the necessary training on personal data protection legislation and data security
• İzmir Özel Can Hastanesi carries out, or has carried out, the necessary audits to ensure the implementation of the provisions of the Law within its own legal entity. The confidentiality and security vulnerabilities revealed as a result of the audits
• Pursuant to the article of the KVK Law, İzmir Özel Can Hastanesi is responsible for ensuring that the third parties to which it transfers personal data also fulfil their obligations to process and preserve the data lawfully and to access the data lawfully in line with this Policy and the provisions of the KVK Law. For this reason, İzmir Özel Can Hastanesi must obtain undertakings, in the contracts and all arrangements to be made when transferring data to third parties, that these conditions will be met and that it will be granted the right to audit. Likewise, İzmir Özel Can Hastanesi must specifically inform all its staff of the responsibilities arising from the processes of transferring personal data to third parties.
• To develop employees’ qualifications, training is provided on preventing the unlawful processing of personal data, preventing unlawful access to personal data, ensuring the preservation of personal data, communication techniques, technical knowledge and skills, and other relevant legislation.
• Employees are required to sign confidentiality agreements regarding the activities carried out by the Company. A disciplinary procedure has been prepared to be applied to employees who do not comply with security policies and procedures.
• Before starting to process personal data, the Institution fulfils its obligation to inform the relevant persons.
• A personal data processing inventory has been prepared. Our employees are trained and informed on the lawful processing of personal data.
• Personal data that are no longer needed are erased, destroyed or anonymised.
• All reasonable measures are taken to prevent information from being stolen, lost or corrupted.
• A disciplinary procedure is applied to employees who do not comply with security policies and procedures, and the obligation to inform the relevant persons is fulfilled.
• Periodic and random internal audits are carried out, and information security training is provided to employees.

9.3. Audit of the Measures Taken for the Protection of Personal Data

Within the scope of the KVK Law, İzmir Özel Can Hastanesi will have the capacity of data controller and will register with the VERBİS system.

Paragraph 1 of Article 11 of the Regulation provides that “The obligations of legal entities established in Türkiye as data controllers under the Law shall be fulfilled by the body authorised to represent and bind the legal entity in accordance with the provisions of the relevant legislation, or by the person or persons specified in the relevant legislation. The body authorised to represent the legal entity may assign one or more persons with respect to the obligations to be fulfilled for the implementation of the Law.”

The persons to whom the management and representation of the company have been delegated by the board of directors, within limits determined in accordance with the relevant articles of the Turkish Commercial Code (TTK), are responsible, under the TTK, the Code of Obligations (BK) and the Turkish Criminal Code (TCK), for transactions and acts performed within the limits of their authority.

In particular, they have been elected as authorised to represent the company and to give statements before law enforcement, public prosecutors’ offices, public institutions and courts.

The Director of each department will be obliged to audit whether the Relevant Users in the departments act in accordance with this Policy and the Disposal Policy prepared within the framework of the Law and the Regulation, and to report to the Board of Directors and the Executive Board. In cases requiring a decision, the opinion of the Legal Counsel’s Office will be obtained, and the decision will be implemented after the Board of Directors has taken it.

In accordance with Article 10 of the KVK Law, İzmir Özel Can Hastanesi notifies the data subject of their rights and guides the data subject on how to exercise these rights.

In accordance with Article 13 of the KVK Law, İzmir Özel Can Hastanesi operates the necessary channels, internal workflows and administrative and technical arrangements for evaluating the rights of data subjects and providing them with the necessary information.

Under Article 10 of the KVK Law, data subjects must be informed before, or at the latest at the time of, the obtaining of their personal data. The information to be communicated to data subjects within the framework of this obligation to inform is as follows:

• The identity of the data controller and of its representative, if any,
• The purposes for which the personal data will be processed,
• To whom and for what purposes the processed personal data may be transferred,
• The method and legal basis of the collection of personal data,
• The other rights listed in Article 11 of the KVK Law.

In order to fulfil its obligation to inform, İzmir Özel Can Hastanesi has prepared privacy notices, on the basis of processes and of the persons whose data are processed, to be provided to data subjects within the scope of the above-mentioned provision of the KVK Law.

Following the provision of the privacy notices to data subjects, explicit consent statements have also been prepared for the data processing activities and data categories that require the explicit consent of the data subject so that İzmir Özel Can Hastanesi can carry out its activities.

On the other hand, İzmir Özel Can Hastanesi has no obligation to inform in the cases listed under Article 28(1) of the KVK Law.

11.1. Procedure and Time Limit for İzmir Özel Can Hastanesi to Respond to Applications

If the data subject submits their request to İzmir Özel Can Hastanesi in accordance with the procedure set out in section 11.1.2 of this chapter, İzmir Özel Can Hastanesi will conclude the request free of charge within thirty days at the latest, depending on the nature of the request.

However, if a fee is prescribed by the KVK Board, İzmir Özel Can Hastanesi will charge the applicant the fee set out in the tariff determined by the KVK Board.

11.2. Information That İzmir Özel Can Hastanesi May Request from the Applicant Data Subject

İzmir Özel Can Hastanesi may request information from the applicant in order to determine whether the applicant is the data subject. In order to clarify the matters contained in the data subject’s application, it may ask the data subject questions regarding the application.

11.3. The Right of İzmir Özel Can Hastanesi to Reject the Data Subject’s Application

İzmir Özel Can Hastanesi may reject the applicant’s application, stating its reasons, in the following cases:

• Processing of personal data for purposes such as research, planning and statistics by anonymising them through official statistics.
• Processing of personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that this does not violate national defence, national security, public safety, public order, economic security, the privacy of private life or personal rights, or constitute a criminal offence.
• Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations assigned and authorised by law to ensure national defence, national security, public safety, public order or economic security.
• Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or enforcement proceedings.
• Processing of personal data being necessary for the prevention of crime or for a criminal investigation.
• Processing of personal data that have been made public by the data subject themselves.
• Processing of personal data being necessary for the performance of supervisory or regulatory duties, or for disciplinary investigations or prosecutions, by public institutions and organisations and professional organisations with the status of public institutions that are assigned and authorised on the basis of the authority granted by law.
• Processing of personal data being necessary for the protection of the economic and financial interests of the State in relation to budgetary, tax and financial matters.
• The data subject’s request being likely to obstruct the rights and freedoms of other persons
• Requests requiring disproportionate effort having been made
• The requested information being publicly available information.

If this Policy is revised or repealed, the revised version of the Policy or the new policy will be published in the relevant places.

This Policy enters into force on 28.01.2018.

All department Directors are responsible for the execution of this Policy, being responsible for monitoring and coordinating all work and transactions under the KVK Law and the regulations of the Personal Data Protection Board on behalf of the board of directors of İzmir Özel Can Hastanesi, which is the data controller and is obliged to fulfil the obligations of the data controller.