Personal Data Protection (KVKK) Policy

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

As Hisar Sağlık Hizmetleri A.Ş. (“Hisar Hospital Intercontinental”), we attach great importance to the security of your personal data. With this awareness, we exercise great care to ensure that all personal data relating to you are processed diligently and in the best possible manner, and are retained accordingly. Conscious of this responsibility, we process your personal data, in our capacity as Data Controller within the scope of the Law No. 6698 on the Protection of Personal Data (the “Law”) and the relevant legislation, within the framework set out below.

Collection and Processing of Personal Data and Purposes of Processing

In order to provide you with services of a high standard, we obtain your personal data verbally, in writing, visually or electronically, depending on the nature of the service provided, through channels such as the Call Centre, the internet, mobile applications, physical premises and similar channels.
Within this scope, the principal personal data of a general and special nature, in particular the personal health data that are necessary for, and obtained for the purpose of, carrying out all medical diagnosis, examination, treatment and care services, are listed below;

• Your identity data, such as your name, surname, Turkish Republic identity number, or, if you are not a Turkish citizen, your passport number or temporary Turkish Republic identity number, place and date of birth, marital status and gender, as well as the photocopy of the Turkish Republic Identity Card or Driving Licence you submit,

• Your contact data, such as your address, telephone number and e-mail address,

• Your financial data, such as your bank account number and IBAN number,

• Your data concerning health and sexual life obtained during the provision of medical diagnosis, treatment and care services, such as the laboratory and imaging results, test results, examination data and prescription information that you submit to be followed up in your file,

• Your responses and comments shared for the purpose of evaluating our services,

• Closed-circuit camera system image and audio recordings taken during your visit to our hospitals,

• Recordings of voice conversations kept in the event that you contact our Call Centre,

• Your data relating to private health insurance and your Social Security Institution data for the purposes of the financing and planning of health services,

• Your vehicle licence plate data, if you make use of the car park and valet service,

• Browsing information, IP address and browser information obtained during the use of our website and mobile application, and the medical documents, surveys, form information and location data that you transmit with your own consent.

Your personal data listed above, together with your special categories of personal data, may be processed for the following purposes:

• Protection of public health, preventive medicine, and the conduct of medical diagnosis, treatment and care services,

• Sharing requested information with the Ministry of Health and other public institutions and organisations pursuant to the relevant legislation,

• Fulfilment of legal and regulatory requirements,

• Sharing requested information with private insurance companies by the Patient Services, Financial Affairs and Marketing departments within the scope of the financing of your health services, the coverage of your examination, diagnosis and treatment expenses, and eligibility enquiries,

• Informing you, through the Call Centre, SMS or our Digital Channels, about your appointment and other matters relating to the medical service process,

• Verification of your identity by the Patient Services, our Healthcare Professionals and the Call Centre departments,

• Planning and management of the institution’s internal operations by the Hospital Management,

• Conducting analyses for the purpose of improving health services by the Quality, Patient Rights and Information Systems departments,

• Provision of training to our employees by the Human Resources and Quality departments,

• Monitoring and prevention of abuse and unauthorised transactions by the Audit and Information Systems departments,

• Carrying out risk management and quality improvement activities by the Quality, Patient Rights and Information Systems departments,

• Invoicing for our services by the Patient Services, Financial Affairs and Marketing departments,

• Verification of your relationship with institutions contracted with our hospital by the Patient Services, Financial Affairs and Marketing departments,

• Responding to all kinds of questions and complaints regarding our health services by the Hospital Management, Patient Rights and Call Centre departments,

• Taking all necessary technical and administrative measures within the scope of the data security of our hospital’s systems and applications by the Hospital Management and Information Systems departments,

• Participation in campaigns and provision of campaign information, and the design and communication of special content and tangible and intangible benefits on web and mobile channels, by the Marketing, Media and Communication and Call Centre departments,

• Measuring, increasing and researching patient satisfaction by the Hospital Management and Patient Experience departments,

• Enabling the conduct of education and training activities by the educational institutions with which the Institution cooperates.

• Conducting scientific studies and research aimed at the development of treatment services to be carried out by the Institution and/or the institution with which it cooperates and by physicians (provided that the data are anonymised)

Your above-mentioned “Personal and Special Categories of Data” may be retained in physical and electronic archives within Hisar Hospital Intercontinental and external service providers with the utmost diligence and in compliance with the provisions of the legislation.

Transfer of Personal Data

Your personal data may, within the framework of the Basic Law on Health Services No. 3359, the Decree Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions, the Law No. 6698 on the Protection of Personal Data, the Regulation on Private Hospitals, the Regulation on the Processing of Personal Health Data and Protection of Privacy, the regulations of the Ministry of Health and other provisions of the legislation, and for the purposes explained above, be shared with;

• The Ministry of Health, sub-units affiliated with the ministry and family medicine centres,

• Private insurance companies (health, pension, life insurance and the like),

• The Social Security Institution,

• The General Directorate of Security and other law enforcement forces,

• The General Directorate of Population,

• The Turkish Pharmacists’ Association,

• Judicial authorities,

• Laboratories, medical centres, ambulance services, medical device providers and institutions providing health services, located in Turkey or abroad, with which we cooperate for medical diagnosis and treatment,

• The healthcare institution to which the patient has been referred or to which the patient has applied directly,

• Your legal representatives whom you have authorised,

• Third parties from whom we receive consultancy, including the lawyers, tax advisers and auditors with whom we work,

• Regulatory and supervisory authorities and official bodies,

• Your employer, and

• Our suppliers, support service providers, archive service providers and business partners whose services we use or with whom we cooperate (for more detailed information, you may obtain information by applying to our hospital in writing).

Method and Legal Basis of Personal Data Collection

Your personal data are collected and processed in all kinds of verbal, written, visual or electronic media for the purposes set out above and in order for all kinds of business falling within the scope of activity of Hisar Hospital Intercontinental to be carried out within the legal framework and, within this scope, for Hisar Hospital Intercontinental to perform its contractual and legal obligations fully and properly. The legal basis for the collection of your personal data is;

• the Law No. 6698 on the Protection of Personal Data,

• the Basic Law on Health Services No. 3359,

• the Decree Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions,

• the Regulation on Private Hospitals,

• the Regulation on the Processing of Personal Health Data and Protection of Privacy,

• the regulations of the Ministry of Health and other provisions of the legislation.

Furthermore, as also stated in Article 6, paragraph 3 of the Law, personal data concerning health and sexual life may be processed without seeking the explicit consent of the data subject only by persons under an obligation of confidentiality or by authorised institutions and organisations, for the purposes of the protection of public health, preventive medicine, the conduct of medical diagnosis, treatment and care services, and the planning and management of health services and their financing.

Your Rights Regarding the Protection of Personal Data

Pursuant to the Law and the relevant legislation;

• to learn whether personal data are processed,

• to request information in this regard if personal data have been processed,

• to access and request personal health data,

• to learn the purpose of processing of personal data and whether they are used in accordance with their purpose,

• to know the third parties to whom personal data are transferred in Turkey or abroad,

• to request the rectification of personal data if they have been processed incompletely or inaccurately,

• to request the erasure or destruction of personal data,

• to request that the operations carried out regarding the rectification of personal data processed incompletely or inaccurately and/or the erasure or destruction of personal data be notified to the third parties to whom the personal data have been transferred,

• to object to the occurrence of a result to the detriment of the person through the analysis of the processed data exclusively by means of automated systems,

• to request compensation for the damage in the event that you suffer damage due to the unlawful processing of personal data; you are entitled to these rights.

Data Security and Right of Application

Your personal data are meticulously protected within the scope of technical and administrative means, and the necessary security measures are ensured at a level appropriate to possible risks, taking into account technological possibilities as well.