EXPLANATORY NOTE FOR PATIENTS/BENEFICIARIES UNDER THE PERSONAL DATA PROTECTION ACT NO. 6698
Purpose and scope of the notice
As an economic entity of the Balat Or-Ahayim Private Jewish Hospital Foundation, we take measures to protect your personal data in accordance with the Personal Data Protection Law No. 6698 (“PDPL” or “Law”). As the “data controller”, we process your personal data in accordance with the PDPL and related legislation for the purposes and in the manner set out below.
The information text on the processing of personal data by the Balat Or-Ahayim Private Jewish Hospital Foundation has been prepared in accordance with Article 10 of the PCPD, entitled “The Data Controller’s Duty to Inform”. The purpose of this document is to inform you as transparently as possible about the identity of the data controller, the method and legal basis for the collection of your personal data, the purposes for which the data is processed, to whom the data may be disclosed and for what purposes, the duration of the data processing and your rights pursuant to Article 11 of the Code.
The explanations given in the “Your personal data” notice also apply to “Special categories of personal data”.
Data Controller
Company Name: Balat Or-Ahayim Private Jewish Hospital Foundation Economic Enterprise
Address: Ayvansaray Mah. Ayvansaray Cad. Musevi Hastanesi Blok No:2 Fatih, Istanbul / Turkey
(This entity will be referred to as the “Company” under this Explanatory Note.)
Collection methods and legal basis of your personal data
Your personal data may be collected through automated or non-automated methods, including the Company’s affiliates, website, social media platforms, call centres, mobile applications, software used within the Company for operational activities, video recordings, and through oral, written or electronic means. Your personal data may be processed, created and updated for the duration of your relationship with the Company and may be stored both digitally and physically under secure conditions.
Method of Collection and Legal Basis of Your Personal Data
Your personal data will be processed in accordance with the purposes indicated under the heading “Personal data processed and purposes of processing” and in compliance with article 5, paragraph 1, of law no. 6698, based on the conditions for obtaining explicit consent or in accordance with the following provisions of article 5, paragraph 2:
1- a) When expressly required by law,
2- b) when it is necessary to protect the life or physical integrity of a person who is physically incapable of giving consent or whose consent is legally invalid,
- c) when the processing of the personal data of the parties is necessary for the establishment or performance of a contract; or
- d) when it is necessary for the controller to comply with its legal obligations
1- e) processing is necessary for the establishment, exercise or defence of legal claims
2- f) if processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not violated.
Your special categories of personal data relating to health will be processed in accordance with the purposes described in the section entitled “Personal data processed and purposes of processing” and in accordance with paragraph 2 of Article 6 of Law no. 6698, either subject to your express consent or in accordance with the provisions of paragraph 3, and will be collected by authorised persons under an obligation of confidentiality. This includes purposes related to the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.
Processed Personal Data
Your personal data is processed securely in accordance with the Personal Data Protection Law, either due to legal obligations or in order to provide better service in the company’s operations and transactions.
In this context, the following types of personal data are collected:
Identity/Passport: This data group contains information about a person’s identity. (e.g., Name, Surname, Date of Birth/Place of Birth, National ID Number, Gender, Social Security Registration Number, Nationality, Marital Status)
Contact Information: This data group includes information that can be used to reach the person. (e.g., Phone Number, Address, Email Address)
Physical Space Security: This data category includes information such as entry/exit records and camera recordings. (e.g., Camera Footage)
Transaction Security: This data category includes information such as IP address, website logins/logouts, passwords, and other security-related data. (e.g., Security Keys, Log Records, IP Addresses)
Financial Information: This data group contains information about the person’s financial details. (e.g., Bank Account Number, IBAN Information)
Visual and Auditory Records: This data group includes visual and auditory data about the person. (e.g., Photographs, Video Recordings)
Health Information: This data group contains information about the person’s health. (e.g., Blood Type, Medical History, Check-Up Results, Consultation Reports, Diet Forms, Surgical Information, Treatment Methods, Disease Types, Medications Used, Eye Retina Imaging, Medical Values, Test Results)
Professional Information: This data category includes information related to the person’s profession. (e.g., Profession, Workplace Information)
–
–
–
–
Purposes of processing your collected personal data:
To allow individuals and/or legal entities (such as employees, visitors, patients, suppliers, business partners, etc.) associated with the Company to benefit from the Company’s products and services through the necessary operations carried out by the relevant business units,
To ensure the safety of life and property, as well as the legal and commercial security of third parties, institutions and organisations (individuals or legal entities) present in the Company’s operational centres or units,
To store camera footage and ensure discipline, security and supervision when physically present at the locations where the Company’s operations are carried out,
To notify our patients of appointments, provide information and send reminders when an appointment has been made,
To plan, manage and provide necessary medicines for internal operations, patient examinations and daily activities,
To comply with legal and regulatory requirements arising from various laws and regulations, including but not limited to: Turkish Commercial Code No. 6102, Turkish Code of Obligations No. 6098, Consumer Protection Law No. 6502, Personal Data Protection Law No. 6698, Tax Procedure Law No. 213, Social Insurance and General Health Insurance Law No. 5510, Basic Health Services Law No. 3359, Health Ministry and Basic Health Services Law No. 3359, the Law on the Organisation of the Ministry of Health and its Affiliated Institutions No. 663, the Regulation on the Improvement and Evaluation of the Quality of Health Services No. 29399, the Regulation on Private Hospitals, the Regulation on the Processing of Personal Health Data and the Protection of its Privacy, the Regulation on Archive Services, and all other related laws and secondary regulations,
To comply with the audit or regulatory duties of competent public institutions and professional organisations with the nature of public institutions,
To fulfil requests for information and documents from judicial and/or administrative authorities,
To carry out listing, reporting and verification analysis studies on the use of the products and services offered, to generate statistical and scientific data, to improve the products and services, to increase customer satisfaction and to make adjustments based on this information,
To carry out market research, advertising and the necessary dissemination of information about our products and services, to deal with complaints and suggestions and to contact you directly through the communication channels shared with the company,
To plan and manage the financing of all services provided and to carry out billing,
To carry out risk management and quality improvement activities,
Fulfil obligations relating to offers, promotions, exemptions, etc. under agreements with private insurance companies and/or other institutions,
To implement all necessary technical and administrative measures for system and application security within the scope of data protection,
To maintain public order and health,
To manage and provide healthcare services, including medical diagnosis, treatment and care, as well as the procurement of medical supplies,
To process professional information and determine whether an illness is related to occupational diseases for the purposes of medical examination.
To whom and for what purpose your processed personal data may be transferred.
In accordance with the Personal Data Protection Act (KVKK) and relevant health legislation, and by ensuring that all necessary technical and administrative measures are taken to maintain an appropriate level of security, your personal data may be processed for the purposes described above;
- To legally authorized public institutions and organizations, in line with their requests and limited to the purposes of such requests,
- To private insurance companies and banks, for the execution and continuity of financial services,
- To attorneys or law firms, for the purpose of pursuing legal matters,
- To domestic and international organizations with which we collaborate or from which we receive or provide contractual services to carry out our activities.
It may be transferred in accordance with the personal data processing conditions specified in Articles 8 and 9 of the Personal Data Protection Law.
Duration of Data Processing and Retention Period
Your personal data will be processed solely for the purposes specified in this Clarification Text, in compliance with the data processing and statute of limitations periods set forth in all applicable laws and regulations binding on our firm. In the event of any changes to the data processing periods prescribed by law, the updated periods shall be adhered to.
In accordance with the principle of purpose limitation, your personal data will be processed only for the duration required to achieve the purposes outlined in this Clarification Text. In all circumstances, it will be processed within the timeframe necessitated by the firm’s practices and the norms of commercial life. Following the expiration of these periods, your personal data will be deleted, destroyed, or anonymized.
Your Rights
As a data subject, you have the following rights under applicable legislation:
- To inquire whether your personal data is being processed and, if so, to request information on how it is being processed (Right to access information) (KVKK Article 11/(a), (b)).
- To learn the purpose of processing your personal data and whether it is being used in accordance with the intended purpose (KVKK Article 11/c).
- To know the third parties to whom your personal data has been transferred (KVKK Article 11/ç).
- To request the correction of your personal data if it is inaccurate or incomplete (KVKK Article 11/d).
- To request the deletion of your personal data if the reasons for processing no longer exist (KVKK Article 7, Article 11/e).
- To request that third parties to whom your personal data has been transferred be informed of any corrections or deletions made to your personal data (KVKK Article 11/f).
- To object to any results derived from the analysis of your processed data that are contrary to your interests (KVKK Article 11/g).
- To request the restriction of processing (KVKK Article 7).
- To request compensation if you suffer damage as a result of the unlawful processing of your personal data (KVKK Article 11/ğ).
The aforementioned rights are restricted by law and may be provided by us solely under specific conditions. (Please review Articles 10 and 13 of the Personal Data Protection Law in particular).
In the event that you wish to exercise the aforementioned right…
Exercising the Rights of the Data Subject:
As a data subject, you may exercise your rights under Article 11 of the Law by submitting your requests in writing to the address “Ayvansaray Mah. Ayvansaray Cad. Musevi Hastanesi Blok No:2 Fatih, Istanbul / Turkey” or by sending an email to kvkk@balathastanesi.com.tr, provided that your email address is registered in the company’s system, in accordance with the “Regulation on Procedures and Principles for Applications to the Data Controller.”
You can access the relevant procedure on our institution’s website or by making a request to the relevant personnel.
Protection of Personal Data
The Special Balat Or-Ahayim Jewish Hospital Foundation Economic Enterprise is obligated to take all necessary physical, technical, and administrative measures to ensure an adequate level of security in order to prevent the unlawful processing of your personal data, prevent unauthorized access to your personal data, and ensure the safekeeping of your personal data. The enterprise takes these measures to the greatest extent possible.
Your personal data may be updated by us at all times as a reasonable data controller.
Right to File a Complaint with the Board (KVKK Articles 13, 14, 15)
Board: Personal Data Protection Board
Address: Nasuh Akar Mah. Ziyabey Cad. 1407. Sok. No: 4, 06520 Balgat-Çankaya/ Ankara, Turkey
Phone: +90 312 216 5000
Website: http://www.kvkk.gov.tr/
