KVKK

Data Protection and Processing Policy

This policy; Law No. 6698 on the Protection of Personal Data and relevant legislation, has been prepared to explain the purposes for which the personal data of our patients, their companions, visitors, employees, and the employees of institutions and organizations we collaborate with are processed, how such data is protected, and the rights of the individuals concerned.

Our clinic adheres to the principles of legality, transparency, integrity, proportionality, and respect for patient privacy in the processing and protection of personal data.

Definitions

Informed Consent: Refers to consent that is specific to a particular matter, based on information provided, and freely given.

Personal Data: Any information relating to an identified or identifiable natural person. Information such as name, surname, Turkish ID number, passport information, phone number, email address, address information, and date of birth falls under the scope of personal data.

Processing of Personal Data: Any operation performed on personal data, such as collection, recording, storage, retention, modification, transfer, classification, or deletion.

Data Controller: A natural or legal person who determines the purposes and methods of processing personal data.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.

Anonymization: The process of rendering personal data incapable of being associated with an identified or identifiable individual.

Purposes of Collecting and Processing Personal Data

Our clinic may process personal data for the purposes of examination, diagnosis, treatment, surgical planning, patient follow-up, appointment management, communication, billing, compliance with legal obligations, and the safe provision of healthcare services.

Your personal data may be collected verbally, in writing, or digitally through our clinic, our physicians, our healthcare staff, our patient advisors, our website, our contact forms, telephone, email, WhatsApp, online appointment systems, and similar channels.

In this context, your personal data may be processed for the following purposes:

• The provision of medical diagnosis, treatment, and care services,
• Planning of ear, nose, and throat (ENT) diseases, rhinoplasty, and functional nasal surgery procedures,
• Scheduling of examination, surgery, and follow-up appointments,
• Informing patients about their appointment and treatment processes,
• Verifying patient identity,
• Providing healthcare services in compliance with regulations,
• Measuring patient satisfaction and improving service quality,
• Creating and storing medical records,
• Conducting billing and financial processes,
• Compliance with legal and regulatory obligations,
• Sharing information requested by the Ministry of Health and other authorized public institutions,
• Taking necessary technical and administrative measures regarding information security,
• Planning and managing the clinic’s internal operations.

Categories of Personal Data Processed

The categories of personal data that may be processed by our clinic are as follows:

Identification Information: First name, last name, Turkish ID number, passport information, date of birth, gender, and similar identification information.

Contact Information: Phone number, email address, address information, and other contact details.

B Health Data: Examination information, diagnosis, treatment, surgical plan, medical history, medications used, laboratory results, imaging records, pre- and post-operative evaluations.</ p>

B Financial Information: Invoice, payment, collection, and financial transaction information.

Visual and Audio Records: Photographs, videos, or audio recordings obtained with the patient’s consent.

Transaction Security Information: IP address, website usage information, log records, and technical security data.

Legal Proceedings Information: Information regarding legal obligations, requests from official authorities, and legal applications and processes.

Basic Principles for the Processing of Personal Data

Op. Dr. Songül Dursun Clinic adheres to the following principles when processing personal data:

Processing in accordance with the law and the principles of good faith,

• Maintaining accurate and, where necessary, up-to-date data,
• Processing for specific, explicit, and legitimate purposes,
• Processing that is relevant, limited, and proportionate to the purpose for which it is processed,
• Retention for the period prescribed by applicable legislation or necessary for the purpose of processing.

Your personal data may be processed based on one or more of the conditions specified in the KVKK:

• Your explicit consent,
• Explicit provision in the law,
• The inability to obtain consent due to practical impossibility,
• It is necessary for the establishment, exercise, or protection of a right,
• Processing within the scope of legitimate interests, provided it does not infringe upon fundamental rights and freedoms.

Special categories of personal data, such as health data, are processed only in accordance with applicable legislation and with the necessary administrative and technical safeguards in place.

Processing of Special Category Personal Data

Your health data may be processed by individuals or authorized institutions and organizations subject to a duty of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment, the provision of care services, and the planning and management of health services.</ p>

Our clinic takes the necessary technical and administrative measures to ensure the secure storage of special category personal data and to protect it against unauthorized access.

Technical and Administrative Measures

Our clinic implements the following technical and administrative measures to ensure the security of personal data:

• Security measures are taken to prevent unauthorized access.
• Strong encryption methods are used in computer, email, and digital systems.
• Only authorized personnel may access personal data.
• Patient records and health data are protected in accordance with privacy principles.
• Employees and service providers are informed about their confidentiality obligations.
• The necessary infrastructure is provided to ensure the secure storage of physical and digital records.
• Personal data processing procedures are conducted in compliance with the law.
• Legal and technical consulting is sought when necessary.

Transfer of Personal Data

Your personal data may be shared with the following individuals, institutions, and organizations in accordance with the Personal Data Protection Law (KVKK) and relevant legislation, provided that such sharing is limited to the purposes specified above:

• Ministry of Health and its affiliated institutions,
• Authorized public institutions and organizations,
• Social Security Institution,
• Private insurance companies,
• Laboratories and imaging centers,
• Contract healthcare providers,
• Legally authorized individuals and institutions,
• Consulting, IT, accounting, and support service providers,
• Third parties authorized under your explicit consent or legal obligation.

Camera Recordings and Physical Security

Camera recordings may be made at our clinic for security purposes. Camera recordings are processed solely for security purposes and are retained for the duration required by applicable laws and regulations.

Only authorized personnel may access these recordings. Camera recordings are not shared with third parties except as required by law or upon request by authorized authorities.

Website and IP Logs

This data may be used to ensure the security of the website, improve the user experience, and analyze technical issues.

Rights of the Data Subject

As a data subject under the KVKK, you have the following rights:

• To learn whether your personal data is being processed,
• If so, to request information regarding such processing,
• To learn the purpose of the processing of your personal data,
• To learn whether the data is being used in accordance with its purpose,
• To request the correction of incomplete or incorrectly processed data,
• Requesting the erasure or destruction of personal data in accordance with legal requirements,
• Requesting that third parties to whom the data has been transferred be notified of the correction, erasure, or destruction,
• Objecting to a decision made through automated systems that results in a negative outcome for the individual,
• You may submit a written request to our clinic to exercise these rights.

Copyright and Content Usage

All text, images, designs, logos, brand elements, and other content on drsongul.com belong to Op. Dr. Songül Dursun.

This content may not be copied, reproduced, distributed, modified, used for commercial purposes, or shared with third parties without written permission.

In the event of unauthorized use, we reserve our legal and criminal rights under applicable laws.

Effective Date

This policy takes effect as of the date it is published on the drsongul.com website.

Op. Dr. Songül Dursun Clinic reserves the right to make changes to this policy as deemed necessary. The updated policy text becomes effective as soon as it is published on the website.

You can contact us regarding the KVKK or requests related to the protection of personal data:

info@drsongul.com