Personal Data Protection and Information Text

MEDICELL HEALTH SERVICES TRADE LTD. CO. (MEDICELL MEDICAL CENTER)
POLICY ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

CONTENTS

1.DEFINITIONS
2.PURPOSE OF THE POLICY
3.PRINCIPLES OF PROCESSING PERSONAL DATA
4.CONDITIONS AND EXCEPTIONAL CIRCUMstances FOR PROCESSING PERSONAL DATA
5.CLASSIFICATION OF PERSONAL DATA
6.CATEGORY OF DATA SUBJECT TO WHICH PERSONAL DATA IS RELATED
7.PURPOSES AND METHODS OF PROCESSING PERSONAL DATA
a. Personal Data of Patients
b. Personal Data of Visitors
c. Personal Data of Business and Solution Partners
d. Personal Data of Job Applicants
e. Personal Data of Employees
ENSURING THE SECURITY OF PERSONAL DATA
TRANSFER OF PERSONAL DATA WITHIN AND OUTSIDE THE COUNTRY
DESTRUCTION OF PERSONAL DATA
RIGHTS OF THE PERSONAL DATA SUBJECT
FINAL PROVISIONS

1. DEFINITIONS

Explicit Consent: Consent given freely and based on informed knowledge regarding a specific matter.
Anonymization: Making personal data impossible to link to an identified or identifiable natural person, even when combined with other data.
Patient: A person who applies to our institution for examination and treatment and receives outpatient treatment.
Personal Data: Any information relating to an identified or identifiable natural person.
Processing of Personal Data: Any operation performed on personal data, such as obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of data, whether wholly or partly automated or non-automated, provided that it is part of a data recording system.
Data Subject: The natural person whose personal data is processed. Special Category Personal Data: Data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are considered special category personal data.
Third Party: Third-party individuals (e.g., employees or officials of companies providing services, companions, etc.) who are related to the aforementioned parties in order to ensure the security of commercial transactions between our institution and these parties or to protect the rights and provide benefits of these individuals.
Data Processor: A natural or legal person who processes personal data on behalf of the data controller, based on the authority given by the data controller.
Data Controller: A natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. Visitor: Natural persons who have entered the physical areas owned by our institution for various purposes or who have visited our websites.

2. PURPOSE AND SCOPE OF THE POLICY

This Policy regulates the procedures and principles adopted and to be implemented by our company in order to comply with the Law No. 6698 on the Protection of Personal Data ("KVKK"), published in the Official Gazette dated 07.04.2016 and numbered 29677, the Regulation on the Processing of Personal Health Data and Ensuring Privacy, published in the Official Gazette dated 20.10.2016 and numbered 29863 ("Regulation"), and the regulations regarding the amendments to this Regulation and related legal regulations, within the scope of the data controller's obligation to inform. The principles regarding the processing of personal data and personal health data processed by our company, the purposes and conditions of processing this data, its transfer within and outside the country, its destruction, and the application and principles regarding your rights on the processed data are notified to you below. Medicell Medical Center will comply with the Personal Data Protection Law (KVKK) and other relevant regulations, and will act in accordance with the procedures and processes set forth in this Policy regarding the processing, use, destruction, transfer, and other aspects of your personal data in accordance with the Law and other regulations.

3. PRINCIPLES OF PROCESSING PERSONAL DATA

Medicell Medical Center carries out its personal data processing activities in accordance with the principles and guidelines listed below, pursuant to Article 4 of the KVKK (Law on Protection of Personal Data), which regulates the procedures and principles regarding the processing of personal data.
a. Compliance with the Law and the Rule of Honesty: Medicell Medical Center processes your personal data in accordance with the KVKK and other laws and regulations that must be complied with due to the nature of the work performed.
b. Accuracy and Up-to-Date Data: Medicell Medical Center takes the necessary steps and technical and administrative measures to ensure that the personal data provided by the data subject is not altered without authorization and inaccurately, and to update the personal data upon request by the data subject when there is a change in the processed data.
c. Processing for Specific, Clear and Legitimate Purposes: Your personal data processed by Medicell Medical Center is processed in accordance with the processing purpose notified to you and within the framework notified.
d. Relevant, Limited and Proportional to the Processing Purpose: Medicell Medical Center does not process personal data that is inconsistent with its activities, not required within the scope of the company's activities, or that exceeds the processing purpose. e. Retention for the Period Stipulated in the Relevant Legislation or Necessary for the Purpose for Which They Are Processed: Your data processed within the framework of the KVKK (Personal Data Protection Law) and other relevant laws and regulations is retained for the periods stipulated in the relevant legislation or for the periods required by the nature of the personal data being processed.

4. CONDITIONS AND EXCEPTIONS FOR PROCESSING PERSONAL DATA

-General personal data to be processed within the scope of the company's activities;
a) Provided that the explicit consent of the data subject is obtained, or;
b) If explicitly provided for in the laws,
-If it is necessary for the protection of the life or physical integrity of the person who is unable to express their consent due to factual impossibility or whose consent is not legally valid, or of another person,
-If it is necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract,
-If it is necessary for the data controller to fulfill its legal obligations,
-If the data has been made public by the data subject,
-If it is necessary to process the data for the establishment, exercise or protection of a right,
-If it is necessary to process the data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,
If one of these conditions exists, it may be processed without obtaining the explicit consent of the data subject. Special personal data to be processed within the scope of the company's activities;
Medicell Medical Center meticulously adheres to the regulations stipulated in the Personal Data Protection Law (KVKK) when processing personal data classified as "special categories." Article 6 of the KVKK defines certain personal data as "special categories," meaning that their unlawful processing carries the risk of causing harm or discrimination to individuals. These include data related to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
In accordance with the Personal Data Protection Law (KVK Law), special categories of personal data are processed in the following cases, provided that adequate measures determined by the KVK Board are taken:
• If the personal data owner has given their explicit consent, or
• If the personal data owner has not given their explicit consent;
– Special categories of personal data other than the personal data owner's health and sexual life are processed in cases stipulated by law,
– Special categories of personal data relating to the personal data owner's health and sexual life are processed only by persons or authorized institutions and organizations under an obligation of confidentiality for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.

5. CLASSIFICATION OF PERSONAL DATA

Identity Information; Information written on your national identity card, including but not limited to: name, surname, mother's name, father's name, place of birth, date of birth, marital status, religion, blood type, registered province, district and neighborhood. Contact Information; Your contact information requested from you or provided by you for the purpose of contacting you; such as home phone number, mobile phone number, residential address or other address information, e-mail address. Customer Information; Information that clearly belongs to an identified or identifiable natural person, processed partially or completely automatically or non-automatically as part of a data recording system; information obtained and produced about the relevant person as a result of our commercial activities and the operations carried out by our business units within this framework. Customer Transaction Information; Information that clearly belongs to an identified or identifiable natural person and is included in the data recording system; such as records related to the use of our products and services, and the instructions and requests necessary for the customer's use of products and services. Personal Information; Required documents include: Criminal record certificate, Passport-sized photograph, Document indicating family status, Military service status certificate, Employment contract/Service contract, Social Security registration form, Criminal record certificate, Information and documents regarding your health status. Also required are: Photocopy of identity card, Population registration certificate, Residence certificate, Health report, Photocopy of diploma. Physical Premises Security; Personal data clearly belonging to an identified or identifiable natural person and included in the data recording system; records and documents relating to entry into and stay within a physical premises.
Transaction Security Information; Your personal data clearly belonging to an identified or identifiable natural person and included in the data recording system; processed to ensure our technical, administrative, legal, and commercial security while conducting our commercial activities.
Legal Transaction Information; Your personal data clearly belonging to an identified or identifiable natural person, processed partially or completely automatically or non-automatically as part of a data recording system; processed within the scope of determining and tracking our legal receivables and rights, fulfilling our obligations, complying with our legal obligations and the Institution's policies.
Marketing Information; Personal data clearly belonging to an identified or identifiable natural person, processed partially or completely automatically or non-automatically as part of a data recording system; Personal data processed for the purpose of customizing and marketing our products and services according to the data subject's usage habits, preferences, and needs, and the reports and evaluations generated as a result of this processing.Financial Information; Personal data processed in whole or in part automatically or non-automatically as part of a data recording system, which clearly belongs to an identified or identifiable natural person; information, documents and records showing any financial results created according to the type of legal relationship established by the Institution with the personal data owner. Curriculum Vitae Information; Your education information, school information, certificate information, educational status and information about your trainings, as written in your CV or requested by the company or provided by you; information about your work experience, including location, date and duration, information about the job and position you previously held, and all kinds of information about your work experience, as written in your CV or requested by the company or provided by you; your references and information about your references as written in your CV. Visitor Information; Name, surname, visiting hours, vehicle license plate (if any), person visited and other information of visitors to the company. Health Data; Data related to health and sexual life obtained during the provision of medical diagnosis, treatment, and care services, including but not limited to laboratory and imaging results, test results, examination data, prescription information, and check-up information submitted by patients visiting our hospital or obtained through procedures performed in our hospital. Biometric Data; Fingerprint/palm scan data, which is a legal requirement for performing procedures on patients visiting our hospital, and fingerprint data taken for attendance/work record keeping for employees.

6. CATEGORY OF DATA SUBJECTS RELATED TO PERSONAL DATA

Identity Information; Customer, Job Applicant, Employee, Hospital Shareholder, Hospital Official
Contact Information; Customer, Job Applicant, Employee, Hospital Shareholder, Hospital Official
Location; Customer, Job Applicant, Employee, Hospital Shareholder, Hospital Official
Customer Information; Customer
Customer Transaction Information; Customer
Physical Security; Customer, Job Applicant, Employee, Hospital Shareholder, Hospital Official, Visitor, Third Party, Supplier employee and official
Transaction Security; Customer, Visitor, Third Party, Hospital Officials
Visual and audio recordings; Customer, Employee, Visitor, Third Party, Hospital Officials
Financial Information; Customer, Employee, Hospital Shareholder, Hospital Official, Employees, Shareholders and Officials of Institutions with which we cooperate
Personnel Information; Employee, Hospital official
Legal Transaction; Customer, Potential Customer, Employee, Job Applicant, Hospital Shareholder, Hospital Official, Visitor, Employees, Shareholders and Officials of Institutions We Collaborate With, Third Party
Criminal Conviction and Security Measures; Job Applicant, Employee, Hospital Official, Hospital Shareholders
Marketing Information; Customer, Potential Customer
Health Information; Customer, Job Applicant, Employee, Hospital Official, Hospital Shareholders
Biometric Data (Fingerprint, Palm Print); Customer, Employee

7. PURPOSES AND METHODS OF PERSONAL DATA PROCESSING

As Medicell Medical Center;
- Managing emergency processes,
- Protecting public health, conducting preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and their financing,
- Maintaining data that must be kept by us in accordance with relevant legislation,
- When the processing of personal data is directly related to the establishment and performance of a contract,
- When it is necessary for our medical center to fulfill its legal obligations,
- Taking appointments, providing information and reminders,
- Carrying out the administrative, commercial and economic activities of the medical center,
- Ensuring the security of the medical center,
- Fulfilling obligations arising from the law and contracts,
- Conducting the necessary examinations and evaluations for the health services provided,
- When it is necessary to carry out personal data processing activities for the legitimate interests of our hospital, provided that it does not harm the fundamental rights and freedoms of individuals,
- Sharing the requested information by notifying the Ministry of Health, the Social Security Institution and other relevant public institutions and organizations as stipulated in the relevant legislation regarding health services,
- Regulatory and supervisory public/private We process personal data of patients, visitors, business partners, employees, and employee candidates who receive services at our hospital within the scope of all our administrative and commercial activities, for the following purposes and limited to:
- Providing necessary information to legal entities and official institutions upon request or audit;
- Carrying out billing and financial reconciliation processes in line with the health services offered at our medical center;
- Measuring patient/visitor satisfaction and responding to questions and complaints submitted to us; and making improvements in areas deemed necessary. Accordingly, the categories of personal data owners and the types of personal data processed for individuals within these categories are detailed in the table above;
a. Regarding Personal Data of PatientsThe following personal data of patients may be processed by your hospital:
-Name, surname, Turkish Republic Identity Number, passport or temporary Turkish Republic Identity Number, place/date of birth, marital status, gender, transaction number and other personal data used to identify and verify the patient's identity;
-Telephone, address, and e-mail address information for communication purposes;
-Voice recordings of conversations with call centers and relevant physical or electronic written documents in case of written communication, in order to follow up on any complaints, notifications or questions and to carry out the necessary processes;
-Contact information for making appointments and providing information;
-All kinds of laboratory, imaging and test results, examination information, diagnosis and prescription information, check-up information within the scope of activities for the protection of public health, preventive medicine, medical diagnosis, treatment and care services.
b. Regarding Personal Data of Visitors:
- Images of individuals visiting our hospital within the scope of camera surveillance and recording activities carried out to ensure internal order and security,
- Visitor information, including visitor forms signed during visits and visitor list records kept in the company system, may be processed in order to identify the relevant person in case of any dispute/wrongful act or other situation.
c. Regarding Personal Data of Business and Solution Partners:
- To ensure workplace security, commercial security and economic security,
- To enable our relevant departments to carry out the necessary workflow processes in order to improve the services offered by Medicell Medical Center and ensure product satisfaction,
- To establish necessary contracts and maintain contact within the scope of the business process,
- To fulfill legal and contractual obligations, your personal data may be processed.
d. Personal Data of Job Applicants are Processed as follows:
- To initiate, conduct, and conclude recruitment processes at Medicell Medical Center hospitals and workplaces, to record recruitment processes, and to monitor and improve recruitment processes and procedures;
- To forward job applications and resumes to the appropriate departments and units to check suitability for the job and to proceed to the interview process;
- To determine and examine whether you meet the necessary qualifications for the position you are applying for during the job application process and in any process carried out during the job application period;
- To contact your references and obtain references about you;
- To contact you as a result of the evaluation made at the end of the job application process;
- To inform you about job opportunities by conducting the necessary evaluations again if a suitable position opens up later;
- To monitor and record with cameras for the purposes of ensuring internal order and security of the company; e. Regarding Personal Data of Employees:
- Camera surveillance and recording to ensure internal order and security within the company,
- Monitoring of email communications by authorized persons to ensure the security and continuity of internal communication channels and business processes,
- Monitoring of electronic devices provided by the hospital to determine whether they are used in accordance with their intended purpose and to ensure their security,
- Ensuring that company lines are used proportionally to their intended purpose,
- Monitoring the location of vehicles provided by the hospital to determine whether they are used in accordance with their intended purpose and to ensure the security of these vehicles,
- Sharing necessary information with the transportation company to provide transportation services to employees,
- Using relevant programs within the hospital for workflow purposes and performance evaluations,
- Performing necessary procedures to provide company lines, vehicles, meal cards, business cards and other tools and equipment provided by the company,
- Debts arising from relevant legislation and employment contracts. and to fulfill obligations,
-To obtain timekeeping and overtime records in accordance with the procedure and truth,
-To make notifications to public institutions and organizations and all authorized public/private legal entities within the scope of the relevant legislation and to provide the necessary documents in audits, your identity information, personnel information, bank account information, contact information and other personal data may be processed in line with the purposes and methods.

8. ENSURING THE SECURITY OF PERSONAL DATA

As Medicell Medical Center, we implement the necessary technical and administrative measures, within the framework of the necessary technological infrastructure, to ensure the security of your personal data that we process within the scope of our company activities, in accordance with the KVKK (Personal Data Protection Law) and relevant legislation; in this regard, we take precautions against data breaches, unauthorized access, data loss, unauthorized modification of data, and other threats, and carry out the necessary audits.
In this context, we identify existing risks and threats, conduct awareness studies by training our employees, and determine policies and procedures regarding personal data security.
▪ Technical Measures Taken to Ensure the Lawful Storage of Your Personal Data and Prevent Unlawful Processing and Access
- Personal data storage, processing, and access activities are monitored with established technical systems.
- The technical measures taken are reported to the relevant parties.
- Personnel knowledgeable in technical matters are employed.
- Access rights are restricted, cryptographic control and key management are used, and permissions are reviewed regularly.
- Software and hardware including virus protection systems and firewalls are used.
- Backup programs are used in accordance with the law to ensure the secure storage of personal data.
- Access to data storage areas containing personal data is logged, and inappropriate access or access attempts are immediately communicated to the relevant parties.
▪ Administrative Measures Taken to Ensure the Lawful Storage of Personal Data and Prevent Unlawful Processing and Access
- Employees are informed and trained on personal data protection law and the lawful storage and processing of personal data.
- Personnel who will process, store, and access personal data have been identified in the personal data processing inventory.
- All activities carried out are analyzed in detail for each department, and as a result of this analysis, personal data processing activities are revealed in relation to the commercial activities carried out by the relevant business units.
- Awareness is created and application rules are determined for the relevant departments to ensure the legal compliance requirements determined on a departmental basis; - Necessary administrative measures to ensure the monitoring of these issues and the continuity of the application are implemented through internal hospital policies and training.
- Employees are informed that they cannot disclose personal data they learn to others in violation of the provisions of the Law No. 6698 on the Protection of Personal Data, and that they cannot use it for purposes other than the processing purpose, and that this obligation continues even after they leave their positions, and the necessary commitments are obtained from them in this regard.
- Clauses are included in the contracts and documents governing the legal relationship between employees, imposing an obligation not to process, disclose, or use personal data, except for the instructions of Medicell Medical Center and the exceptions provided by law, and employees are made aware of this issue. In addition, in accordance with the data security principles stipulated within the scope of the KVKK (Law on the Protection of Personal Data), we ensure the minimization of personal data, create the necessary confidentiality agreements with data processors, provide our employees with the necessary training to ensure the security of personal data and prevent breaches, and take the necessary measures for the security of personal data kept in both electronic and physical environments.

9. TRANSFER OF PERSONAL DATA WITHIN AND OUTSIDE THE COUNTRY

Your personal data and personal health data are transferred within the framework of the purposes explained in this policy text and the Law No. 3359 on Basic Health Services, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, Law No. 6698 on the Protection of Personal Data, the Private Hospitals Regulation, the Regulation on the Processing of Personal Health Data and the Protection of Privacy, and related regulations;

-In order to fulfill our contractual and legal obligations and to carry out the administrative, commercial and economic activities of our hospital, your personal data is transferred to the Ministry of Health, the Social Security Institution, the General Directorate of Security and other law enforcement agencies, the General Directorate of Population, courts and enforcement offices, the Turkish Pharmacists Association, regulatory and supervisory institutions, insurance companies, representatives authorized by patients, cooperating laboratories and other centers, and to Electronic Medical Records and Electronic Health Records systems. -In order to improve the efficiency of Medicell Medical Center and its recruitment policies, and to ensure sustainability, your personal data may sometimes be transferred to third parties.
-For the administration and management of hospital operations, the execution of hospital tasks, the implementation of hospital policies, and the efficient management and execution of workflows, your personal data may be transferred to third parties for data storage purposes, personnel attendance control system applications, and backup systems. -The personal data of our current employee candidates, employees, suppliers, patients, and shareholders, as stated in this policy, are never transferred abroad.

10. DESTRUCTION OF PERSONAL DATA

Personal data processed within the scope of Medicell Medical Center's activities are stored for the purposes of processing and for the periods necessary to achieve these purposes, and for the retention period stipulated in the relevant legislation. Data that has lost its function, whose retention period has expired, or which the data owner requests to be destroyed if possible within the framework of legislation, shall be destroyed using the appropriate method from the methods of deletion, destruction, or anonymization of personal data listed in Article 7 of the KVKK (Personal Data Protection Law).
Deletion of personal data is the process of making personal data completely inaccessible and unusable for the relevant users.
Destruction of personal data is the process of making personal data completely inaccessible, irretrievable, and unusable by anyone.
Anonymization of personal data is the process of making personal data such that, even if it is matched with other data, it cannot be linked in any way to an identified or identifiable natural person.

11. RIGHTS OF THE DATA SUBJECT

Regarding personal data processed within the scope of Medicell Medical Center's activities, the data subject may exercise their rights as stipulated in Article 11 of the Personal Data Protection Law and Article 10 of the Regulation by applying to Medicell Medical Center or by filling out a form at www.medicell.com;
- To learn whether personal data and/or personal health data are being processed,
- To request information regarding the processing of personal data and/or personal health data, if it has been processed,
- To access and request personal health data,
- To learn the purpose of processing personal data and/or personal health data and whether it is being used in accordance with its purpose,
- To know the third parties to whom personal data and/or personal health data have been transferred, domestically or abroad,
- To request the correction of personal data and/or personal health data if they are incomplete or inaccurate,
- To request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK (Personal Data Protection Law) and the deletion of personal health data within the framework of the conditions stipulated in the amended Article 9 of the Regulation,
- To request that the actions taken in accordance with the principles specified in subparagraphs (f) and (g) of this article be notified to the third parties to whom personal data/personal health data have been transferred,
- To object to a result that is detrimental to the individual arising from the analysis of processed data exclusively through automated systems. - Individuals have the right to claim compensation for damages incurred due to the unlawful processing of personal data. However, our company may reject the applicant's application, stating the reasons, in the following cases: - Processing of personal data for purposes such as research, planning, and statistics through official statistics and anonymization. - Processing of personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy, or personal rights, or constitute a crime. - Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security. - Processing of personal data by judicial authorities or enforcement agencies in relation to investigation, prosecution, trial, or execution proceedings. - When the processing of personal data is necessary for the prevention of crime or for criminal investigation. - When the personal data has been made public by the data subject themselves. - When the processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigation or prosecution, by authorized and competent public institutions and organizations, and professional organizations with the status of public institutions, based on the authority granted by law. - When the processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budget, tax and financial matters. - When the request of the personal data subject may infringe upon the rights and freedoms of other individuals.
- When requests requiring disproportionate effort have been made. - When the requested information is publicly available.

12. FINAL PROVISIONS

If you exercise your rights mentioned above and make an application to Medicell Medical Center regarding the matters mentioned above, your requests will be processed free of charge within a maximum of thirty (30) business days, depending on the nature of the request. However, if the process requires additional costs for us, it may be possible to request the fee specified in the tariff determined by the Personal Data Protection Board.
You can apply in writing to the address below by filling out the form on the Company's website or by personally proving your identity regarding matters related to the processing of your personal data.
MEDICELL HEALTH SERVICES TRADE LTD. CO.
Mimaroba Mah. Çarmıklı Cad. No:7/1 Büyükçekmece / ISTANBUL
Phone Number: +90 212 868 1 868
Website address for contact: https://www.medicell.com.tr info@medicell.com.tr