PERSONAL DATA PROCESSING AND PROTECTION POLICY

PURPOSE AND SCOPE

As Dentist Derya Elik, located at Alaybey Mah. Şehit Asım Aksoy Cad. Ulusoy No:41 A Karşıyaka-İZMİR (hereinafter referred to as the Doctor/Clinic/Practice/Employer), we give great importance to protecting personal data of all individuals with whom we interact in any way, in compliance with the Law on the Protection of Personal Data No. 6698 (KVKK) and the provisions of the European Union General Data Protection Regulation (GDPR). We ensure that all necessary measures are taken in line with these regulations.

This Personal Data Protection Policy is prepared to inform you about the processes regarding the collection, use, sharing, and storage of personal data by Dentist Derya Elik located at Alaybey Mah. Şehit Asım Aksoy Cad. Ulusoy No:41 A Karşıyaka-İZMİR. In the personal data processing and protection process, the relevant legislation in force will be applied as a priority.

The main purpose of this Personal Data Protection and Processing Policy (the "Policy") is to outline the rules, measures, duties, and responsibilities adopted by the Doctor and Clinic in protecting personal data in a methodological approach, and to ensure transparency in the measures we take to protect personal data.

DEFINITIONS AND ABBREVIATIONS

The terms used in this Policy have the following meanings:

• Employees: Refers to the employees of the Doctor and Clinic.
• Contact Person: The person responsible for overseeing personal data processing activities and the implementation of KVKK policies and procedures within the Clinic.
• Personal Data: Any information related to an identified or identifiable natural person.
  • Examples include: name, surname, address, phone number, date of birth, place of birth, eye color, Turkish ID number.
• Data Subject: The natural person whose personal data is processed. For example, an employee, visitor, or customer.
• Personal Data Processing: Any operation performed on personal data, whether wholly or partially by automated means or as part of a data recording system.
  • Examples include: obtaining, recording, storing, modifying, transferring.
• KVK Law: Refers to the Law on the Protection of Personal Data No. 6698.
• GDPR: The General Data Protection Regulation of the European Union.

3. PRINCIPLES OF PERSONAL DATA PROCESSING

The Doctor and Clinic process personal data in accordance with the procedures and principles outlined in KVKK and other applicable laws.

The following principles are adhered to when processing personal data:

a) Compliance with the law and good faith:
The Doctor and Clinic process personal data in compliance with the provisions of the relevant legal regulations and in good faith. They inform data subjects about the processing of their personal data.

b) Accuracy and being up-to-date when necessary:
The Doctor and Clinic take necessary measures to ensure that the personal data they process is accurate and up-to-date.

c) Processing for specific, clear, and legitimate purposes:
The Doctor and Clinic determine legitimate and lawful purposes for processing personal data and ensure that data is processed only as much as necessary for the services provided.

d) Being relevant, limited, and proportionate to the purposes for which they are processed:
The Doctor and Clinic only process personal data that is necessary to achieve the specified purposes and avoid collecting or processing unnecessary personal data.

e) Retention for the period stipulated by relevant legislation or for the required time for processing purposes:
The Doctor and Clinic retain personal data in compliance with the provisions of applicable legal regulations. Once the purpose of processing is fulfilled or the retention period ends, personal data is deleted, anonymized, or destroyed.

CONDITIONS FOR PROCESSING PERSONAL DATA

The Doctor and Clinic comply with the provisions of the KVK Law when processing personal data under the following conditions:

1. Personal data cannot be processed without the explicit consent of the data subject.

   • Personal data is processed with the explicit consent of the data subject. Patients are informed about the subject and their explicit consent is obtained based on free will.

2. Personal data may be processed without the explicit consent of the data subject in the following cases:

   • a) It is clearly provided for by the laws.
   • b) It is necessary to protect the life or physical integrity of the person or another person who cannot express consent due to actual impossibility.
   • c) It is directly related to the establishment or performance of a contract, and the processing of personal data is necessary for the parties to the contract.
   • d) It is necessary to fulfill the legal obligation of the data controller.
   • e) The data has been made public by the data subject.
   • f) It is necessary to establish, use, or protect a right.
   • g) It is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

The Doctor and Clinic comply with the regulations regarding the processing of special categories of personal data as specified in the KVK Law.

According to KVK Article 6, special categories of personal data include data related to a person’s race, ethnic origin, political opinions, religious or philosophical beliefs, appearance, association or union membership, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.

The Doctor and Clinic process special categories of personal data with the explicit consent of the data subject, or, in cases related to public health, preventive medicine, medical diagnosis, treatment, and care services, or the planning and management of healthcare services and their financing, these special categories of personal data may be processed without explicit consent by persons under the obligation of confidentiality or authorized institutions and organizations.