Data Protection Law

PATIENTS/PATIENT RELATIVES INFORMATION TEXT REGARDING THE PROCESSING OF PERSONAL DATA

Your personal and sensitive personal data will be processed by Private Çorlu Vatan Hospital (Can Health Facilities Operation and Trade Inc.), as the Data Controller within the Law No. 6698 on the Protection of Personal Data and related legislation, as stated below, in accordance with Private Hospitals Regulations issued by the Ministry of Health.

1- Processed Personal Data:

In order to provide you with high-quality healthcare services, we collect your personal data through verbal, written, visual, or electronic means, utilizing various channels such as our call center, website, web-based applications, physical spaces, etc., depending on the nature of the service provided.

The primary personal and sensitive personal data processed by Private Çorlu Vatan Hospital (Can Health Facilities Operation and Trade Inc.), including all of your health data required for the execution of all medical diagnoses, examinations, treatments and care services are specified below:

Identity Information: Your name, surname, ID number, passport number or temporary Turkish ID number, place and date of birth, marital status, gender, signature, health insurance information, professional qualification card, driver’s license, and other identification data; your camera recordings images, biometric data that are kept for security and audit purposes in the event of your visit our hospital.

Contact Information: Your address, phone number, email address, and other contact details, your voice call records kept by customer representatives or patient services in accordance with quality standards, and your personal data obtained when you contact us via e-mail, letter or other means.

Financial Information: Your bank account number, credit card information, business registration number, financial information like billing information; private health insurance data, and Social Security Institution data related to the financing and planning of healthcare services, and your Social Security Institution data.

Health Information: All kinds of personal data related to health and sexual life obtained during or as a result of the execution of medical diagnosis, treatment and care services, including but not limited to your laboratory results, test results, examination data, appointment information, prescription information.

2- Purposes of Processing Your Personal Data:

Personal data/sensitive personal data may be processed by Private Çorlu Vatan Hospital for the following purposes:

• Fulfillment of our legal obligations stipulated in the Basic Law No. 3359 on Healthcare Services, the Decree-Law No. 663 on the Organization and Duties of the Ministry of Health and Affiliated Institutions, the Private Hospitals Regulation, the Personal Data Protection Law No. 6698, the Regulation on the Processing and Privacy of Personal Health Data, and other relevant legislations,
• Preservation of public health; execution of preventive medicine, medical diagnosis, treatment, and care services,
• Sharing information requested by the Ministry of Health and other public institutions and organizations according to the relevant regulations,
• Patient Services, Financial Operations, financing of your healthcare services by paying institutions, coverage of your examination, diagnosis, and treatment expenses, and sharing requested information with private insurance companies within the scope of eligibility inquiry,
• Appointment reminders and similar services through our Call Center and digital applications,
• Identity verification by patient services, healthcare professionals, and call center departments.
• Fulfillment of risk management and quality improvement activities mandated by quality standards in the healthcare sector, as overseen by the Quality Unit and Information Systems Unit
• Billing for our services provided by the Patient Services, Financial Affairs, and Marketing departments.
• Information confirmation regarding the employment or membership status in companies, chambers, associations, and organizations with which our hospital has established corporate agreements,
• Response to any questions or complaints related to healthcare services by the Hospital Management, Patient Rights, and Call Center departments.
• Participation in campaigns and providing campaign information, designing and conveying special content, tangible and intangible benefits on web and mobile channels by Marketing, Media and Communications, Call Center departments,

Your “Personal and Sensitive Personal Data” mentioned above is preserved within the Private Çorlu Vatan Hospital and its external service providers in both physical and electronic archives, providing the necessary technical/administrative measures and in compliance with legal regulations.

3- Transfer of Personal Data:

By ensuring that all necessary technical and administrative measures are taken to ensure the appropriate level of security in accordance with the PDPL and the relevant health legislation, your Personal Data / Sensitive Personal Data for the purposes set out in Section 2; The Basic Law No. 3359 on Health Services, the Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Organizations, the Regulation on Private Hospitals, the Personal Data Protection Law No. 6698, the Regulation on the Processing of Personal Health Data and Ensuring Privacy and other relevant legislation provisions may be shared with individuals, institutions and/or organizations permitted by the provisions.

• Ministry of Health, its sub-units, and family health centers,
• Private Insurance Companies (Health, Pension, Life Insurance, etc.),
• Social Security Institution,
• General Directorate of Security and other law enforcement agencies,
• Population General Directorate,
• Turkish Pharmacists Association,
• Judicial authorities,
• Collaboration partners such as laboratories, medical centers, ambulances, medical device/supply companies, and healthcare service providers with whom we cooperate for medical diagnosis and treatment,
• The healthcare institution to which the patient is referred or where the patient applies,
• Your legal authorized representatives,
• Third parties authorized to access patient data within the scope of the law, including our lawyers, tax consultants, and auditors,
• Regulatory and supervisory authorities, and official bodies,
• The occupational health physician serving at your workplace,
• Our suppliers and support service providers that we benefit from their services or collaborate.

4- Method and Legal Grounds for Personal Data Collection:

Method of Collection: Your personal data, in accordance with the processing purposes; before, during, and/or after your arrival at Private Çorlu Vatan Hospital; in oral, written, visual or electronic media, though means like telephone, SMS, MMS, etc., online via the social security institution’s system, from records shared for the benefit of a private insurance company in case of your visit to our healthcare institutions on recommendation and/or on your own initiative, through records from other healthcare institutions and organizations, emails, calls to the Central Call Records through the website, oral, written, printed, and similar channels, are collected and stored in physical and digital environments, so that Private Çorlu Vatan Hospital can fully and properly fulfill its contractual and legal obligations.

Legal Grounds:

The legal grounds for the collection of your personal data are:

Law No. 6698 on the Protection of Personal Data,

Law No. 3359 Health Services Basic,

Law No. 663 on the Organization and Duties of the Ministry of Health and Affiliated Institutions.

• Private Hospital Regulations,
• Regulation on the Processing and Protection of Personal Health Data Privacy,
• Regulations of the Ministry of Health and other relevant legal provisions,

Moreover, as stated in Article 6, Paragraph 3 of the Law, personal data related to health and sexual life may be processed without the explicit consent of the data subject, solely for the purpose of protecting of public health, preventive healthcare, medical diagnosis, treatment, and care services, as well as for the planning and management of health services and financing, under the obligation of confidentiality.

5- Storage and Deletion of Personal Data

Private Çorlu Vatan Hospital stores the processed personal data in accordance with the periods specified by regulations. In cases where no specific duration is stipulated by the legislation, personal data is stored for a period necessary for the hospital’s practices and customary business life related to the services it provides when processing the data. After this period, the data is stored only for the purpose of serving as evidence in potential legal disputes for the duration specified as necessary in practice. Following the expiration of the specified duration, the relevant personal data is deleted, destroyed, or anonymized.

6- Rights of Data Subjects – Personal Data Protection

If you, our valuable service recipients, as the owner of the personal data collected, processed and transferred by Private Çorlu Vatan Hospital, wish to use your rights under this heading and/or within the scope of PDPL             , within the procedures and principles stipulated in this Clarification Text and the legislation, or if you apply to Private Çorlu Vatan Hospital, your requests in your application will be finalized free of charge within a maximum of thirty (30) business days days in accordance with this Information Text. However, if the transaction requires an additional cost for Private Çorlu Vatan Hospital, the fee in the tariff determined by the Personal Data Protection Board may be requested.

 According to the laws and related regulations you possess:

• The right to know whether personal data is being processed,
• The right to request information if personal data has been processed,
• Access to personal health data and the right to request this information,
• The right to know the purpose of processing personal data and whether they are being used for their intended purpose,
• Knowledge of third parties, domestic or foreign, to whom personal data has been transferred,
• The right to request correction if personal data is incomplete or inaccurate,
• The right to request the deletion or destruction of personal data,
• The right to request the correction of inaccuracies or the deletion or destruction of personal data and the notification of these actions to third parties to whom the data has been transferred,
• The right to object to adverse outcomes resulting from the exclusive automated analysis of processed data,
• The right to request compensation for damages caused by the unlawful processing of personal data.

According to Article 28 of the law, the following cases are excluded from the scope of the law, and individuals cannot assert their rights in these matters:

• Processing of personal data for research, planning, and statistical purposes by rendering them anonymous through official statistics,
• Processing of personal data for artistic, historical, literary, or scientific purposes or for freedom of expression, provided it does not violate national defense, national security, public safety, public order, economic security, privacy, or personal rights, and does not constitute a crime,
• Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order, or economic security,
• Processing of personal data by judicial authorities or enforcement agencies in the course of investigation, prosecution, trial, or execution processes,

According to Article 28/2 of the law, except for the right to request compensation for damages, individuals cannot assert their rights in the following cases:

• Processing of personal data necessary for the prevention of crime or criminal investigation,
• Processing of personal data that has been publicly disclosed by the data subject,
• Processing of personal data by competent public institutions and organizations, or professional organizations with regulatory or supervisory duties, for the purpose of conducting inspections or investigations, or for disciplinary proceedings,
• Processing of personal data necessary for the protection of the state’s economic and financial interests in budget, tax, and financial matters,

7-Data Security and Right to Application

Your personal data is meticulously protected through technical and administrative measures, and necessary security precautions, considering potential risks, are taken to store the data at an appropriate level with technological capabilities.

In order to determine whether the person applying to the Private Çorlu Vatan Hospital is the data owner, the relevant person may be requested for information, and questions related to the application may be directed to the data owner to clarify the specified matters. Private Çorlu Vatan Hospital may reject the application of the person applying in the cases listed below, explaining the reasons:

• Processing personal data for research, planning, and statistical purposes by rendering them anonymous through official statistics,
• Processing personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided it does not violate national defense, national security, public safety, public order, economic security, privacy, or personality rights, or constitute a crime,
• Processing personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized and empowered by law to ensure national defense, national security, public safety, public order, or economic security,
• Processing personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial, or enforcement proceedings,
• Necessity of processing personal data to prevent the commission of a crime or for the investigation of a crime.
• Processing personal data that has been publicly disclosed by the data owner themselves,
• Necessity of processing personal data by authorized and competent public institutions and organizations, or professional organizations with the status of a public institution, for the performance of supervisory or regulatory tasks, or for disciplinary investigation or prosecution,
• Necessity of processing personal data for the protection of the state’s economic and financial interests concerning budget, tax, and financial matters,
• Possibility of the data owner’s request obstructing the rights and freedoms of other individuals,
• Making requests that require disproportionate effort,
• The requested information being public information,

You can submit your requests within the scope of the law by filling out the “Application Form in Accordance with the Personal Data Protection Law” on the corluvatan.com/en/ website and deliver it in person or send it via a notary to the address Esentepe Neighborhood, Deva Street 11/A Çorlu/Tekirdağ.