Personal Data Protection Law (PDPL)
Information / Disclosure Text
ENT Specialist
Date: ...... / ...... / 20.....
Address: Mustafa Kemal Mahallesi 2118. Cad. No:4 Maidan Business Center B-Block Floor:12 No:141, Cankaya/Ankara
TR: +90 535 687 37 00 ENG: +90 535 687 37 10
E-mail: info@tevfiksozen.com Web: tevfiksozen.com
Social: @dr.tevfiksozen
1) Purpose and Scope of the Disclosure
Pursuant to the Turkish Personal Data Protection Law No. 6698 (“PDPL”), the Basic Health Services Law No. 3359, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, the Regulation on Private Hospitals, and other relevant legislation, this disclosure text has been prepared to inform you about the collection and processing of your personal data—including your sensitive personal data—that you provide to us while benefiting from our health services and other services.
As the Data Controller, Assoc. Prof. Dr. Tevfik Sozen’s Clinic may record, store, update, disclose and/or transfer your personal data to third parties (such as persons/organizations providing services, employees/partners of the service provider, public institutions/organizations and private legal entities) within the framework of the purposes explained in this disclosure text and as permitted by the relevant legislation; and may process, classify and use your data in other ways allowed under the PDPL and related legislation.
Sensitive personal data may be processed without seeking your explicit consent only where required for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and financing, by persons under a confidentiality obligation or authorized institutions and organizations. In all other cases, sensitive personal data may be processed only if sufficient measures determined by the PDPL are taken, as required by law.
Your personal data are collected verbally, in writing, visually or electronically through channels such as call center, website, verbal/written applications and similar means, for the purposes of providing public health services, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and financing.
2) Processed Personal Data and Purposes of Processing
Your personal data—primarily your health data and other sensitive personal data—may be processed by Assoc. Prof. Dr. Tevfik Sozen’s Clinic in a limited and proportionate manner, linked to the purposes stated below, including but not limited to:
Identity Data: Name, surname, Turkish ID number, passport number or temporary Turkish ID number, place and date of birth, marital status, gender, insurance or patient protocol number, and other identity data that may identify you.
Contact Data: Address, phone number, e-mail address and other contact data; call center voice recordings kept as required by standards; and personal data obtained when you contact us via e-mail, letters or other means.
Financial / Accounting Data: Bank account number, IBAN, credit card data, billing data and similar financial data; private health insurance data for planning and financing of health services; and Social Security Institution (SSI) data. If you visit our clinic, camera recordings kept for security and audit purposes.
Health Data: Laboratory results, test results, examination data, appointment data, prescription data, and all health and sexual life related personal data obtained during medical diagnosis, treatment and care services or as a result thereof; and other personal data you may provide during your applications to Assoc. Prof. Dr. Tevfik Sozen’s Clinic, including your CV if you apply for a job and any personal data related to your employment/service relationship if you become an employee or contracted employee of the clinic.
These data may be processed in accordance with the purposes set out below, including but not limited to:
Verifying your identity.
Protecting public health; carrying out preventive medicine, medical diagnosis, treatment and care services.
Planning and managing health services and financing.
Managing clinic operations and daily processes.
Providing information about your appointment when you schedule one; medication supply; informing you about your appointment if you do not attend.
Risk management and quality improvement activities.
Conducting assessments for development of health services.
Meeting legal and regulatory requirements; fulfilling requests of the Ministry of Health and other public institutions/organizations; sharing information requested by them under relevant legislation.
Responding to all questions and complaints related to our health services.
Taking all necessary technical and administrative measures for data security in our systems and applications.
Analyzing your use of our health services to improve and enhance services; providing necessary information to regulatory/supervisory authorities; meeting official inspection requests.
Training and development of our employees; monitoring, preventing and reversing improper or unauthorized processing.
Storing health data required by relevant legislation; maintaining records related to your services with institutions we have agreements with; billing and invoicing.
Ensuring patient satisfaction, and other similar purposes.
3) Cases Where Explicit Consent Is Not Required Under the PDPL
If at least one of the following conditions exists, your personal data may be processed even if you do not have explicit consent:
Explicitly stipulated in laws.
Necessary to protect the life or physical integrity of a person who is unable to express consent due to actual impossibility, or whose consent is not legally valid.
Necessary for the establishment or performance of a contract, provided it is directly related to the contract parties.
Necessary for the data controller to fulfill its legal obligations.
Made public by the data subject.
Necessary for the establishment, exercise or protection of a right.
Necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
In addition, health and sexual life related personal data may be processed without explicit consent only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and financing, by persons under a confidentiality obligation and authorized institutions/organizations.
4) Transfer of Personal Data
Your personal data related to our service areas may be transferred—within the scope of the purposes explained above and for the execution of the necessary business processes—by Assoc. Prof. Dr. Tevfik Sozen’s Clinic to:
Private insurance companies;
Units affiliated with the Ministry of Health;
Social Security Institution (SSI);
General Directorate of Security and other law enforcement bodies;
Directorate General of Population and Citizenship Affairs;
Turkish Pharmacists’ Association;
Courts and all judicial authorities;
Authorized representatives you appoint; lawyers; tax and financial advisors; auditors; and third parties from whom we receive consultancy services;
Regulatory and supervisory institutions; official authorities; and other third parties we cooperate with to develop and/or carry out health services,
and, where required, to recipients abroad, in line with the transfer conditions set out in Articles 8 and 9 of the PDPL.
5) Method and Legal Basis of Collection
Your personal data are collected verbally, in writing, visually or electronically for the purposes stated above, and to enable health services to be provided within the legal framework, and for the clinic to fulfill its legal obligations.
6) Rights of Data Subjects Under the PDPL
When you apply to Assoc. Prof. Dr. Tevfik Sozen’s Clinic, you may:
Learn whether your personal data are processed.
Request information if your personal data have been processed.
Learn the purpose of processing and whether they are used in accordance with the purpose.
Learn the third parties to whom your personal data are transferred domestically or abroad.
Request correction if your personal data are incomplete or incorrectly processed.
Request deletion or destruction of your personal data within the conditions stipulated in Article 7 of the PDPL, and request notification of such actions to third parties to whom your data were transferred.
Object to the occurrence of a result against you by analyzing processed data exclusively through automated systems.
Request compensation for damages if you suffer damages due to unlawful processing of your personal data.
If your request requires an additional cost, you may be charged the fee determined by the Personal Data Protection Board. If the written response is up to the first 10 (ten) pages, no fee will be charged; for each page over 10 (ten) pages, a fee of 1 TL per page may be charged. If the response is provided in a recording medium such as CD or flash memory, the cost of the medium may be charged.
Your applications will be finalized as soon as possible and in any case within 30 (thirty) days, depending on the nature of the request.
7) Application Method
To exercise your rights under the PDPL, you may submit your applications in Turkish and in writing to Assoc. Prof. Dr. Tevfik Sozen’s Clinic. For detailed information, you may visit the website of the Personal Data Protection Authority.
You can apply by:
Filling out the form on tevfiksozen.com and sending a wet-signed copy to us by hand or via notary to: Abdi Ipekci Cad. No:61 Reasurans Han 2D Block Floor:7 Nisantasi / Istanbul,
Filling out the form on tevfiksozen.com and sending it with secure electronic signature or mobile signature,
Sending it from your e-mail address registered in our system to the clinic’s KEP address or e-mail address previously notified.
Your application must clearly and understandably state your request. If the applicant is acting on behalf of someone else, a notarized special power of attorney may be required.
Applications must include: name-surname, signature, Turkish ID number (for Turkish citizens), residence or workplace address, e-mail address, telephone and fax number, and the subject of the request, as required under the “Communique on the Procedures and Principles of Application to the Data Controller.” Applications missing these elements may be rejected.
The clinic reserves the right to make changes in this disclosure text at any time due to amendments in the PDPL, secondary regulations, and decisions of the Board. Changes will take effect immediately as of the date the updated text is notified to you.
