Clarification Text about the Protection of Personal Data

This disclosure text has been prepared by KAVACIK MEDICAL HEALTH SERVICES AND PRODUCTS TRADE AND INDUSTRY JOINT STOCK COMPANY, primarily including all other affiliated subsidiaries, other companies within its body and hospitals (“MEDISTATE”), in the capacity of data controller, in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”), the Regulation on Personal Health Data, the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation and the relevant legislation.

HOW IS YOUR PERSONAL DATA PROCESSED?

1. Patient Registration: When you check in as a guest to any of our hospitals within MEDISTATE, your following data is processed by our guest services personnel for the purpose of registering you to the system (“System”) based on the legal grounds that “processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of a contract” and “it is mandatory for the data controller to fulfill its legal obligation”:

• First Name and Surname
• T. Identity Number
• Passport number or temporary R.T. Identity Number for those who are not Turkish citizens
• Address
• Mobile Phone
• E-mail Address
• Place and Date of Birth
• Marital Status
• Gender information
• Private health insurance or Social Security Institution data
• Appointment information

 As a result of these transactions, a “Patient Number” and a “Protocol Number” are assigned to all our guests. Instant transfer is made to the Medula system belonging to the Social Security Institution (“SGK”) through the system where all this data is processed.

 In addition, during the patient registration process, an SMS is sent to the data subject recipients who perform the patient registration process in order to complete the System registration of our guests on the system and to enable them to access the content of the disclosure text at any time. The content of the sent SMS includes 2 separate one-time confirmation codes for our guests who wish to give consent within the scope of KVKK and Law No. 6563 on the Regulation of Electronic Commerce (“ETK”). In the event that the confirmation code is reported back by our guests to our guest services personnel performing the patient registration process, a record is created on the system belonging to the data subject recipient indicating that the necessary explicit consents and approvals for KVKK and ETK have been given. The explicit consents and approvals given will remain valid until the right to reject is exercised and they are withdrawn

1. Health Service: The following data of our guests whose registration process is completed will be processed and recorded in the system during the provision of the requested health service and due to the nature of this service, by health personnel and our physicians who are under the obligation of confidentiality, based on the legal grounds of "carrying out medical diagnosis, treatment and care services" as well as cases explicitly provided for in the Private Hospitals Law No. 2219 and the Basic Law on Health Services No. 3359, the Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, the Regulation on Private Hospitals, the Health Implementation Communiqué, the Regulation on Patient Rights and the Turkish Code of Obligations No. 6098: Health Data (obtained as a result of medical diagnosis, treatment and care services, including but not limited to these)

All these data are instantly transferred to the E-Nabız system affiliated with the R.T. Ministry of Health (“Ministry”).

• 3. Patient Discharge: After the medical services of our guests are completed, the following data are processed for the purpose of collecting the medical service fee and issuing an invoice according to the relevant insurance status of our guests, based on the legal grounds that “processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of a contract” and “it is mandatory for the data controller to fulfill its legal obligation”:

  • First Name and Surname
  • Bank Account Information
  • Credit Card Number
  • Invoice Information

1. Other Services:

• Call Center and Switchboard

 When you call the MEDISTATE call centers or the switchboard of one of the hospitals within MEDISTATE, for the purposes of creating your appointment requests, answering your information requests and/or receiving any other requests including patient rooms, your following personal data are processed based on the legal grounds that “processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of a contract” and “data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”:

• First Name and Surname
• Phone Number
• T. Identity Number
• E-mail Address
• Appointment information
• Complaints

• Patient Rights Center

If you wish to exercise any of your rights within the scope of the Regulation on Patient Rights as our guest in any of our hospitals within MEDISTATE, your following personal data will be processed by our relevant unit for the purpose of finalizing your requests and complaints based on the legal ground that “it is mandatory for the data controller to fulfill its legal obligation”: First Name and Surname Phone Number R.T. Identity Number E-mail Address Appointment information Request Content Medical Information

• Guest Satisfaction

Following the patient discharge processes, a customer satisfaction survey is sent via SMS in the form of a link to the mobile phone numbers of our guests based on their System registration, in order to increase the quality of the health services provided and to measure the guest experience. When this survey link is opened, there are questions in the guest satisfaction survey to measure satisfaction. When the answers given here match the record on the System, they are automatically transferred to the MEDISTATE guest experience unit and our guests are contacted by the unit. Apart from this process, in the event that the patient opens a complaint record via the institution's websites, various social media platforms, or complaint websites, contact is made to resolve or respond to the complaint.

Websites and Mobile Applications

There is an option to obtain an e-appointment on the websites open for visit for the affiliated subsidiaries and hospitals within MEDISTATE. In order to obtain an e-appointment through these websites, as the first step, the R.T. Identity number of the data subject is entered into the appropriate place on the page. Patient information is retrieved from the Medula system of SGK via the entered R.T. Identity number and is displayed in a masked manner on the next page. On the page in the second step, the GSM number required to complete the registration process is added to the appropriate place. In the last step, the e-appointment process is completed by selecting the hospital, medical unit, and physician, and a one-time appointment number is obtained. If the obtained e-appointment is requested to be cancelled, the appointment cancellation process is completed by entering the R.T. Identity number, hospital selection, and appointment number into the relevant fields. Data subjects who wish to benefit from the e-result service on the website can access the results of analysis and imaging performed at the relevant hospital by entering the hospital selection and R.T. Identity number data into the necessary fields. However, in the results appearing here, all identity and contact data regarding the patient are shown in a masked manner. Data subjects can also obtain video call appointments from the websites. The appointment process is the same as the e-appointment, and during the realization of the video call appointment, your visual and auditory data will be processed based on the legal ground of the establishment and performance of the contract for the purpose of providing the video consultancy service. You can access information regarding the processing of your health data within the scope of the video call from the "Health Service" heading of this Disclosure Text. On the page titled “we are listening to you” on the websites, where guest requests and complaints are received, you can convey your complaints, suggestions, and thanks to MEDISTATE with your R.T. Identity number, first and last name, phone number, relevant hospital, and your message, the content of which will be determined by you. This data of yours will be processed based on your explicit consent for the purpose of carrying out activities directed towards patient satisfaction in the patient rights center and guest satisfaction processes. By filling out the “Information and Reservation” section for check-up services through our website, your personal data of name, surname, phone number, and hospital selection will be processed based on the legal ground that “processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of a contract” for the purpose of carrying out activities to contact you again. When you download our mobile applications to your smartphone, an SMS containing a verification code is sent to your phone as a result of entering your R.T. Identity number and phone number data. The transmitted SMS code is sent to your personal phone number registered in our systems and should not be shared with third parties. You provide access to your account after entering this code into the required field. Your personal data that you have provided to us in these processes will be processed through fully automated means based on the legal grounds that “processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of a contract” and “data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” for the purposes of carrying out service delivery processes and increasing patient satisfaction. In case you add your credit card for the purpose of making payment within the application, your credit card information will be processed by the licensed payment service provider from whom we receive services in this regard, for the purpose of receiving payment and based on the legal ground of performance of the contract. Your credit card information will strictly not be recorded or seen by MEDISTATE. In addition to the aforementioned, any information you add to the non-mandatory sections within the application will be processed by us for the purpose of providing you with better service, under the assumption that you have given your explicit consent in this regard.

Informational Activities

Informational Activities Informational activities of a health-protective and health-promoting nature are carried out in the form of commercial electronic messages such as SMS, e-mail, etc., only for our guests who have given KVKK and Communication consent and limited only to informational activities in accordance with the Regulation on Private Hospitals. Recipients may exercise their right to reject contained in the message content if they do not wish to receive the messages. Consent remains valid until the right to reject is exercised. Visual and auditory records, such as photographs and/or videos of some of our guests, are processed solely by obtaining the explicit consent of the data subjects for the purpose of carrying out informational activities about the hospitals within MEDISTATE. Data subjects may withdraw their explicit consent given in this regard at any time.

HOW IS YOUR PERSONAL DATA TRANSFERRED?

a- Health Service

Your personal data listed above will be transferred to authorized institutions and organizations, primarily but not limited to the Ministry, Provincial and District Health Directorates, Public Health Centers and other units affiliated with the Ministry, within the scope of our notification and/or reporting obligations by persons appointed by authorized authorities or within the scope of automated systems such as Medula, E-Nabız and similar, to laboratories in Turkey and abroad with which we cooperate for medical diagnosis and treatment, to institutions providing ambulance, medical device and health services, to our subsidiaries and/or affiliates and/or group companies through the common SYSTEM used by all our hospitals, to SGK for patients under SGK affiliation, to your insurance company of which you are a member if you use your private insurance, to your institution in case your billing is to be made to the institution you work for, to the relevant health institution when you need to be referred, to the relevant health institution abroad if you request a second opinion from a physician located abroad, and to the legal representatives you have authorized, based on the legal grounds of protection of public health, operation of preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing

b- Services Received from Third Parties

Your data will be transferred to our subcontractors, business partners, legal representatives we have authorized and third parties from whom we receive consultancy services, including lawyers, consultants, and auditors we work with, domestic organizations and other third parties and their legal representatives with whom we cooperate and receive services contractually to carry out our activities, only in connection with the service received, in a limited and proportionate manner, and on the prerequisite of obtaining undertakings that they will take all technical and administrative measures required by the KVKK during the service period.

c-Insurance Service and Contracted Institutions

For the purpose of benefiting from private health insurance or complementary insurance, and including but not limited to any other insurance product or contracted institution agreement in the hospitals within MEDISTATE, the data subject's first and last name, mobile phone number, invoice information, and all personal health data processed for the provision of medical diagnosis and treatment are transferred to consultants, insurance companies, or contracted institutions with whom cooperation agreements have been made, based on the legal ground of protection of public health, operation of preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing. The process after the transfer is carried out personally by the relevant consultant, insurance company, or contracted institution.

d-Call Center Service

Call center and voice traffic services are received by MEDISTATE from third parties in the capacity of data processor service providers. Within the scope of this service, your personal data obtained through the call center will be transferred to the service provider from whom services are received in this regard. 

WHAT ARE YOUR RIGHTS AS A DATA SUBJECT?

Within the scope of Article 11 of the KVKK, which regulates the rights of the data subject;

• To learn whether personal data is processed or not
• To request information if personal data has been processed,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose
• To know the third parties to whom personal data is transferred at home or abroad, To request correction of personal data if it is incomplete or incorrectly processed
• To request the deletion or destruction of personal data
• To request notification of the transactions regarding the correction, deletion, or destruction of personal data to the third parties to whom the personal data has been transferred
• To object to the occurrence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems
• To demand compensation for the damage in case of loss due to unlawful processing of personal data,

You can submit your applications to MEDISTATE via the “Application Form” published on the website in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

CONTACT

MEDICAL HEALTH SERVICES AND PRODUCTS TRADE AND INDUSTRY JOINT STOCK COMPANY Headquarters Address: Rüzgarlıbahçe Bahçe Mahallesi Cumhuriyet Caddesi No:24, Beykoz/İstanbul, 34805

MERSIS No: 0528059740700018 

Phone/Fax: 0216 331 4040 / 0216 413 75 15

E-Mail: iletişim@MEDISTATE.com.tr 

Website: https://www.MEDISTATE.com.tr