Doc.
No.: BY.YD.02
Date of Release: 31.01.2020
Rev. Date: -
Rev.
No: 0
We,
as Private Şelale Thermessos Hospital, attach a great importance to
the security of your personal data, which is the building block of
our core values aiming at institutionalism. With this awareness, we
pay a high-degree of sensitivity to patient privacy and, accordingly,
to the protection of all personal data of our patients in the best
way possible and with due care. Our hospital meticulously protects
your personal data by using all the possibilities offered by
technology effectively and by implementing data security-related
technical and administrative measures. The security measures
implemented by our hospital are provided at a level appropriate to
possible risks, taking into account the technological possibilities.
With
the awareness of this responsibility, we, as the Data Controller as
per the Personal Data Protection Law No. 6698 (the "PDPL"),
may process your personal data in accordance with the Health Services
Fundamental Law No. 3359, the Decree Law No. 663 Concerning the
Organization and Duties of the Ministry of Health and its Affiliated
Institutions, the Private Hospitals Regulation, the Regulation on
Processing and Ensuring Privacy of Personal Health Data (the
"Regulation"), the regulations issued by the Ministry of
Health and other relevant legislation and only within the scope and
purpose described below.
Before
processing any personal data obtained, Private Şelale Thermessos
Hospital, as the Data Controller, submits this Disclosure Text to
persons concerned in accordance with Article 10 of the Personal Data
Protection Law (the "PDPL") and in accordance with the
Communiqué on the Procedures and Principles for the Fulfilment of
Disclosure Obligation issued by the Personal Data Protection
Authority.
Obtaining
and processing of personal data
Your
personal data processed by Private Şelale Thermessos Hospital is
collected verbally, in writing or electronically through our call
centre, website, online services and similar means depending on the
health services provided. Your personal data can also be collected
when you attend training, seminars or organizations organized by
Private Şelale Thermessos Hospital. Your special categories of
personal data, particularly your health data, and your general
personal data can be responsibly processed by Private Şelale
Thermessos Hospital in connection with and limited to the purposes
specified in this Article, including, but without limitation to,
following, within the personal data processing requirements and
purposes specified in Articles 5 and 6 of the PDPL:
Your
Identity Information; Your name, surname, ID number, passport number
or temporary ID number, place and date of birth, marital status,
gender, insurance and/or patient protocol number and other identity
data that can identify you;
Your
Contact Information: Your address, telephone number, e-mail
address and other contact data, voice conversation records kept by
customer representatives or patient services in accordance with call
centre standards, and your personal data obtained when you contact
us via e-mail, letter or other means;
Your
Health Information: All kinds of health data obtained during or as a
result of medical diagnosis, treatment and care services, including,
but not limited to, patient medical reports, diagnostic data,
biometric data, laboratory results, test results, examination data,
appointment information, prescription information;
Your
health data and other personal data you send to or enter at
www.termessoshastanesi.com
Patient
Relations Management: Questionnaires filled out by patients, letters
of thanks and complaints, satisfaction results, etc.; Notifications
made to evaluate Private Şelale Thermessos Hospital;
Your
other personal data, including your resume, if you apply for a job,
and your employment contract all kinds of personal data related to
your qualifications if you are an employee or a related employee of
Private Şelale Thermessos Hospital;
If
you visit our hospital, your camera recordings and images that are
kept for security and inspection purposes;
Your
Accounting Information: Your financial data such as your bank
account number, IBAN number, credit card information, invoicing and
invoice information;
Your
private health insurance data and Social Security Institution data
for the purpose of financing and planning health services;
Purposes
of Personal Data Processing
All
kinds of personal data (including, but not limited to, special
categories of personal data) obtained by Private Şelale Thermessos
Hospital can be processed for the following purposes:
Verification
of your identity by our Patient Services, Healthcare Professionals
and Call Centre Departments;
Provision
of services such as protection of public health, preventive
medicine, medical diagnosis, treatment and care;
Sharing
any information requested with the Ministry of Health and other
public institutions and organizations in accordance with the
relevant legislation;
Monitoring
and preventing abuse and unauthorized transactions by the Audit and
Information Systems Departments;
Fulfilling
our legal obligations in the Health Services Fundamental Law No.
3359, the Decree Law No. 663 on the Organization and Duties of the
Ministry of Health and its Affiliated Institutions, the Regulation
on Private Hospitals, the Regulation on Processing and Ensuring the
Privacy of Personal Health Data and other related regulations;
Sharing
any information requested with private insurance companies within
the scope of financing of your healthcare services, covering your
examination, diagnosis and treatment expenses and legitimacy inquiry
by the Patient Services, Financial Affairs and Marketing
Departments;
Performing
analyses and risk development by the Human Resources, Quality,
In-Company Training, Patient Experience, Information Systems
Departments to improve health services;
Invoicing
for our services by the Patient Services, Medical Accounting,
Financial Affairs, Marketing Departments;
Answering
all your questions and complaints about our health services by the
Hospital Management, Patient Experience, Patient Rights, Call Centre
Departments;
Taking
all necessary technical and administrative measures by the Hospital
Management and Information Systems Departments within the scope of
data security of our hospital systems and applications;
Provision
of information about campaigns and participation in campaigns,
designing and communicating special contents, tangible and
intangible benefits on our website and mobile channels by the
Marketing, Media and Communication, Call Centre Departments;
Measuring,
increasing and investigating patient satisfaction by the Hospital
Management, Patient Rights, Patient Experience Departments;
Preserving
information about your health data that should be kept in accordance
with the relevant legislation;
Transfer
of Personal Data
By
ensuring that all kinds of technical and administrative measures are
taken to ensure the appropriate level of security in accordance with
the PDPL and the relevant health legislation, and for the purposes
listed above, we can transfer your personal to persons/institutions
and/or organizations permitted by the provisions of the Private
Hospitals Regulation, the Personal Data Protection Law No. 6698, the
Regulation on the Processing and Ensuring the Privacy of Personal
Health Data and other related legislation; to private insurance
companies, banks, funds, auditors; consultants; business partners;
national/international organizations and other real and/or legal
third-parties that we contractually receive services from and/or
provide services to, cooperate with, in order to carry out our
activities.
In
addition to the above, personal data may be transferred to foreign
countries ("Foreign Countries with Sufficient Protection")
that have been declared to have adequate protection by the Board.
Situations
where personal data can be processed without explicit consent under
the PDPL
In
accordance with Article 5 of the PDPL, your personal data listed
below may be processed without your explicit consent in the following
cases:
if
clearly provided for in the laws;
if
the processing of your personal data is mandatory to protect life or
body integrity of yourself or any other person, in cases where you,
as the data subject, are unable to disclose your consent due to
actual impossibility or where your consent is not considered legally
valid;
if
the processing of your personal data held by contracting parties is
necessary, provided that the processing is directly related to the
execution or performance of a contract;
if
the processing is mandatory to fulfil any legal obligation;
if
your personal data is made public by you;
if
the data processing is compulsory in order to establish, exercise or
protect a right;
if
the data processing is mandatory for the legitimate interests of the
Private Şelale Thermessos Hospital, provided that your fundamental
rights and freedoms are not damaged.
Health-related
personal data, however, can be processed without the express consent
of the person concerned by persons or authorized institutions and
organizations under the obligation of secrecy, for the purposes of
protection of public health, preventive medicine, medical diagnosis,
treatment and care services, planning and management of health
services and financing.
Method
of, and Legal Ground for, Collecting Personal Data
Your
personal data is collected in all kinds of verbal, written or
electronic media within the scope of the above-mentioned purposes and
in order for Private Şelale Thermessos Hospital to fulfil its
contractual and legal obligations. Legal ground for collecting your
personal data:
Personal
Data Protection Law No. 6698;
Health
Services Fundamental Law No. 3359;
Decree
Law No. 663 on the Organization and Duties of the Ministry of Health
and its Affiliated Institutions;
Private
Hospitals Regulation;
Regulation
on Processing and Ensuring the Privacy of Personal Health Data;
Regulations
issued by the Ministry of Health and other legislative provisions.
Furthermore,
as specified in paragraph 3 of Article 6 of the Law, personal data
related to health and sexual life can only be processed without the
express consent of the person concerned by persons or authorized
institutions and organizations under the obligation of secrecy, for
the purposes of protection of public health, preventive medicine,
medical diagnosis, treatment and care services, planning and
management of health services and financing.
Data
Security
We,
as Private Şelale Thermessos Hospital, attach utmost importance to
the meticulous protection and security of your personal data within
all technical and administrative possibilities. We would like to
inform you that we take, and are in full compliance with, all
security measures that are required to be taken in accordance with
information security standards and procedures, we act with the
awareness that personal data security is at the forefront in all our
products and services we offer you, we take into account all kinds of
risks by taking into account the said security measures and
technological possibilities, and we take every action in this regard.
Your
Rights about Your Personal Data
To
the extent that your personal data is processed by Private Şelale
Thermessos Hospital as the Data Controller, you, as per Article of
the PDPL, and by filling in the "PDPL Access/Information Request
Form" below, delivering it by hand to the hospital where you
have received service, sending it through a notary public, sending an
e-mail signed with your secure electronic signature, or by e-mailing
a "Word or PDF" file signed with your secure electronic
signature to kvkk@termessoshastanesi.com, will have the right to:
to
find out whether your personal data has been processed;
to
request information about the processing of your personal data;
to
find out the purposes of processing of your personal data;
if
your personal has been transferred to third-parties home or abroad,
to find out such third-parties;
if
your personal data has been processed in an incomplete and incorrect
manner, to request for correction of the same;
to
request for deletion and/or destruction of your personal data, if
the grounds that require processing of your personal data have
disappeared request or Private Şelale Thermessos Hospital does not
have any legal ground or legitimate interest to process your
personal data;
to
object to the emergence of any consequences against you through the
analysis of their data processed exclusively by means of automatic
systems;
if
you suffer any loss and/or damage due to the unlawful processing of
your personal data, to claim indemnification of losses and/or
damages you have suffered.
Based
on the nature of the request, Private Şelale Thermessos Hospital
shall finalize the request free of charge as soon as possible and
within 30 (thirty) days at the latest. However, if the said
conclusion requires any additional cost, Private Şelale Thermessos
Hospital shall charge the fee in the tariff determined by the
Personal Data Protection Board.
Please
click
there to
download the PERSONAL DATA PROTECTION LAW (PDPL) APPLICATION FORM
Best
Regards,
Private
Şelale Thermessos Hospital
