REGARDING THE PROCESSING OF PERSONAL DATA FOR PARENT/GUARDIAN

DISCLOSURE STATEMENT

 

Pursuant to the Law on the Protection of Personal Data No. 6698 (“KVKK“) published in the Official Gazette dated 07.04.2016 and numbered 29677, the Regulation on Personal Health Data published in the Official Gazette dated 21.06.2019 and numbered 30808, the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation published in the Official Gazette dated 10.03.2018 dated 10.03.2018 and numbered 30356 published in the Official Gazette dated 21.06.2019 and numbered 30808, the Communiqué on the Procedures and Principles to be followed in the Fulfillment of the Disclosure Obligation and other legislation, it has been prepared by our company One Dose Sağlık Teknolojileri Anonim Şirketi (“Company” or “One Dose“) in the capacity of “Data Supervisor“. As One Dose, we would like to inform and enlighten you about our personal data processing activities within the scope of remote health services we provide through our website and application One Dose – Health in accordance with Article 10 of the KVKK.

 

1. Data Controller

 

Pursuant to KVKK, as One Dose, as the data controller, we will be able to process, record, store, classify, update, and disclose/transfer your personal data to third parties in connection with the purposes described below, in a limited and measured manner, in accordance with the law and good faith, in an accurate and up-to-date manner, and where permitted by the legislation and/or limited to the purpose for which they are processed.

 

The term “Personal Data” means any information relating to an identified or identifiable natural person.

 

The term “Sensitive Personal Data” refers to data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

 

By the term “processing“; including but not limited to those regulated in the KVKK, all kinds of operations performed on data such as obtaining, recording, storing, storing, preserving, changing, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system. Your personal data may be processed by authorized personnel within the Company.

 

2. Processed Personal Data

 

We will be processing personal data in the following categories of personal data, including the data shared with us by  the CHILD / CHILD / PERSON, of which you are the PARENT / GUARDIAN, during the purchase of services from our hospital.

 

• Identity Data: Consists of name-surname, gender, photocopy of ID, Turkish ID number, date of birth, signature
• Contact Data: Consists of telephone number, e-mail address, mobile phone, address
• Transaction Security Data: Logs of access to the internet over the Company network (for anyone accessing the internet over the Company network), user names, e-mail accounts, last logon dates, IP information and similar system and application user account information, all kinds of log records related to the security of the internal communication of the systems, security restrictions.
• Finance Data: Information on the provision of private insurances, bank account information, IBAN number and similar account and payment information.
• Audio and Visual Data: Consists of visual and audio data such as security camera footage.
• Sensitive Personal Data: Consists of blood type information, personal health information, genetic data.

 

At the same time, the following data about you is processed.

 

• Identity Data: Consists of name-surname, copy of ID, Turkish ID number and signature data
• Contact Data: Consists of telephone number, e-mail address, mobile phone, address

 

 

1. Purpose of Processing Personal Data

 

Data Categories of Processed Personal Data	Purpose of Processing	Legal Grounds
Identity Data	·         Execution of goods / service sales processes ·         Execution of goods, services, production and operation processes ·         Conducting finance and accounting affairs ·         Execution of activities in accordance with the legislation ·         Conducting activities for customer satisfaction ·         Conducting marketing analysis studies ·         Execution of marketing processes of products/services ·         Ensuring physical space security ·         Execution and supervision of business activities ·         Execution of information security processes ·         Conducting audit and ethical activities ·         Execution of access authorizations ·         Conducting marketing analysis studies ·         Conducting communication activities ·         Execution of company/product/service commitment processes	KVKK Art. 5/1 “Explicit consent” KVKK Art. 5/2 (c) “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract” KVKK Art. 5/2 (ç) “It is mandatory for the data controller to fulfill its legal obligation” KVKK Art. 5/2 (e) “Establishment, exercise or protection of a right” Art. 5/2 (f) of the LPPD “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” KVKK Art. 6/2 (e) “It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning, management and financing of health services by persons under the obligation to keep secrets or authorized institutions and organizations”
Contact Data	·         Execution of goods / service sales processes ·         Execution of goods, services, production and operation processes ·         Execution of information security processes ·         Execution of access authorizations ·         Execution of activities in accordance with the legislation ·         Conducting finance and accounting affairs ·         Conducting activities for customer satisfaction ·         Conducting marketing analysis studies ·         Execution of marketing processes of products/services ·         Ensuring physical space security ·         Execution and supervision of business activities ·         Conducting communication activities	KVKK Art. 5/1 “Explicit consent” KVKK Art. 5/2 (c) “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract” KVKK Art. 5/2 (ç) “It is mandatory for the data controller to fulfill its legal obligation” KVKK Art. 5/2 (e) “Establishment, exercise or protection of a right” Art. 5/2 (f) of the LPPD “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” KVKK Art. 6/2 (e) “It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning, management and financing of health services by persons under the obligation to keep secrets or authorized institutions and organizations”
Process Security Data	·         Execution of information security processes ·         Conducting audit and ethical activities ·         Execution of access authorizations	KVKK Art. 5/2 (ç) “It is mandatory for the data controller to fulfill its legal obligation” Art. 5/2 (f) of the LPPD “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”
Finance Data	·         Execution of goods / service sales processes ·         Execution of goods, services, production and operation processes ·         Conducting finance and accounting affairs ·         Execution of activities in accordance with the legislation ·         Conducting communication activities	KVKK Art. 5/2 (c) “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract” KVKK Art. 5/2 (ç) “It is mandatory for the data controller to fulfill its legal obligation” KVKK Art. 5/2 (e) “Establishment, exercise or protection of a right” Art. 5/2 (f) of the LPPD “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”
Audiovisual Data	·         Ensuring physical space security ·         Execution of activities in accordance with the legislation	Art. 5/2 (f) of the LPPD “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”
Special Categories of Data	·         Execution and supervision of business activities ·         Conducting finance and accounting affairs	KVKK Art. 6/2 (e) “It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning, management and financing of health services by persons under the obligation to keep secrets or authorized institutions and organizations”

 

4. Collection Method of Your Personal Data

 

Personal data are collected by the Company through different channels, verbally, in writing or electronically for the purposes stated above in order to carry out our activities.

 

Within this framework, personal data may be processed by obtaining explicit consent in the light of the principles stipulated in Article 4(2) of the LPPD or in accordance with Article 5/2 (c) “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract“, 5/2 (ç) “It is mandatory for the data controller to fulfill its legal obligation“, 5/2 (f) “It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.”, “Establishment, exercise or protection of a right” in Article 5/2 (e) of the LPPD, “It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons under the obligation to keep secrets or authorized institutions and organizations” in Article 6/3 (e) of the LPPD can be processed and transferred without obtaining explicit consent in the presence of legal reasons.

 

5. Transfer of Your Personal Data

 

Personal data processed within the scope of the purposes described above; In accordance with the basic principles stipulated in the KVKK and within the personal data processing conditions and purposes specified in Article 8 of the KVKK, it may be transferred to the following persons, shared with them and / or these persons may be given access to personal data:

 

• Identity, communication, customer transaction data, for the purpose of carrying out the processes related to the sale, provision and performance of the products and services offered by the Company, in this context, for the provision of medical diagnosis, treatment and care services by physicians and health institutions registered in our system, and for the purpose of carrying out storage and archiving activities, Since our Company is obliged to record the transactions related to remote health services in the central health system in accordance with the relevant legislation, based on the legal reason “It is stipulated in the laws” in accordance with Article 5/2(a) of the KVKK, with the Ministry of Health, and based on the legal reason “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” in accordance with Article 5/2(c) of the KVKK,

 

• Health Data with physicians and health institutions subject to the confidentiality obligation registered in our system based on your explicit consent in order to evaluate the patient, to carry out the processes related to the necessary tests and examinations, to carry out activities within the scope of diagnosis and treatment studies regarding the patient, to transfer health data to physicians and health institutions for the performance of services, to plan and execute patient relationship management processes, to provide medical diagnosis, treatment and care services;

 

• Health Data with insurance companies contracted by the insured patient based on your explicit consent for the purpose of financing and planning of health services, sharing information requested by private insurance companies

 

• Identity, communication, insurance and financial data, financing and planning of health services, confirming your relationship with the institutions contracted with our hospital, sharing the information requested with private insurance companies within the scope of the eligibility query with the insurance company and support and consultancy service providers contracted by the insured patient based on the legal reason “Data processing is mandatory for the establishment, use or protection of a right” in accordance with Article 5/2 (e) of the KVKK,

 

• Identity, communication, customer transaction, transaction security data with our cloud service provider for the purpose of carrying out the processes related to the sale, presentation and performance of the products and services offered by the Company, with our cloud service provider and with the identity verification sharing service of the Ministry of Interior based on the legal reason that “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” and “It is mandatory for the data controller to fulfill its legal obligations for the purpose of identity verification” in accordance with Articles 5/2(c) and 5/2(ç) of KVKK;

 

• Identity, contact, customer transaction and financial data with our contracted accountants for the purpose of carrying out financial and accounting transactions, based on the legal grounds that “It is mandatory for the data controller to fulfill its legal obligations” in accordance with Article 5/2(ç) of the KVKK;

 

• Identity, communication, and customer transaction data in order to carry out the processes related to the provision and performance of the products and services offered by the Company, to plan and execute the activities necessary to recommend the products and services offered by the Company to the relevant persons by customizing them according to the tastes, usage habits and needs of the relevant persons, to respond to all kinds of questions and complaints regarding our health services, to evaluate our services, With our contracted service providers that provide support, maintenance and repair services to the CRM system based on the legal reason “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” in accordance with Article 5/2 (f) of the KVKK for the purpose of carrying out marketing processes and advertising / campaign / promotion processes regarding the services offered by the Company;

 

• Health data execution of the processes related to the provision and performance of the products and services offered by the Company, planning and execution of the activities necessary to recommend the products and services offered by the Company to the relevant persons by customizing them according to the tastes, usage habits and needs of the relevant persons, responding to all kinds of questions and complaints regarding our health services, With the contracted service provider due to the fact that the CRM system can be accessed by our contracted service providers providing support, maintenance and repair services based on your explicit consent for the purpose of evaluating our services, conducting marketing processes regarding the services offered by the Company and conducting advertising / campaign / promotion processes;

 

• Regarding the commercial electronic messages that we will send to you in line with your consent, the Company is obliged to register your contact address in a national Commercial Electronic Message Management System (IYS) established by the Ministry of Trade in accordance with the provisions of the relevant legislation.Since it is obliged to register to a national Commercial Electronic Message Management System (IYS) established by the Ministry of Commerce, in order to fulfill our obligation arising from the law, it is recorded in the Commercial Electronic Message Management System (IYS) based on the legal reason “It is mandatory for the data controller to fulfill its legal obligation” in Article 5/2 (ç) of the KVKK, without the requirement of explicit consent in order to fulfill our obligation arising from the law.

 

• Since the identity and contact data are provided through the relevant software/portal in order to follow up your electronic commercial message permissions and personal data processing, sharing, transferring explicit consents and to follow up the permissions within the scope of IYS integration, without seeking your explicit consent, based on the legal reason “It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” in Article 5/2 (f) of the KVKK, the contracted company and

 

will be shared.

 

Our Company undertakes to keep personal information strictly private and confidential, to take all necessary measures to prevent unauthorized use or disclosure of personal information to a third party and to exercise due diligence.

 

Personal data other than health data processed within the scope of the purposes described above; In accordance with the basic principles stipulated in the KVKK and within the personal data processing conditions and purposes specified in Article 8 of the KVKK, companies within the Güven Health Group, including our Company’s subsidiaries and affiliates, authorized courts and / or public institutions and organizations, our business partners may be transferred, shared with them and / or these persons may be given access to your personal data. In addition, your data may be transferred directly or indirectly by Güven Hospital to any third party, authorized institutions and organizations from which consultancy, support or other services are received within the framework of certain personal data processing conditions and purposes.

 

Health data; In accordance with the basic principles stipulated in the KVKK, since health and related ancillary services are also provided by companies within the Güven Health Group, health data may be transferred to, shared with, and/or given access to your personal data to companies within the Güven Health Group, including our Company’s subsidiaries and affiliates, based on your explicit consent in accordance with 6/3 (a).

 

 

6. Transfer of Your Personal Data Abroad

 

Your personal data is transferred to third party service providers abroad, provided that appropriate assurance is provided by the standard contract regulated under Article 9 of the KVKK and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad.

 

 

7. Your Rights as a Data Subject Pursuant to Article 11 of the LPPD

 

If the requests regarding the rights in question are submitted in writing as personal data owners and with a written petition containing explanations regarding the right you want to use, together with documents identifying the identity, to our Company’s Konutkent Mah. 3028.Cad. No: 8D Interior Door No: 27 Çankaya/ANKARA address in person or by registered letter with return receipt or info@onedose.io e-mail address, the request will be evaluated by our Company and finalized within 30 (thirty) days at the latest as stipulated under the KVKK. Although it is essential not to charge any fee for the requests, our Company reserves the right to charge a fee based on the fee tariff determined by the Personal Data Protection Board.

 

Without prejudice to the cases stipulated in Article 28 of the KVKK titled “Exceptions” Without prejudice to the cases stipulated in Article 28 of the KVKK titled “Exceptions”, by applying to our Company, personal data; to learn whether it has been processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in accordance with its purpose; to know the third parties to whom it is transferred domestically or abroad; to request notification of the transactions made by the third parties to whom it is transferred; to request correction in case of incomplete or incorrect processing; to request deletion or destruction in the event that the reasons requiring its processing disappear; to request notification of the transactions made to third parties to whom your personal data is transferred; to object to the occurrence of an adverse result by analyzing it exclusively through automated systems and to demand the compensation of the damage in case of damage due to processing in violation of the KVKK.

 

Within the scope of your right to information, you can obtain information within the scope of the above-mentioned and you can access One Dose Sağlık Teknolojileri A.Ş. Data Owner Application Form at https://www.onedose.io/.

 

One Dose Health Technologies Inc.

Center             : Konutkent Mah. 3028.Cad. No: 8D Interior Door No:27 Çankaya/ANKARA

Wire               : 0 850 450 06 06

Mersis No       : 0544128049300001

 

REGARDING THE PROCESSING OF PERSONAL DATA

DATA SUBJECT’S EXPLICIT CONSENT TEXT

 

I have read the General Clarification Statement on the Processing of Personal Data (“Clarification Statement“). Within the scope of the Law No. 6698 on the Protection of Personal Data (“KVKK“), One Dose Sağlık Teknolojileri A.Ş. (“Company“), Regarding the registration of the minor / child /  for whom I am the Parent / Guardian One Dose application

 

• To process identity data, communication data, health data and marketing data in order to ensure the continuity and sustainability of the health service and to plan and execute the activities necessary to recommend the products and services offered by the Company to the relevant persons by customizing them according to the tastes, usage habits and needs of the relevant persons, to carry out marketing activities, to carry out advertising / campaign / promotion processes, and to contact me with commercial electronic messages when necessary

 

I give my explicit consent.

 

Name Surname

Signature:

History:

 

REGARDING THE TRANSFER OF PERSONAL DATA

DATA SUBJECT’S EXPLICIT CONSENT TEXT

 

I have read the General Clarification Statement on the Processing of Personal Data (“Clarification Statement“). Within the scope of the Personal Data Protection Law No. 6698 (“KVKK“), One Dose Sağlık Teknolojileri A.Ş. (“Company“), regarding the registration of the minor/child I am the guardian of to the One Dose application

 

• To transfer identity data, communication data, health data and financial data to contracted suppliers, third parties from whom services are received, business partners and group companies including our Company’s subsidiaries and affiliates for the purposes of ensuring the continuity and sustainability of health services and conducting marketing/advertising/campaign/promotion processes,
• Transferring health data to insurance companies for the purpose of financing and planning health services and collecting payments from insurance policies

 

 

Name Surname

Signature:

History: