REGARDING THE PROCESSING OF PERSONAL DATA FOR PATIENTS
GENERAL DISCLOSURE STATEMENT
Pursuant to the Law No. 6698 on the Protection of Personal Data (“KVKK“) published in the Official Gazette dated 07.04.2016 and numbered 29677, our Company One Dose Sağlık Teknolojileri Anonim Şirketi (“Company“), in its capacity as “Data Controller“, may process your personal data within the limits determined by the KVKK and for the situations specified in the KVKK. As our Company, we would like to inform and enlighten you about our personal data processing activities in accordance with Article 10 of the LPPD.
Pursuant to the LPPD, we, as the Company, as the data controller, will be able to process, record, store, classify, update, and disclose/transfer your personal data to third parties in connection with the purposes described below, in a limited and measured manner, in accordance with the law and good faith, in an accurate and up-to-date manner, and in cases permitted by the legislation and/or limited to the purpose for which they are processed.
The term “Personal Data” means any information relating to an identified or identifiable natural person.
The term “Sensitive Personal Data” refers to data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
By the term “processing“; including but not limited to those regulated in the KVKK, all kinds of operations performed on data such as obtaining, recording, storing, storing, preserving, changing, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system. Your personal data may be processed by authorized personnel within the Company.
- Personal Data We Process
The categories of personal data we process are as follows:
- Identity Data: Consists of name, surname, date of birth, place of birth, marital status, Turkish ID number or passport number and information, gender information.
- Contact Data: Consists of telephone number, e-mail address, mobile phone number, address.
- Transaction Security Data: Logs of access to the internet over the Company network (for anyone accessing the internet over the Company network), user names, e-mail accounts, last logon dates, IP information and similar system and application user account information, all kinds of log records related to the security of the internal communication of the systems, security restrictions.
- Finance Data: Consists of company title, SSI information, information on the provision of private insurance, pension information, tax identification number, receivable / payable balance, bank account information, financial transaction information, invoice / check / promissory note information, IBAN number and similar account and payment information.
- Sensitive Personal Data: Information on disability status, blood type information, personal health information, information on devices and prostheses used, genetic data, information on sexual life, race information, information on beliefs, ethnic origin information.
- Marketing Data: Campaign includes information and evaluations obtained as a result of direct marketing activities.
- Processing Your Personal Data
| Data Categories of Your Processed Personal Data | Purpose of Processing | Legal Grounds |
| Identity Data
|
· Execution and supervision of business activities
· Conducting communication activities · Execution of goods/service production and operation processes · Conducting activities for customer satisfaction · Execution of contract processes · Conducting finance and accounting affairs · Execution of activities in accordance with the legislation · Conducting activities for customer satisfaction · Conducting marketing analysis studies · Execution of information security processes · Follow-up of requests and complaints
|
KVKK Art. 5/2 (a) “Explicitly stipulated by law“
KVKK Art. 5/2 (c) “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract.” Art. 5/2 (f) of the LPPD “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” KVKK Art. 5/2 (e) “Data processing is mandatory for the establishment, exercise or protection of a right” KVKK Art. 5/1 “Explicit consent“ |
| Contact Data
|
· Conducting communication activities
· Execution and supervision of business activities · Execution of goods/service production and operation processes · Execution of contract processes · Conducting marketing activities · Conducting activities for customer satisfaction
|
KVKK Art. 5/2 (c) “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract.”
Art. 5/2 (f) of the LPPD “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” KVKK Art. 5/2 (e) “Data processing is mandatory for the establishment, exercise or protection of a right” KVKK Art. 5/1 “Explicit consent“ |
| Process Security Data | · Execution of information security processes
· Conducting audit and ethical activities · Execution of access authorizations
|
KVKK Art. 5/2 (ç) “It is mandatory for the data controller to fulfill its legal obligation”
Art. 5/2 (f) of the LPPD “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” |
| Finance Data | · Execution of goods / service sales processes
· Execution of goods, services, production and operation processes · Conducting finance and accounting affairs · Execution of activities in accordance with the legislation
|
KVKK Art. 5/2 (a) “Explicitly stipulated by law“
KVKK Art. 5/2 (c) “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract” KVKK Art. 5/2 (ç) “It is mandatory for the data controller to fulfill its legal obligation”
|
| Special Categories of Data | · Execution of activities in accordance with the legislation
· Execution of goods / service sales processes · Execution and supervision of business activities · Conducting finance and accounting affairs · Conducting marketing activities |
KVKK Art. 6/3 (e) “It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning, management and financing of health services by persons under the obligation to keep secrets or authorized institutions and organizations” |
| Marketing Data | · Conducting activities for customer satisfaction
· Conducting marketing analysis studies · Execution of goods / service sales processes · Execution of marketing processes of products/services · Execution of goods, services, production and operation processes |
KVKK Art. 5/1 “Explicit consent” |
- Collection Method of Your Personal Data
In order to carry out our activities, your personal data is collected by the Company from the person himself/herself, through different channels such as the Company’s website, call / contact center or mobile application, verbally, in writing or electronically for the purposes stated above.
- Transfer of Your Personal Data
Business partners for the purpose of conducting and auditing business activities, carrying out the production and operation processes of goods/services and carrying out the operation processes of goods/services, phone number, e-mail address, mobile phone number, address, date of birth, place of birth, marital status, T.R. ID number or passport number and information Art. 5/2 (c) of KVKK/2 (c) “Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract” and KVKK Art. 5/2 (f) “Provided that it does not harm the fundamental rights and freedoms of the data subject, it is mandatory to process data for the legitimate interests of the data controller”.
Racial information, blood group information, personal health information are transferred to business partners for the purpose of conducting and supervising business activities, carrying out goods/services production and operation processes based on the legal grounds of Article 6/3(a) “Explicit consent” and Article 6/3(e) “It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and planning, management and financing of health services by persons under the obligation to keep secrets or authorized institutions and organizations”.
Name-Surname, Turkish ID number or passport number and information are transferred to business partners for the purpose of conducting activities for customer satisfaction based on the legal grounds of Article 5/1 “Explicit consent” and Article 5/2 (c) “It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract”.
Mobile phone number, e-mail address, address, name-surname, date of birth, place of birth, marital status, Turkish ID number or passport number and information, gender information to business partners (Ordinatrum and contracted doctors) and authorized public institutions and organizations (E-nabız) for contracted doctors to access the data. 5/2 (f) “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” and KVKK Art. 5/2 (ç) “It is mandatory for the data controller to fulfill its legal obligation” is transferred based on the legal reason.
Racial information, ethnic origin information, information on disability status, blood group information, personal health information, device and prosthesis information, genetic data to business partners and authorized public institutions and organizations (E-nabız) in order for contracted doctors to access the data Art.6/3(a) “Explicit consent” and Art.6/3 (e) “It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons under the obligation to keep secrets or authorized institutions and organizations”.
Your personal data other than your health data processed within the scope of the purposes described above; In accordance with the basic principles stipulated in the KVKK and within the personal data processing conditions and purposes specified in Article 8 of the KVKK, your personal data may be transferred to, shared with, and/or given access to your personal data to companies within the Güven Health Group, including our Company’s subsidiaries and affiliates, authorized courts and/or public institutions and organizations. In addition, your data may be transferred directly or indirectly by the Company to any third party, authorized institutions and organizations from which consultancy, support or other services are received within the framework of certain personal data processing conditions and purposes.
Your health data; In accordance with the basic principles stipulated in the KVKK, since health and related ancillary services are also provided by companies within the Güven Sağlık Group, your health data may be transferred to, shared with, and/or given access to your personal data to companies within the Güven Sağlık Group, including our Company’s subsidiaries and affiliates, based on your explicit consent in accordance with 6/3 (a).
- Transfer of Your Personal Data Abroad
Your personal data is transferred to third party service providers abroad, provided that appropriate assurance is provided by the standard contract regulated under Article 9 of the KVKK and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad.
- Your Rights as a Data Subject Pursuant to Article 11 of the LPPD
If you submit your requests regarding your rights in writing as personal data owners and with your written petition containing your explanations regarding the right you want to exercise, together with documents identifying your identity, to our Company’s Konutkent Mah. 3028 Cad. No: 8d Interior Door No: 27 Çankaya / Ankara in person or by registered letter with return receipt, your request will be evaluated by the Company and finalized within 30 (thirty) days at the latest as stipulated under the KVKK. Although it is essential not to charge any fee for the requests, the Company reserves the right to charge a fee based on the fee tariff determined by the Personal Data Protection Board.
Without prejudice to the cases stipulated in Article 28 of the KVKK titled “Exceptions” Without prejudice to the cases stipulated in Article 28 of the KVKK titled “Exceptions”, by applying to our Company, your personal data; to learn whether it has been processed; if processed, to request information about it; to learn the purpose of processing and whether it is used in accordance with its purpose; to know the third parties to whom it is transferred domestically or abroad; to request correction in case of incomplete or incorrect processing; to request its deletion or destruction in case the reasons requiring its processing disappear; to request notification of the transactions made to third parties to whom your personal data has been transferred; to object to the occurrence of a result against you by analyzing it exclusively through automated systems; and in case you suffer damage due to processing in violation of the KVKK, we inform you that you have the right to demand the compensation of the damage in the capacity of “Data Supervisor” within the scope of KVKK.
Within the scope of your right to obtain information within the scope of the above-mentioned information and One Dose Sağlık Teknolojileri Anonim Şirketi Data Owner Application Form, https://www.onedose.io/ You can access the internet address.
One Dose Sağlık Teknolojileri Anonim Şirketi
Center : Konutkent Mah. 3028 Cad. No: 8d Interior Door No: 27 Çankaya / Ankara
Mersis No : 0544128049300001