Privacy Policy on Protection of The Personal Data

The Law No. 6698 on the Protection of Personal Data is intended to safeguard individuals' fundamental liberties and rights, particularly their right to privacy, with respect to the processing of personal data. It also lays out duties, guidelines, and procedures that apply to all natural and legal persons who process personal data.

This privacy policy outlines the data categories, processing purposes, legal grounds, means of collection of your data and your rights regarding processing of your data while providing services under the COSMEDİST SAĞLIK HİZMETLERİ VE TURİZM LİMİTED ŞİRKETİ trademark (hereinafter referred to as the “Company” ).

Your personal information will only be processed by our organization in the capacity of Data Controller accordance with the rules of the Ministry of Health and related legislation as well as the provisions of Personal Data Protection Law No. 6698 (hereinafter referred to as "Law" and/or "KVKK") and applicable legislation.

1. Data Categories

In order to provide our patients with the health treatments they seek, we gather a variety of information from them. Under all circumstances, the information is gathered by us in compliance with the requirements and standards for data processing set forth in the Law. We collect and process the following categories of data:

Your identification information including your name, surname, TR identity number, passport number, temporary TR identity number, birthplace, date of birth, mother's and father's names, marital status, gender, blood group, insurance number, and/or patient protocol number.

Your Contact Details: Your home address, phone number, email, and other contact information,

Your voice call records held by patient services or customer support agents in compliance with call center standards, along with your personal information collected when you contact us by phone, email, or other methods;

Your financial information, including billing information and credit card details only found on the slip,

To plan and finance health services, we will use information from Social Security and your private health insurance.

Health-Related Information: Your patient's medical records, diagnostic data, biometric and genetic data, laboratory results, test results, examination data, appointment information, prescription information, and all other types of health information and data collected throughout or as a result of medical diagnosis, treatment, and care services.

Your feedback, including survey responses from patients, complaint letters, satisfaction ratings, CCTV records in public spaces in accordance with the law in our partner clinics.

2. Processing Purposes

Within the scope of the legislation on health services and in accordance with the Law No. 6698; our Company as the data controller, processes personal data for the following purposes;

1. To fulfill our duties in accordance with the Health Services Constitutive Law No. 3359, Decree Law No. 663 on the Organization and Responsibilities of the Ministry of Health and its Affiliates, the Regulation on the Processing and Protection of Personal Health Data, and other pertinent laws,

2. For preventive medicine, medical diagnosis, execution of treatment and care services, organization and management of health services, and finance,

3. For the planning and administration of our partner clinic's operations, 4. To inform you about the appointment if you have an appointment,

5. To disclose the required information with the Ministry of Health and relevant public institutions and organizations in order to comply with our legal obligations,

6. To analyzing the health services you utilize and to help develop and improve health services

7. To verifying your identity,

8. To take all required administrative and technological steps to ensure the systems and applications being utilized are secure with regard to data,

9. To fulfill our retention requirements in compliance with applicable legislation

10. To disclose the required information during the inquiries and inspections of governmental organizations with regulatory and oversight functions,

11. To disclose the requested information with private insurance companies within the scope of financing health services,

12. For quality improvement activities and performing risk management,

13. To measuring patient satisfaction, respond to all your questions and complaints within our health services,

14. To contacting you to inform you about our services (notifying you via e-mail, sms, call) in case you want to receive marketing communications,

15. Procurement of drugs or medical devices,

16. To perform our services.

3. Transfer of Your Personal Data

3.1.Your personal information will be recorded, stored, classified, processed, transferred, and updated in accordance with applicable law, and it may be shared upon official institution request, subject to the terms of the request, in case it is circumstances allowed by applicable law (with Courts, Chief Prosecutor's Offices, Ministries, and all other official institutions with the authority to request, etc.).

3.2. As per the Article 8 of the KVKK and only to the extent necessary to fulfill the request, the following parties will receive access to your personal information:

- In accordance with the processing purposes; Institutions or organizations and private insurance companies allowed by the Health Services Basic Law No. 3359, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliates, Regulation on the Processing and Privacy of Personal Health Data and other relevant legislation,

- Security General Directorate and similar law enforcement agencies,

- General Directorate of Census,

- Turkish Pharmacists Association,

- Domestic/foreign organizations and other 3rd parties with which we get services and cooperate to carry out our activities,

- In the event of a potential legal conflict, our attorneys,

- Representatives of official institutions authorized to audit our institutions.

We take utmost care during the transfer of your data and take all necessary legal and administrative measures to protect your data during the transfers.

To clarify, we do not transfer your personal data to outside of Türkiye.

4. Methods and Legal Grounds for Processing of Personal Data

We may collect your personal information by any form of contact, including written, oral, and electronically.

We process your personal data for the legal grounds “Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract”, “necessary to comply with the legal obligations of the data controller”, and “Processing of data is necessary for the legitimate interests of the data controller, provided that the processing does not violate the fundamental rights and freedoms of the data subject” in accordance with the Article 5 of the KVKK.

We process your sensitive personal data including your health data in accordance with the Article 6/3 of the KVKK by the individuals under confidentiality obligation for the purposes of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.

5. Your Rights Regarding Your Personal Data

You have the following rights under Article 11 of the KVKK to the extent that our Company, as a data controller, processes your personal data.

a) to learn whether your personal data are processed or not,

b) to request information as to if your personal data have been processed,

c) to learn the purpose of the processing of your personal data and whether these personal data are used in compliance with the purpose,

ç) to know the third parties to whom your personal data are transferred in country or abroad,

d) to request the rectification of the incomplete or inaccurate data, if any,

e) to request the erasure or destruction of his/her personal data under the conditions referred to in Article 7 of the KVKK,

f) to request reporting of the operations carried out pursuant to sub-paragraphs (d) and (e) to third parties to whom your personal data have been transferred,

g) to object to the occurrence of a result against yourself in case of analysis of the data processed solely through automated systems,

ğ) to claim compensation for the damage arising from the unlawful processing of your personal data.

You may contact the Company from following address for the exercise of your rights: info@estedian.com

The Company will respond to your request as per the KVVK and relevant secondary legislation.