PRIVACY NOTICE REGARDING THE POLICY ON THE PROTECTION AND PROCESSING OF PERSONAL DATA PURSUANT TO THE PERSONAL DATA PROTECTION LAW KVKK (LAW NO. 6698)
1. General Definition
Under the Law, personal data covers any and all data relating to an identified or identifiable natural person. Special categories of personal data, a specific type of personal data, refer to data concerning race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance and attire, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Processing of personal data refers to any and all operations performed on data — such as the collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, takeover, making available, classification, or prevention of the use of personal data — by fully or partially automated means, or by non-automated means provided that the data forms part of a data recording system.
2. Purpose and Identity of the Data Controller
This “General Privacy Notice on the Protection and Processing of Personal Data” has been prepared by the data controller identified below, Hera Sağlık ve Güzellik Hizmetleri Ticaret Anonim Şirketi (“Özel Zen Polikliniği” or the “Company”), in order to fulfill the obligation to inform with respect to the processing of your personal data, pursuant to Article 10 of the Personal Data Protection Law No. 6698 (the “Law”) and the “Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform”.
The data controller of your personal data is resident at the address “Barbaros Mah. Begonya sok. No:3J Nida Kule Kat:B1 Ataşehir – İstanbul, Turkey”, is a taxpayer of the KOZYATAĞI Tax Office with tax number 4610890831, and its MERSİS Number is 0461089083100001. Web address: info@zenpoliklinik.com. As Hera Sağlık ve Güzellik Hizmetleri Ticaret Anonim Şirketi (“Özel Zen Polikliniği” or the “Company”), acting in the capacity of data controller pursuant to the Personal Data Protection Law No. 6698 (the “Law”), your personal data may be processed within the scope explained below, within the framework of the purposes listed below and in a manner connected with, limited to, and proportionate to these purposes, while preserving the accuracy and currency of your personal data as it reaches us.
Hera Sağlık ve Güzellik Hizmetleri Ticaret Anonim Şirketi (Özel Zen Polikliniği), acting as Data Controller under the KVKK, operates in the field of MEDICAL AESTHETIC applications as a healthcare institution holding Polyclinic status in accordance with the procedures of the Ministry of Health of the Republic of Turkey, within the scope of non-inpatient general medical practice provided in polyclinics by private healthcare institutions.
As Özel Zen Polikliniği, pursuant to the Personal Data Protection Law No. 6698 (KVKK) and acting in the capacity of Data Controller, we hereby declare that your personal data — requested through visits to our premises and/or our website, or through calls made by our call center or calls you place to our call center, and/or shared with us directly or indirectly for the purchase of products or services — may, within the framework of the purpose requiring its processing and in a manner connected with, limited to, and proportionate to that purpose, be recorded, stored, retained, and reorganized; may be shared with the institutions legally authorized to request such personal data; may, in the cases and under the conditions stipulated by the Law, be transferred to third parties in Turkey or abroad, assigned, and classified; may be deleted upon the request of the data subject; and may be processed in the ways enumerated in the Law.
In accordance with Article 4 of the Law, our Company processes personal data in a manner that is lawful and in compliance with the rules of good faith, accurate and up to date, for specific, explicit, and legitimate purposes, and in a manner connected with and limited to those purposes. Our Company retains personal data for the period stipulated in the applicable laws or required by the purpose of the personal data processing. Our Company processes personal data based on one or more of the conditions set out in Article 5 of the Law, in compliance with Article 20 of the Constitution and Article 5 of the Law. Our Company acts in accordance with the provisions stipulated in Article 6 of the Law with respect to the processing of special categories of personal data. In accordance with Articles 8 and 9 of the Law, our Company complies with the rules set forth in the law and the regulations issued by the Board regarding the transfer of personal data. Özel Zen Polikliniği may update and amend the provisions of this privacy notice, which currently contains up-to-date provisions, at any time in compliance with the applicable legislation by publishing them on its website. Updates and amendments shall be effective as of the date of their publication.
3. Purposes of Processing Your Personal Data
Your collected personal data may be processed by Özel Zen Polikliniği, in accordance with the fundamental principles stipulated in the Law and within the personal data processing conditions set out in Articles 5 and 6 of the Law, in the processes of managing data subjects’ personal data, for the purposes of ensuring the legal, technical, commercial, and occupational security of the Company and of the relevant persons who have a business relationship with the Company, and of performing its activities.
Your personal data listed below — including your special categories of personal data, and your health data in particular — may be processed by Özel Zen Polikliniği, including but not limited to the items set out below, in a manner connected with, limited to, and proportionate to the purposes specified in this article:
Your Identity Information: Your name, surname, Turkish ID (T.C.) number, passport number or temporary Turkish ID number, place and date of birth, marital status, gender, insurance or patient protocol number, and other identity data by which we may identify you;
Your Contact Information: Your address, telephone number, e-mail address, and other contact data; your voice call recordings kept by customer representatives or patient services in accordance with call center standards; and your personal data obtained when you contact us by e-mail, letter, or other means;
Your Accounting Information: Your financial data such as your bank account number, IBAN number, credit card information, and billing information; your data relating to private health insurance and your Social Security Institution data for the purpose of financing and planning healthcare services; and, if you visit our clinic, your camera footage recorded for security and audit purposes,
Your Health Information: Any and all personal data concerning your health and sexual life obtained during, or as a result of, the conduct of medical diagnosis, treatment, and care services — including but not limited to your laboratory results, test results, examination data, appointment information, and prescription information; if you apply for a job at Özel Zen Polikliniği, your other personal data obtained in this respect, including your résumé; and, if you are an employee of, or an employee affiliated with, Özel Zen Polikliniği, any and all personal data relating to your employment contract.
Any and all of your personal data obtained by Özel Zen Polikliniği may be processed for the purposes listed here: verifying your identity; protecting public health; preventive medicine; conducting medical diagnosis, treatment, and care services; planning and managing healthcare services and their financing; planning and managing the operation of our clinic and its daily operations; supplying medication; informing you about your appointment if you have made one; carrying out risk management and quality improvement activities; conducting assessments to improve healthcare services; conducting research; fulfilling legal and regulatory requirements; confirming your relationship with the institutions contracted with the clinic; invoicing for our healthcare services; sharing the requested information with private insurance companies within the scope of the financing of healthcare services; sharing the requested information with the Ministry of Health and the relevant public institutions and organizations in accordance with the applicable legislation; responding to any questions and complaints regarding our healthcare services; taking all necessary technical and administrative measures within the scope of data security for our clinic’s systems and applications; analyzing your use of healthcare services and storing your health data for the purpose of developing and improving the healthcare services we provide; providing the required information to regulatory and supervisory authorities and official bodies in line with their requests and audits; training and developing our employees; monitoring and preventing abuse and unauthorized transactions and reversing such transactions; retaining the information relating to your health data that must be stored pursuant to the applicable legislation; ensuring financial reconciliation with our contracted institutions with respect to the healthcare services provided to you; measuring patient satisfaction; and, without being limited to the foregoing, conducting and developing medical diagnosis, treatment, and care services, planning and managing healthcare services and their financing, increasing patient satisfaction, research, and similar purposes.
4. Parties to Whom Your Personal Data Is Transferred and the Purposes of Transfer
Your collected personal data may be transferred by our Company — in accordance with the provisions of all applicable legislation and the fundamental principles stipulated in Law No. 6698, and within the personal data transfer conditions set out in Articles 8 and 9 of the Law — to our shareholders, our business partners, our suppliers, and legally authorized public and private institutions and organizations, within the scope of the “Purposes” listed above.
Personal data belonging to those who receive our services may be transferred by Özel Zen Polikliniği — for the purposes of having the business units carry out the work necessary to enable the relevant persons to benefit from the services provided by Özel Zen Polikliniği and conducting the related business processes, planning and executing the commercial or scientific strategies of Özel Zen Polikliniği, and ensuring the legal, technical, and commercial security of the persons who have a relationship with Özel Zen Polikliniği — to private insurance companies, the Ministry of Health and its affiliated sub-units, the Social Security Institution, the General Directorate of Security and other law enforcement agencies, the General Directorate of Civil Registration, the Turkish Pharmacists’ Association, courts and all kinds of judicial authorities, central and other third parties, the representatives you have authorized, the lawyers to whom you have granted power of attorney on the matter, the third parties from whom we receive consultancy services — including tax and financial advisors and auditors — regulatory and supervisory authorities, and official bodies, as well as our business partners and other third parties with whom we cooperate to develop or carry out healthcare services for the purposes stated above; such data may be transferred to third parties in Turkey as well as abroad, within the framework of the personal data transfer conditions and purposes set out in Articles 8 and 9 of the Law
5. Method of Collection of Your Personal Data and Its Legal Basis
Your personal data may be collected by Özel Zen Polikliniği in electronic form via e-mail, mobile application, website, open internet sources, social media, telephone, SMS, and call center channels, and in physical form via hand delivery or postal channels. In addition, your personal data will be collected based on the legal grounds set out in Articles 5 and 6 of the Law — the establishment and/or performance of a contract; the establishment, exercise, and/or protection of a right; the fulfillment of a legal obligation; and legitimate interest — and, where you provide it, on the basis of your explicit consent.
Pursuant to Article 7/1 of the KVKK, when the purpose requiring the processing of your personal data ceases to exist and/or when the limitation/retention periods during which we are obliged under the legislation to process your data expire, your personal data will be deleted, destroyed, or anonymized.
6. Cases in Which Personal Data May Be Processed Without Explicit Consent Under the KVKK
Pursuant to Article 5 of the Personal Data Protection Law No. 6698, your personal data may be processed without your explicit consent in the following cases, namely:
•Where expressly provided for by law,
•Where the processing of your personal data is necessary for the protection of your own or another person’s life or physical integrity, in cases where you, as the data subject, are unable to give your consent due to actual impossibility or where your consent is not granted legal validity,
•Where the processing of the personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract,
•Where processing is mandatory for the fulfillment of a legal obligation,
•Where your personal data has been made public by yourself,
•Where data processing is mandatory for the establishment, exercise, or protection of a right,
•Where data processing is mandatory for the legitimate interests of the Company, provided that it does not harm your fundamental rights and freedoms.
•Personal health data may be processed without the explicit consent of the data subject by persons under an obligation of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, conducting medical diagnosis, treatment, and care services, and planning and managing healthcare services and their financing.
7. Your Rights as a Personal Data Subject Listed in Article 11 of the Law
Pursuant to Article 11 of the Law, we hereby inform you that, as data subjects, you have the following rights:
•To learn whether your personal data is processed,
•To request information regarding your personal data if it has been processed,
•To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
•To know the third parties to whom your personal data is transferred, whether in Turkey or abroad,
•To request the correction of your personal data if it has been processed incompletely or inaccurately, and to request that the action taken in this respect be notified to the third parties to whom your personal data has been transferred,
•To request the deletion or destruction of your personal data if the reasons requiring its processing cease to exist, even though it has been processed in compliance with the Law and other applicable legal provisions, and to request that the action taken in this respect be notified to the third parties to whom your personal data has been transferred,
•To object to the occurrence of a result to your detriment arising from the analysis of the processed data exclusively by means of automated systems,
•To request compensation for damages if you suffer damage due to the unlawful processing of your personal data.
You may submit your requests regarding the rights listed above by using the HERA SAĞLIK VE GÜZELLİK HİZMETLERİ TİCARET ANONİM ŞİRKETİ “ÖZEL ZEN POLİKLİNİĞİ” APPLICATION FORM ON THE PROTECTION OF PERSONAL DATA provided below, or you may deliver your written and wet-ink signed request petition — containing the minimum requirements set out in the Communiqué on the Procedures and Principles of Application to the Data Controller — in person to the address of the Company’s head office at “Barbaros Mah. Begonya sok. No:3J Nida Kule Kat:B1 Ataşehir – İstanbul, Turkey”, send it via a notary public, send it with an electronic signature via our Company’s address info@zenpoliklinik.com, or, if your e-mail address is registered in our Company’s systems, submit it to our Company via the e-mail address info@zenpoliklinik.com. Depending on the nature of your request, your applications will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest. However, if the transaction requires an additional cost, a fee may be charged to you according to the tariff to be determined by the Personal Data Protection Board. If the responses to applications exceed 10 (ten) pages, a processing fee of 1.00 (one) TL will be charged for each page. If you request that the response be provided on a recording medium such as a CD or a flash drive, a fee will be charged according to the cost of the requested recording medium.
8. Special Circumstances
In order to ensure security and for the purposes stated in this notice, Özel Zen Polikliniği carries out personal data processing activities involving monitoring with security cameras in the buildings and facilities of Özel Zen Polikliniği and tracking guest entries and exits. These activities involve the processing of personal data. In accordance with Article 12 of the Law, our Company takes the necessary technical and administrative measures to ensure the security of the personal data obtained as a result of camera monitoring activities. Within the scope of security camera monitoring, our Company aims to improve the quality of the services provided, to ensure their reliability, to ensure the safety of the company, its customers, and other persons, and to protect customers’ interests in relation to the services they receive. The data obtained for the purpose of tracking guest entries and exits is processed solely for this purpose, and the relevant personal data is recorded in the data recording system in the physical environment and stored for the committed period.
Within the scope of security camera monitoring, our Company aims to improve the quality of the services provided, to ensure their reliability, to ensure the safety of the company, its customers, and other persons, and to protect customers’ interests in relation to the services they receive.
The camera monitoring activities carried out by our Company are conducted in accordance with the Law on Private Security Services and the related legislation. Only a limited number of Company employees have access to the recordings that are made and stored in digital form. The limited number of persons with access to the recordings declare, by way of a confidentiality undertaking, that they will protect the confidentiality of the data they access. Apart from the camera recording described above, our Company carries out personal data processing activities aimed at tracking guest entries and exits in our Company’s buildings and facilities, in order to ensure security and for the purposes stated in this notice. No monitoring whatsoever is carried out in places such as restrooms and changing rooms.
Personal Data Protection Application Form
Depending on the nature of your request, your applications will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest.