OP. DR. SEDAT CÖMERT CLINIC – PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

This Privacy Notice has been prepared pursuant to the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”) to inform data subjects about the procedures and principles regarding the processing of personal data of patients/clients who apply to OP. DR. SEDAT CÖMERT CLINIC (“DR. SEDAT CÖMERT”). Ensuring the security of personal data is a priority for DR. SEDAT CÖMERT. Therefore, personal data are processed securely and any unlawful access is prevented by implementing appropriate technical and organisational measures in compliance with the applicable legislation.

DATA CONTROLLER

Your personal data will be processed by OP. DR. SEDAT CÖMERT CLINIC as the “data controller” under the KVKK and as the “controller” under the GDPR. Address: Nenehatun Caddesi No:114, Floor:1, GOP Çankaya, Ankara, Türkiye 06680. Compliance with KVKK and GDPR is the responsibility of the data controller; where necessary, the clinic may receive support from specialised legal and information security consultants.

CATEGORIES OF PERSONAL DATA PROCESSED

The following personal data and special categories of personal data will be processed in accordance with the principles set out in Article 4 KVKK and Article 5 GDPR; on the legal bases specified in Articles 5–6 KVKK and Articles 6–9 GDPR; for the purposes described in this Notice; lawfully, fairly, transparently, and limited to what is necessary, with appropriate security measures:

1– Identity Data: Name, surname, Turkish ID/Passport/Temporary ID number, ID/passport details, place and date of birth, marital status, gender, profession, signature and similar identifiers.

2– Contact Data: Residential/work address, telephone numbers, e-mail address, IP address, social media identifiers and other contact information.

3– Health Data (Special Category): Blood group, laboratory and imaging results, tests, allergies, chronic and communicable diseases, history of surgeries/operations, regular medications, medical treatments, prescription details, lifestyle-related information, body analysis/measurements, and other health data necessary for treatment.

4– Visual/Audio Records: Photographs and/or videos taken before/during/after medical procedures and CCTV footage for workplace security; where applicable, audio records.

5– Financial Data: Bank account/IBAN, billing details, payment information and similar financial data.

6– Travel/Accommodation Data: For patients within the scope of health tourism: flight, transfer and accommodation information.

PURPOSES OF PROCESSING

Your personal data are processed for the following purposes: creating patient files; provision of examination, preventive healthcare, medical diagnosis, treatment and care services; managing follow-up and control processes; monitoring potential complications; contacting you and managing appointments; patient satisfaction and request management; performance of legal and contractual obligations; fulfilling statutory retention obligations; obtaining consultations from other specialists when necessary; fulfilling administrative obligations under health tourism legislation and planning transfer/accommodation/interpretation services; planning and managing healthcare services and financing; ensuring workplace, technical and commercial security; complying with public obligations.

  • Contact Data: Managing appointments and controls; with your explicit consent, sending information/announcements about medical services.
  • Health Data: Conducting diagnosis and treatment; consultations; creating patient records; statutory retention.
  • Photo/Video/Audio: Monitoring treatment processes and workplace security; with explicit consent, informative/educational communications.
  • Financial Data: Payment collection, invoicing and refunds.
  • Travel/Accommodation: Organising health tourism logistics.

If the relevant data are not provided, statutory obligations of the data controller may not be properly fulfilled and medical processes may not be carried out effectively.

METHODS OF COLLECTION

Personal data may be collected during examination and treatment processes, through forms and declarations, laboratory/imaging results; via contact forms on www.sedatcomert.net; via messages sent to corporate e-mail addresses; photos/videos taken before/during/after procedures; where necessary, via telehealth/online communication tools (subject to each provider’s privacy and cross-border transfer policies); messages and applications via social media; mandatory traffic logs when using guest Wi-Fi at the clinic; and CCTV systems for workplace security. Data may be processed in physical and electronic environments in accordance with KVKK and GDPR.

Your data are processed by the data controller and authorised processors verbally, in writing or electronically, by automated or non-automated means, with appropriate technical and organisational measures. Legal bases include KVKK Articles 5/2 and 6/3 and GDPR Articles 6–9; explicit consent is obtained where required.

  • Sending information, announcements or reminders about medical services via SMS/e-mail and mobile communication.
  • Sharing photographs/videos related to treatment on the clinic’s website and/or social media accounts.
  • Transfers of personal data abroad when using service providers whose servers are located outside Türkiye.

If you share data through platforms (e.g., messaging/video-call and social media applications, foreign e-mail providers) whose servers are abroad and whose privacy/cross-border policies you have accepted, such sharing may constitute a transfer abroad and may be deemed to include your explicit consent to that transfer.

KVKK 6/3 & GDPR 9/2(h): Health data processed by healthcare professionals bound by confidentiality obligations for the purposes of medical diagnosis, treatment and care.

KVKK 5/2(c) & GDPR 6/1(b): Contacting you and managing appointment/control processes for the performance of services.

KVKK 5/2(f) & GDPR 6/1(f): Patient satisfaction and request management under the legitimate interests of the clinic, provided your fundamental rights and freedoms are not infringed.

KVKK 5/2(a) & 5/2(ç) & GDPR 6/1(c): Compliance with legal obligations: keeping patient records, statutory retention of health data, invoicing/tax obligations, obligations under the Ministry of Health and health tourism legislation, data security, and processes before judicial and administrative authorities.

DISCLOSURE AND RECIPIENTS

In accordance with KVKK Articles 8–9 and GDPR Articles 45–49, and limited to the purposes stated above, your personal data may be disclosed—subject to appropriate confidentiality undertakings and security measures—to the following recipients:

  • Other specialist physicians for consultations; laboratories and imaging service providers,
  • Finance, accounting and audit consultants; legal advisors; IT/infrastructure and clinical software providers; interpreters; health-tourism agencies,
  • Competent public institutions and organisations, and judicial authorities where required by law.

RETENTION PERIODS

Your personal data are stored for the periods required by applicable legislation and then deleted, destroyed or anonymised. Unless otherwise mandated, the following periods apply:

Category Retention Period
Identity Data 20 years after the end of the service
Contact Data 20 years after the end of the service
Health Data 20 years after the end of the service
Photo/Video Data 20 years after the end of the service
Financial Data 5 years after the end of the service

AGE THRESHOLDS UNDER APPLICABLE LAW

Under the KVKK, individuals under 18 years of age require the consent of their legal representatives. Under the GDPR, for EU citizens/residents, the general threshold is 16 (subject to Member State variations); below this age, consent must be given by the legal representative.

WITHDRAWAL OF CONSENT

If you have provided explicit consent under KVKK 5/1 and GDPR 6/1(a), you may withdraw it at any time. Withdrawal will take effect prospectively from the moment your notice is received by the data controller.

DATA SUBJECT RIGHTS UNDER THE GDPR

  • Right of Access (Art. 15)
  • Right to Rectification (Art. 16)
  • Right to Erasure (Art. 17)
  • Right to Restriction of Processing (Art. 18)
  • Right to Data Portability (Art. 20)
  • Right to Object (Art. 21)

DATA SUBJECT RIGHTS UNDER THE KVKK

  • To learn whether personal data are processed,
  • If processed, to request information thereof,
  • To learn the purpose of processing and whether they are used in line with that purpose,
  • To know the third parties to whom data are transferred domestically or abroad,
  • To request correction of incomplete or inaccurate data and notification of third parties,
  • To request deletion or destruction when the reasons for processing cease to exist and notification of third parties,
  • To object to results arising to the detriment of the person by analysing data exclusively through automated systems,
  • To claim compensation for damages arising from unlawful processing.

HOW TO EXERCISE YOUR RIGHTS & RESPONSE TIMES

To exercise your rights, submit a written application clearly stating your request and including identification documents to the clinic address or via the communication channels on our website: Nenehatun Caddesi No:114, Floor:1, GOP Çankaya, Ankara, Türkiye 06680. Requests will be finalised as soon as possible and within 30 days at the latest, depending on their nature. If processing your request incurs a cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Authority.

By reading and accepting this Privacy Notice, you acknowledge that you have been informed about the data-processing activities of DR. SEDAT CÖMERT, that you understand your rights under the KVKK and GDPR, and that you freely consent to the processing of your personal data and special categories of personal data within the scope of this Notice where consent is required. You may decline to accept this Notice.

Data Controller: OP. DR. SEDAT CÖMERT CLINIC — Address: Nenehatun Caddesi No:114, Floor:1, GOP Çankaya, Ankara, Türkiye 06680 — Phone: 0532 463 71 20 / 0312 468 84 95 — Website: www.sedatcomert.net

Kind regards.