Information Notice on the Protection of Personal Data (KVKK)

1. PURPOSE OF THE CLARIFICATION TEXT

Pursuant to the provisions of the Personal Data Protection Law No. 6698 (the "Law"), the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, and the relevant legislation, DENTAFIX ORAL AND DENTAL HEALTH POLYCLINIC, in its capacity as Data Controller, has prepared this text to inform and enlighten you regarding which of your personal data are processed during the "Appointment and Treatment" process, the purposes and legal reasons for processing your personal data, the methods of collection, the recipient/recipient groups to whom we transfer personal data and for what purposes, as well as your rights.

In order to provide you with the services (dental practices) offered by Dentafix Oral and Dental Health Polyclinic, it is necessary for us to obtain your personal information and health data and to record and store them within the limits required by the service to be provided. The health data we are obliged to record in order to provide you with healthcare services are considered special categories of personal data under the Law. In this context, pursuant to Article 6, paragraph 2 of the Law on the Protection of Personal Data No. 6698, which stipulates that "Special categories of personal data cannot be processed without the explicit consent of the data subject", it is mandatory to obtain your explicit written consent as your personal health data can only be recorded under the special conditions specified in the law. This consent form will be presented to you in our polyclinic and the explicit consent text will be submitted for your approval.

2. DATA CONTROLLER’S OBLIGATION TO INFORM

This clarification text has been prepared by Dentafix Oral and Dental Health Polyclinic, as the data controller, in accordance with the Personal Data Protection Law No. 6698 (KVKK), the Regulation on Personal Health Data, the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, and other relevant legislation, for the purpose of informing patients and their relatives regarding the processing of their personal data. Pursuant to Article 10 of KVKK No. 6698, the data controller or the person authorized by him is obliged to inform the data subjects about the following matters within the framework of the obligation to inform:

• The identity of the data controller and its representative, if any,
• Which personal data will be processed and for what purpose,
• To whom and for what purpose the processed personal data may be transferred,
• The method and legal reason for collecting personal data,
• Other rights listed in Article 11 of KVKK.

3. IDENTITY OF THE DATA CONTROLLER

Company Title: Dentafix Oral and Dental Health Polyclinic

Address: Aksoy Mah. Girne Blv. No:38/E Karşıyaka/İZMİR

4. PURPOSE OF PROCESSING PERSONAL DATA AND YOUR DATA TO BE PROCESSED

In accordance with KVKK and the relevant legislation, the categories and descriptions of personal data that may be processed within the scope of the purposes and legal reasons stated in this Clarification Text are as follows:

• Performance of the contract, explicit provision by law, necessity to fulfill our legal obligations, protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of healthcare services and their financing, sharing of information requested by the Ministry of Health and other public institutions and organizations in accordance with the relevant legislation,
• Compliance with legal and regulatory requirements, mandatory cases stipulated by the Ministry of Health,
• Financing of healthcare services, coverage of your examination, diagnosis and treatment expenses, entitlement inquiries, sharing of requested information with private insurance companies by the Patient Services, financial affairs, accounting departments,
• Informing you about your appointment via our communication channels,
• Verification of your identity by Patient Services, Health Personnel, and Call Center departments,
• Planning and management of the internal operations of the polyclinic by the Polyclinic Management,
• Conducting analyses to improve healthcare services by Quality, Patient Experience, and Information Systems departments,
• Providing training to our employees by Human Resources and Quality departments,
• Monitoring and preventing abuse and unauthorized transactions by Audit and Information Systems departments,
• Carrying out risk management and quality improvement activities by Quality, Patient Experience, and Information Systems departments,
• Issuing invoices for your services by Patient Services, Financial Affairs, and Accounting departments, confirming your relationship with institutions contracted with your hospital by Patient Services, Financial Affairs, and Accounting departments, responding to any questions or complaints regarding healthcare services provided/to be provided by Polyclinic Management, Patient Experience, Patient Rights, and Call Center departments,
• Taking all necessary technical and administrative measures within the scope of data security of our polyclinic’s systems and applications by Polyclinic Management and Information Systems departments,
• Measuring, increasing, and researching patient satisfaction by Polyclinic Management.
• Your personal and sensitive personal data specified above may be stored with great care in physical and electronic archives within Dentafix and external service providers, in compliance with the provisions of the legislation.

Your personal health data obtained for the execution of medical diagnosis, examination, treatment, and care services, as well as other general and special categories of personal data obtained, are listed below:

• Identity Information: Name, surname, Turkish ID number, passport number or temporary Turkish ID number if you are not a Turkish citizen, place and date of birth, marital status, gender, and other identity data, as well as personal data obtained from the ID card or similar identity document presented,
• Contact Information: Address, phone number, e-mail address, etc.
• Customer Transaction: Payment, invoice information, bank account number, IBAN number, etc.
• Physical Space, Visual and Audio Records: Common area camera recordings,
• Race Information: As requested by the Ministry of Health system,
• Health Information: Laboratory and imaging results provided by you for follow-up in your file, test results, examination data, prescription information obtained during medical diagnosis, treatment and care services, answers and feedback you share to evaluate our services,
• Digital Data: Camera system images obtained in common areas during your visit to our polyclinic, data you have shared with us through communication channels such as WhatsApp messages,
• Other: Data related to private health insurance for the financing and planning of your healthcare services, Social Security Institution data, browsing information obtained during the use of our website, IP address, browser information, and medical documents, surveys, form information, and location data voluntarily shared by you.

5. TRANSFER OF DATA

5.1 Your personal data is not transferred abroad.

5.2 Within Turkey, your personal data may be transferred for the purposes mentioned above and under the conditions for the transfer of personal data set out in Articles 8 and 9 of KVKK, within the scope of Law No. 359, Decree Law No. 663, relevant regulations and legislation, to:

• The Ministry of Health and its affiliated units,
• The Turkish Dental Association,
• Relatives of the patient (individuals declared in writing by the patient),
• The Social Security Institution,
• Private insurance companies,
• Individuals appointed by notary as proxy,
• Laboratories providing outsourced services,
• The General Directorate of Security and other law enforcement authorities,
• Judicial authorities,
• Domestic laboratories, medical devices, and healthcare service providers we cooperate with for medical diagnosis and treatment,
• Regulatory and supervisory institutions, official authorities,
• Domestic auditors; consultants; lawyers; business partners; domestic institutions with whom we have contractual relations to conduct our activities; and other third parties.

6. METHOD AND LEGAL REASON FOR COLLECTING PERSONAL DATA

As stated in Article 6, paragraph 3 of the Law on the Protection of Personal Data, personal data relating to health and sexual life may be processed without explicit consent by persons or authorized institutions and organizations subject to confidentiality obligations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

In all business processes included in the activities of our polyclinic, your personal data in verbal, written, visual or electronic media are collected within the purposes specified above and within the limitations set out in the legal framework. The legal grounds for the collection of your data are:

• Personal Data Protection Law No. 6698,
• Fundamental Law on Health Services No. 3359,
• Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions,
• Regulation on Private Health Institutions Providing Oral and Dental Health Services,
• Regulation on Patient Rights,
• Regulation on the Processing of Personal Health Data and Protection of Privacy,
• Regulations of the Ministry of Health and other provisions of legislation.

7. RIGHTS OF THE DATA SUBJECT

Within the framework of the rights listed in Article 11 of KVKK No. 6698 and the rights granted to individuals under Article 20 of the Constitution, the data subject has the right to request the following information. As Dentafix Oral and Dental Health Polyclinic, we provide the necessary information to the data subjects regarding their rights as determined by law. Data subjects have the right to:

• Learn whether personal data is processed,
• If personal data has been processed, request information regarding this,
• Access their personal health data and request these data,
• Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• Know the third parties to whom personal data are transferred, domestically or abroad,
• Request correction of personal data in case of incomplete or incorrect processing, and request that the transaction made in this context be notified to the third parties to whom personal data are transferred,
• Request the deletion or destruction of personal data in case the reasons requiring processing are eliminated, despite having been processed in accordance with the provisions of Law No. 6698 and other relevant laws, and request that the transaction made in this context be notified to the third parties to whom personal data are transferred,
• Object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,
• Request compensation for the damage in case of damage due to unlawful processing of personal data,
• Pursuant to Article 13, paragraph 1 of the Law, you may submit your request regarding the exercise of your rights by filling in the "Data Subject Application Form" available on our company’s other website and/or by the other methods stipulated in the legislation:
• By sending a petition/form duly prepared with a wet signature and including official documents confirming your identity, to the address "Aksoy Mah. Girne Bul. No: 38E Karşıyaka / İzmir – Turkey" in person or via mail/cargo or other means,
• By sending an e-mail to our company’s e-mail address "dentafix.clinics@gmail.com" using the e-mail address you have previously notified to our company and registered in our system, together with official documents confirming your identity,
• By applying through notary public channels or by other methods specified in Law No. 6698, or by sending to our company’s electronic notification address 25868-70766-96477.

8. METHODS FOR EXERCISING THE RIGHTS OF DATA SUBJECTS

You can apply using the communication methods specified in the Data Subject Communication Form in order to exercise your rights. Your applications will be concluded free of charge within 30 days by Dentafix Oral and Dental Health Polyclinic. However, if the process requires an additional cost, a fee determined in the tariff set by the Personal Data Protection Board may be charged.

The data controller accepts or rejects the request and notifies the data subject in writing or electronically. If the request specified in the application is accepted, it is fulfilled by the data controller. If the application arises due to the fault of the data controller, the fee charged is refunded to the applicant.