DR. ABDURRAHMAN EFEM PERSONAL DATA PROCESSING, PROTECTION AND DISPOSAL POLICY

Introduction

At the private clinic operated by Dr. Abdurrahman Efem (“Efem Clinic”), we attach significant importance to the security and protection of personal data.

As the data controller, we process and retain personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and other applicable legislation, subject to the principles and conditions described in this Policy.

1. Purpose and Scope

The Turkish Personal Data Protection Law No. 6698 entered into force in 2016.

This Dr. Abdurrahman Efem Personal Data Processing, Protection and Disposal Policy (“Policy”) has been prepared to explain the principles applied to the processing, protection, retention and disposal of personal data relating to individuals who interact with Efem Clinic and provide personal data through any lawful channel.

The Policy aims in particular to protect privacy and personal data by implementing appropriate technical and administrative measures and to establish the principles followed by Efem Clinic in fulfilling its obligations under KVKK and applicable secondary legislation.

This Policy applies to the processing, protection, storage, erasure, destruction and anonymisation of personal data within the scope of Law No. 6698.

Data Controller: Dr. Abdurrahman Efem
Address: Levent Mahallesi, Nispetiye Cad. Krizantem Sok. No:12, Istanbul, Türkiye
Telephone: +90 212 247 30 01
Email: hi@drabdurrahmanefem.com

2. Definitions

Personal Data: Any information relating to an identified or identifiable natural person.

Special Categories of Personal Data: Personal data relating to race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Data Subject: The natural person whose personal data is processed.

Processing of Personal Data: Any operation performed on personal data, wholly or partly by automated means or by non-automated means forming part of a data filing system, including collection, recording, storage, retention, alteration, adaptation, disclosure, transfer, retrieval, making available, classification or restriction of use.

Electronic Environment: Any environment in which personal data can be created, accessed, read, altered or stored through electronic devices or systems.

Non-Electronic Environment: Written, printed, visual, physical and other environments other than electronic environments.

Data Filing System: A system in which personal data is processed by being structured according to specific criteria.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.

KVKK / Law: The Turkish Personal Data Protection Law No. 6698.

Explicit Consent: Freely given, specific and informed consent relating to a particular matter.

Disposal: The erasure, destruction or anonymisation of personal data.

Periodic Disposal: The recurring process of erasing, destroying or anonymising personal data ex officio at intervals specified in the applicable retention and disposal policy when all conditions requiring the processing of such personal data have ceased to exist.

Transfer of Personal Data Abroad: The transfer of personal data to a recipient located outside Türkiye in accordance with Article 9 of KVKK and the applicable regulations governing international data transfers. Such transfers may take place only where the relevant legal conditions and, where applicable, appropriate safeguards or permitted exceptions are satisfied.

3. Data Subjects

Individuals whose personal data may be processed within the scope of this Policy include, without limitation:

patients;
website visitors;
visitors to the Clinic;
natural persons who enter into agreements for the purchase or provision of goods or services;
employees and employment candidates; and
other natural persons who lawfully provide their personal data to Efem Clinic.

4. Categories of Personal Data

Efem Clinic may process the following categories of personal data in accordance with the processing conditions set out under KVKK and applicable legislation.

Identity Information

Information identifying an individual contained in documents such as identity cards, driving licences, residence documents, passports and marriage certificates.

Special Categories of Personal Data

Information falling within the special categories of personal data defined under KVKK, including health data, sexual-life data, criminal conviction and security-measure data, biometric data and genetic data.

Health Data

Health-related information provided to or obtained by the Clinic in accordance with applicable law, which may include information such as blood group, medication use, disability status, chronic conditions, medical history and other information necessary for healthcare services.

Image and Audio Data

Photographs, videos, audio recordings and other visual or audio data processed within the scope of Clinic activities where there is an appropriate legal basis for such processing.

Contact Information

Telephone numbers, addresses, email addresses and other information used to communicate directly with the data subject or, where appropriate and lawful, with a person designated for emergency contact.

Education, Employment and Professional Information

Information concerning education, internships, employment history, professional experience and documents containing such information, including CVs and biographies.

Transaction Security Information

Personal data processed for the purpose of maintaining the technical, administrative, legal and commercial security of Clinic activities and information systems.

Financial Information

Personal data contained in financial records, documents and information arising from the relevant relationship between the data subject and Efem Clinic.

Audit and Inspection Information

Personal data processed in connection with audits, inspections and compliance obligations arising from applicable legislation.

Request and Complaint Management Information

Personal data processed for the receipt, assessment and resolution of requests, enquiries, feedback and complaints submitted to Efem Clinic.

Digital Usage and Cookie Data

Where applicable, data generated through interaction with digital services, including website usage and browsing information, device and technical data, cookie information and other digital identifiers processed in accordance with applicable law and the Clinic's cookie practices.

5. Processing of Special Categories of Personal Data

Special categories of personal data require increased protection because unlawful processing or disclosure may create a heightened risk to the rights and freedoms of individuals.

Efem Clinic may need to process special categories of personal data, particularly health data, in connection with healthcare, medical and aesthetic services and its legal, professional and ethical obligations.

Such data is processed only where one or more of the conditions permitted under Article 6 of KVKK are satisfied.

Depending on the circumstances, these conditions may include:

the explicit consent of the data subject;
processing expressly permitted or required by law;
processing necessary for the establishment, exercise or protection of a legal right; or
processing necessary for the protection of public health, preventive medicine, medical diagnosis, treatment or care services, or the planning, management and financing of healthcare services by persons subject to a duty of confidentiality or by authorised public institutions and organisations.

Appropriate measures determined by the Personal Data Protection Board, together with other necessary technical and administrative safeguards, are applied when processing special categories of personal data.

6. Purposes of Processing Personal Data

Personal data may be processed by Efem Clinic for purposes including:

fulfilling legal obligations arising from applicable healthcare legislation and other relevant regulations;
protecting public health and providing preventive medicine, medical diagnosis, treatment and care services in accordance with applicable law;
planning and managing healthcare services;
providing information regarding appointments;
planning and managing the Clinic's internal operations;
ensuring compliance with Clinic policies, procedures and legal obligations;
evaluating and improving the services provided;
carrying out billing and accounting processes;
verifying identity where required;
responding to lawful requests from the Ministry of Health and other authorised public institutions and authorities;
responding to questions, requests and complaints relating to Clinic services;
evaluating use of healthcare services where necessary for service management and improvement;
measuring and improving patient satisfaction;
providing information regarding Clinic services and, where legally permitted and subject to any consent requirements that apply, communicating marketing, campaign or personalised content;
procuring medicines, medical devices or other products where necessary for the relevant service;
fulfilling statutory and regulatory obligations;
creating and administering personnel files for employees and candidates where applicable;
ensuring physical premises security; and
performing contractual obligations relating to the procurement or provision of goods and services.

Personal data will not be used for unrelated commercial purposes outside the purposes described in this Policy and the requirements of applicable law.

7. Methods of Processing Personal Data

Personal data may be collected and processed by Efem Clinic through channels including:

email;
telephone;
the Clinic's website;
appointment and patient management systems;
written or electronic forms; and
physical documents.

Personal data may therefore be processed orally, in writing or electronically and by automated or non-automated means where such processing falls within the scope of KVKK.

Where unnecessary personal data is voluntarily submitted to Efem Clinic through email or another communication channel without having been requested by the Clinic and without a lawful or operational need for its processing, such data will not be used for unrelated purposes and will be handled in accordance with applicable data minimisation and disposal requirements.

8. Persons Authorised to Access Personal Data

Access to personal data processed by Efem Clinic is restricted according to necessity, role and authorisation.

Within the Clinic, access may be granted to:

Dr. Abdurrahman Efem; and
authorised Efem Clinic employees.

Access is limited to the extent required for the relevant person's duties and responsibilities.

9. Transfer of Personal Data

Personal data processed by Efem Clinic may be transferred, where legally permitted and only to the extent necessary:

to authorised public institutions and organisations, limited to information lawfully requested within the scope of their legal authority;
to accounting advisers, contracted financial advisers and relevant financial or electronic commerce service providers where necessary to fulfil accounting, taxation and financial obligations;
to the Clinic's patient and appointment management software provider where necessary for appointment and patient-management processes and subject to applicable confidentiality and data-security obligations; and
to logistics providers within Türkiye, limited to identity and contact information where necessary for the provision or delivery of services.

Domestic transfers are carried out in accordance with Article 8 of KVKK and other applicable legislation.

Where a transfer of personal data outside Türkiye becomes necessary, such transfer will be carried out only in accordance with Article 9 of KVKK and the applicable rules governing international data transfers, including any applicable adequacy decision, appropriate safeguard or legally permitted exception.

The Clinic does not transfer personal data to unrelated third parties for purposes incompatible with those described in this Policy.

10. Retention of Personal Data

Efem Clinic retains personal data only for the period required for the purposes for which it was processed and for any minimum or mandatory retention period prescribed by applicable legislation.

When determining retention periods, the Clinic considers in particular:

the purpose for which the data is processed;
legal and regulatory retention requirements;
contractual obligations;
limitation periods relating to possible legal claims; and
whether continued retention remains necessary and proportionate.

Once the legal basis and purposes requiring retention cease to exist, personal data is erased, destroyed or anonymised in accordance with KVKK and the applicable legislation.

Where the Clinic is required to maintain a personal data retention and disposal policy, disposal is carried out during the first applicable periodic disposal process following the date on which the obligation to erase, destroy or anonymise the data arises.

The interval between periodic disposal processes will not exceed the maximum period permitted under applicable legislation.

11. Storage and Security of Personal Data

Where personal data is processed and stored electronically, it is retained through the Clinic's authorised electronic systems, servers, databases and service providers, subject to applicable security measures.

Where personal data is processed physically or through non-automated means, it is stored in protected areas within the Clinic's premises with access restricted to authorised persons.

Additional safeguards are applied to special categories of personal data according to their level of sensitivity and applicable regulatory requirements.

In accordance with Article 12 of KVKK, Efem Clinic takes appropriate technical and administrative measures designed to:

prevent unlawful processing of personal data;
prevent unlawful access to personal data; and
ensure the appropriate protection and security of personal data.

Relevant employees are informed of personal data confidentiality and security requirements.

Confidentiality and data-security obligations may also form part of employment agreements, confidentiality undertakings, internal policies and Clinic procedures.

12. Erasure, Destruction and Anonymisation of Personal Data

Personal data is processed and disposed of in accordance with KVKK and applicable secondary legislation.

When all reasons requiring continued processing cease to exist, personal data is erased, destroyed or anonymised by Efem Clinic either ex officio or upon a valid request by the data subject, as applicable.

Depending on the storage medium and circumstances, disposal methods may include:

secure erasure of electronic records;
rendering electronic data inaccessible and irretrievable where destruction is required;
physical destruction of paper records through secure shredding; or
anonymisation using appropriate techniques that prevent the data from being associated with an identified or identifiable natural person.

Disposal procedures are performed using methods appropriate to the relevant storage medium and level of sensitivity.

Periodic disposal is carried out at intervals determined under the Clinic's applicable retention and disposal procedures, and such interval will not exceed six months where the relevant legislation requires a periodic disposal schedule.

Records relating to disposal operations are retained for the periods required by applicable law.

13. Rights of Data Subjects

Under Article 11 of KVKK, data subjects have the right to apply to the data controller and:

learn whether their personal data is being processed;
request information where their personal data has been processed;
learn the purpose of processing and whether the personal data is being used in accordance with that purpose;
learn the third parties to whom personal data has been transferred in Türkiye or abroad;
request correction of incomplete or inaccurate personal data;
request erasure or destruction of personal data under the conditions set out in Article 7 of KVKK;
request notification of correction, erasure or destruction operations to third parties to whom the personal data has been transferred;
object to a result arising against them through the analysis of personal data exclusively by automated systems; and
claim compensation for damage suffered as a result of unlawful processing of personal data.

14. Applications to the Data Controller

Requests concerning your rights under KVKK may be submitted to the data controller in accordance with the applicable legal procedures.

Requests submitted by email may be sent to:

hi@drabdurrahmanefem.com

Applications should clearly state the request and contain the information required under the applicable rules governing applications to data controllers, which may include:

full name;
Turkish Republic identification number or, for foreign nationals, passport or other identification information where legally required;
residential or workplace address for notification;
email address, telephone number or fax number, where applicable; and
details of the request.

Where an application is submitted by email, the subject line may state:

“Application Under the Personal Data Protection Law”

Applications will be concluded as soon as possible according to the nature of the request and, in any event, within 30 days, in accordance with applicable legislation.

Applications are generally processed free of charge. Where responding to a request gives rise to additional costs, fees may be charged in accordance with the tariff determined by the Turkish Personal Data Protection Board and applicable regulations.

Contact

For questions, comments or requests concerning this Policy or the exercise of your rights relating to personal data, you may contact us using the details below:

Data Controller: Dr. Abdurrahman Efem
Address: Levent Mahallesi, Nispetiye Cad. Krizantem Sok. No:12, Istanbul, Türkiye
Telephone: +90 212 247 30 01
Email: info@abdurrahmanefem.com

Personal Data Processing, Protection and Disposal Policy