Personal Data Storage and Destruction Policy

1. INTRODUCTION

Protection of personal data is an issue of major concern in view of Özel Gebze Doğa Hastanesi Sağlık Hizmetleri A.Ş. (to be referred briefly as “Private Central Prime Hospital”, and/or as “Hospital” hereinafter), and is being dealt with by our Hospital with maximum sensitivity. In this respect, processing the personal data in a way that conforms to the expectations of the relevant persons, and that is in compliance with the relevant laws, constitutes one of the building blocks of our Hospital.

Our Hospital, thus, stores and destroys the personal data it obtains in the course of its activities in compliance with the general principles and regulations stipulated under this Personal Data Storage and Destruction Policy (to be referred briefly as “Policy” hereinafter), which has been created in accordance particularly with the Constitution, and with the Personal Data Protection Law No. 6698 (to be referred briefly as “PDPL”, and/or as “Law” hereinafter), Regulation on the Deletion, Destruction or Anonymization of Personal Data (to be referred briefly as “Regulation” hereinafter), and with other relevant legislation as well.

2. PURPOSE AND SCOPE OF THE POLICY

Hospital has intended by this Policy to fulfill the obligations stipulated under the relevant legislation, putting forth the Hospital’s general principles regarding the storage and destruction of the real-personal data subject to the personal data processing activities falling within the scope of PDPL being in particular.
While this Policy comprises not only all the personal data subject to the Hospital’s data processing activities falling within the scope of PDPL, the documents being referred to by the Policy comprise both physical and digital copies.

3. DEFINITIONS

Unless the content of this Policy requires otherwise:

"Explicit Consent"

Consent based on information and being expressed by free will regarding to a specific issue,

“Recipient Group”

The real person or legal entity category, to which personal data are transferred by the Data Controller,

"Constitution"

Constitution of the Republic of Turkey,

“Relevant User”

The persons that process the personal data either within the organization of the data controller, or pursuant to the power and instruction respectively bestowed by the data controller, other than the person or unit that is responsible from the technical storage, protection, and back-up of the data,

“Destruction”

Deletion, destruction, or anonymization of the personal data,

“Recording Medium”

All sorts of environments where personal data are processed either by fully/partially automatic ways, or by non-automated ways, on the condition not to be part of any data recording system,

"Personal Data"

All sorts of data appertaining to a real-person whose identity is clear or may be clarified (i.e. name-surname, TR ID#, e-mail address, DOB, credit card no., bank account no – thus procession of legal-entities does not fall within the scope of PDPL),

“Relevant Person”

Real-person, whose personal data are processed,

"Personal Data Procession"

All sorts of processes that the personal data may undergo, such as obtaining, saving, storing, modifying, rearranging, clarifying, transferring them, taking them over, making them attainable, classifying them, or avoiding the use of them either by fully/partially automatic ways, or by non-automated ways, on the condition not to be part of any data recording system,

“Board”

Personal Data Protection Board,

"Sensitive Personal Data"

Data related to race, ethnic origin, political opinion, philosophical belief, religion, sect, or any other faith, dress, association/foundation/trade-union membership, health, sexual life, penal conviction, and security measures, as well as the biometric and genetic data,

“Periodical Destruction”

The process of deleting, destroying, or anonymizing the personal that are stipulated hereunder, and that may be performed ex officio, if the personal data processing conditions stipulated under PDPL have ceased as a whole,

"Data Controller"

The person who determines the purposes and means of the procession of personal data, and operates the place where these data are systematically stored (data recording system)

4. RECORDING MEDIUMS BEING REGULATED UNDER THE POLICY

Hospital stores all personal data subject to the data processing activities falling within the scope of PDPL at the following environments, where the personal data are processed either by fully/partially automatic ways, or by non-automated ways, on the condition not to be part of any data recording system:

Our Hospital’s databases, third-party databases, e-mail accounts, desktop computers, Hospital personnel’s devices (such as cell phones), back-up areas, paper files, etc.

5. REASONS THAT NECESSITATE STORAGE AND DESTRUCTION OF PERSONAL DATA

Hospital constitutes its personal data processing activities on the basis of the following principles:

•   Conforming to the rule of law and integrity,
•   Keeping the personal data accurate, and updated when necessary,
•   Processing for definite, clear, and legitimate purposes,
•   Being correlated with and restricted to, and corresponding to the relevant procession purpose,
•   Storing for the period that is either stipulated in the relevant legislation, or required by the relevant procession purpose.

While Hospital stores and makes use of personal data pursuant to the personal data processing purposes stipulated under the relevant articles of the Private Prime Hospital’s Personal Data Protection and Procession Policy, and to the personal data processing conditions stipulated under articles 5 and 6 of PDPL given below, in a way conforming to the abovementioned principles, it destroys the personal data either ex officio, or upon the request of the relevant persons in case when the conditions in question have ceased as a whole.

(a) Explicit Consent of the Personal Data Subject

Primary condition of processing the personal data is the explicit consent of the data subject. Personal data subject’s explicit consent should have been declared regarding to a specific issue, on the basis of information, and by free will.

(b) Express Stipulation by Law

In cases stipulated clearly under the relevant Laws, the data subject’s personal data may be processed legally without his/her express consent.

The personal data of a data subject, who is unable to declare his/her consent, or whose consent may not be validated due to actual impossibility, may be processed in cases where procession of his/her personal data is a must so as to protect the life or bodily integrity of another person.

(d) Direct Concern Regarding Constitution or Execution of the Contract

Provided that it is directly correlated with the constitution or execution of a contract, procession of personal data is applicable in cases where it is necessary to process the personal data of the contractual parties.

(e) Legal Obligation

The personal data of a data subject may be processed in cases where such data procession is a must for our Hospital to fulfill its legal obligations.

(f) Data Subject's Publication of His/Her Personal Data

In case the data subject has publicized his/her personal data, the personal data of him/her may be processed in a way restricted with the said publication.

(a) Data Procession Mandatory for the Constitution, or Protection of a Right

Data subject’s personal data may be processed in case such procession is a must for the constitution, utilization, or protection of a right.

(b) Data Procession Mandatory for the Legitimate Interests of Our Hospital

On the condition not to cause any harm to the basic rights and freedoms of the personal data subject in question, his/her personal data may be processed in case such procession is a must for the sake of our Hospital’s legitimate interests.

In this respect, while one of the foregoing conditions may constitute the ground of the personal data processing activity in question, more than one of the said conditions may constitute the ground of the same personal data processing activity.

6. METHODS APPLICABLE TO PERSONAL DATA DESTRUCTIONAND TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN FOR LEGAL PERSONAL DATA DESTRUCTION

Our Hospital deletes, destroys, or anonymizes the personal data by the following methods in case the personal data processing conditions stipulated under articles 5 and 6 of PDPL have ceased as a whole. Our Hospital displays utmost attention and care in the destruction of the personal data. In this respect, our Hospital takes the necessary technical and administrative measures for the following issues in parallel with the relevant technological facilities and application cost, and pursuant to the provisions of the article 12 of PDPL, and those of the Regulation, to the aforementioned general principles, to this Policy, and to the resolutions passed by the Personal Data Protection Board. Our Hospital takes the record of all the processes performed within the scope of destruction, and these records are kept for a period of 10 years, except other relevant legal obligations. Unless it is to be resolved otherwise by the Personal Data Protection Board, our Hospital chooses among ex officio deletion, destruction, or anonymization for being applicable, and in parallel with the relevant technological facilities and application cost, as the method of destroying the personal data, and declares the reason of choice of its applicable method upon the request of the personal data subject.

(a) Personal Data Deletion Methods

Deletion of the personal data is the process of making the personal data inaccessible and unusable anyhow for the relevant users. Our Hospital takes all sorts of technical and administrative measures necessary in parallel with the relevant technological facilities and application cost, in order to make the deleted personal data inaccessible and unusable anyhow for the relevant users.

In this respect, our Hospital applies the following methods for the process of deleting the personal data:
[The Institution has to declare the deletion methods it applies within the scope of the deletion activities, as well as the technical and administrative measures it applies in order to perform the deletion securely]

(b) Personal Data Destruction Methods

Destruction of the personal data is the process of making the personal data unable to be accessed, recovered, and used anyhow by anyone. Our Hospital takes all sorts of technical and administrative measures necessary in parallel with the technological facilities and application cost relevant to the destruction of the personal data.

In this respect, our Hospital applies the following methods for the process of destroying the personal data:

[The Institution has to declare the destruction methods it applies within the scope of the destruction activities, as well as the technical and administrative measures it applies in order to perform the destruction securely]

Anonymization of the personal data is the process of making the personal data unable to be correlated with any known or identifiable real person anyhow, even though the same data may be matched with other data. Our Hospital has to make the personal data unable to be correlated with any known or identifiable real person by the recipients or recipient groups, even by means of techniques that are applicable in respect of the recording medium and the relevant field of activity, such as recovering, or matching the relevant personal data with other data, in order to make the personal data become anonymized. Our Hospital takes all sorts of technical and administrative measures necessary in parallel with the technological facilities and application cost relevant to the anonymization of the personal data.

In this respect, our Hospital applies the following methods for the process of anonymizing the personal data:

[The Institution has to declare the anonymization methods it applies within the scope of the anonymization activities, as well as the technical and administrative measures it applies in order to perform the anonymization securely]

1. TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN FOR SECURE PROTECTION OF PERSONAL DATA, AND FOR AVOIDING UNLAWFUL PROCESSING AND ACCESSING THEREOF

While our Hospital displays utmost attention and care for keeping the personal data securely, and for avoiding their illegal procession and accession, it takes the necessary technical and administrative measures for the following issues in parallel with the relevant technological facilities and application cost, and pursuant to the provisions of the article 12 of PDPL, and those of the Regulation, to the aforementioned general principles, to this Policy, and to the resolutions passed by the Personal Data Protection Board:

[Technical and Administrative Measures being taken by the Institution have to be entered herein]

8. TITLES, UNITS, AND JOB DESCRIPTIONS OF THOSE TAKING PART IN THE PERSONAL DATA STORAGE AND DESTRUCTION PROCESSES

Our Hospital, and its personnel involving in the personal data storage and destruction processes are being informed and trained in the issues of personal data protection law, and legal procession of the personal data.
In this respect, our Hospital’s employees and its personnel getting to know personal data as a matter of their duties store and destroy the information in question in compliance with the provisions of the PDPL, and those of the other relevant legislation. This obligation of theirs continues also after their resignations.

9. STORAGE AND DESTRUCTION PERIODS

Our Hospital stores the personal data for the period either that is stipulated under the legislation it is subject to, or that is required by the purpose of their procession, and destroys them thereupon.

Upon the personal data subject’s apply to our Hospital, and receiving his/her request for the destruction of the personal data belonging to him/her, our Hospital:

(a) in case the respective personal data procession conditions have ceased as a whole:

(i) concludes the request of the personal data subject in no longer than thirty days, and informs him/her accordingly, and

(ii) informs the relevant third-parties, in case the personal data in question have been transferred to third-parties, and causes the fulfillment of the necessary procedures before them.

(b) in case the respective personal data procession conditions have not ceased as a whole, may reject this request of the personal data subject upon declaring the ground of its rejection in compliance with article 13.3 of the PDPL, and submits its response of rejection to the personal data subject either in writing, or via digital environment in no later than thirty days.

10. PERIODICAL DESTRUCTION TERMS

Our Hospital destroys the personal data in the first periodic destruction process following the date its obligation to destroy the relevant personal data arises. In this respect, our Hospital puts the personal data to destruction in periods of 3 months upon the rise of its obligation to destroy the relevant personal data. The referred period may by no means exceed the maximum periodic destruction term stipulated under article 11 of the Regulation.

11. EFFECTIVE DATE

This Policy has become effective as of [Effective Date has to be entered herein]. The Policy is subject to update at times so as to conform to the changing conditions and legislation. Up-to-date Policy becomes effective as of the date it is published via www.merkezprime.com.tr. In case any contradiction is to arise between this Policy and the provisions of the PDPL, the Regulation, and those of the Personal Data Protection and Procession Policy of the Private Central Prime Hospital, the relevant provisions stipulated under the PDPL, the Regulation, and those of the Personal Data Protection and Procession Policy of the Private Central Prime Hospital shall prevail.