1
Personal Data Protecon and Privacy Policy
Scope:
This policy, tled "Personal Data Protecon and Privacy Policy," has been prepared by Surgicraers
Health Tourism and Educaon Consulng Services Import Export Limited Company (Surgicraers) to
explain the complete set of rules for processing personal data and to provide the necessary
informaon.
Denions:
Personal Data: Any informaon relang to an idened or idenable real person.
Special Categories of Personal Data: Data concerning individuals' race, ethnic origin, polical opinions,
philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership in associaons,
foundaons or trade-unions, health, sexual life, criminal convicons and security measures, and
biometric and genec data.
Explicit Consent: Consent that is informed and freely given on a specic subject.
Anonymizaon: The process of rendering personal data unable to idenfy a specic or idenable real
person, even if matched with other data.
Processing of Personal Data: Any operaon performed on personal data, whether or not by automated
means, such as collecon, recording, organizaon, structuring, storage, adaptaon or alteraon,
retrieval, consultaon, use, disclosure by transmission, disseminaon or otherwise making available,
alignment or combinaon, restricon, erasure or destrucon.
Data Subject: The real person whose personal data is processed.
Data Recording System: The system in which personal data is processed based on certain criteria.
Data Controller: The real or legal person who determines the purposes and means of processing
personal data and is responsible for establishing and managing the data recording system.
Data Processor: The real or legal person who processes personal data on behalf of the data controller.
Contact Person: The person responsible for the operaon of procedures and communicaon with the
Board.
KVKK: The Personal Data Protecon Law No. 6698, published in the Ocial Gazee dated April 7, 2016,
and numbered 29677.
KVKK Working Group: Contact Person authorized by Surgicraers.
Board: Personal Data Protecon Board.
Authority: Personal Data Protecon Authority.
Policy: Surgicraers' Personal Data Protecon and Privacy Policy.
2
Personal Health Data: All informaon relang to the physical and mental health of an idenable or
idened real person and the health services provided to the person.
Erasure of Personal Data: The process of making personal data inaccessible and unusable for the
relevant users.
Destrucon of Personal Data: The process of making personal data inaccessible, unrecoverable and
unusable for anyone.
Periodic Destrucon: The process of deleng, destroying, or anonymizing personal data, which is to be
carried out automacally at recurring intervals if all the condions for processing personal data
specied in the Law are eliminated.
References: Personal Data Protecon Law ('KVKK') And Related Legislaon: The Law No. 6698
published in the Ocial Gazee dated April 7, 2016, and numbered 29677, and related legislaon.
Changes: Our policy regarding the changes to be made in this policy at various mes following the
enactment of the relevant legislaon will be updated along with the revision number. Changes will
come into eect on the date of publicaon of the Policy containing the changes.
Purpose: The purpose of this policy is to explain Surgicraers' data processing acvies and to inform
the relevant persons, thereby ensuring transparency in the protecon of personal data. In this context,
Surgicraers has included in this Policy the processing of personal data within the scope of the KVKK,
the data subjects involved in this processing, their rights, the use of cookies and similar technologies,
and other relevant maers.
General Principles Related to Data Processing:
Surgicraers processes personal data in accordance with the following principles as exemplied in the
'Purposes of Processing Personal Data' secon of this Policy:
- Compliance with law and integrity,
- Accuracy and, where necessary, up-to-dateness,
- Processing for specied, explicit, and legimate purpose,
- Being relevant, limited, and proporonate to the purposes for which they are processed,
- Retenon for the period spulated in the relevant legislaon or necessary for the purpose they are
processed.
Data Processed by Surgicraers:
Personal data is processed in accordance with Arcles 5 and 6 of the KVKK without explicit consent in
acvies that can be carried out and under the condenality obligaon specied in Arcle 6/3 for
medical diagnosis, treatment, and care services, and planning and managing health services. For
purposes other than these, personal data is processed through explicit consent obtained from data
subjects.
3
The personal data processed in compliance with the principles in this Policy and which vary depending
on the nature and type of the relaonship between Surgicraers and the data subject, the
communicaon channels used, and the menoned purpose informaon, are as follows:
- Idenfying informaon of the data subject such as name, surname, Turkish ID number, age, profession,
tle, work informaon, educaon status, gender, criminal record, career, IBAN,
- Data such as date of birth, place of birth, identy number, blood group, serial number, volume number,
family order number, and photograph found in identy vericaon documents such as photocopies of
identy cards, passports, and driver's licenses,
- Communicaon records including address, email, phone and fax number, social media address, and
communicaon records within phone conversaons and email correspondence,
- Detailed nancial data related to collecon and payment acvies,
- Visual and auditory data such as security camera footage and audio recordings,
- Health data such as medical treatment informaon, diagnosis informaon, blood group, health report,
applied medical treatment,
- Pre-operave and post-operave photographs.
Purposes of Processing Personal Data:
The personal data obtained from you is processed by Surgicraers for the following purposes and under
the condions stated in Arcles 5 and 6 of the Law, to enable you to benet from health services
provided through health tourism services mediated by our instuon:
- Idencaon,
- Making, reminding, changing appointments, and other nocaons related to service provision,
- Evaluaon and diagnosis of the paent,
- Outpaent or inpaent treatment of the paent,
- Provision of health services for paent care, including medicaon and medical supplies,
- Preparing for surgery and conducng related acvies,
- Conducng necessary tests and examinaons,
- Preparing and controlling medicaons and materials,
- Conducng imaging and similar acvies within the scope of diagnosc and treatment acvies for the
paent,
- Monitoring the treatment process, creang medical records,
- Managing and storing personal belongings of the paent,
- Conducng processes related to the fees for products and services oered by the Instuon,
- Conducng accounng andnancial transacons,
- Storing collected data in accordance with legal regulaons for the required duraon,
4
- Receiving and evaluang requests and complaints,
- Following and conducng legal processes,
- Fullling requests from ocial instuons,
- Conducng processes related to companies with which we have insurance agreements and/or other
instuons,
- Conducng informaon security processes,
- Conducng inspecons and ethical acvies by ocial instuons and professional organizaons,
- Conducng market research, promoon, and informaon acvies related to the products and services
oered by the Instuon,
- Receiving and evaluang feedback on the products and services oered by the Instuon,
- Contacng the paent for academic trainings, scienc research, publicaons, consultancy, and similar
acvies, and fullling requests for parcipaon in training seminars and similar organizaons,
- Ensuring workplace security,
- Academic and Educaonal Use of Data: The collected personal data are used for academic studies,
scienc research, and educaonal purposes by the physicians and health professionals to whom the
data is transferred. In this context, the anonymizaon of the data and its processing in compliance with
the Personal Data Protecon Law (KVKK) are ensured. The data can be ulized for academic
publicaons in peer-reviewed journals, naonal and internaonal meengs, conferences, and seminars
for scienc and educaonal purposes. Addionally, it is used in social media, online, and face-to-face
meengs for the training of health professionals and paent educaon.
Transfer of Personal Data:
The personal data and special category personal data collected from you can be transferred, in line with
the purposes conveyed above, within the limits and to the extent required by the following regulaons:
Turkish Commercial Code No. 6102, Tax Procedures Law No. 213, Turkish Civil Code No. 4721, Code of
Obligaons No. 6098, Basic Law of Health Services No. 3359, Decree Law No. 663 on the Organizaon
and Dues of the Ministry of Health and its Aliated Instuons, Personal Data Protecon Law No.
6698, Regulaon on Private Hospitals, Regulaon on the Processing of Personal Health Data and the
Protecon of Privacy, Regulaon on Internaonal Health Tourism and Tourist's Health, and other
regulaons and provisions set by the Ministry of Health. This transfer of data will be to our employees,
doctors, auxiliary health workers, suppliers, service providers we collaborate with to conduct our
services, legal consultants, legally authorized public instuons, and legally authorized private
individuals, in accordance with the condions for data processing set out in Arcles 5 and 6 of the Law,
and in compliance with the rules regarding the transfer of personal data stated in Arcles 8 and 9 of
the Law. With your explicit consent, your personal data can be transferred to contracted instuons,
5
insurance companies, and hospitals, or those authorized by contracted instuons, insurance
companies, hospitals for the purposes of managing provision and billing processes related to the
services we oer, ensuring you benet from health, travel, complicaon, etc. insurances, and
conducng payment processes related to your treatment expenses. With your explicit consent, your
relevant health data and other personal data can be transferred, limited to your request, to your
relaves you specify by name or to third pares. Also, with your explicit consent, communicaon can
be established with you via email and social media applicaons.
Collecon of Personal Data:
Your personal data is collected by our Instuon within the scope of the purposes menoned above;
through our computer environments, tablets, instuonal informaon management soware, our
website where online services are oered, email and social media applicaons, and in the physical
environment through our health forms, cargo/post, fax, and face-to-face meengs. If opportunies
related to the Instuon's services are provided to your relaves under agreements that may
occasionally occur between the Instuon and contracted insurance companies, your personal data
may also be obtained through informaon and documents provided by such relaves. Your personal
data is processed based on the legal reasons menoned below, in accordance with the personal data
processing condions specied in Arcles 5 and 6 of the Law. Your personal data is processed within
the scope of Arcle 5 of the Law for reasons such as the establishment and performance of a service
contract, the fulllment of the Instuon's legal obligaons, the establishment, exercise or protecon
of a right, and the necessity of data processing for the legimate interests of the Instuon. Your health
data is processed by persons under condenality obligaon in accordance with Arcle 6/3 of the Law,
for the purposes of conducng medical diagnosis, treatment, and care services, and planning and
managing health services.
Retenon Period of Personal Data:
Personal data is retained within Surgicraers for the relevant legal retenon periods and as long as
necessary for the acvies related to these data and the purposes stated in this Policy. Personal data
whose purpose of use has ended and whose legal retenon period has expired will be deleted,
destroyed, or anonymized.
Rights of the Data Subject Under the KVKK:
As the personal data owner, we inform you that you have the following rights under Arcle 11 of the
Law:
- To learn whether your personal data is processed
- To request informaon if your personal data has been processed
6
- To learn the purpose of processing your personal data and whether they are used in accordance with
their purpose
- To know the third pares to whom your personal data is transferred domescally or abroad
- To request correcon of your personal data if it has been processed incompletely or inaccurately, and
to request nocaon of the operaon to third pares to whom personal data has been transferred
- To request the deleon or destrucon of personal data if the reasons for processing have ceased to
exist, despite being processed in accordance with the Law and other relevant legal provisions, and to
request nocaon of the operaon to third pares to whom personal data has been transferred
- To object to the emergence of a result against you by analyzing the processed data exclusively through
automated systems
- To demand compensaon for damage in case of loss due to unlawful processing of personal data
Minors:
Individuals under the age of 18 must visit the Website under the supervision of their parents. They
should not share any personal data without the accompaniment of their parents. The personal data of
minors is collected with the explicit consent of the parent who has custody authority.
Security of Personal Data:
Surgicraers aaches importance to the condenality and security of personal data. Accordingly, it
takes necessary technical and administrave security measures to protect personal data from
unauthorized access, harm, loss, or disclosure.
Responsibility:
The implementaon and execuon of the requirements of this policy are the responsibility of the KVKK
Working Group. The contact person is responsible for all communicaon with the Board.
Eecveness and Control:
This policy comes into eect on the date of its publicaon, and the KVKK Working Group is responsible
for keeping the procedure up to date.
Revision History
Revision No: 00 Publicaon of the Document: 22.12.2023