Privacy Notice / Disclosure Text

PRIVATE KARAKUCAK CLINICINFORMATION TEXT ON THE PROCESSING OF PERSONAL DATA

This information text has been prepared to inform data subjects regarding the procedures and principles concerning the processing of Personal Data of patients/clients who apply to PRIVATE KARAKUCAK CLINIC SULTAN KARAKUCAK in accordance with the Personal Data Protection Law No. 6698 under Turkish Law (“KVKK”) and the European Union General Data Protection Regulation (“GDPR”).

Ensuring the security of the Personal Data of patients/clients is among the top priorities of PRIVATE KARAKUCAK CLINIC. Therefore, in order to process the Personal Data of patients/clients securely and to prevent any unlawful access or data breaches, necessary security measures are taken by PRIVATE KARAKUCAK CLINIC in compliance with applicable legislation.

DATA CONTROLLER

Your Personal Data will be processed by PRIVATE KARAKUCAK CLINIC SULTAN KARAKUCAK, owned by Dr. SULTAN KARAKUCAK, located at “Kültür Mah. 4314 Sok. No:8 İç Kapı No:1 Akdeniz/Mersin” within the scope of the KVKK. SULTAN KARAKUCAK with Mersis No: 4218501090000011 is considered the “DATA CONTROLLER” under the KVKK and “DATA CONTROLLER” under the GDPR.

PRIVATE KARAKUCAK CLINIC has contracted a law firm with expertise in Personal Data Protection to serve as the “Data Protection Officer” under the GDPR. The compliance process with KVKK and GDPR has been carried out within the Clinic under the guidance of the expert law firm, with implementation responsibility belonging to the Data Controller.

PERSONAL DATA TO BE PROCESSED

Your Personal Data listed below will be processed by PRIVATE KARAKUCAK CLINIC in compliance with the fundamental principles set forth in Article 4 of KVKK and Article 5 of GDPR, under the conditions and purposes of Personal Data processing stated in Articles 5 and 6 of KVKK and Articles 6 and 9 of GDPR, for the purposes mentioned in this Information Text, lawfully, limited and proportional to the purpose, fairly and transparently, accurately and up to date, and with all technical and administrative measures foreseen in the legislation to ensure data security.

1-IDENTITY INFORMATION: Your name, surname, Turkish ID Number and/or Passport Number and/or Temporary Turkish ID Number, identity information, passport information, place and date of birth, marital status, gender, profession, signature, and other identity data that can identify you.

2-CONTACT INFORMATION: Your address (residence/work), phone number (landline/mobile), email address, IP address, social media accounts, and other contact information.

3-HEALTH INFORMATION: Your blood type, lab and imaging results, test results, allergies, chronic diseases, venereal diseases, infectious diseases, previous surgeries/operations, medications used regularly, Covid-19 related data, medical treatments, prescription information, skin analysis data, body measurement data, harmful health habits, and other health data necessary for treatments and procedures to be applied to you.

4-PHOTOGRAPH AND VIDEO RECORDINGS: Image and audio data recorded before, during, and/or after medical procedures, and data recorded by security cameras with the purpose of ensuring workplace safety.

5-FINANCIAL INFORMATION: Your bank account number, IBAN, credit card information, billing and invoice data, and other financial data.

6-TRANSFER AND ACCOMMODATION INFORMATION: If you are a health tourist arriving within the scope of International Health Tourism, your transfer information, flight ticket details, hotel accommodation information.

PURPOSE OF PROCESSING YOUR PERSONAL DATA

Your Personal Data is processed by PRIVATE KARAKUCAK CLINIC for the following purposes in accordance with KVKK and GDPR: creating patient files; conducting examination, diagnosis, treatment and care services; performing post-treatment follow-ups; managing possible complication processes; direct communication with you; managing appointment processes; ensuring patient satisfaction and handling requests; fulfilling legal and contractual obligations; retaining health-related data for the legally prescribed durations; obtaining consultations from other physicians if necessary; fulfilling legal obligations under health tourism regulations; organizing transfer, accommodation, and translation services for health tourists; communicating medical updates; informing third parties about procedures; managing healthcare financing and services; ensuring workplace safety; fulfilling legal responsibilities arising from the doctor-patient relationship; fulfilling financial and administrative obligations; ensuring technical and commercial security; and fulfilling public obligations.

Your Personal Data will be processed by PRIVATE KARAKUCAK CLINIC under KVKK and GDPR in the following situations:

• Identity Information; will be processed to provide examination, preventive medicine, diagnosis, treatment, care services, create patient files, ensure patient satisfaction, and organize services for health tourists.
• Contact Information; will be used to manage appointment processes and follow-up care, and with your explicit consent, to share updates about medical services and send greetings on special occasions.
• Health Information; will be processed to carry out medical and aesthetic treatments, consult other specialists if needed, maintain medical records, store health data for legally required durations, and fulfill legal obligations.
• Photograph, Video and Audio Data; will be used to monitor treatment processes and ensure workplace safety, and with your explicit consent, may be used for educational and promotional purposes.
• Financial Data; will be used for processing payments, issuing invoices, and handling refunds.
• Transfer and Accommodation Data; will be used to plan logistics for health tourists.

If you do not provide the Personal Data mentioned above, the legal obligations of PRIVATE KARAKUCAK CLINIC in providing treatment services cannot be fulfilled properly, which may hinder the success of your treatment and/or recovery.

METHOD OF COLLECTION OF PERSONAL DATA

Your Personal Data may be collected by PRIVATE KARAKUCAK CLINIC depending on the healthcare service provided through the following methods:

• By submitting your health reports, lab/imaging results, or other health declarations during your in-person visits,
• By completing the “Patient Information and Consent Form”,
• By filling out contact forms on the website www.karakucakklinik.com,
• By sending emails to info@karakucakklinik.com,
• Through photos/videos recorded before, during, or after your treatment,
• Via online consultation applications (e.g., WhatsApp, Zoom, Facetime, Skype) upon your request,
• By messaging or commenting via social media profiles (e.g., Instagram, Facebook, Twitter, YouTube),
• Through “contact us” or “get information” panels embedded in social media ads,
• Via log devices (firewall) if you use the clinic’s guest Wi-Fi network,
• Via CCTV cameras with audio recording used for workplace safety.

Your data will be processed during medical diagnosis, treatment, and care services to fulfill the contractual and legal obligations of PRIVATE KARAKUCAK CLINIC under KVKK and GDPR.

PURPOSE, METHOD AND LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

Your Personal Data may be processed physically and electronically by persons authorized by PRIVATE KARAKUCAK CLINIC, as “DATA PROCESSORS”, through written, oral, camera or photo recordings, by taking necessary technical and administrative security measures and, where required by KVKK and GDPR, by also obtaining your explicit consent.

CASES WHERE YOUR EXPLICIT CONSENT IS REQUIRED

In accordance with Article 6/1(a) of GDPR and Article 5/1 of KVKK, your Personal Data may be processed only with your explicit consent in the following cases:

• Sending SMS or emails and establishing mobile communication for promoting, announcing, and informing about medical services and innovations offered by PRIVATE KARAKUCAK CLINIC,
• Sharing photo and/or video recordings taken before, during, or after medical procedures for treatment monitoring purposes on social media accounts or corporate websites of PRIVATE KARAKUCAK CLINIC and/or Dr. SULTAN KARAKUCAK.

• Since sharing your data through service providers located abroad constitutes “transfer abroad” and requires “explicit consent”, your consent will be obtained in such cases. However, in the following cases, PRIVATE KARAKUCAK CLINIC will not make an international transfer and YOUR EXPLICIT CONSENT WILL NOT BE REQUIRED AS IT IS ALREADY OBTAINED BY THE SERVICE PROVIDER YOU USE:

• If you use international platforms (e.g., WhatsApp, Zoom, Facetime, Skype, Messenger, Google, Instagram, Facebook), by agreeing to their Privacy Policies and International Data Transfer Principles, you will be deemed to have given consent to share data with PRIVATE KARAKUCAK CLINIC and/or Dr. SULTAN KARAKUCAK and for international data transfer via these applications.
• If you request communication via email services (e.g., Hotmail, Gmail, Yahoo) whose servers are located abroad, your data will be deemed transferred abroad with your consent, per the provider’s terms, and PRIVATE KARAKUCAK CLINIC will process the data in line with its own Privacy Policy and Data Protection Statement.
• If you engage with social media ads or promotions by PRIVATE KARAKUCAK CLINIC or Dr. SULTAN KARAKUCAK on platforms with foreign servers, your data will be shared and processed in accordance with the terms you have accepted with those platforms and PRIVATE KARAKUCAK CLINIC’s privacy terms.

• If you send direct messages to PRIVATE KARAKUCAK CLINIC and/or Dr. SULTAN KARAKUCAK through social media platforms with servers located abroad, your data will be processed in accordance with PRIVATE KARAKUCAK CLINIC’s Data Protection and Privacy policies.

CASES WHERE YOUR DATA MAY BE PROCESSED WITHOUT OBTAINING YOUR EXPLICIT CONSENT:

Pursuant to GDPR Article 9/2(h) and KVKK Article 6/3;

• For the purpose of conducting examination, medical diagnosis, treatment, and care services, your Health Data, which is considered Special Category Personal Data, will be processed without your explicit consent by Dr. SULTAN KARAKUCAK, who is under a legal obligation of confidentiality.

Pursuant to GDPR Article 6/1(b) and KVKK Article 5/2(c);

• Your Personal Data will be processed without your explicit consent by PRIVATE KARAKUCAK CLINIC for purposes such as post-treatment follow-ups, direct communication with you, and appointment management.

Pursuant to GDPR Article 6/1(f) and KVKK Article 5/2(f) based on our legitimate interests;

• Your Personal Data will be processed without your explicit consent by PRIVATE KARAKUCAK CLINIC to ensure patient satisfaction and request management.

Pursuant to GDPR Article 6/1(c), KVKK Article 5/2(a) and Article 5/2(ç), based on legal obligations, your Personal Data will be processed without your explicit consent in the following cases:

• Creating patient files.
• Storing health data as required by applicable legislation.
• Issuing invoices and tracking your payments.
• Fulfilling tax payment obligations.
• Fulfilling obligations under the Ministry of Health Regulations.
• Fulfilling obligations under Health Tourism Regulations.
• Ensuring data security.
• Fulfilling legal obligations before judicial authorities.
• Fulfilling administrative obligations before public institutions and organizations.

TRANSFER OF YOUR PERSONAL DATA AND TO WHOM AND FOR WHAT PURPOSE IT WILL BE TRANSFERRED

Your Personal Data collected under the conditions and purposes stated in Articles 5 and 6 of KVKK and Articles 6 and 9 of GDPR may be transferred by PRIVATE KARAKUCAK CLINIC, in compliance with Articles 8 and 9 of KVKK and Articles 45 and 49 of GDPR, to the extent necessary and with confidentiality agreements signed, with all administrative and technical security measures in place, to the following third parties and institutions for the purposes of conducting and improving examination, medical diagnosis, treatment, and care services; obtaining consultations from other specialists; fulfilling administrative obligations under health tourism legislation; organizing transfer, accommodation, and translation services for health tourists; establishing communication with patients; managing follow-up appointments; planning and managing healthcare services and their financing; fulfilling responsibilities arising from the legal relationship between the doctor and the patient; fulfilling financial, legal and administrative obligations; ensuring technical and commercial security; fulfilling public obligations; and promoting the medical services offered.

Within this scope, your Personal Data processed by PRIVATE KARAKUCAK CLINIC may be transferred to:

• Other specialist physicians for consultation purposes,
• Its insured employees,
• Its affiliates,
• Its suppliers,

• Financial advisors, tax and finance consultants, and auditors,
• Legal counsel,
• Database (server) providers,
• Clinic Management Software service providers,
• Web consultants,
• Translators,
• Data Protection Officer,
• IT consultants,
• Tourism agencies,

• Authorized public institutions and organizations within the scope of legal obligations,
• Judicial authorities.

PERSONAL DATA RETENTION PERIOD

Your Personal Data will be retained by PRIVATE KARAKUCAK CLINIC for as long as it is legally required. Documentation and retention obligations arise from local regulations related to commercial, tax, and healthcare laws. Below is a table showing the retention periods for your Personal Data.

AGE LIMIT OF DATA SUBJECT UNDER LEGISLATION

Under the KVKK, patients/clients must be at least 18 years old to personally give consent for the processing of their personal data. For patients/clients under this age, consent must be given by their legal representatives.

Under the GDPR, patients/clients who are citizens of European Union countries or residents in EU member states may personally give consent for the processing of their personal data provided they are at least 16 years old, or at the age limit required by their country. For individuals below this age, consent must be given by their legal representatives.

WITHDRAWAL OF CONSENT

If you have given consent to PRIVATE KARAKUCAK CLINIC for the processing of your Personal Data, please be informed that under GDPR Article 6/1(a) and KVKK Article 5/1, you may withdraw your consent at any time. Your consent will be revoked once your statement of withdrawal is submitted to our contact address specified below in the manner outlined.

RIGHTS OF DATA SUBJECTS UNDER GDPR

Your Personal Data is also protected under the GDPR. In cases where the GDPR applies (EU citizens or residents of EU countries), data subjects have the following rights:

• Right of Access (GDPR Article 15): The data subject has the right to confirm whether their personal data is being processed by PRIVATE KARAKUCAK CLINIC and, if so, to access the details specified in Article 15 of the GDPR.
• Right to Rectification (GDPR Article 16): The data subject has the right to request the correction of inaccurate or outdated personal data held by PRIVATE KARAKUCAK CLINIC.
• Right to Erasure (GDPR Article 17): The data subject may request the deletion of their personal data held by PRIVATE KARAKUCAK CLINIC. If the conditions in Article 17 of the GDPR are met, the data will be deleted without undue delay.
• Right to Restriction of Processing (GDPR Article 18):

• If the accuracy of the data is contested, processing may be restricted until verified.
• If processing is unlawful and the data subject requests restriction instead of deletion.
• If the controller no longer needs the data but the data subject requires it for legal claims.
• If the data subject objects under GDPR Article 21(1), processing may be restricted until the controller’s legitimate grounds are verified to override those of the data subject.

• Right to Data Portability (GDPR Article 20): If technically feasible, the data subject may request the transfer of their personal data from PRIVATE KARAKUCAK CLINIC to another controller. This right is applicable when data processing is based on consent or a contract.
• Right to Object (GDPR Article 21):

• The data subject has the right to object, on grounds relating to their particular situation, to processing based on GDPR Article 6(1)(e) or (f), including profiling. PRIVATE KARAKUCAK CLINIC shall no longer process the personal data unless compelling legitimate grounds are demonstrated.
• The data subject may object at any time to processing for direct marketing purposes, including profiling to the extent it relates to such marketing.
• If an objection is made to processing for direct marketing purposes, the personal data shall no longer be processed for those purposes.

RIGHTS OF DATA SUBJECTS UNDER KVKK

Pursuant to Article 11 of the KVKK, individuals whose Personal Data is processed have the following rights:

• To learn whether personal data is processed,
• To request information if their data has been processed,
• To learn the purpose of processing and whether it is used appropriately,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request correction of incomplete or incorrect data and notification to third parties,
• To request deletion or destruction of data if reasons for processing no longer exist, even if processed in accordance with law, and notification to third parties,
• To object to a result against them through analysis of data solely by automated systems,
• To request compensation for damages arising from unlawful processing of personal data.

To exercise the rights listed above, please submit your written request clearly stating which right under the GDPR or Article 11 of KVKK you wish to exercise. Your signed request, along with identity verification documents, can be delivered in person to the address “Kültür Mah. 4314 Sok. No:8 İç Kapı No:1 Akdeniz/Mersin,” sent via notary, or emailed with a secure electronic signature to [info@karakucakklinik.com](mailto:info@karakucakklinik.com), or by other means specified in the KVKK. Applications must include your name-surname, signature, ID number/passport number/temporary ID number, residence or workplace address, email address, telephone and fax number, and subject of the request as per the “Communiqué on Application Procedures and Principles to the Data Controller.”

PRIVATE KARAKUCAK CLINIC will conclude your request free of charge within 30 (thirty) days at the latest, depending on the nature of the request. However, if the process requires additional cost, a fee may be charged as determined by the Personal Data Protection Board.

CONSENT AND APPROVAL

By reading and accepting this Information Text, you acknowledge that you have been fully and clearly informed about the data processing activities carried out by PRIVATE KARAKUCAK CLINIC, that you have learned your rights under KVKK and GDPR, and that you freely and voluntarily give your explicit consent for the processing of your Personal Data and Special Category Personal Data by PRIVATE KARAKUCAK CLINIC within the scope of this Information Text.

You have the right to refuse this Information Text after reading it.

SULTAN KARAKUCAK is declared as the “DATA CONTROLLER” under KVKK and as the “CONTROLLER” under GDPR.

Kind regards.