Personal Data Policy

In order to comply with the Personal Data Protection Law No. 6698 (“KVKK”) published in the Official Gazette dated 07.04.2016 and numbered 29677, the Regulation on Processing and Ensuring Privacy of Personal Health Data published in the Official Gazette dated 20.10.2016 and numbered 29863, the Regulation on Personal Health Data (“Regulation”) published in the Official Gazette dated 21.06.2019 and numbered 30808, as well as the regulations and relevant legal regulations regarding amendments to these Regulations, the procedures and principles adopted and to be implemented by Ankara Ankara Magnet Hospital are set out in this Policy within the scope of the data controller’s obligation to inform.

This process is carried out in accordance with applicable legal regulations regarding the processing and protection of personal data. Ankara Magnet Hospital's Personal Data Protection Policy has been prepared in accordance with current regulations.

The policy was developed by integrating the rules set forth by relevant legislation with Ankara Magnet Hospital's practices. The necessary preparations are being carried out in accordance with the effective periods stipulated in the Personal Data Protection Law. The personal data mentioned above may be processed, when necessary, within the framework of legislation such as Health Services Fundamental Law No. 3359, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, the Private Hospitals Regulation, the Regulation on the Processing and Protection of Privacy of Personal Health Data, the Regulation on Personal Health Data, and Ministry of Health regulations. These data will be transferred to the physical archives and information systems of our hospitals and/or suppliers. Consequently, personal data will be preserved in both digital and physical environments for an appropriate period, taking into account the legal periods defined in institutional procedures.

Regarding your personal data processed at Ankara Magnet Hospital, the principles of processing personal data and personal health data, the purposes and conditions of processing this data, the transfer and destruction of this data within the country and abroad, and the practices and principles regarding your rights on the processed data are notified to you below.

Private Han Medical Center and Health Services Limited Company (hereinafter referred to as "Ankara Magnet Hospital") will proceed in accordance with the procedures and processes set out in this policy in order to comply with the KVKK and other relevant regulations and in the processing, use, destruction, transfer and other matters of your personal data in accordance with the Law and other regulations.

Definitions

Concept	Definition
Personal Data:	Any information relating to an identified or identifiable natural person will be referred to as personal data.
Personal Health Data:	It refers to all kinds of information regarding the physical and mental health of an identified or identifiable natural person and information regarding the health service provided to that person.
Special Personal Data:	Data regarding a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, appearance and dress, membership of associations, foundations or unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data are special personal data.
Explicit Consent:	Consent regarding a specific subject, based on the information given to the relevant person and expressed by the free will of the relevant person, is referred to as explicit consent.
Buyer Group:	The recipient group is the category of natural or legal persons to whom personal data is transferred by the data controller.
Anonymization:	Anonymization is the process of making personal data incapable of being associated with an identified or identifiable natural person, even when matched with other data.
De-identification:	De-identification is the processing of personal data in a way that cannot be associated with the relevant person, provided that technical and administrative measures are taken to prevent the data from being associated with an identified or identifiable natural person and without being combined with other data stored in a different environment.
Open Data:	Anonymized data that is made available to everyone over the internet free of charge or at a cost not exceeding its preparation cost, that has no intellectual property rights and can be used freely for any purpose, that can be read by machines and thus can work with other data and systems, is called open data.
Open Health Data:	It refers to health data that has been turned into open data.
Masking:	Masking is defined as operations such as deleting, crossing out, painting or starring certain areas of personal data in a way that prevents them from being associated with an identified or identifiable natural person.
Destruction of Personal Data:	The process of deleting, destroying or anonymizing personal data is the destruction of personal data.
Disposal:	The process of making personal data inaccessible, irretrievable and reusable by anyone is the process of destruction.
Periodic Destruction:	In case all the processing conditions of personal data specified in the law are eliminated, the deletion, destruction or anonymization process specified in the personal data storage and destruction policy, which will be carried out ex officio at recurring intervals.
Blackout:	These are operations such as crossing out, painting or blurring personal data in a way that prevents it from being associated with an identified or identifiable natural person.
Destruction of Personal Data:	The process of making personal data inaccessible, irretrievable and reusable by anyone is the destruction of personal data.
Deletion of Personal Data:	Deletion of personal data is the process of making personal data inaccessible and unusable for the relevant users in any way.
e-Pulse:	The e-Pulse system is the system established by the Ministry in accordance with e-Government applications, which allows the relevant persons, their physicians or third parties they authorize to access their health data.
KamuNET:	KamuNET is a project developed by the Ministry of Transport and Infrastructure to ensure data communication between public institutions and organizations, to conduct this data communication over a virtual network that is closed to the internet and more secure against physical and cyber attacks, to minimize cyber security risks, to provide standards for existing and future secure closed-circuit solutions, and to establish appropriate infrastructure for common applications.
Direct Identifiers:	They are identifiers that, on their own, directly reveal, disclose, and distinguish the person to whom they are related.
Indirect Identifiers:	They are identifiers that, when combined with other identifiers, reveal, disclose and distinguish the person they are in relation to.
Law:	It is the Personal Data Protection Law No. 6698 dated 24.03.2016.
Related User:	The relevant user is the person who processes personal data within the data controller organization or in accordance with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of data.
Recording Medium:	Any medium containing personal data processed by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system is a recording medium.
Personal Data Processing Inventory:	The inventory in which data controllers create a detailed account of their personal data processing activities, which they carry out in connection with their business processes, by relating the purposes of processing personal data, the data category, the recipient group to which the data is transferred, and the data subject group, and by explaining the maximum period required for the purposes for which personal data is processed, the personal data intended to be transferred to foreign countries, and the measures taken regarding data security.
Processing of Personal Data:	Any operation performed on personal data, such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, either fully or partially by automatic means or non-automatic means provided that it is part of any data recording system.
Board:	Personal Data Protection Board.
Record:	Data controllers registry (VERBİS) kept by the Personal Data Protection Authority.
Data Recording System:	A recording system in which personal data is structured and processed according to certain criteria.
Data Controller:	The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
Data Processor:	They are natural or legal persons outside the organization of the data controller who process personal data on behalf of the data controller based on the authority granted by the data controller.
Contact Person:	The data controller is responsible for facilitating communication between the data subject and the data subject or the Personal Data Protection Authority. If the data controller is a legal entity established in Türkiye, it must appoint a contact person and enter the information about this contact person, designated during registration with the Data Controllers Registry, into VERBIS.
Personal Data Owner:	The natural person whose personal data is processed (Relevant Person).
Third Person:	In order to ensure the security of commercial transactions between our institution and the above-mentioned parties or to protect the rights of the above-mentioned persons and to provide benefits, third-party real persons related to these persons (e.g. employees or officials of the company from which service is received, companions, etc.)
Visitor:	They are real persons who have entered the physical areas of our institution for various purposes or visited our websites.

Principles of Processing Personal Data

Ankara Magnet Hospital carries out its personal data processing activities within the framework of the principles and fundamentals listed below, in accordance with Article 4 of the KVKK, which regulates the procedures and fundamentals regarding the processing of personal data.

Compliance with Law and the Rule of Integrity

Ankara Magnet Hospital processes your personal data in accordance with the KVKK and other laws and regulations that are mandatory due to the nature of the work performed.

Being Accurate and Up-to-Date

Ankara Magnet Hospital carries out the necessary procedures and takes technical and administrative measures to ensure that the personal data provided by the data owner is not changed without permission or inaccurately and to update the personal data upon request by the data owner when there is a change regarding the processed data.

Processing for Specified, Explicit and Legitimate Purposes

Your personal data processed by Ankara Magnet Hospital is processed in accordance with the processing purpose and within the framework notified to you.

Linkage, Limitation and Proportionality for Processing Purposes

Ankara Magnet Hospital does not process personal data that is not compatible with its activities, is not needed within the scope of Company activities, and goes beyond the purpose of processing.

Storage for the Period Stipulated in the Relevant Legislation or Necessary for the Purpose for which they are Processed

Your data processed within the framework of KVKK and other relevant laws and regulations are kept for the period stipulated in the relevant legislation or required to be kept within the framework of the legislation due to the nature of the personal data processed.

Conditions for Processing Personal Data and Exceptional Cases

General personal data to be processed within the framework of company activities;
Provided that the explicit consent of the data owner is obtained,
It is clearly stipulated in the laws,
It is necessary for the protection of the life or physical integrity of a person who is unable to give his consent due to physical impossibility or whose consent is not recognized as legally valid, or of another person.
Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or execution of a contract.
Mandatory for the data controller to fulfill its legal obligations
Made public by the relevant person himself,
Data processing is mandatory for the establishment, exercise or protection of a right,
Provided that it does not harm the fundamental rights and freedoms of the data subject, data may be processed without the explicit consent of the data subject if one of the situations in which data processing is mandatory for the legitimate interests of the data controller exists.
Special personal data to be processed within the framework of company activities;
Unless the explicit consent of the data owner is obtained, it will not be processed,
Except for special personal data related to health and sexual life, it may be processed without the explicit consent of the data owner in cases prescribed by law.
Sensitive data related to health and sexual life may be processed without the explicit consent of the data owner for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing.
It can be processed to the extent of the permission given by the relevant person in the e-pulse system.

Personal Data Classification

Personal Data	Explanation
Identity Information:	The information written on your identity card including, but not limited to, name, surname, mother's name, father's name, place of birth, date of birth, marital status, religion, blood type, registered province, district and neighborhood.
Contact Information:	Your contact data requested from you or provided by you so that we can contact you, such as your home telephone number, mobile phone number, residence address or other address information, and e-mail address.
Personal Information:	Photocopy of ID card/Driver's License/Passport/ID card, Identity register copy, Certificate of Residence, Health report, Photocopy of diploma, Criminal record, Passport photo, Document stating family status, Military service status certificate, Employment Contract / Service Contract, SGK employment declaration, Your criminal record (criminal record), Information and documents regarding your health condition.
Bank Account Information:	Bank account number, IBAN number, other information regarding credit card and debit card.
Background Information:	Your educational information, school information regarding your education, certificate information, educational status and information about your training, as written in your CV or requested by Ankara Magnet Hospital or provided by you, Location, date and duration information regarding your work experience as written in your CV or requested by Ankara Magnet Hospital or provided by you, information regarding your previous job and position, and all kinds of information regarding your work experience, Your photograph, as written in your CV or requested by Ankara Magnet Hospital or provided by you, Your driver's license and the information written on your driver's license, as requested by Ankara Magnet Hospital or provided by you, Your references and information regarding your references, as written in your CV or requested by Ankara Magnet Hospital or provided by you.
Visitor Information:	Name and surname of visitors to the company, visiting hours, vehicle license plate (if any), person visited and other information.
Health Data:	Data related to health and sexual life obtained during the execution of medical diagnosis, treatment and care services, such as, but not limited to, laboratory and imaging results, test results, examination data, prescription information, check-up information obtained by patients coming to our hospital or procedures performed in our hospital.
Third Party Natural Persons:	Information provided by third party natural persons such as companions etc. determined by patients admitted to our hospital.

Purposes and Methods of Processing Personal Data

As Ankara Magnet Hospital;

Protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing,
Preserving the data that must be kept by us in accordance with the relevant legislation,
Ensuring identity verification by relevant units,
Making appointments, providing information and reminders,
To properly carry out the existing workflows within the framework of commercial, administrative and economic activities of Ankara Magnet Hospital and the services offered by Magnet Hospital,
Orientation and training of employees within career planning,
Ensuring the security of Ankara Magnet Hospital hospitals and workplaces,
Fulfillment of legal and contractual obligations,
Risk management, quality improvement, prevention of abuse and violations,
Carrying out the examinations and evaluations required for the health services provided,
Confirming the relationships between the hospital and the contracted institutions and the patients,
Conducting research and development (R&D) studies,
Provision of equipment, medicine and other tools and equipment,
Sharing the requested information with the Ministry of Health via KamuNet, the Social Security Institution and other relevant public institutions and organizations by notifying them from their relevant servers, as stipulated in the relevant legislation on health services,
Within the scope of the promotional and advertising activities carried out, the promotion of Ankara Magnet Hospital and its services, the announcement of various campaigns and social activities, the sharing of various articles and visuals through electronic and printed media and/or the creation of a brand phenomenon,
Providing necessary information to regulatory and supervisory public/private legal entities and official institutions upon request or audit,
Carrying out billing and financial reconciliation transactions in line with the health services offered by Ankara Magnet Hospital,
To measure patient/visitor/companion satisfaction and to make improvements in areas deemed necessary in order to respond to requests and complaints conveyed to us,

We process personal data of patients, visitors, companions, business partners, employees and job candidates who are served in our hospital within the scope of all our administrative and commercial activities, including but not limited to these.

In this direction;

Regarding Patients' Personal Data

For the purposes of carrying out registration procedures during the patient admission process, making legal declarations regarding the health services offered by Ankara Magnet Hospital, and carrying out internal processes; patients' name, surname, Turkish ID number, passport or temporary Turkish ID number, place/date of birth, marital status, gender, transaction number, and other personal data to identify and identify the patient,
Telephone, address and e-mail address information for the purpose of communication and carrying out relevant business processes,
To ensure that invoicing transactions are carried out, bank account number, IBAN address and other financial data are collected for both in-hospital transactions and for notifications to insurance companies, Social Security Institution, Ministry of Health and its affiliated institutions within the framework of contractual relations and legal obligations.
In order to ensure that any complaints, notifications or questions raised by the patient are followed up and the necessary processes are carried out, voice recordings of calls made with call centers, and relevant physical or electronic written documents in case of written communication,
Contact information for making appointments and providing information,
Name and nutrition information to ensure that a nutrition and diet program is created specifically for the patient and that the nutrition programs and diet programs prescribed by doctors are implemented as required,
Within the scope of the activities of protecting public health, providing preventive medicine, medical diagnosis, treatment and care services, all kinds of laboratory, imaging and test results, examination information, diagnosis and prescription information, and check-up information may be processed by Ankara Magnet Hospital.

Regarding Visitors' Personal Data

Images of people visiting our hospital within the scope of camera imaging and recording activities carried out to ensure internal order and security,
Identity and contact information entered into the system used to fulfill the legal notifications required to be made to the police departments regarding the accompanying persons,
To ensure the security of Ankara Magnet Hospital companies and hospitals, cameras are used to record and monitor vehicles entering the parking lot.
In order to identify the relevant person in the event of any dispute/tort or other situation, visitor information can be processed through visitor forms signed during the visit to the company and visitor list records kept in the company system.

Regarding Personal Data of Business and Solution Partners

Ensuring workplace safety, commercial security and economic security,
To ensure that the necessary workflow processes can be carried out by our relevant departments in order to improve the services offered by Ankara Magnet Hospital and to ensure product satisfaction,
Establishing necessary contracts and establishing contact within the scope of the business process,
Your personal data may be processed for the purposes of fulfilling legal and contractual obligations.

Regarding Personal Data of Employee Candidates

Initiating, carrying out and completing recruitment processes in Ankara Magnet Hospital hospitals and workplaces, recording recruitment processes, and monitoring and improving recruitment processes and procedures,
Forwarding job applications and CVs to the appropriate departments and units to check their suitability for the job and proceed to the interview process,
Determining and examining whether you have the necessary qualifications for the position you are applying for, at the time of applying for the job, during the application process and during all procedures to be carried out during the application period.
Searching for your references and getting references about you,
To be able to contact you as a result of the evaluation made at the end of the job application process,
If a suitable position opens up later, you can be informed about the job opportunity by making the necessary evaluations again.
In order to ensure order and security within the company, the resume information, identity information, contact information and other personal data of the employee candidates are processed in line with the purposes and methods of camera monitoring and recording.

Regarding Personal Data of Employees

Camera imaging and recording to ensure order and security within the company,
Monitoring and backing up e-mail conversations by authorized persons in order to ensure the security of business processes and continuity of workflows through internal communication channels and to protect the legitimate interests of the company,
Monitoring the electronic devices provided by the hospital to ensure their security and to ensure that they are used in accordance with the purpose for which they were provided,
To ensure that the company's lines are used in accordance with the purpose of supply,
To determine whether the vehicles provided by the hospital to the field team are used in accordance with the purpose of provision and to monitor the location of these vehicles in order to ensure their safety,
To publish information, promotions, CVs and photographs of employees and doctors on the Ankara Magnet Hospital website, within the framework of the employer's management rights for the purpose of informing the public.
Having employees fill out surveys to measure employee satisfaction,
Recording expenses incurred by employees within the workplace in detail, such as payments to be made to employees, additional rights to be provided, and salary deductions, in order to establish rights for employees when the employer needs to exercise its management rights.
Providing information to the insurance companies with which the business partners are formed, in order to establish a right by providing private health insurance to employees, on matters limited to those that need to be communicated as required by the business,
Using relevant programs within the hospital for workflows and performance evaluations, recording entry and exit times via electronic entry cards,
Conducting health screenings in accordance with the legislation on occupational health and safety, fulfilling legal notifications in case of work accidents, and conducting necessary examinations and follow-ups to protect public health,
Carrying out the necessary procedures to provide company lines, vehicles, meal cards, business cards and other equipment provided by the company,
To be able to fulfill the debts and obligations arising from the relevant legislation and employment contracts,
Your identity information, personnel information, bank account information, contact information, contact information, health information and other personal data may be processed in line with the purpose and methods of making notifications to public institutions and organizations and all authorized public/private and legal entities within the scope of the relevant legislation and providing the necessary documents during audits.

Ensuring the Security of Personal Data

As Ankara Magnet Hospital, we implement the necessary administrative and technical measures within the framework of the necessary technological infrastructure to ensure the safekeeping and security of your personal data, which we process as part of our company operations, in accordance with the Personal Data Protection Law (KVKK) and relevant legislation. To this end, we take precautions against data breaches, unauthorized access, data loss, unauthorized data modification, and other threats, and conduct necessary inspections. Despite all these precautions and measures, if a data breach still occurs, we notify the relevant parties and the KVK Authority as soon as possible and within 72 hours at the latest.

In this context, we identify existing risks and threats, conduct awareness-raising activities by training our employees, and establish policies and procedures related to personal data security. The administrative and technical measures taken by our institution to ensure "data security" in accordance with Article 12 of the Personal Data Protection Law are outlined below, and necessary checks are carried out to ensure the proper implementation of these measures.

Technical Measures Taken to Ensure the Lawful Storage of Your Personal Data and to Prevent Unlawful Processing and Access

Personal data storage, processing and access activities are controlled by established technical systems.
The technical measures taken are reported to the relevant party.
Personnel knowledgeable in technical matters are employed.
Access authorizations are limited, cryptographic control and key management are used, and authorizations are reviewed regularly.
Virus protection and firewall systems and software and hardware including firewalls are used.
Backup programs are used in accordance with the law to ensure the safe storage of personal data.
Access to data storage areas containing personal data is logged within the framework of Law No. 5651, and any improper access or access attempts are instantly communicated to the relevant parties.

Administrative Measures Taken to Ensure the Lawful Storage of Personal Data and Prevent Unlawful Processing and Access

Employees are informed and trained about the protection of personal data and the storage and processing of personal data in accordance with the law.
In the personal data processing inventory, personnel who will process, store and access personal data have been identified and appointed as contact persons.
All activities carried out are analyzed in detail across all departments, and as a result of this analysis, personal data processing activities specific to the commercial activities carried out by the relevant business units are revealed.
To ensure legal compliance requirements determined on a departmental basis, awareness is raised and application rules are determined for the relevant departments; necessary administrative measures to ensure the supervision and continuity of these matters are implemented through in-hospital policies and training.
Employees are informed that they cannot disclose the personal data they have learned to anyone else in violation of the provisions of the Personal Data Protection Law No. 6698 and cannot use it for purposes other than those for which it was processed, and that this obligation will continue after they leave their job, and the necessary commitments are obtained from them in this regard.
The contracts and documents governing the legal relationship between employees include clauses that impose an obligation not to process, disclose or use personal data, except for the instructions of Ankara Magnet Hospital and exceptions stipulated by law, and employees' awareness is raised on this issue.

In addition, in accordance with the data security principles stipulated under the KVKK, we ensure personal data minimization in order to avoid processing unnecessary data, create the necessary confidentiality agreements with data processors, provide our employees with the necessary training to ensure the security of personal data and prevent breaches, and take the necessary measures to ensure the security of personal data stored in physical as well as electronic environments.

Domestic Use of Personal Data and Transfer Abroad

Your personal data and personal health data will be processed within the framework of the purposes explained in this policy and the Health Services Fundamental Law No. 3359, the Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, the Personal Data Protection Law No. 6698, the Private Hospitals Regulation, the Regulation on the Processing and Protection of Privacy of Personal Health Data, the Regulation on Personal Health Data and relevant regulations;

In order to fulfill our contractual and legal obligations and to carry out our hospital’s administrative, commercial and economic activities, the data is transferred to the Ministry of Health, Social Security Institution, General Directorate of Security and other law enforcement agencies, CİMER, SABİM, Ministry of Labor, General Directorate of Population, courts and enforcement offices, Turkish Pharmacists Association, regulatory and supervisory institutions, insurance companies, representatives authorized by patients, collaborating laboratories and other centers, and Electronic Medical Records and Electronic Health Records systems.
To insurance companies and authorized institutions/organizations for the purpose of billing the services provided by Ankara Magnet Hospital and carrying out medical diagnosis, treatment and care services, planning and managing health services and their financing,
In order to improve the efficiency and employment policies of Ankara Magnet Hospital and to ensure sustainability, sometimes and when necessary, third parties,
To banks in order to fulfill the obligations of the employer within the scope of the employment contract,
To the hospital, offices and units within Ankara Magnet Hospital, in order to ensure the continuity of business processes and the proper execution of activities, and to the fund company located abroad to prepare the necessary reports,
Your personal data is transferred to third parties, Hospital Information Management System (HIS) applications and backup systems for data storage purposes, in order to manage and manage the hospital affairs, implement hospital policies, and manage and execute the workflow efficiently.
Within the framework of the public's right to information, medical information about the patient and socio-cultural and economic information about the patient and their relatives can be shared with the press and media, provided that the explicit consent of the relevant person is obtained.

Storage Periods of Personal Data

Personal data processed by the institution within the framework of its activities is retained for the period stipulated in the relevant legislation. In this context, personal data:

Personal Data Protection Law No. 6698,
Turkish Code of Obligations No. 6098,
Public Procurement Law No. 4734,
Civil Servants Law No. 657,
Social Insurance and General Health Insurance Law No. 5510,
Regulation of Publications Made on the Internet and These Publications No. 5651
Law on Combating Crimes Committed by Means of
Public Financial Management Law No. 5018,
Occupational Health and Safety Law No. 6331,
Law No. 4982 on the Right to Information,
Law No. 3071 on the Use of the Right to Petition,
Labor Law No. 4857,
Higher Education Law No. 2547,
Retirement Health Law No. 5434,
Social Services Law No. 2828
Regarding Health and Safety Measures to be Taken in Workplace Buildings and Annexes
Regulations,
Regulation on Archive Services
It is stored for the retention periods stipulated in other secondary regulations in force in accordance with these laws.

Data Source	Storage Period	Source
Personal Data Protection Board Procedures	10 Years	Personal Data Protection Authority Personal Data Storage and Destruction Policy Published by KVKK
Contracts	10 Years from Termination of Contract	Personal Data Protection Authority Personal Data Storage and Destruction Policy Published by KVKK
Institutional Communication Activities	10 Years from the End of Operation	Personal Data Protection Authority Personal Data Storage and Destruction Policy Published by KVKK
Human Resources Processes	10 Years from the End of Operation	Personal Data Protection Authority Personal Data Storage and Destruction Policy Published by KVKK
Log Record Tracking Systems	10 Years	Personal Data Protection Authority Personal Data Storage and Destruction Policy Published by KVKK
Hardware and Software Access Processes	2 Years	Personal Data Protection Authority Personal Data Storage and Destruction Policy Published by KVKK
Registration of Visitors and Meeting Users	2 Years from the End of the Event	Personal Data Protection Authority Personal Data Storage and Destruction Policy Published by KVKK
Camera Records	2 Years	Personal Data Protection Authority Personal Data Storage and Destruction Policy Published by KVKK

Destruction of Personal Data

Personal data processed within the scope of Ankara Magnet Hospital's activities are stored for the purpose of processing and for the period necessary to achieve this purpose, and for the retention periods stipulated in the relevant legislation.
Data that has lost its function, whose storage period has expired, and which is requested to be destroyed by the data owner, if possible within the framework of the legislation, are destroyed using one of the appropriate methods of deleting, destroying or anonymizing personal data listed in Article 7 of the KVKK.
The operations will be carried out in accordance with the time period, procedures and principles specified in the “Regulation on the Deletion, Destruction or Anonymization of Personal Data”, “Regulation on the Processing and Ensuring the Privacy of Personal Health Data” and “Regulation on Personal Health Data”.
It applies the necessary partial de-identification or masking measures on printed materials containing patient personal health data, such as analysis and examination results, and takes other measures to make it difficult to determine who the material belongs to in case it falls into the hands of unauthorized persons.
It evaluates the processed data in order to create open health data, taking into account the regulations on data privacy and data security, in order to ensure transparency and accountability in the health system, to direct policies and strategies regarding the provision of health services, to support scientific research in the field of health and to ensure the development of health-related products and services.
Ankara Magnet Hospital has set a six-month periodic destruction period. Accordingly, the institution conducts periodic destruction in June and December each year.
All actions regarding the deletion, destruction or anonymization of personal data are recorded and the records in question are kept for at least three years, excluding other legal obligations.

Environments Where Personal Data Is Saved

Personal data and personal health data of data owners are stored securely in the environments specified below in accordance with the KVKK and relevant legislation.

Electronic Environment: HBYS, Common Management/Archive folders created on the Server, Personnel Computers.
Physical Environment: Hospital Internal Archive, External Archive, physical environments in administrative and patient areas of Hospital Departments.

Persons Managing and Working in the Process of Storing and Destroying Personal Data

Authorized and authorized persons involved in the storage and destruction of personal data and personal health data are defined in the company's corporate destruction policy.

Technical and Administrative Measures Taken for the Lawful Destruction of Personal Data

Secure Deletion from Software: When deleting data processed by fully or partially automatic means and stored in digital environments, methods are used to delete the data from the relevant software in a way that makes it inaccessible and reusable for the relevant users.
Deleting Relevant Data in the Cloud System by Issuing a Delete Command: Removing the access rights of the relevant user on the file or the directory in which the file is located on the central server; deleting the relevant rows in the databases with database commands; or deleting the data on portable media, i.e. flash disks, using appropriate software can be considered within this scope.

However, if the deletion of personal data will result in the inability to access and use other data within the system, personal data will be deemed deleted if the personal data is archived by making it unrelated to the relevant person, provided that the following conditions are met.

It is not accessible to any other institution, organization or person,
Taking all necessary technical and administrative measures to ensure that personal data is accessed only by authorized persons.
Secure Deletion by a Professional: In some cases, Ankara Magnet Hospital may contract with an external professional to delete personal data on its behalf. In such cases, the professional will securely delete the personal data, rendering it inaccessible and unusable to the Relevant Users.
Obscuring Personal Data on Paper: This method involves physically removing personal data from a document by cutting it out or rendering it invisible or obscured using permanent ink, making it irreversible and unreadable with technological solutions, to prevent the misuse of personal data or to delete data requested for deletion. If necessary, personal data on paper can be destroyed using this method.
Demagnetization: It is a method of damaging the data on magnetic media in an unreadable manner by passing it through special devices where it is exposed to high magnetic fields.
Physical Destruction: Personal data may be processed by non-automated means, provided it is part of a data recording system. When such data is destroyed, the personal data is physically destroyed so that it cannot be used later. Data on paper and microfiche is also destroyed this way because it cannot be destroyed any other way. Paper shredders and document shredders can be used for this purpose.
Overwriting: The overwriting method is writing random data consisting of 0s and 1s at least seven times on magnetic media and rewritable optical media by means of special software.
Anonymization Methods That Do Not Create Value Irregularities: Anonymization methods that do not create value irregularities are used to generalize, replace or remove a specific data or sub-data group from any personal data group without making any changes or additions/deletions to the personal data stored.
Variable Extraction: After the data collected by the descriptive data extraction method is brought together, the existing data set is anonymized by removing the "highly descriptive" variables from the data set created.
Removing Records: Stored data is made anonymous by removing the data row containing singularity among the records.
Regional Hiding: If a single piece of data has a decisive nature because it creates a very invisible combination, anonymization is achieved by hiding the relevant data.
Lower and Upper Bound Coding: The lower and upper bound coding method is used to anonymize the values in a data group containing predefined categories by combining them according to a certain criterion.
Generalization: With the data aggregation method, many data are aggregated and personal data is made unrelated to any person.
Global Coding: With the data generation method, a more general content is created from the content of personal data and personal data is made incapable of being associated with any person.
Anonymization Methods Providing Value Disorder: In anonymization methods that provide value disorder, unlike those that do not, distortion is created by changing some data in personal data groups.
Data Exchange: In the data exchange method, the values of a variable are exchanged between pairs selected from among the stored data.

During the occurrence of the above-mentioned situations, full compliance with the provisions of the KVKK, the Regulation and other relevant legislation is ensured to ensure data security and all necessary administrative and technical measures are taken.

Periodic Destruction of Personal Data

Ankara Magnet Hospital anonymizes expired personal data, which does not have any other data processing purpose that requires the storage of personal data, within 180 days (6 months) following the expiration of the storage period.

Personal data held by Ankara Magnet Hospital will be checked at regular intervals and any data for which the processing conditions have completely disappeared will be deleted, destroyed or anonymized.

Your personal data will be deleted, destroyed, or anonymized during the first periodic destruction process following the date on which the obligation to delete, destroy, de-identify, or anonymize personal data arises. This period will not exceed six months.

In the event of irreparable or impossible damage or a clear violation of law, the Board may shorten the period specified in this article. In such a case, the deletion will be carried out within a period not exceeding the new period determined by the Board.

These periodic review and destruction procedures to be applied to personal data are included in the Personal Data Processing Inventory created by Ankara Magnet Hospital and submitted/to be submitted to the VERBİS system.

Periods for Deleting, Destroying or Anonymizing Personal Data

Your personal data will be deleted, destroyed, or anonymized during the first periodic destruction process following the date on which the obligation to delete, destroy, or anonymize personal data arises. This period will not exceed six months. The Board may shorten the period specified in this article if irreparable or impossible harm occurs or if there is a clear unlawful violation.

Periods to be Applied Upon the Request for the Erasure, Destruction or Anonymization of the Data Owner's Personal Data

The Data Owner shall submit their requests regarding the implementation of the Law to Ankara Magnet Hospital in writing or through other methods determined by the Board. Magnet Hospital shall either accept the request or reject it, explaining the reason, and shall notify the relevant person in writing or electronically as soon as possible and within 30 days at the latest. If the request in the application is accepted, the necessary action will be taken.

If all the processing conditions for the personal data subject to the request have been eliminated, the personal data subject to the request will be deleted, destroyed, de-identified or anonymized.

Unless otherwise decided by the Board, Ankara Magnet Hospital will select the appropriate method for deleting, destroying, or anonymizing personal data ex officio. Upon the request of the relevant person, Ankara Magnet Hospital will select the appropriate method, explaining the reason for the selection.

If the personal data subject to the request has been transferred to third parties, this will be notified to the third party; the necessary actions will be taken within the scope of the Regulation on the Deletion, Destruction or Anonymization of Personal Data by the third party.

Rights of Personal Data Owners

Regarding the personal data processed within the scope of the activities of Ankara Magnet Hospital, the data owner may apply to Ankara Magnet Hospital, within the framework of your rights listed in Article 11 of the KVK and Article 10 of the Regulation;

To learn whether personal data and/or personal health data are being processed,
Request information regarding the processing of personal data and/or personal health data,
Access to and request for personal health data,
To learn the purpose of processing personal data and/or personal health data and whether they are used in accordance with their purpose,
To know the third parties to whom personal data and/or personal health data are transferred, either domestically or abroad,
To request correction of personal data and/or personal health data in case they are processed incompletely or incorrectly,
Request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK and the deletion of personal health data within the framework of the conditions stipulated in the amended Article 9 of the Regulation,
To request that the transactions carried out in accordance with the principles set out in subparagraphs (f) and (g) of this article be notified to third parties to whom personal data/personal health data have been transferred,
To object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,
In case of damage caused by the unlawful processing of personal data, the person has the right to demand compensation for the damage.

Final Provisions

If you exercise your rights above and submit an application to Ankara Magnet Hospital regarding the matters described above, your requests will be processed within thirty (30) business days, free of charge for up to 10 pages, depending on the nature of the request, and for a fee determined by the Board for more than 10 pages. However, if the process requires additional costs for us, we may charge the fee set by the Personal Data Protection Board. In the event of an error on the part of Ankara Magnet Hospital, the fee will be refunded to the data subject.

You can apply for matters related to the processing of your personal data by filling out the "Personal Data Request Form" available on the Company's website and using the method appropriate for you, among those specified in the form.

Private Han Medical Center and Health Services Limited Company Contact Information

MERSIS Number: 0685086888700001

Contact Email Address: iletisim@magnethastanesi.com.tr

Head Office Address: Mebusevleri Neighborhood, Anıt Street, Number: 12 Çankaya / Ankara

Head Office Phone Number: +90 312 212 80 80

Website Address: https://magnethastanesi.com.tr/en/

In case of written application, please write a statement on the envelope stating “Request for Information Regarding the Processing of Personal Data”.

You can download the Data Controller Application Form

Institutional