This privacy notice Law No. 6698 on the Protection of Personal Data’ (“KVKK”), Regulation on Personal Health Data, Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform and in compliance with the relevant legislation, has been prepared by MLP Sağlık Hizmetleri A.Ş. and all its affiliates, subsidiaries, and hospitals (“MLPCARE”) in its capacity as the data controller.

For the full list of all companies and hospitals under MLPCARE click here[YS1] .

HOW ARE YOUR PERSONAL DATA PROCESSED?

I. Patient Registration

When you visit any of our hospitals under MLPCARE as a guest, your personal data listed below are processed by our guest services personnel for the purpose of registering you in the Hospital Information Management System (“HBYS”) based on the legal grounds of “necessity for the establishment or performance of a contract directly related to the parties” and “necessity for the data controller to fulfill its legal obligations”:

• Name and Surname
• Turkish ID Number
• For non-Turkish citizens, passport number or temporary Turkish ID number
• Address
• Mobile Phone
• Email Address
• Place and Date of Birth
• Marital Status
• Gender Information
• Private health insurance or Social Security Institution data
• ID Card Scan
• Appointment Information

As a result of these processes, all our guests are assigned a "Patient Number" and a "Protocol Number."

All these processed data are instantly transferred to the Medula system of the Social Security Institution ("SGK") via the HBYS system.

Additionally, during the patient registration process, an SMS is sent to the recipient to complete their HBYS registration in the system and to allow them access to the disclosure text at any time. The SMS contains two separate one-time confirmation codes for guests who wish to provide consent under KVKK and the Law No. 6563 on the Regulation of Electronic Commerce ("ETK"). If the guests provide these confirmation codes to the guest services personnel handling the registration, a record of their explicit consent and approvals under KVKK and ETK is created in the HBYS system. The given consent and approvals will remain valid until they are withdrawn by exercising the right to opt out.

II. Health Services

After completing the registration process, the following data of our guests will be processed by our healthcare personnel and physicians, who are bound by confidentiality obligations, in order to provide the requested healthcare services. These data will be processed primarily based on the legal reason of “carrying out medical diagnosis, treatment, and care services” and in accordance with the provisions explicitly set forth in Law No. 2219 on Private Hospitals, the Basic Law on Health Services No. 3359, the Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, the Private Hospitals Regulation, the Healthcare Implementation Communiqué, the Patients’ Rights Regulation, and the Turkish Code of Obligations No. 6098, and will be recorded in HBYS:

- Health Data (Medical diagnosis, treatment, and care services obtained and not limited to these)

All these data are instantly transferred to the E-Nabız system under the Ministry of Health ("Ministry").

III. Patient Discharge

After our guests' medical services are completed, the following data are processed for the purpose of collecting the medical service fee and issuing invoices according to their insurance status, based on the legal grounds of “the necessity of processing personal data for the establishment or performance of a contract directly related to the parties” and “the necessity of processing personal data for the data controller to fulfill its legal obligations”:

• Full Name
• Bank Account Information
• Credit Card Number
• Invoice Information

IV. Other Services

1. Call Center and Switchboard

When you call MLPCARE call centers or the switchboard of one of the hospitals under MLPCARE, the following personal data are processed for the purpose of scheduling appointment requests, responding to information requests, and/or processing any other requests based on the legal grounds of “the necessity of processing personal data for the establishment or performance of a contract directly related to the parties” and “the necessity of processing personal data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”:

• Full Name
• Phone Number
• National ID Number
• Email Address
• Appointment Information
• Phone Call Audio Recordings
• Complaints

2. Patient Rights Center

If you wish to use any of the rights within the scope of the Patient Rights Regulation at any of the hospitals within the MLPCARE network, your personal data will be processed by the relevant unit based on the legal ground of "the necessity to fulfill the legal obligation of the data controller" in order to handle your requests and complaints:

• Full Name
• Phone Number
• Turkish Identity Number
• Email Address
• Request Content
• Medical information

3. Guest Satisfaction

After the patient's discharge, a customer satisfaction survey is sent via SMS to the guests' registered mobile phone numbers in the Hospital Information Management System (HBYS). This survey includes questions to measure satisfaction. When the answers provided match the HBYS records, they are automatically transferred to the MLPCARE guest experience unit, which will then contact the guests. If a complaint is made through the hospital's websites, social media, or complaint websites, the guest will be contacted to resolve the complaint or provide an answer.

4. Hospital Closed-Circuit Television (CCTV) System

In all hospitals within the MLPCARE network, surveillance and recording are conducted via a closed-circuit camera system. During this process, the physical space security of all visitors to the hospitals and the visual and auditory records are processed automatically based on the legal grounds of "the necessity to process data for the legitimate interests of the data controller, without infringing on the fundamental rights and freedoms of the data subject."

5. Parking and Valet Services

Some of our hospitals within the MLPCARE network provide parking and valet services. If visitors wish to benefit from these services, their vehicle make/model and license plate information will be processed based on the legal ground of "the necessity to process data for the legitimate interests of the data controller" to ensure the safety of operations and track visitor records.

6. Websites and Mobile Applications

Some of the websites of the affiliated companies and hospitals within the MLPCARE network offer the opportunity to make e-appointments. To make an e-appointment, the individual’s Turkish Identity Number is entered on the appropriate field of the page. Using this number, patient information is retrieved from the SGK Medula system and displayed in a masked form on the next page. The necessary GSM number is added on the second page to complete the registration, and the e-appointment process is completed by selecting the hospital, medical unit, and doctor. A one-time appointment number is generated.

If the e-appointment needs to be canceled, the Turkish Identity Number, hospital selection, and appointment number are entered in the respective fields to complete the cancellation process.

For individuals wishing to access the test and imaging results from the relevant hospital, they can enter the hospital selection and Turkish Identity Number on the website. The test results will be shown with all identification and communication data masked.

Individuals can also schedule video consultations via the website. The process is similar to the e-appointment system, and during the video consultation, visual and auditory data will be processed based on the legal grounds of "contract formation and execution" in order to provide the service.

On the website's "We Are Listening" page, where guest requests and complaints are received, you can share your complaints, suggestions, and thanks with MLPCARE by providing your Turkish Identity Number, full name, phone number, relevant hospital, and message. Your data will be processed based on your explicit consent for the purposes of patient rights and guest satisfaction activities.

By filling out the "Information and Reservation" section for the check-up service on our website, your name, surname, phone number, and hospital selection will be processed for the purpose of contacting you for follow-up activities, based on the legal ground of "necessary for the formation or execution of a contract."

Additionally, if you make a donation to the selected institution through our website using the "Get Well Soon" service, the donor's name, surname, patient name, surname, hospital, and room number will be processed as part of the donation process.

Only guests who have given consent for KVKK and Communication will be contacted, and according to the Regulation on Private Hospitals, information will be provided in the form of SMS, email, etc., limited to informative activities to protect and develop health. Recipients can use the right to reject in the content of the message if they do not wish to receive it. The consent remains valid until the right of refusal is exercised.

Some of our guests’ photos and/or videos are processed only with the explicit consent of the individuals for the purpose of conducting informative activities about hospitals within MLPCARE. The concerned individuals can withdraw their explicit consent at any time.

HOW IS YOUR PERSONAL DATA TRANSFERRED?

1. Health Services 

The personal data listed above is transferred to authorized authorities, including the Ministry, Provincial and District Health Directorates, Public Health Centers, and other units affiliated with the Ministry, and those designated by them, or to institutions and organizations authorized by automatic systems such as Medula, E-Nabız, and similar. This includes domestic and international laboratories, ambulances, medical devices, and healthcare providers for medical diagnosis and treatment cooperation, all hospitals using a common hospital information system (HBYS), affiliated companies and/or subsidiaries, SGK (Social Security) for patients covered by SGK, insurance companies for private insurance use, the employer for billing purposes, relevant healthcare organizations when referral is necessary, and relevant healthcare institutions abroad if a second opinion is requested from a foreign doctor. The legal basis for these transfers is "public health protection, preventive medicine, medical diagnosis, treatment and care services, and health service and financing planning and management."

2. Services Provided by Third Parties

Subcontractors, business partners, lawyers, consultants, auditors, and other third-party service providers, organizations we cooperate with, domestic/international entities, and legal representatives are authorized to transfer the data only in relation to the services provided. All transfers are done in compliance with the technical and administrative measures required by KVKK and subject to signed confidentiality agreements.

3. Insurance Services and Partner Institutions

For individuals benefiting from private health insurance, supplementary insurance, or any other insurance product or partnership agreement, the relevant personal data such as name, surname, phone number, invoice details, and all personal health data related to medical diagnosis and treatment are transferred to consulting, insurance companies, or partner institutions under the legal grounds of "public health protection, preventive medicine, medical diagnosis, treatment and care services, and health service and financing planning and management." After the transfer, the process is managed by the consultant, insurance company, or partner institution.

4. Call Center Services

MLPCARE utilizes third-party data processors for call center services. The personal data processed via the call center will be transferred to the third-party service provider offering this service.

5. Educational/Teaching Institutions in Cooperation

Personal data is transferred to educational/teaching institutions in cooperation with MLPCARE for conducting training and research activities. This transfer is based on the legal grounds of "the data processing being mandatory for the legitimate interests of the data controller, without harming the fundamental rights and freedoms of the relevant person" and "public health protection, preventive medicine, medical diagnosis, treatment, and care services, and health service and financing planning and management."

Click here for the full list of educational/teaching institutions cooperating with MLPCARE.

WHAT ARE YOUR RIGHTS AS A RELEVANT PERSON?

The rights of the relevant person under Article 11 of KVKK, which regulates the rights of the data subject, are available here.

1. Kişisel verilerinin işlenip işlenmediğini öğrenme,
2. Kişisel verileri işlenmişse buna ilişkin bilgi talep etme,
3. Kişisel verilerinin işlenme amacını ve bunların amacına uygun kullanılıp kullanılmadığını öğrenme,
4. Yurt içinde veya yurt dışında kişisel verilerin aktarıldığı üçüncü kişileri bilme,
5. Kişisel verilerin eksik veya yanlış işlenmiş olması halinde bunların düzeltilmesini isteme,
6. Kişisel verilerin silinmesini veya yok edilmesini isteme,
7. Kişisel verilerin düzeltilmesi, silinmesi veya yok edilmesine ilişkin işlemlerin kişisel verilerin aktarıldığı üçüncü kişilere bildirilmesini isteme,
8. İşlenen verilerin münhasıran otomatik sistemler vasıtasıyla analiz edilmesi suretiyle kişinin kendisi aleyhine bir sonucun ortaya çıkmasına itiraz etme,
9. Kişisel verilerin kanuna aykırı olarak işlenmesi sebebiyle zarara uğraması halinde zararın giderilmesini talep etme,

Başvurularınızı, Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ 'e uygun olarak “KVKK Erişim / Bilgi Talep Formu” üzerinden MLPCARE’e iletebilirsiniz.

Bu aydınlatma metni 19/12/2022 tarihinde güncellenmiş olup, MLPCARE tarafından internet siteleri ve diğer sair yöntemlerle ilgili kişilerin erişimine sunulmuştur ve kısmen veya tamamen yenilenmesi halinde yürürlük tarihi güncellenerek, yenilenmiş metin yine aynı yöntemlerle yayınlanacaktır.