Data controller and scope
DATA CONTROLLER: BB Balaban Sağlık Hizmetleri ve Ticaret Limited Şirketi
ADDRESS: Prof. Dr. Ahmet Taner Kışlalı Mahallesi, 2400. Cadde No: 6 D: 6, 06810 Çankaya/Ankara, Türkiye
CONTACT:
As the data controller, we exercise the utmost care with regard to the security of your personal data. With this in mind, we attach great importance to processing and retaining all personal data belonging to every individual connected with our field of activity — including those who make use of our products and services — in conformity with Law no. 6698 on the Protection of Personal Data (the “PDP Law”), the Regulation on the Processing of Personal Health Data and the Safeguarding of Privacy, and the relevant legislation. Fully conscious of this responsibility, and in our capacity as data controller, we process your personal data in the manner set out below and within the limits prescribed by the legislation.
The Personal Data Protection Law
ARTICLE 3 — Definitions
a) Explicit consent: consent relating to a specific matter, based on information and expressed by free will;
b) Anonymisation: rendering personal data incapable, by any means whatsoever, of being associated with an identified or identifiable natural person, even when matched with other data;
c) The President: the President of the Personal Data Protection Authority;
ç) Data subject: the natural person whose personal data are processed;
d) Personal data: any information relating to an identified or identifiable natural person;
e) Processing of personal data: any operation performed on data, such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, making available, classifying or restricting the use of personal data by wholly or partly automated means, or by non-automated means provided that they form part of a data filing system;
f) The Board: the Personal Data Protection Board;
g) The Authority: the Personal Data Protection Authority;
ğ) Data processor: the natural or legal person who processes personal data on behalf of the data controller on the basis of the authority conferred by the controller;
h) Data filing system: the recording system in which personal data are processed after being structured according to specific criteria;
ı) Data controller: the natural or legal person who determines the purposes or criteria of the processing of personal data and is responsible for establishing and managing the data filing system.
Collection of personal data
Your personal data are collected — in connection with the protection of public health and the provision of preventive medicine services, medical diagnosis, treatment and care services, and any other service offered by the data controller — where you apply in person or online, where you request information or documents, orally, in writing, visually or aurally, and through what you share electronically by way of the website or social media.
Processing of personal data
Within the scope of our activities as data controller, the following data of the data subject are held:
identity data, contact data, financial data, data concerning the recipient of the product or service / the patient / the customer, audio-visual records and signature data.
In other words, these are the personal data belonging to the data subject: first name, surname, Turkish identity number, passport number, temporary identity number, marital status, occupation, sex, date of birth, e-mail address, telephone number, address details, bank account/IBAN details, credit card and payment details, patient protocol number, data concerning private health insurance for the purposes of financing and planning healthcare, Social Security Institution data, appointment date, appointment time, the member of staff performing the procedure, information about the procedure performed, the patient's medical report, laboratory results, test results, examination details, consultation fee details, allergy information, check-up information, the doctor's analyses and comments, the data subject's diagnostic history, the diagnosis, the medicines used and prescribed, prescription details, and photographic and visual records — together with, but not limited to, all personal data relating to health and sexual life obtained during and/or as a result of the provision of medical diagnosis, treatment and care services — as well as IP address details, voice call recordings kept in accordance with call-centre standards, camera recordings kept for security and monitoring purposes during visits to the data controller, cookie data, and the personal data you share of your own volition through forms you send to or complete on the website.
Purposes of processing the personal data and special category personal data processed
The aforementioned personal data / special category personal data belonging to the data subject are:
- processed within the framework of the purpose requiring their processing, and in a manner connected with, limited to and proportionate to that purpose:
- conduct of emergency processes
- conduct of information security processes
- conduct of activities in conformity with the legislation
- conduct of financial and accounting affairs
- conduct of communication activities
- conduct and supervision of business activities
- conduct of goods and services sales processes
- planning and execution of processes for managing relations with recipients of products and services and with patients
- conduct of customer relationship management processes
- conduct of activities aimed at customer satisfaction
- conduct of retention and archiving activities
- conduct of contractual processes
- follow-up of requests and complaints
- conduct of product and service marketing processes
- ensuring the security of the data controller's operations
- protection of public health, preventive medicine, and the provision and development of medical diagnosis, treatment and care services;
- development and improvement of healthcare services;
- and the provision of information to authorised persons, institutions and organisations. To these ends the data are kept up to date, recorded, stored, retained and processed.
The data are moreover collected electronically and/or by physical means, limited to the purposes expressly stated in the law. In addition, your data are recorded, stored, retained and processed for the following purposes: identification and verification in order to prevent your personal data or special category personal data from being obtained by others; protection of public health, preventive medicine, and the provision of medical diagnosis, treatment and care services; the planning and management of healthcare services and their financing; the supply of the necessary medicines and/or medical materials and/or devices; budget planning and management for healthcare services; the sharing of requested information with the Ministry of Health and other public institutions and organisations in accordance with the relevant legislation; the sharing of requested information with private insurance companies and contracted institutions; the sharing — provided it does not contravene the legislation — of information and documents requested by private insurers or contracted institutions in connection with the financing of healthcare, and the monitoring of that process; invoicing for the healthcare services provided and the establishment of relations with contracted institutions; the sharing of information and documents on a patient-by-patient basis in accordance with the legislation; the recording of incoming calls by the call centre; and the measurement of customer satisfaction.
Transfer of the personal data and special category personal data processed
Personal data obtained for processing within the framework of the general principles laid down in the Law may, pursuant to Article 8 of the Law, be transferred to third parties with the explicit consent of the data subject. Apart from this, the company may also carry out transfers in the cases provided for in the Law in which personal data may be transferred without the explicit consent of the data subject.
In this context:
1 — Conditions for the transfer of personal data within the country
- where it is expressly provided for by law;
- where it is necessary to protect the life or physical integrity of the person, or of another, who is unable to express consent owing to actual impossibility or whose consent is not recognised as legally valid;
- where processing of the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract;
- where it is necessary for the data controller to fulfil a legal obligation;
- where the data have been made public by the data subject;
- where processing is necessary for the establishment, exercise or protection of a right;
- where processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
2 — Conditions for the transfer of special category personal data within the country
- where the explicit consent of the data subject has been obtained;
- in respect of special category personal data other than those relating to health and sexual life, where it is expressly provided for by law;
- in respect of personal data relating to health and sexual life, where they are processed by persons under an obligation of confidentiality or by authorised institutions and organisations for the purposes of protecting public health, preventive medicine, the provision of medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.
Within the scope of the law and other legislation and for the purposes set out above, your personal data may be shared — provided that this does not contravene the Personal Data Protection Law — with our company and with private insurance companies, the Ministry of Health and its subordinate units, the Social Security Institution, the General Directorate of Security and other law-enforcement bodies, the General Directorate of Civil Registration, the Turkish Pharmacists' Association, the courts and any judicial authority, central and other third parties, the lawyers and other representatives you have authorised, third parties from whom we receive advice including tax and financial advisers and auditors, and other third parties, including regulatory and supervisory bodies and official authorities, for the purpose of developing or providing healthcare services for the purposes stated above.
Applicable legislation
As explained above, your personal data are processed in any oral, written, visual or electronic medium for the purposes set out above and in order that all business falling within the field of activity of the group's companies may be conducted within the legal framework. Your personal data are collected and processed so that contractual and statutory obligations can be fulfilled fully and properly. The legal grounds for the collection of these personal data include:
- Law no. 6698 on the Protection of Personal Data;
- Law no. 6098, the Turkish Code of Obligations;
- Law no. 5510 on Social Insurance and Universal Health Insurance;
- Law no. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications;
- Law no. 6361 on Occupational Health and Safety;
- Law no. 4857, the Labour Code;
- Law no. 2828 on Social Services;
- Law no. 4632 on the Individual Pension Savings and Investment System;
- the Regulation on Health and Safety Measures to be Taken in Workplace Buildings and Annexes;
- the Regulation on State Archive Services;
- the Regulation on Occupational Health and Safety Services;
- Law no. 3359, the Basic Law on Health Services;
- Decree Law no. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions;
- and the other secondary legislation in force under these laws. The data are retained and processed for the retention periods laid down within that framework.
Furthermore, given that we provide services to patients connected with the European Union and maintain commercial relations with persons and institutions there, care is taken to ensure standards that also comply with European Union personal data protection legislation, in particular the General Data Protection Regulation.
As stated in the Personal Data Protection Law, personal data relating to health and sexual life may be processed without the explicit consent of the data subject only by persons under an obligation of confidentiality or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, the provision of medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing; we act in conformity with the legislation in this respect.
Rights of the data subject
The rights of the data subject are explained in the privacy notice published on the data controller's website. Article 11 of Law no. 6698 is also set out below.
Rights of the data subject
ARTICLE 11 —
(1) Everyone has the right, by applying to the data controller, in relation to themselves:
a) to learn whether personal data are being processed;
b) if they have been processed, to request information in that regard;
c) to learn the purpose of the processing of personal data and whether they are used in accordance with that purpose;
ç) to know the third parties, in the country or abroad, to whom the personal data have been transferred;
d) to request the rectification of personal data where they have been processed incompletely or incorrectly;
e) to request the erasure or destruction of personal data under the conditions laid down in Article 7;
f) to request that the operations carried out under subparagraphs (d) and (e) be notified to the third parties to whom the personal data have been transferred;
g) to object to an outcome to their detriment arising from the analysis of the processed data exclusively by automated systems;
ğ) and, where they suffer damage as a result of the unlawful processing of personal data, to claim compensation for that damage.
Using the application form available at http://fizyocare.com.tr/ and in accordance with the procedures and principles set out in the Communiqué on the Procedures and Principles of Application to the Data Controller, the data subject may apply, together with documents evidencing their identity, by wet signature to the address “Prof. Dr. Ahmet Taner Kışlalı Mahallesi, 2400. Cadde No: 6 D: 6, 06810 Çankaya/Ankara”, or by using their e-mail address to write to info@fizyocare.com. The requests contained in the application will be concluded free of charge within 30 days at the latest.
Cookie policy
This Cookie Policy covers the websites operated by BB Balaban Sağlık Hizmetleri ve Ticaret Limited Şirketi and contains explanations concerning that company's use of cookies. By using our site you consent to cookies being used in the manner set out in this Cookie Policy.
Who sends cookies, and how?
Cookies are sent by BB Balaban Sağlık Hizmetleri ve Ticaret Limited Şirketi and/or, where the page visited provides certain content such as video or photographs, by third parties, by way of the communication established during your visit between the browser on your device (such as Google Chrome or Safari) and the servers of the organisation referred to above.
For what purposes are cookies used?
Cookies are used for many different objectives. By way of example, they are chiefly used for the purposes set out below:
- the proper functioning of the website (for example, so that content such as text, photographs and links appears in the right places)
- offering visitors a more personalised and engaging experience (for example, providing services tailored to your preferences)
- developing and optimising the website (for example, restoring pages that contain errors or are little used), and
- remembering visitors' preferences (for example, the details you enter when signing in to our website, your language and other preferences)
What kinds of cookies do you use?
- Session cookies are temporary cookies kept on your devices until you leave the website.
- Persistent cookies, by contrast, are cookies that remain on your device's hard disk for long periods, and their lifetimes may vary from a few days to several years.
- Strictly necessary cookies must be stored so that the website can function properly and users can make use of the services and navigation features offered on the site. For example, the social media sharing cookies sent to your device by social networks — although not sent by us — so that you can share news items that interest you on our site or reach our accounts on the relevant platform are strictly necessary cookies.
- Functional and analytical cookies are used for purposes such as remembering your preferences, enabling effective use of the website and optimising the site so that it meets users' needs, and they contain data about how visitors use the site. By their nature, cookies of this kind may contain your personal information. For example, the cookies that record your language preference on our site are functional cookies.
How is the information we receive from your device used?
We also use, for statistical purposes and after anonymisation, usage data concerning the frequency of clicks during your visits on the articles, news items and content in the other tabs of our website and concerning the pages visited. You are not obliged to accept cookies in order to use our website, but the quality of your user experience may then be reduced. You may delete or block cookies, but in that case our website may not work as it should. We do not use the data we collect through cookies to identify you. Cookies are not used for purposes other than those set out in this Cookie Policy and are not processed in a manner contrary to data protection legislation.
