INFORMATION ON THE PROTECTION OF PERSONAL DATA
This disclosure text has been prepared by MLP Sağlık Hizmetleri A.Ş. and all its affiliates, other companies and hospitals ("MLPCARE") as the data controller in accordance with the Personal Data Protection Law No. 6698 ("KVKK"), the Regulation on Personal Health Data, the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation and the relevant legislation.
HOW IS YOUR PERSONAL DATA PROCESSED?
I. Patient Registration
When you enter any of our hospitals within MLPCARE as a guest, your following data is processed by our guest services personnel for the purpose of your registration in the Hospital Information Management System (“HIS") based on the legal reason that "it is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" and "it is mandatory for the data controller to fulfill its legal obligation"
- Name Surname
- T.R. ID Number
- Passport number or temporary Turkish ID number for non-Turkish citizens
- Mobile Phone
- E-mail Address
- Place and Date of Birth
- Marital Status
- Gender information
- Private health insurance or Social Security Institution data
- ID Card Scan
- Appointment information
As a result of these procedures, all our guests are assigned a "Patient Number" and a "Protocol Number".
All these data are instantly transferred to the Medula system of the Social Security Institution ("SSI") through the HIS, where all these data are processed.
In addition, during the patient registration process, SMS is sent to the relevant person recipients of the patient registration process so that our guests can complete the HIS registration on the system and access the content of the clarification text at any time. In the content of the SMS sent, there are 2 single-use approval codes separately for our guests who want to give consent within the scope of KVKK and Law No. 6563 on the Regulation of Electronic Commerce ("ETK"). If the consent codes are reported back to our guest services personnel who perform the patient registration process by our guests, a record is created on the HIS of the recipient that the explicit consent and approvals required for KVKK and ETK have been given. Express consents and approvals shall be valid until revoked by exercising the right of refusal.
II. Health Service
The following data of our guests whose registration process has been completed will be used during the provision of the requested health service and in accordance with this service, by our healthcare personnel and physicians who are under the obligation to keep confidentiality "medical diagnosis, The legal reason "to carry out treatment and care services" will be processed and recorded in the HIS based on the cases explicitly stipulated in the Private Hospitals Law No. 2219 and the Basic Law on Health Services No. 3359, the Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Organizations, the Regulation on Private Hospitals, the Health Implementation Communiqué and the Patient Rights Regulation and the Turkish Code of Obligations No. 6098:
- Health Data (including, but not limited to, obtained as a result of medical diagnosis, treatment and care services)
All these data are instantly transferred to the E-Nabız system of the Republic of Turkey Ministry of Health ("Ministry").
III. Patient Discharge
After the medical services of our guests are completed, the following data are processed for the purpose of receiving the medical service fee from our guests and issuing invoices according to the relevant insurance status and based on the legal reason that "it is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" and "it is mandatory for the data controller to fulfill its legal obligation".
- Name Surname
- Banka Account Details
- Credit Card Number
- Invoice Data
IV. Other Services
a) Call Center and Switchboard
When you call MLPCARE call centers and the switchboard of one of the hospitals within MLPCARE, your following personal data, including patient rooms, are processed based on the legal reason that "it is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" and "data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject" in order to create your appointment requests, respond to your information requests and / or receive any other requests
- Name Surname
- Telephone Number
- T.R. ID Number
- E-mail Address
- Appointment Information
- Phone Call Audio Recording
b) Patient Rights Center
If you wish to exercise any of your rights under the Patient Rights Regulation as a guest in any of our hospitals within MLPCARE, your personal data below will be processed by our relevant unit for the purpose of finalizing your requests and complaints based on the legal reason that "it is mandatory for the data controller to fulfill its legal obligation".
- Name Surname
- Telephone Number
- T.R. ID Number
- E-mail Address
- Request Content
- Medical information
c) Guest Satisfaction
The guest satisfaction survey, which aims to improve the quality of health services offered after patient check-out procedures and to measure the guest experience, is sent via SMS to the mobile phone numbers of our guests based on the HIS registration in the form of a link. There are questions to measure satisfaction in the guest satisfaction survey that appears when this survey link is opened. When the answers given here match the record on the HIS, they are automatically transferred to the MLPCARE guest experience unit and our guests are contacted by the unit. Apart from this process, if the patient files a complaint through the institution's websites, various social media, or complaint websites, they will be contacted to resolve or respond to the complaint.
d) Hospital Closed Circuit (CCTV) Camera System
All hospitals within MLPCARE are monitored and recorded with a closed circuit camera system. In this process, the physical space security and audio-visual records of all our visitors visiting the hospitals will be automatically processed for the purpose of ensuring the security of the operations of the data controller and the creation and follow-up of visitor records, based on the legal grounds of "Data processing is mandatory for the legitimate interests of the data controller and for the data controller to fulfill its legal obligation, provided that it does not harm the fundamental rights and freedoms of the data subject".
e) Parking and Valet Services
Some of our hospitals within MLPCARE have parking and valet services. If our visitors who visit our hospitals by car want to benefit from these services, vehicle brand / model and vehicle license plate data will be processed based on the legal reason "It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject" for the purpose of ensuring the security of the data controller operations and creating and tracking visitor records.
f) Websites and Mobile Apps
Some of the websites of MLPCARE's subsidiaries and hospitals that are open to visitors offer the possibility to make e-appointments. In order to make an e-appointment via these websites, the first step is to enter the T.R. ID number of the person concerned in the appropriate place on the page. The patient information is retrieved from the SSI's Medula system through the entered Turkish ID number and displayed on the next page in a masked form. On the page in the second step, the GSM number required to complete the registration process is added to the appropriate place. In the last step, the e-appointment process is completed by selecting the hospital, medical unit and physician and a one-time appointment number is obtained.
If you want to cancel the e-appointment, the appointment cancellation process is completed by entering the T.R. ID number, hospital selection and appointment number in the relevant fields.
Those who wish to benefit from the e-result service on the website can access the results of tests and imaging performed at the relevant hospital by selecting the hospital and entering their T.R. Identity number data in the required fields. However, the results here show all patient identification and contact data masked.
Relevant persons can also make an appointment for a video call on their website. The appointment process is the same as e-appointment, and during the realization of the video call appointment, your visual and audio data will be processed on the legal basis of the establishment and performance of the contract in order to provide video consultancy services. You can access information on the processing of your health data within the scope of video calls under the heading "Health Service" of this Clarification Text.
You can send your complaints, suggestions and thanks to MLPCARE with your T.R. ID number, name, surname, phone number, the relevant hospital and your message, the content of which will be determined by you, on the page titled "we listen to you" on the website where guest requests and complaints are received. This data will be processed based on your explicit consent in order to carry out activities for patient satisfaction in the patient rights center and guest satisfaction processes.
When you fill in the "Information and Reservation" section for the check up service on our website, your name, surname, telephone number and hospital selection personal data will be processed based on the legal reason that "it is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" in order to carry out the activities of contacting you again.
In addition, if you make a donation to the institution of your choice by using the "e-get well soon" service on our website, the name and surname of the donor, the name and surname of the patient, the hospital and room number from which the service is received, the message you want to convey and your data on the donation receipt (such as bank, account number, donation amount) will be processed based on your explicit consent in order to carry out donation processes and will be transferred to the foundations you donate to based on the purpose and legal reason. Your donation is considered as your explicit consent to this activity.
When you download our mobile applications to your smartphone, you will receive an SMS with a verification code after you enter your T.R. ID number and phone number data. The transmitted SMS code is sent to your personal phone number registered in our systems and should not be shared with third parties. After entering this code in the required field, you can access your account.
Through your account, you can access data on your past and future appointments, e-prescriptions and reminders, make physical appointments or video call appointments, submit complaints and suggestions, view your past health records and, if you wish, add your test and examination results from other hospitals for review by the relevant physician. If you give your consent, you can benefit from various services we offer, such as viewing nearby pharmacies or Medical Park hospitals by sharing your location information. In addition, if you enter your credit card information based on your approval through the application, you can pay for the service you have received. If you give your consent, you can track the number of steps, weight, pulse, ECG and height data to be taken from the relevant health application of your phone. Your personal data that you provide to us in these processes will be processed by fully automated means for the purposes of carrying out service delivery processes and increasing patient satisfaction, based on the legal reason that "it is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" and "it is necessary to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned".
In addition, if you purchase a check-up service through our mobile application, your personal data such as name, surname, phone number, and hospital selection will be recorded and processed based on the legal reason that "it is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract" in order to ensure the organization of the process with the relevant patient in order to provide the service.
If you add your credit card to make a payment within the application, your credit card information will be processed by the licensed payment service provider from which we receive services in this regard, for the purpose of receiving the payment and on the legal basis of the performance of the contract. Your credit card information will never be recorded or seen by MLPCARE.
In addition to the above-mentioned, your information that you will add to the non-mandatory sections within the application will be processed by us, assuming that you have your explicit consent in this regard, in order to provide you with better service.
II. Information Activities
Health-protective and health-promoting information is provided in the form of commercial electronic messages such as SMS, e-mail, etc., only with our guests who have given KVKK and Communication consent and limited to informing activities in accordance with the Private Hospitals Regulation. Recipients can use their right to reject the message if they do not want to receive it. The consent is valid until the right to refuse is exercised.
For some of our guests, audio-visual records such as photographs and/or videos are processed only by obtaining the explicit consent of the relevant persons in order to carry out informative activities about the hospitals within MLPCARE. Relevant persons may withdraw their explicit consent at any time.
III. How Is Your Personal Data Transferred?
a) Health Service
Your personal data listed above, within the scope of our obligation to notify and / or report to authorized institutions and organizations within the scope of Medula, E-Nabız and similar automated systems established by persons appointed by the competent authorities, including but not limited to the Ministry, Provincial and District Health Directorates, Public Health Centers and other units affiliated to the Ministry, to domestic and foreign laboratories, ambulances, medical devices and health service providers that we cooperate with for medical diagnosis and treatment, to our subsidiaries and / or affiliates and / or group companies through the common HIS used by all our hospitals, It will be transferred to SSI for patients subject to SSI, to your insurance company you are a member of if you use your private insurance, to your institution if your invoicing will be made to the institution you work for, to the relevant health institution when you need to be referred, to the relevant health institution abroad if you request a second opinion from a physician abroad, and to the legal representatives you have authorized, based on the legal reason of "protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing" for the provision of health services.
b) Services from Third Parties
It will be transferred to our subcontractors, business partners, lawyers, consultants, auditors, including the lawyers, consultants, auditors we work with, legal representatives and third parties that we receive consultancy from and authorize, domestic / organizations and other third parties and their legal representatives, from whom we contractually receive services to carry out our activities, with whom we cooperate, only in connection with the service received, limited and measured, and with the precondition of obtaining commitments that they will take all technical and administrative measures required by the KVKK during the service.
c) Insurance Service and Contracted Institutions
For the purpose of benefiting from private health insurance or supplementary insurance, including but not limited to any other insurance product or contracted institution contract, the name, surname and mobile phone number information of the person concerned, invoice information, all personal health data processed for the provision of medical diagnosis and treatment in the hospitals within MLPCARE are transferred to the consultant, insurance company or contracted institutions with which a cooperation agreement has been made based on the legal reason "protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing". The post-transfer process is carried out personally by the relevant consultant, insurance company or contracted institution.
d) Call Center Service
Call center and voice traffic services are received by MLPCARE as a data processing service provider from third parties. Within the scope of this service received, your personal data will be transferred to the service provider through the call center.
e) Education/Training Institutions We Cooperate With
Your personal data is transferred to educational institutions in cooperation with MLPCARE for the purpose of carrying out training and research activities based on the legal reason of "data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject" and "protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing".
Click here for the full list of education/training institutions in cooperation with MLPCARE.
IV. What Are Your Rights as a Relevant Person?
Within the scope of Article 11 of the KVKK, which regulates the rights of the relevant person;
- To find out whether their personal data has been processed,
- Request information in case your personal data has been processed;
- To find out the purpose for processing of their personal data and whether they have been used in accordance with this purpose,
- Know the third parties to whom your personal data has been transmitted at home or abroad;
- Requesting correction of personal data if it is incomplete or incorrectly processed,
- Request deletion or destruction of personal data,
- To request notification of the correction, deletion or destruction of personal data to third parties to whom personal data are transferred,
- Object to any unfavorable result that you suffer due to the analysis of processed data only by means of automatic systems;
- In case of damage due to unlawful processing of personal data, to demand compensation for the damage,
You can submit your applications to MLPCARE via the "KVKK Access / Information Request Form" in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.
This clarification text has been updated on 19/12/2022 and has been made available to the relevant persons by MLPCARE through its websites and other methods and in case it is partially or completely renewed, the effective date will be updated and the renewed text will be published through the same methods.