Personal Data Retention and Disposal Policy

Data Controller: Op. Dr. Murat Polat (the “Clinic”)

Address: Konaklar, Akasyalı Sk. No:17, Beşiktaş, 34330 Istanbul, Türkiye

E-mail: info@drmuratpolat.com

Phone: +90 535 973 69 61

Location: Google Maps

Last updated: [date]

1. Purpose and Legal Basis

This Policy explains how the Clinic retains and disposes of personal data. It has been prepared in accordance with the Constitution of the Republic of Türkiye, the Law on the Protection of Personal Data No. 6698 (“PDPL” / “KVKK”), the Regulation on the Deletion, Destruction or Anonymization of Personal Data, the Regulation on Personal Health Data, and other applicable legislation.

Its aim is to set out the principles the Clinic follows when storing and disposing of the personal data of patients, prospective patients, visitors, employees and other individuals whose data we process, and to fulfil our legal obligations as a data controller.

2. Definitions

• Explicit consent: Consent relating to a specific matter, given freely and on an informed basis.
• Anonymization: Rendering personal data impossible to link to an identified or identifiable person, even when combined with other data.
• Disposal: The deletion, destruction or anonymization of personal data.
• Personal data: Any information relating to an identified or identifiable natural person (e.g. name, ID or passport number, e-mail address, telephone number, photographs, address, date of birth).
• Special categories of personal data: Data on race, ethnic origin, political opinion, philosophical belief, religion or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data. Medical records, before/after photographs and treatment details fall into this category.
• Data subject: The natural person whose personal data is processed.
• Processing: Any operation performed on personal data, such as collecting, recording, storing, altering, transferring, disclosing, classifying or restricting its use, whether by automated or non-automated means forming part of a filing system.
• Recipient group: The categories of natural or legal persons to whom personal data is transferred.
• Relevant user: Persons who process personal data within the Clinic or on its instructions, other than those responsible for the technical storage, protection and backup of data.
• Periodic disposal: Disposal carried out ex officio at the regular intervals set out in this Policy once all conditions for processing have ceased to exist.

3. Scope and Recording Media

This Policy covers all personal data processed by the Clinic, in both physical and electronic form. Personal data may be stored in the following media:

• Electronic: Clinic computers and servers, patient management software, e-mail accounts, cloud and backup systems, company mobile devices and messaging channels used for patient communication (e.g. WhatsApp Business, Instagram), external storage devices (USB, hard drives).
• Physical: Patient files and consent forms, paper archives, visitor logs, printouts and copies.

4. Principles of Processing and Retention

The Clinic processes personal data in line with the following principles:

• Lawfulness and fairness;
• Accuracy and, where necessary, keeping data up to date;
• Processing for specified, explicit and legitimate purposes;
• Being relevant, limited and proportionate to those purposes;
• Retaining data only for the period required by legislation or by the purpose of processing.

Legal grounds for personal data (Article 5)

Personal data is retained where at least one of the following grounds applies:

• the data subject has given explicit consent;
• processing is expressly provided for by law;
• processing is necessary to protect the life or physical integrity of a person who cannot give consent;
• processing is necessary for the conclusion or performance of a contract (e.g. treatment agreements);
• processing is necessary for the Clinic to comply with a legal obligation;
• the data has been made public by the data subject;
• processing is necessary to establish, exercise or protect a right;
• processing is necessary for the Clinic’s legitimate interests, provided it does not harm the data subject’s fundamental rights and freedoms.

Legal grounds for health data (Article 6)

Following the amendments to the PDPL that entered into force on 1 June 2024, health data may be processed, among other grounds, by persons or authorized institutions under a duty of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services. Where no other legal ground applies, the Clinic relies on the data subject’s explicit consent (for example, for the use of before/after photographs in marketing materials).

5. When Personal Data Is Disposed Of

Personal data is deleted, destroyed or anonymized, either ex officio or at the data subject’s request, where:

• the legislation forming the basis for processing is amended or repealed;
• the purpose of processing or retention no longer exists;
• processing was based solely on explicit consent and the data subject withdraws that consent;
• the maximum retention period has expired and no other ground justifies further retention.

Unless the Personal Data Protection Board decides otherwise, the Clinic chooses the appropriate method of disposal (deletion, destruction or anonymization) taking into account the available technology and implementation costs. Where disposal is carried out at the data subject’s request, the reason for the chosen method is explained on request.

Disposal methods

• Deletion: Making data inaccessible and unusable for relevant users, e.g. secure deletion from software and accounts, removing access rights, blacking out data on paper.
• Destruction: Rendering data permanently unrecoverable, e.g. shredding paper documents, physically destroying storage media.
• Anonymization: Removing or masking identifiers so the data can no longer be linked to an individual (e.g. for statistical use).

6. Technical and Administrative Measures

In accordance with Article 12 of the PDPL, the Clinic takes the following measures:

• Strong passwords and access authorizations are used on computers, software and e-mail accounts; access to patient data is limited to authorized staff.
• Staff receive training on data protection and patient confidentiality and sign confidentiality undertakings, which remain in force after they leave the Clinic.
• Regular data backups are performed, and backup media are protected.
• Patient files and records are shared only with the patient, persons authorized by the patient in writing, competent public authorities as required by law, and judicial authorities.
• Data subjects are informed (privacy notice) before their data is processed.
• A personal data processing inventory is maintained and kept up to date.
• Where personal data is transferred abroad (for example, for communication with international patients or the use of cloud-based services), the conditions of Article 9 of the PDPL are observed.

7. Retention and Disposal Periods

Personal data is retained only for the period required by applicable legislation or by the purpose of processing. Once the obligation to dispose arises, data is disposed of in the first periodic disposal, which is carried out every six (6) months.

8. Requests from Data Subjects

Data subjects may exercise their rights under Article 11 of the PDPL, including the right to request the deletion or destruction of their personal data, by applying to the Clinic in writing, via registered electronic mail (KEP), with a secure electronic signature, or from an e-mail address previously registered with the Clinic, using the contact details above.

• If all conditions for processing have ceased to exist: The Clinic disposes of the data, concludes the request within thirty (30) days at the latest and informs the data subject. If the data has been transferred to third parties, the Clinic notifies them and ensures that the necessary action is taken.
• If the conditions for processing still exist: The Clinic may refuse the request under Article 13(3) of the PDPL and informs the data subject of the refusal and its reasons, in writing or electronically, within thirty (30) days at the latest.

9. Updates

The Clinic may update this Policy when required by changes in legislation or in its processing activities. The current version is published on www.drmuratpolat.com.