KVKK

1. INTRODUCTION

1.1  Purpose 

Personal Data Storage and Destruction Policy (“Policy”), Dr. It has been prepared to determine the procedures and principles regarding the works and transactions regarding personal data storage and destruction activities carried out by Birkan Duras as the data controller.

Our business; In line with the legal mission, vision and basic principles; Personal data of patients, companions, personnel, personnel candidates and service providers are transferred to the Republic of Turkey. It has prioritized processing in accordance with the Constitution, international conventions, Personal Data Protection Law No. 6698 (“Law”) and other relevant legislation and ensuring that relevant persons exercise their rights effectively.

Work and transactions regarding the storage and destruction of personal data are carried out in accordance with the Policy prepared accordingly.

1.2  Scope

Personal data of patients, companions, personnel, personnel candidates and service providers are within the scope of this Policy, and this Policy is applied to all recording environments where personal data managed by our business is processed and activities related to personal data processing.

1.3  Abbreviations and Definitions

Among the legal and technical terms included in this Policy;

It expresses.

2. EXPLANATIONS ON STORAGE AND DISPOSAL

Personal data processed by our business is stored and destroyed in accordance with the Law.

In this context, detailed explanations regarding storage and disposal are given below.

2.1  Storage Remarks

In Article 3 of the Law, the concept of processing personal data is defined, in Article 4, it is stated that the personal data processed should be related to the purpose for which they are processed, limited and proportionate and should be kept for the period required by the relevant legislation or for the purpose for which they are processed, and in Articles 5 and 6, it is stated that the processing of personal data should be limited and proportionate. conditions are listed.

Accordingly, personal data is stored for the period stipulated in the relevant legislation or for the period appropriate to our processing purposes.

2.1.1      Legal Reasons Requiring Personal Data Storage

Processed personal data is processed and stored if at least one of the legal reasons listed below exists.

• Clearly prescribed by law
• It is necessary to process the data of the parties for the performance of the contract
• It is mandatory for the data controller to fulfill its legal obligation
• Data processing is mandatory for the establishment, exercise or protection of a right
• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned
• Providing preventive medicine, medical diagnosis, treatment and care services
• Explicit Consent

2.1.2      Processing Purposes Requiring Storage

Personal data is processed and stored for the purposes stated below.

• Execution of emergency management processes
• Executing information security processes
• Conducting the application processes of employee candidates
• Fulfillment of obligations arising from employment contracts and legislation for employees
• Execution of fringe benefits and benefits processes for employees
• Conducting educational activities
• Execution of access authorizations
• Conducting activities in accordance with the legislation
• Carrying out finance and accounting affairs
• Ensuring physical space security
• Execution of assignment processes
• Following up and carrying out legal affairs
• Carrying out communication activities
• Planning human resources processes
• Carrying out occupational health and safety activities
• Receiving and evaluating suggestions for improving business processes
• Conducting performance evaluation processes
• Carrying out storage and archive activities
• Execution of contract processes
• Following up requests and complaints
• Ensuring the security of movable goods and resources
• Ensuring the security of data controller operations
• Carrying out talent and career development activities
• Providing information to authorized persons, institutions and organizations
• Carrying out promotional activities

2.2 Reasons Requiring Destruction

Personal data;

• Amendment or abolition of the relevant legislative provisions that constitute the basis for its processing,
• The purpose requiring processing or storage is eliminated,
• In cases where personal data is processed only on the basis of explicit consent, the relevant person may withdraw his/her explicit consent.
• Our business accepts the application made by the relevant person regarding the deletion and destruction of his personal data within the framework of his rights in accordance with Article 11 of the Law,
• In cases where our business rejects the application made by the relevant person requesting the deletion, destruction or anonymization of his personal data, finds the answer given insufficient, or does not respond within the time period stipulated in the Law; Complaining to the Board and this request being approved by the Board,
• The maximum period requiring personal data to be stored has passed and there are no conditions that justify storing personal data for a longer period of time,

In such cases, it is deleted, destroyed or ex officio deleted, destroyed or anonymized by our business upon the request of the relevant person.

3. TECHNICAL AND ADMINISTRATIVE MEASURES

In order to safely store personal data, prevent unlawful processing and access of personal data, and destroy personal data in accordance with the law, technical and administrative measures are taken within the framework of adequate measures determined and announced by the Board for special personal data in accordance with Article 12 of the Law and the fourth paragraph of Article 6 of the Law. measures are taken.

3.1  Technical Measures

The technical measures taken regarding the processed personal data are listed below:

• Network security and application security are provided.
• Security measures are taken within the scope of supply, development and maintenance of information technology systems.
• An authority matrix has been created for employees.
• Access logs are kept regularly.
• Employees who change their duties or leave their jobs have their authorizations in this area removed.
• Up-to-date anti-virus systems are used.
• Firewalls are used.
• User account management and authorization control system is implemented and these are also monitored.
• Log records are kept without user intervention.
• Secure encryption / cryptographic keys are used for sensitive personal data and are managed by different units.
• Cyber security measures have been taken and their implementation is constantly monitored.
• Special qualified persons’ data transferred on portable memory, CD, DVD media are encrypted.
• Periodically authorization checks are carried out for employees who have access to sensitive personal data.
• Security updates for the environments where the data is stored are constantly monitored, necessary security tests are performed or performed regularly and the test results are recorded.
• Security tests of software that access sensitive personal data are carried out regularly and the test results are recorded.
• A two-stage authentication system is used for remote access to sensitive personal data.
• If personal health data is to be transferred between servers in different physical environments, transfer is made between the servers by establishing a VPN or using sFTP methods.
• For personal data stored in digital environment, periodic deletion, destruction or anonymization processes are carried out.

3.2 Administrative Measures

Administrative measures taken regarding processed personal data are listed below:

• There are disciplinary regulations for employees that include data security provisions.
• Training and awareness activities are carried out for employees on data security at regular intervals.
• Corporate policies on access, information security, use, storage and destruction have been prepared and implemented.
• Confidentiality commitments are made.
• The signed contracts contain data security provisions.
• Extra security measures are taken for personal data transferred via paper and the relevant documents are sent in confidential document format.
• Personal data security policies and procedures have been determined.
• Personal data security issues are reported quickly.
• Personal data security is monitored.
• Necessary security measures are taken regarding entry and exit to physical environments containing personal data.
• The security of physical environments containing personal data is ensured against external risks (fire, flood, etc.).
• The security of environments containing personal data is ensured.
• Personal data is reduced as much as possible.
• Periodical and/or random audits are carried out within the institution.
• Protocols and procedures for the security of special personal data have been determined and implemented.
• If special personal data is to be sent via e-mail, it must be sent encrypted and using a KEP or corporate mail account.
• The authorization scope and duration of users who are authorized to access sensitive personal data are clearly defined.
• Inventory allocated to employees who change their duties or leave their jobs is returned.
• Personal data inventory has been prepared.
• Deletion, destruction or anonymization are carried out at periodic intervals.

4. STORAGE AND DISPOSAL PERIOD

Regarding the personal data processed by our business within the scope of its activities; retention periods are included in the Personal Data Storage and Destruction Policy.

Updates are made to these retention periods if necessary.

For personal data whose storage period has expired, ex officio deletion, destruction or anonymization is carried out during the first periodic destruction period following the end of the storage period.

4.1  Table of Storage Periods

4.2  Disposal Times

Our business ex officio deletes, destroys or anonymizes personal data in accordance with the principles and procedures set out in this Policy, in the first periodic destruction process following the date on which the obligation to delete, destroy or anonymize personal data in accordance with the provisions of the Law and Regulation arises.

If the data controller duly applies to us using the right to request the deletion of personal data specified in Article 13 of the Law;

• If all the conditions for processing personal data have been eliminated; Personal data subject to the request will be deleted, destroyed or anonymized by an appropriate destruction method within 30 (thirty) days from the day the request is received.
• If all the conditions for processing personal data have not been eliminated, the request may be rejected by explaining the reason for the request in accordance with the third paragraph of Article 13 of the Law, and the rejection response will be notified to the relevant person in writing or electronically within 30 (thirty) days at the latest.

5. PERIODIC DESTRUCTION TIMES

In accordance with Article 11 of the Regulation, the periodic destruction period is determined as 6 months. Accordingly, periodic destruction is carried out every year in June and December.

6. DISPOSAL METHODS

At the end of the period stipulated in the relevant legislation or the storage period required for the purpose for which they are processed, personal data are destroyed ex officio or upon the application of the relevant person, using the techniques specified below, in accordance with the provisions of the relevant legislation.

6.1 Deletion of Personal Data

Personal data is deleted by the methods given below.

6.2 Destruction of Personal Data

Personal data is destroyed by the methods given below.

6.3 Anonymization of Personal Data

Anonymization of personal data means making it impossible to associate personal data with an identified or identifiable natural person in any way, even if it is matched with other data.

In order for personal data to be anonymized; Personal data must be returned by the data controller or third parties and/or made impossible to associate with an identified or identifiable natural person, even through the use of appropriate techniques in terms of the recording environment and relevant field of activity, such as matching the data with other data.

While our company anonymizes personal data, it does so in accordance with the above-mentioned standards. After the anonymization of personal data, personal data cannot be associated with an identified or identifiable natural person in any way.

7. MEASURES TAKEN TO ENSURE THE LEGAL COMPLIANCE OF THE DISPOSAL PROCESS

Destruction operations carried out ex officio upon request and during periodic destruction processes are carried out in accordance with the Law, the Regulation and this Policy. The technical and administrative measures taken in this context are shown separately below.

7.1  Technical Measures

• Access rights to personal data of employees in information technology units are kept under control.
• The destruction of personal data is ensured in a way that the data cannot be recycled and does not leave an audit trail.

7.2  Administrative Measures

• Personnel are trained on personal data protection legislation, data security and destruction.
• The destruction processes are inspected at regular intervals. Necessary measures are taken to eliminate detected security vulnerabilities.

8. RECORDING MEDIA

Personal data is stored in accordance with the provisions of the law, regulation and other relevant legislation. The recording media of personal data stored in this context are shown in the table below.

9. PRECAUTIONS TAKEN FOR PERSONAL DATA SECURITY

In order to safely store personal data, prevent unlawful processing and access of personal data, and destroy personal data in accordance with the law, technical and administrative measures are taken within the framework of adequate measures determined and announced by the Board for special personal data in accordance with Article 12 of the Law and the fourth paragraph of Article 6 of the Law. measures are taken.

9.1  Technical Measures

The technical measures taken regarding the processed personal data are listed below:

• Network security and application security are provided.
• Security measures are taken within the scope of supply, development and maintenance of information technology systems.
• Up-to-date anti-virus systems are used.
• Firewalls are used.
• Intrusion detection and prevention systems are used.
• Cyber security measures have been taken and their implementation is constantly monitored.
• Cryptographic encryption and backup are provided.
• User account management, key management and data masking are performed.
• Deletion, destruction or anonymization is carried out
• Data loss prevention software is used.

9.2  Administrative Measures

Administrative measures taken regarding processed personal data are listed below:

• There are disciplinary regulations for employees that include data security provisions.
• Training and awareness activities are carried out for employees on data security at regular intervals.
• Corporate policies on access, information security, use, storage and destruction have been prepared and implemented.
• Employees who change their duties or leave their jobs have their authorizations in this area removed.
• Personal data security policies and procedures have been determined.
• Personal data security is monitored.
• Necessary security measures are taken regarding entry and exit to physical environments containing personal data.
• The security of physical environments containing personal data is ensured against external risks (fire, flood, etc.).
• The security of environments containing personal data is ensured.
• Personal data is reduced as much as possible.
• Periodical and/or random audits are carried out within the institution.

10. PERSONNEL TITLE, UNIT AND DUTY DISTRIBUTION

All units and employees are required to ensure that the technical and administrative measures taken by the responsible units within the scope of the Policy are properly implemented, the training and awareness of the unit employees are increased, their monitoring and continuous supervision are ensured, and personal data is prevented from being processed unlawfully, personal data is unlawfully accessed, and personal data is protected against the law. It actively supports the responsible units in taking technical and administrative measures to ensure data security in all environments where personal data is processed in order to ensure proper storage. 11. UPDATES TO THE POLICY

Changes may be made to this Personal Data Storage and Destruction Policy due to changes in legislation, in accordance with Board decisions or in line with developments in the sector or the field of informatics. Changes made in this context are immediately recorded in the text and explanations regarding the changes are added to the updates table below.

Updates Table

12. FINAL PROVISIONS

This Personal Data Storage and Destruction Policy, Dr. It was prepared by Birkan Duras and announced in appropriate places within the enterprise and announced to the personnel working under employment contracts and other relevant persons.