Clarification text on the processing of personal data

Özel Toplum Sağ.Hiz.Tic.A.Ş. (“OGAH”) olarak; 6698 sayılı Kişisel Verilerin Korunması Kanunu (“KVKK”) ve ilgili mevzuat ve yasal düzenlemelerden kaynaklanan faaliyetleri çerçevesinde kişisel verilerinizin işlenmesi, saklanması ve aktarılmasına ilişkin siz Çalışanlar ve Çalışan Adaylarımızı, Stajyer Adaylarımızı,

Our Online Visitors,

Shareholders/Partners,

Members of our Board of Directors,

We want to support our patients

Our Potential Patients

We have prepared this clarification text in order to inform you.

Which of Your Personal Data is Processed and What are the Purposes of Processing Your Personal Data?

Employee Candidates

Identity Information

Processed Personal Data

Name, Surname, Date of Birth, Turkish ID Number/Foreign ID Number, Driver’s License Type

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidate Application Processes, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations, Other: Execution of Human Resources Activities for Future Positions

Contact Information

Processed Personal Data

E-mail address, Residence Address, Home Phone Number, Cell Phone Number

Personal Data Processing Purposes:

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidate Application Processes, Execution of Activities in Compliance with the Legislation, Execution of Communication Activities, Planning of Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations, Other: Execution of Human Resources Activities for Future Positions

Personal Information

Processed Personal Data

Military Service, Educational Background and Details, Reference Information, Work History and Details, Curriculum Vitae, Foreign Language Skills

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidate Application Processes, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations, Other: Execution of Human Resources Activities for Future Positions

Transaction Security Information

Processed Personal Data

Password, Device MAC Address, Internal IP Address, External IP Address, Traffic Data (e.g. Connection Time/Duration, Amount of Communication, etc.)

Purposes of Processing Personal Data

Execution of Information Security Processes, Execution of Application Processes of Employee Candidates, Execution of Storage and Archive Activities

Finance Information

Processed Personal Data

Bank Account Information

Purposes of Processing Personal Data

Execution of Application Processes of Employee Candidates, Planning of Human Resources Processes, Execution of Storage and Archive Activities

Professional Experience Information

Processed Personal Data

EKAT Certificate

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidate Application Processes, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations, Other: Execution of Human Resources Activities for Future Positions

Health Information

Processed Personal Data

Information on Disability Status

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidate Application Processes, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations, Other: Execution of Human Resources Activities for Future Positions

Criminal Conviction and Security Measures Information

Processed Personal Data

Criminal Record

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidate Application Processes, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations, Other: Execution of Human Resources Activities for Future Positions

Reference Information

Processed Personal Data

Name, Surname, Registration Number, Department, Title, Reference Type, Telephone Number

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidate Application Processes, Execution of Activities in Compliance with the Legislation, Planning of Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations, Other: Execution of Human Resources Activities for Future Positions

Audio and Visual Recordings

Processed Personal Data

Switchboard Center Voice Recordings

Purposes of Processing Personal Data

Execution of Audit / Ethical Activities, Execution of Communication Activities, Receiving and Evaluating Suggestions for Improving Business Processes, Execution of Customer Relationship Management Processes, Execution of Activities for Customer Satisfaction, Follow-up of Requests / Complaints, Providing Information to Authorized Persons, Institutions and Organizations

Trainee Candidates

Identity Information

Processed Personal Data

Name, Surname, Turkish ID Number, Date of Birth, Driver’s License Type

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Application Processes of Employee Candidates, Execution of Activities in Compliance with Legislation, Planning of Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations

Contact Information

Processed Personal Data

Electronic Mail Address, Home Phone, Cell Phone, Residence Address

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Application Processes of Employee Candidates, Execution of Activities in Compliance with Legislation, Execution of Communication Activities, Planning of Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations

Personal Information

Processed Personal Data

Internship Information, Student Number, Education History and Details, Employment History and Details, Military Service, Foreign Language, Competency Information

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidate Application Processes, Execution of Activities in Compliance with the Legislation, Planning Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations

Transaction Security Information

Processed Personal Data

Password, Device MAC Address, Internal IP Address, External IP Address, Traffic Data (e.g.: Connection Time/Time, Amount of Communication, etc.)

Purposes of Processing Personal Data

Managing Information Security Processes, Conducting Activities in Compliance with Legislation, Planning Human Resources Processes, Conducting Storage and Archive Activities

Health Information

Processed Personal Data

Information on Disability Status

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidate Application Processes, Execution of Activities in Compliance with the Legislation, Planning Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations

Criminal Conviction and Security Measures Information

Processed Personal Data

Criminal Record

Purposes of Processing Personal Data

Execution of Information Security Processes, Execution of Activities in accordance with the Legislation, Providing Information to Authorized Persons, Institutions and Organizations

Reference Information

Processed Personal Data

Name, Surname, Registration Number, Department, Title, Reference Type

Purposes of Processing Personal Data

Execution of Employee Candidate / Intern / Student Selection and Placement Processes, Execution of Employee Candidate Application Processes, Planning of Human Resources Processes, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations

Audio and Visual Recordings

Processed Personal Data

Switchboard Center Voice Recordings

Purposes of Processing Personal Data

Execution of Audit / Ethical Activities, Execution of Communication Activities, Receiving and Evaluating Suggestions for Improving Business Processes, Execution of Customer Relationship Management Processes, Execution of Activities for Customer Satisfaction, Follow-up of Demands / Complaints, Providing Information to Authorized Persons, Institutions and Organizations

Physical Space Security Information

Processed Personal Data

Entry/Exit Registration Information, CCTV Registration Information, Person Visited, Time/Duration of Visit, Date of Visit, Reason for Visit, Vehicle Entry Permit

Purposes of Processing Personal Data

Conducting Activities in Compliance with the Legislation, Ensuring Physical Space Security, Conducting Internal Audit / Disciplinary Activities, Conducting Occupational Health and Safety Activities, Conducting Storage and Archive Activities, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations, Creating and Monitoring Visitor Records

Transaction Security Information

Processed Personal Data

Device MAC Address, Internal IP Address, External IP Address, Traffic Data (e.g.: Connection Time/Time, Amount of Communication, etc.)

Purposes of Processing Personal Data

Execution of Information Security Processes, Execution of Access Authorizations, Execution of Activities in Compliance with Legislation, Execution of Internal Audit / Disciplinary Activities, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations

Online Visitors

Transaction Security Information

Processed Personal Data

Traffic Data (e.g. Connection Time/Time, Amount of Communication, etc.)

Purposes of Processing Personal Data

Execution of Information Security Processes, Execution of Access Authorizations, Execution of Activities in Compliance with Legislation, Execution of Internal Audit / Disciplinary Activities, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations

Shareholder/Partner

Identity Information

Processed Personal Data

Name, Surname, Turkish Identity Number/ Foreign Identity Number, Signature

Purposes of Processing Personal Data

Execution of Finance and Accounting Affairs, Follow-up and Execution of Legal Affairs, Execution of Investment Processes, Execution of Management Activities

Members of the Board of Directors

Identity Information

Processed Personal Data

Name, Surname, Turkish ID Number

Purposes of Processing Personal Data

Execution of Information Security Processes, Execution of Access Authorizations, Execution of Activities in Compliance with Legislation, Execution of Finance and Accounting Affairs, Execution of Business Continuity Activities, Execution of Storage and Archive Activities, Ensuring the Security of Data Controller Operations

Contact Information

Processed Personal Data

Residence Address

Purposes of Processing Personal Data

Execution of Activities in Accordance with the Legislation, Execution of Communication Activities

Personal Information

Processed Personal Data

Curriculum Vitae Information, Information on Remuneration Paid within the Scope of Attendance Rights

Purposes of Processing Personal Data

Execution of Financial and Accounting Affairs, Execution of Assignment Processes, Follow-up and Execution of Legal Affairs, Ensuring Security of Legal Transactions, Execution of Internal Audit / Disciplinary Activities, Execution / Audit of Business Activities, Receiving and Evaluating Suggestions for Improvement of Business Processes, Execution of Business Continuity Activities, Execution of Storage and Archive Activities, Execution of Contract Processes, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Management Activities

Legal Action Information

Processed Personal Data

PDP Information

Purposes of Processing Personal Data

Execution of Activities in Compliance with the Legislation, Follow-up and Execution of Legal Affairs, Ensuring Security of Legal Transactions, Conducting Internal Audit / Disciplinary Activities, Planning Human Resources Processes, Conducting Storage and Archive Activities, Providing Information to Authorized Persons, Institutions and Organizations

Physical Space Security Information

Processed Personal Data

CCTV Recordings

Purposes of Processing Personal Data

Execution of Information Security Processes, Ensuring Physical Space Security, Conducting Internal Audit / Disciplinary Activities, Conducting Occupational Health / Safety Activities, Conducting Storage and Archive Activities, Ensuring the Security of Movable Goods and Resources, Providing Information to Authorized Persons, Institutions and Organizations, Conducting Management Activities, Creating and Monitoring Visitor Records

Transaction Security Information

Processed Personal Data

Traffic Data (e.g.: Connection time/duration, amount of communication, etc.), Corporate E-Mail Account Archives, Electronic Access/Activity Records, Device MAC Address, Internal IP Address, External IP Address, Destination IP/Domain Name Records

Purposes of Processing Personal Data

Execution of Information Security Processes, Execution of Audit/Ethical Activities, Execution of Access Authorizations, Execution of Activities in Compliance with Legislation, Execution of Internal Audit / Disciplinary Activities, Execution/Supervision of Business Activities, Execution of Risk Management Processes, Execution of Storage and Archive Activities, Ensuring the Security of Movable Goods and Resources, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Management Activities

Finance Information

Processed Personal Data

Credit Information

Personal Data Processing Purposes:

Execution of Audit/Ethical Activities, Execution of Activities in Compliance with Legislation, Execution of Finance and Accounting Affairs, Follow-up and Execution of Legal Affairs, Execution of Internal Audit / Disciplinary Activities, Planning Human Resources Processes, Execution/Supervision of Business Activities, Execution of Risk Management Processes, Execution of Storage and Archive Activities, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Management Activities

Risk Management Information

Processed Personal Data

Information Processed for Managing Commercial Risks, Information Processed for Managing Technical Risks

Personal Data Processing Purposes:

Execution of Activities in accordance with the Legislation, Execution of Strategic Planning Activities

Our patients

Identity Information

Processed Personal Data

Name, Surname, Turkish ID Number, Address, Home Phone Number, Mobile Phone Number Private health data

Personal Data Processing Purposes:

Execution of Activities in Compliance with Legislation, Execution of Financial and Accounting Affairs, Follow-up and Execution of Legal Affairs, Execution of Business Continuity Activities, Execution of Customer Relationship Management Processes, Execution of Activities for Customer Satisfaction, Execution of Performance Evaluation Processes, Execution of Storage and Archive Activities, Follow-up of Requests/Complaints, Informing Authorized Persons, Institutions and Organizations, Disease detection, follow-up and treatment procedures by processing private health data, Informing the necessary institutions about private health data

Contact Information

Processed Personal Data

E-Mail Address, Work Phone Number, Cell Phone Number, Company Name/Title, Workplace Address

Personal Data Processing Purposes:

Execution of Activities in Compliance with the Legislation, Execution of Financial and Accounting Affairs, Execution of Company/Product/Service Commitment Processes, Follow-up and Execution of Legal Affairs, Execution of Communication Activities, Execution/Supervision of Business Activities, Execution of Business Continuity Ensuring Activities, Execution of Logistics Activities, Execution of Goods / Services After Sales Support Services, Execution of Goods / Services Sales Processes, Execution of Goods / Services Production and Operation Processes, Execution of Customer Relationship Management Processes, Execution of Activities for Customer Satisfaction, Organization and Event Management, Execution of Performance Evaluation Processes, Execution of Advertisement/Campaign/Promotion Processes, Execution of Storage and Archive Activities, Execution of Contract Processes, Execution of Strategic Planning Activities, Follow-up of Demands/Complaints, Execution of Supply Chain Management Processes, Execution of Marketing Processes of Products/Services, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations

Finance Information

Processed Personal Data

Bank Account Information, Income Information, Credit Report

Personal Data Processing Purposes:

Execution of Activities in Compliance with the Legislation, Execution of Financial and Accounting Affairs, Follow-up and Execution of Legal Affairs, Execution/Supervision of Business Activities, Execution of Business Continuity Ensuring Activities, Execution of Goods/Service Sales Processes, Execution of Customer Relationship Management Processes, Execution of Storage and Archive Activities, Execution of Supply Chain Management Processes, Execution of Marketing Processes of Products/Services, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations

Customer Transaction Information

Processed Personal Data

Check Information, Receipt Information, Order Information, Request Information, Customer Number, Invoice Information

Personal Data Processing Purposes:

Execution of Activities in Compliance with the Legislation, Execution of Finance and Accounting Affairs, Execution of Company/Product/Services Loyalty Processes, Follow-up and Execution of Legal Affairs, Execution/Supervision of Business Activities, Execution of Business Continuity Activities, Execution of Goods/Service Sales Processes, Execution of Goods/Service Production and Operation Processes, Execution of Customer Relationship Management Processes, Execution of Activities for Customer Satisfaction, Execution of Marketing Analysis Studies, Execution of Storage and Archive Activities, Execution of Contract Processes, Execution of Strategic Planning Activities, Follow-up of Demands/Complaints, Execution of Supply Chain Management Processes, Ensuring the Security of Data Controller Operations, Execution of Investment Processes, Providing Information to Authorized Persons, Institutions and Organizations

Marketing Information

Processed Personal Data

Customer Experience Survey Information, Shopping History Information, Payment History Information, Complaint/Contact Forms

Processed Personal Data

Customer Experience Survey Information, Shopping History Information, Payment History Information, Complaint/Contact Forms

Personal Data Processing Purposes:

Execution of Company/Product/Service Loyalty Processes, Execution of Business Continuity Activities, Execution of Goods/Services After Sales Support Services, Execution of Goods/Services Sales Processes, Execution of Customer Relationship Management Processes, Execution of Activities for Customer Satisfaction, Execution of Marketing Analysis Studies, Execution of Storage and Archive Activities, Execution of Strategic Planning Activities, Follow-up of Demands/Complaints, Execution of Marketing Processes of Products/Services, Ensuring the Security of Data Controller Operations, Execution of Investment Processes

Information on Company Authorities

Processed Personal Data

Identity Information, Contact Information, Signature Circular

Personal Data Processing Purposes:

Execution of Activities in Compliance with the Legislation, Execution of Financial and Accounting Affairs, Follow-up and Execution of Legal Affairs, Execution of Communication Activities, Execution/Supervision of Business Activities, Execution of Business Continuity Ensuring Activities, Execution of After Sales Support Services for Goods/Services, Execution of Goods / Service Sales Processes, Execution of Goods / Service Production and Operation Processes, Execution of Storage and Archive Activities, Execution of Contract Processes, Execution of Marketing Processes of Products / Services, Ensuring the Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations

Audio and Visual Recordings

Processed Personal Data

Switchboard Center Voice Recordings

Purposes of Processing Personal Data

Execution of Audit / Ethical Activities, Execution of Communication Activities, Receiving and Evaluating Suggestions for Improving Business Processes, Execution of Customer Relationship Management Processes, Execution of Activities for Customer Satisfaction, Follow-up of Requests / Complaints, Providing Information to Authorized Persons, Institutions and Organizations

Potential Patients

In the event that the personal data processing activity carried out within the scope of the above-mentioned purposes does not meet any of the reasons for compliance with the law other than the existence of the explicit consent of the data subject stipulated under the KVKK, the explicit consent of the data subject is obtained by OGAH for the relevant processing process.

What are the Methods of Collecting Your Personal Data?

Your personal data specified above in categories; application forms, employment contract, contracts, CV, electronic tracking and physical access control systems in the workplace, (EX: biometric and card access systems, CCTV), information systems and electronic devices (EX: telecommunication infrastructure, computers and telephones), İŞKUR and private employment agencies (including Kariyer.net, etc.), parties providing Headhunter services, third parties (EX: KKB and Findeks), online website, Cookies/Cookies created by our own website, Tracking Cookies/Tracking Cookies created by third parties (EX: Hotjar), site usage measurement systems (EX: Google Analytics) and other documents declared by the person concerned.

What is the Legal Reason for Collecting Your Personal Data?

Your personal data is processed by OGAH within the scope of the establishment of the contract, allocation of rights and our legitimate interests in accordance with the relevant legislation, especially the Turkish Commercial Code, Turkish Code of Obligations and KVKK regulations, in line with the realization of the purposes described above.

Do We Transfer Your Personal Data to a Third Party?

Your personal data,

To Authorized Public Institutions and Organizations in the country for the purposes of conducting activities in accordance with the legislation, following and conducting legal affairs, informing authorized persons, institutions and organizations, fulfilling the obligations arising from the employment contract and legislation for employees, conducting/supervising business activities and conducting occupational health/safety activities within the scope stipulated by the legal regulation, and

Within the scope stipulated by the legal regulations, to Real Persons or Private Legal Entities within the country for the purposes of conducting activities in accordance with the legislation and providing information to authorized persons, institutions and organizations

will be able to be transferred.

Do We Transfer Your Personal Data Abroad?

As OGAH, we do not transfer your personal data abroad.

How Long Is Your Personal Data Stored?

The retention period of your personal data is as follows:

If a period of time is specified in the law or relevant legislation for the storage of data, the data in question must be kept for at least this period. Considering the possibilities such as the late receipt of a possible court request or the request of an administrative authority authorized by law regarding the relevant data or the occurrence of a dispute to which we may be a party, the retention period of the data is determined by adding a period of 6 months to 1 year to the periods stipulated in the legislation for the storage of your data and the data in question is deleted at the end of the specified period.

If the legislation does not stipulate a period for the storage period of the data we process, your data is stored as required by the relationship between us and for the period specified in the contract with you. After the end of this relationship or after the period specified in the contract has expired, your data will be deleted, destroyed or anonymized without your request.

If you request the deletion of your data, the retention period of which is determined in the legislation, before the prescribed periods, your request in question will not be realized.

If you request the deletion of your data, which is not stipulated in the legislation regarding the retention period and which is not intended for processing, it will be deleted immediately or within 6 months at the latest.

What are the Rights You Can Exercise Regarding Your Personal Data?

Regarding your personal data;

Learn whether your personal data is being processed,

Request information if your personal data has been processed,

To learn the purpose of processing personal data and whether they are used for their intended purpose,

To know the third parties to whom your personal data is transferred domestically or abroad,

To request correction of your personal data in case of incomplete or incorrect processing,

To request the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK legislation,

When you request the correction of incomplete or incorrect data and the deletion or destruction of your personal data, to request that this situation be notified to third parties to whom we transfer your personal data,

In case you suffer damage due to unlawful processing of personal data, to demand the compensation of this damage

you have rights.

How Can You Exercise Your Rights?

If you wish, you can submit your applications and requests regarding your personal data via the Data Subject Application Form;

Private Toplum Sağ.Hiz.Tic.A.Ş. Aydınlar Mah. G.M.K. Bulv. No:248 Merkez/GİRESUN address,

By applying to Özel Toplum Sağ.Hiz.Tic.A.Ş. in person with a valid identity document,

By sending it to our registered electronic mail address ozel.toplumsaglik@hs02.kep.tr by using a registered electronic mail (KEP) address and secure electronic signature or mobile signature,

By sending to our address ozel.toplumsaglik@hs02.kep.tr from the e-mail address previously notified to Özel Toplum Sağ.Hiz.Tic.A.Ş. by the relevant person and registered in our system

You can forward it to Özel Toplum Sağ.Hiz.Tic.A.Ş.

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, the application of the Data Subject must include the name, surname, signature if the application is in writing, Turkish ID number, (passport number if the applicant is a foreigner), residential or workplace address for notification, e-mail address for notification, telephone number and fax number, if any, and information on the subject of the request.

The Relevant Person must clearly and comprehensibly state the matter requested in the application to exercise the above-mentioned rights, including explanations regarding the right he/she requests to exercise. Information and documents related to the application must be attached to the application.

Although the subject matter of the request must be related to the applicant’s person, if acting on behalf of someone else, the applicant must be specifically authorized to do so and this authorization must be documented (special power of attorney). In addition, the application must include identity and address information and must be accompanied by identity verification documents.

Requests made by unauthorized third parties on behalf of someone else will not be evaluated.

How long will your requests regarding the processing of your personal data be answered?

Your requests regarding your personal data will be evaluated and answered within 30 days at the latest from the date of receipt. If your application is evaluated negatively, the reasons for rejection will be sent to the address you specified in your application by e-mail or postal mail, or by one of the methods selected in the Contact Person Application Form.