1. INTRODUCTION 

1.1 purpose 

Personal data retention and destruction policy (“policy”),“ Op. Dr. Tuba Crescent POWERFUL Practice” (“Institution”) which is operated on transactions and business activities related to storage and disposal has been prepared in order to determine the procedures and principles.

Institution;institution employees, employee candidates, patients, suppliers, service providers, visitors and other third parties of personal data of the Turkish republic constitution, international agreements, the law on protection of personal data No. 6698 (“Law”) and other applicable legislation of the concerned persons in accordance with the rights that are processed as a priority to ensure the effective use of it is committed. Procedures for the disposal and storage of personal data, and work is performed in accordance with the policy, which was prepared by the agency in this regard.

1.2 Scope 

Institution employees, employee candidates, patients, suppliers, service providers and other third parties the personal data of visitors to this privacy policy are managed by the organization or institution within the scope of processed personal data with regard to the processing of personal data of all recording environments and activities to which this policy applies.

1.3 abbreviations and definitions 

Recipient Group : Personal data is the natural or legal person the category of the data transferred by the principal.

Explicit Consent : Related to a specific topic, based on informed consent and free will, are described.

Anonymous Making : Personal data, by matching with other data or identifiable natural person cannot be linked to a specific ID in no way even making.

Running : “Op. Dr. Tuba Crescent POWERFUL Practice ” the staff of the institution.

Patient : “Op. Dr. Tuba Crescent powerful practice from health care, medical treatment and the person who receives services.

Electronic Media : Personal data of the electronic devices can be created with it can be read, can be written where can be changed and environments.

Non-Electronic Media : The electronic environment outside of all written, printed, visual, etc. other environments.

Service provider : a specific contract with the agency that provides service protection of personal data within the framework of the natural or legal person. 

Contact : Personal data is processed by a real person.

Related User : Technically, data storage, data protection and backup, which is responsible for excluding the person or unit responsible for authorization and in accordance with the instruction or data from within the organization responsible for are the people who process personal data.

Destruction : Personal data deletion, destruction or has been rendered anonymous.

Law : Law No. 6698 On Protection Of Personal Data.

Recording Medium : Fully or partially automated, or be part of any data recording system to record non-personal data processed in any environment that contains automated ways.

Personal Data : All kinds of information about identified or identifiable natural person.

The Inventory Of The Processing Of Personal Data : Data processing activities, depending on the principals of the business processes they are accomplishing personal data; the purpose and legal reason of personal data processing the data category, data is transferred to the recipient group and associating with a group of people created by the subject of personal data required for the purposes they are processed and the maximum conservation of the duration of the measures prescribed by explaining the transfer of personal data to foreign countries and data protection detaylandirdik inventory.

The Processing Of Personal Data : Your personal data completely or partially automated, or be part of any data recording system to record non-automatic means obtaining, recording, storage, modification, rearrangement, disclosure, transfer, acquisition, can be obtained, making classification such as the Prevention of the use or any operation that is performed on the data.

The Personal Data Of A Private Nature : Of persons, race, ethnic origin, political opinion, philosophical belief, religion and sect, or other beliefs, costume and clothing, Association or trade union membership, health, sexual life, criminal convictions and security measures, with data on genetic and biometric data.

Periodic Destruction : The disappearance of all of the conditions of law in the processing of personal data retention and destruction of personal data in the case of ex officio be performed and repeated at intervals specified in the policy to delete, destroy, or the process of making anonymous.

Policy : Personal data retention and destruction Policy

Process Data : By the power vested in the principal the principal data of the natural or legal person, who process personal data on behalf of data.

Data Recording System : Personal data is processed by the recording system configured according to specific criteria.

Data Responsible : Determines the purposes and means of the processing of personal data, the establishment and management of a natural or legal person responsible for data recording system.

Data Principals Registration Information System : Data refers to the record of principals and processes for their use in other related internet-accessible on the record, the president created and managed by the information system.

VERBIS : Principals Registration Information System Data

Regulation : Published in the official gazette dated 28 October 2017 of personal data deletion, destruction or anonymization on regulation.

2.RESPONSIBILITY AND TASK DISTRIBUTIONS 

All organizational units and employees, technical and administrative measures that are being taken under the policy by the units responsible for the proper implementation of staff training and awareness raising, monitoring and continuous control to prevent unlawful processing of personal data, personal data, and preventing access to personal data is processed for purposes of lawful and unlawful storage of personal data in all environments technical and administrative measures for ensuring data security issues to the units responsible for the introduction of active support. The names of the retention and disposal of personal data involved in the process, units, and mission belonging to the distribution of are given in Table 1.

Table 1: retention and disposal processes in task distribution

3.RECORDING MEDIA 

Personal data by the agency are listed below in environments that are stored in a safe manner in accordance with law.

Table 2: personal data storage environments

4.COMMENTS REGARDING THE RETENTION AND DISPOSAL

Institution employees, employee candidates, patients, suppliers, visitors and service provider in the relationship as the current and third persons, institutions or organizations of their employees personal data are stored and destroyed in accordance with the law. In this context, the storage and disposal related to detailed explanations below, respectively, have been given.

4.1 Storing Comments On

Article 3 of the law defined the concept of the processing of personal data in Article 4, the personal data processed in connection with the purpose they are processed, limited and restrained to be stipulated in the relevant legislation or for the purpose they are processed, and retained as long as required should be indicated that, in terms of the processing of personal data in Article 5 and 6 were counted. Accordingly, within the framework of our corporate activities or personal data are stored until the appropriate time to our processing purposes stipulated in the relevant legislation.

4.1.1 Legal Reasons To Keep That Requires 

Institution and its activities in the personal data processed within the framework of the relevant legislation shall be retained until such time. In this context, personal data;

• Law No. 6698 on protection of personal data
• The Act Of 5651
• Turkish code of obligations No. 6098,
• The Turkish Commercial Code No. 4721,
• Law No. 6563
• Regulations and legislation related to private health insurance
• Patient Rights Directive and related legislation
• The Statute Of Deontology,
• Social insurance and General Health Insurance Law No. 5510, insurance legislation
• No. 6331 Occupational Health and Safety Act,
• Information Act No. 4982,
• The law on the use of the right of Petition No. 3071,
• 4857 and
• Retired Health Law No. 5434
• Law No. 2828 on social services
• Buildings and workplace health and safety requirements to be taken in supplements,
• Archive Services Regulation
• Other secondary legislation within the framework of these laws which are in force in accordance with the prescribed retention period, until it is stored.

4.1.2 Purpose Of Processing That Requires You To Keep 

Within the framework of the activities of the institution in which stores personal data for the following purposes.

• The performance of the health service
• Billing operations
• Carry out the process of human resources.
• Corporate communication are available.
• The safety and control of the institution,
• Ensure the security of data,
• Ensure the physical security of the institution of the interior,
• Staff training
• As a result of agreements and protocols signed, and be able to perform business operations.
• VERBIS within the scope of employees, data principals, representatives of the contact person responsible for the data and the data of those who committed preferences and needs, identify and edit if necessary, update the services accordingly.
• Required by legal regulations, or in the manner required, ensure the fulfillment of the legal obligations.
• A business relationship with the institution in real / liaison with entities provide.
• For information on your social media accounts
• Sms, to send an electronic message to be able to be able to respond to any questions and complaints within the health services
• Financial consultancy, Legal Consultancy Services, Recruitment
• Burden of proof as evidence in legal disputes that may arise in the future.

4.2 The Reasons Of Destruction 

Personal data;

• No modification or processing that form the basis for repeal of the provisions of the relevant legislation,
• The purpose of that require to be stored,processed or elimination
• Processing personal data in the event that only occurred pursuant to the terms of explicit consent, taking back the explicit consent of the person concerned,
• Pursuant to Article 11 of the law, the rights of the person concerned regarding the destruction or deletion of your personal data within the framework of his application to be accepted by the institution,
• By the Relevant Person of the institution of personal data deletion, destruction or anonymization to reject the reference to find out the answer with the demand itself or in cases that do not respond within the time stipulated in the law; the person concerned to file a complaint with the Personal Data Protection Personal Data Protection Authority and approved by the agency this demand,
• That requires the storage of personal data and personal data that is past the maximum period for the absence of any circumstances that would make it right to keep longer, in the event of the institution, upon request by the person concerned will be deleted, destroyed or ex officio deleted, destroyed or made anonymous.

5. TECHNICAL AND ADMINISTRATIVE MEASURES 

Secure storage of personal data, unlawful processing and access with the Prevention of personal data to be disposed of in accordance with the law of the fourth paragraph of Article 12 of the law with Article 6 of the act, pursuant to the personal data of a private nature for adequate measures to be determined by the board by the institution within the framework of the technical and administrative measures are taken.

5.1 Technical Measures 

By institution, committed in relation to personal data received technical measures are listed below:

• Infiltration (Penetration) testing ICT systems for our institution's risk, threat, vulnerability, and, if applicable, the necessary precautions are taken by the openings uncovered.
• Information Security Incident Management with real-time analysis results of the risks and threats that will affect the sustainability of information systems are constantly monitored.
• The institution's information systems, equipment, software, and data necessary for the physical security measures are taken.
• Environmental threats to ensure the security of Information Systems, Hardware (an access control system that allows only authorized personnel entry system room, 7/24 monitoring system, to ensure the physical security of edge forming a local area network switches, fire extinguishing system, air conditioning system, the physical environment where the data resides (archives , accounting, patient files, etc.) only in the presence of a person who is authorized keys, etc.) and software (firewalls, attack prevention systems, anti-virus software, the log record tracking system, network access control, malware blocking systems, etc.) precautions are taken.
• To prevent unlawful processing of personal data identify risks and take appropriate technical measures to those risks, checks are carried out and measures taken for provided a regular basis is taken as support for the technical computing.
• Access to personal data within the institution by creating access procedures related to reporting and analysis activities are carried out.
• They recorded personal access to the storage areas where the data resides improper access or access attempts are kept under control.
• Institution, personal data will not be accessible to interested users deleted and re-provides the necessary precautions to be used.
• In the case of personal data obtained by others is unlawful to people about this situation and report to the board by the authority to an appropriate system and infrastructure has been established.
• Are followed and the appropriate security patches and vulnerabilities of information systems being installed are kept up to date.
• Strong passwords are used and processed personal data in electronic environments.
• Safe record keeping processed personal data in electronic environments (logging) systems are used.
• Providing safe and secure storage of personal data, data backup programs are used.
• Electronic or non-personal data that is stored in the environment to access, according to the principles of access are limited.
• Personal data that is required for qualified special lighting made if deemed necessary, legally consent were obtained.
• Special processes of qualified employees who are involved in the processing of personal data personal data given training on private security, confidentiality agreements, powers of authorized users access to the data are defined.
• Qualified special personal data processed, stored, and/or that are being accessed by unauthorized entry and physical security of the physical environment and providing adequate security measures are taken they blocked the exit.
• Qualified special personal data via e-mail must be transferred encrypted corporate e-mail address or account are transferred to the pep. Portable memory, CD, DVD media, such as if it needs to be transmitted through cryptographic methods and it is encrypted with the cryptographic key is kept in a different environment. If you are transferring between servers in different physical environments, or data transfer by establishing a VPN between servers with FTP method is carried out. If you need to transfer paper documents through the medium of theft, loss or unauthorized persons and against such risks as seen by the paperwork necessary measures to be “hidden” in the format are sent.

5.2 Administrative Measures

By the institution committed administrative measures in relation to personal data received are listed below:

• The improvement of the quality of employees for unlawful processing of personal data to prevent unlawful access to personal data for the provision preventing the storage of personal data and on the premises are provided with training.
• Activities that are executed by the supplier and the employees of the institution were purchased services, etc. private and corporate parties have signed confidentiality agreements.
• Legal action against employees who violate security policies and procedures are applied.
• KVKK Discipline Policy has been prepared.
• KVKK Institution within the guidelines has been prepared.
• KVKK cookie policy has been prepared.
• The application form has been prepared in KVKK.
• Before it starts the processing of personal data by the institution, the contacts of lighting the obligation is fulfilled, the law, if necessary, the consent of the persons concerned is taken.
• Lighting has been prepared and consent forms.
• For practice/physical space to inform KVK are available.
• It complies with staff contracts.
• The processing of personal data of the inventory has been prepared.
• Premises of periodic and random audits are conducted.
• Information security training for employees are provided.
• That contain personal data of the physical environment is external risks (fire, flood, etc.) security can be provided against.
• Your personal data is reduced as much as possible.
• Qualified personal is defined and implemented special protocols and procedures for data security.
• Pandemic required in the process and the necessary measures have been taken kvkk lighting and our patients and our staff are informed.

6. PERSONAL DATA DESTRUCTION TECHNIQUES 

The period prescribed in the relevant legislation or for the purpose they are processed at the end of the retention period for the personal data required by the authority upon the request of the person concerned or ex officio, again in accordance with the provisions of the legislation are destroyed by the following techniques.

6.1 Deletion Of Your Personal Data

The personal data will be deleted with the method given in Table 3.

Table 3: The Deletion Of Your Personal Data

6.2 Destruction Of Personal Data 

Personal data are destroyed by the agency by the methods given in Table 4.

Table 4: Destruction Of Personal Data

6.3 Anonymization Of Personal Data 

Anonymization of personal data, personal data or with other data of a natural person identifiable in no way be linked to eslestirils even specific ID to make.

To be " anonymized personal data; personal data, or third parties responsible for the data to be returned by and/or with other data, such as data recording media in terms of matching the field through the use of appropriate techniques and related activity, or even specific ID cannot be associated with an identified or identifiable natural person must be made.

7. RETENTION AND DESTRUCTION OF ALL TIMES 

By the institution within the scope of activities in relation to personal data being processed;

• Depending on the process with respect to all personal data personal data within the scope of activities that are performed on the basis of the processing of personal data in the inventory of the storage time;
• Data storage period on the basis of categories verbis in the record;
• On the basis of the process of retention and destruction of personal data storage time the policy is located.

The storage in question on time, updates are made by the administrator of the institution, if necessary. The retention period for personal data, ex officio, which ended delete, destroy, or responsible for the security of the data is carried out by the process of making anonymous.

Table 5: Table, Storage and disposal on the basis of the duration of the process

Activities for preparation and execution of contracts following the expiration of the retention period of 10 years after the end of the contract in the time of the first periodic destruction

The execution of corporate communication activities following the expiration of the retention period of 10 years after the end of the activity in the time of the first periodic destruction

 8. THE TIME OF THE PERIODIC DESTRUCTION

The periodic destruction of the institution in accordance with Article 11 of the regulation is determined as the duration of 6 months. Accordingly, in the months of June and December of each year, the institution periodic destruction process is carried out.

9. SPECIAL PROCESSING OF PERSONAL DATA

9.1 In terms of data protection, the owner of more critical importance to the various aspects of the processing of personal data believed to have special custom illustrates the sensitivity.

Qualified special personal data in accordance with the act, to be determined by the board, provided that adequate measures are in place, the following terms are processed in the presence of:

• If you have the express consent of the data owner or
• If you have the express consent of the data owner the data owner's private qualified health and sexual life of the personal data outside the law prescribed in the special qualified personal data to the health of your sex life and of the owner of the data, however, Public Health Protection, preventive medicine, medical diagnosis, treatment and care services execution, for the purposes of the planning and management of health services financing, or persons under the obligation of confidentiality by the authorized institution is processed.

SPECIAL MEASURES RELATING TO THE PROCESSING OF PERSONAL DATA

6 of the law. Special item which is included in the processing of personal data in accordance with the decision of the board dated 31.01.2018 number 2018/10 data in his capacity as a principal, the following measures are taken:

Special to the security of personal data is a systematic, rules are clear, manageable, and sustainable this policy has been identified. Special processes for employees that are involved in the processing of personal data,

• Privacy contracts is made of
• Authorized users access to the data, the scope and duration of authority is clearly defined,
• The authorization checks are carried out periodically.
• Qualified personal is defined and implemented special protocols and procedures for data security.
• Change the task or work in this area is separated from the immediate removal of the powers of the employees. In this context, data is returned to inventory their assigned by the principal.
• Qualified special personal data processed, stored, and/or the environment are being accessed, the physical environment;
  • * Special character according to the nature of the personal data of the environment, adequate security measures (electrical leakage, fire, flood, theft, etc. case) are
  • * Unauthorized access is prevented by ensuring the physical security of these environments.

10. THE TRANSFER OF PERSONAL DATA SPECIAL

Qualified in accordance with law specific to be achieved, personal data, processing data for the purposes of the owner's private data to third parties qualified personal data is not transferred.

11. THE POLICY OF PUBLICATION AND STORAGE

Politics, wet-signed (printed paper) on the Web page that is published in two different media and in electronic environment is disclosed to the public. Printed paper copy is also stored in the file by the data manager.

12. THE PERIOD OF THE POLICY IS UPDATED 

Policy reviewed and updated as needed sections are necessary.

13. REPEAL THE POLICY EFFECT AND 

The policy entered into force on the date written below is considered. Old wet repeal of the policy of signed copies to be given by the data manager with the decision cancelled (cancellation cancellation by writing shot or bowl) for a period of at least 5 years and shall be signed by the data manager are stored. 13.09.2021