Protection, Storage and Disposal Policy of Personal Data

INTRODUCTION

Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. (Private B.D.İ. Oral and Dental Health Polyclinic), all kinds of personal data belonging to you, our esteemed patients and their relatives, our employees and all third parties related to us, to whom we provide health services in connection with our activities and service purposes, are subject to the Law on Protection of Personal Data No. 6698 ( We attach importance to its processing and storage in accordance with KVKK).

With this “Personal Data Protection, Storage and Disposal Policy” (Policy), Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. The basic principles are determined by determining the methods and responsibilities regarding the deletion, destruction and anonymization of personal data in the required time for the purposes of processing.

PURPOSE

The purpose of this policy is Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. To make explanations on the systems adopted for the protection of personal data and the personal data processing activities carried out in accordance with the Law on the Protection of Personal Data No. 6698, dated March 24, 2016, published in the Official Gazette dated April 7, 2016 and numbered 29677, , to ensure the regulation and supervision of processes that require personal data processing within the organization, to develop the awareness of the legal processing of personal data in the units involved in the processing of personal data and to establish a sense of responsibility in this context, about our personal data processing processes, our employee candidates, officials, visitors, cooperation To provide transparency about our data processing processes by informing the employees, shareholders and officials of the institutions we are in, as well as the third parties, whose personal data are processed by Best Dental Istanbul.

CONTENT

This policy, within the scope of the activities carried out by Best Dental Istanbul, is valid for our employee candidates, our website and social media account users, our employees, former employees, officials, visitors, participants, employees, shareholders and officials of various institutions/organizations such as the supplier companies we cooperate with. and all personal data of third parties that are subject to automatic or non-automatic processing provided that they are part of any data recording system.

The scope of the matters we have stated in this policy may cover all of these groups, which are counted according to the type of processing activity, as well as some groups, such as employees of the supplier company, wholly or partially.

IMPLEMENTATION OF POLICY AND RELEVANT LEGISLATION

This policy, KVKK, Regulation and Regulation on Data Controllers Registry No. 30286 etc. It has been prepared on the basis of relevant regulations.

DEFINITIONS

The terms used in this policy are used to have the following meanings, and if a different term is used instead of the related term or a different meaning is given to the related term, in the terms defined in the legal legislation or regulatory agency decisions, Best Dental Istanbul may also make a change. Such terms will be considered as amended in the application of this policy from the date the amendment enters into force, without the need to

CATEGORIES OF PERSONAL DATA PROCESSED, CATEGORIES OF RELATED PERSONS, CLASSIFICATION OF DATA ACCORDING TO THE DATA SUBJECT PERSON GROUP AND RECIPIENT GROUPS TO WHICH IT IS TRANSFERRED

Personal Data Categories

Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. Within the scope of the personal data processing activities carried out by the Company, the categories and explanations of the personal data processed are as follows:

Contact Categories

Within the scope of this Policy, explanations about our patients, platform users, employees, employee candidates and third parties (suppliers and authorized or employees of institutions with which we have a business relationship) are included.

Classification of Personal Data by Data Subject Group

The following table describes the personal data categories and the relevant person categories by matching:

Recipient Groups to which Personal Data is Transferred

Personal data within the scope of the policy, Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. may be transferred to the recipient groups listed below for the purposes specified.

RECORDING ENVIRONMENTS

Personal data is recorded and stored securely in accordance with the law in the following environments.

Electronic media:

Servers: Central server, data center servers, backup, email, web, file sharing etc.

Software: Office software etc.

Information security devices: Firewall, intrusion detection and prevention, antivirus, etc.

Electronic devices: Network devices, desktop and laptop computers, portable devices (USB, hard disk, memory card, etc.), printers, scanners, copier, mobile devices (Phone, tablet, etc.) and optical discs (CD, etc.).

Physical environments:

Unit cabinets, archive,

Manual data recording systems (forms, notebooks, etc.) are written, printed and visual media.

MATTERS REGARDING THE PROTECTION OF PERSONAL DATA

Best Dental Istanbul Oral and Dental Health Services Ltd. Şti., in accordance with Article 12 of the KVKK, takes the necessary administrative and technical measures to ensure the level of security appropriate for the nature of the data to be protected in order to prevent the illegal processing of personal data and illegal access to the data, and carries out the necessary audits in this context.

Administrative Measures

The main administrative measures taken to prevent unlawful processing of personal data, to prevent unlawful access to data and to ensure data protection are listed below:

Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. Personal data processing activities carried out by the Company were determined and a regularly updated personal data inventory was prepared.

Before starting to process personal data, the obligation to inform the relevant persons is fulfilled.

Responsibilities of employees regarding personal data security have been determined in their job descriptions and it has been ensured that they are aware of their responsibilities in this regard.

In order to improve the quality of the employees, trainings are provided on the protection of personal data, processing in accordance with the law, preventing the illegal processing of personal data and illegal access to the data, communication techniques, technical information skills, information security trainings and the Law No. 657 and other relevant legislation. .

Implementation rules are determined in order to ensure compliance requirements, in-house policies are implemented and audits are carried out in order to ensure the continuity of these issues and practice.

Confidentiality commitments are signed by the employees within the scope of personal data protection legislation and data security regarding the activities carried out.

Service recipients. Provisions have been added to the contracts and documents signed with suppliers and third parties in order to ensure the legal processing, protection and data confidentiality of personal data, the responsibilities of the parties are clearly regulated, and provisions that impose sanctions for data processing activities that are contrary to the law and the contract. In case the processed personal data is obtained by others unlawfully, this situation will be notified to the relevant person and the Board as soon as possible.

Technical Measures

In order to prevent unlawful processing of personal data, illegal access to data and to ensure data protection, measures are taken and updated to the extent technology allows, the main technical measures are listed below:

Risks to prevent the unlawful processing of personal data are determined, appropriate technical measures are taken against these risks, and controls are made for the measures taken.

By establishing access procedures, reporting and analysis studies are carried out regarding access to personal data.

Access to personal data stored in electronic or non-electronic media is restricted and only authorized persons are allowed to access this data limited to the purpose of storing personal data, inappropriate access or access attempts are kept under control.

Access to information systems and authorization of users are done through access and authorization matrix and security policies.

Necessary measures are taken for the physical security of information systems equipment, software and data.

Security tests and research are carried out to detect security vulnerabilities on information systems, and the existing or potential risky issues identified as a result of the tests and investigations are eliminated.

The website served by the practice is encrypted with the SHA 256 Bit RSA algorithm using the HTTPS method.

Strong passwords are used in electronic environments where personal data is processed.

Necessary measures are taken to ensure that the deleted personal data is inaccessible and reusable for the relevant users.

Security vulnerabilities are followed and appropriate security patches are installed and information systems are kept up-to-date.

In order to ensure the security of information systems against environmental threats, hardware (access control system that allows only authorized personnel to enter the system room, fire extinguishing system, air conditioning system, etc.) and software (virus protection programs, firewalls, network access control, systems that prevent malware, etc.). .) precautions are taken.

Some personal data are given special importance by the legislation due to the risks of causing victimization and discrimination when processed unlawfully. In accordance with the decision of the Board, dated 31.01.2018 and numbered 2018/10, regarding the “Adequate Precautions to be Taken by Data Controllers in the Processing of Special Quality Personal Data”; Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. A separate, manageable and sustainable policy has been determined within the practice, with the utmost sensitivity, for the security of sensitive personal data.

Special quality personal data security trainings have been provided for employees involved in special quality personal data processing, confidentiality agreements have been made, and the scope and duration of authorization of users who have access to data are clearly defined.

The security updates of the environments where the data is located are followed, the necessary security tests are carried out and the test results are recorded.

Adequate security measures (against electrical leakage, fire, flood, theft, etc.) of physical environments where sensitive personal data are processed, stored or accessed are taken, and unauthorized entries and exits are prevented by ensuring physical security.

If sensitive personal data needs to be transferred via e-mail, it is transferred in encrypted form with a corporate e-mail address or by using a KEP account. If transferring is carried out between servers in different physical environments, data transfer is carried out via FTP method or online via the plesk control panel. If it is required to be transferred via paper media, necessary precautions are taken against the risks such as theft, loss or viewing of the document by unauthorized persons, and the document is sent in a confidential format.

Measures to be Taken in Case of Unauthorized Disclosure of Personal Data

In case the personal data processed in accordance with Article 12 of the KVKK is obtained by others illegally, this situation will be notified to the relevant personal data owner and the KVK Board as soon as possible. In this context, Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. Following the determination of the persons affected by the data breach, by notifying the Board without delay and within 72 hours at the latest from the date of learning of this situation, the relevant persons can be reached within the shortest reasonable time possible, such as publishing the contact address of the data subject directly, or on the website of the data controller if it cannot be reached. methods will be reported. In data breach notifications, the purpose of notifying the Board and the people affected by the breach is to ensure that measures are taken to prevent or minimize the negative consequences that may arise for these people as a result of the breach.

MATTERS REGARDING THE STORAGE AND DISPOSAL OF PERSONAL DATA

Storage and Disposal of Personal Data

Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. Personal data obtained by us are securely recorded, stored and destroyed in accordance with the relevant legislation, especially the provisions of the KVKK, in different environments depending on the principles such as the nature of the data, the purposes of processing and the frequency of use.

Storage and Disposal Periods of Personal Data

Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. It preserves the personal data it processes within the scope of its activities for the period specified in the relevant legislation or for the period required for the purpose for which it is processed. In this framework, first of all, if it is stated in the relevant legislation how long the personal data should be kept, this period is acted upon. In case of expiration of the period, the request of the data owner or the purpose of processing the data, the personal data shall be transferred to Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. deleted, destroyed or anonymized by Detailed information about the storage periods of the processed personal data is given in Annex 2 of this Policy.

Reasons Requiring Destruction of Personal Data

Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. Personal data processed within the framework of its activities are deleted, destroyed or anonymized upon the request of the person concerned or ex officio, for the following reasons.

Amendment or repeal of the provisions of the relevant legislation, which are the basis for processing,

The disappearance of all purposes that require the processing of personal data and the reasons that require it to be stored,

In cases where the processing of personal data takes place only on the basis of explicit consent, the data owner withdraws his consent,

The request of the data owner to destroy their personal data by using their rights under KVKK and the application made to Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. in the event that the answer is found insufficient or the answer is not given within the time stipulated in the Law; Complaints to the Board and the approval of this request by the Board are the cases where there is no condition to justify keeping the personal data for a longer period, although the maximum period for keeping the personal data has passed.

Legal Disposal of Personal Data

Despite being processed in accordance with the provisions of the law and other relevant laws, in case the purpose that requires the processing and storage of personal data ceases to exist, the personal data shall be transferred to Best Dental Istanbul Oral and Dental Health Services Ltd., ex officio or upon the request of the data owner. Sti. by deletion, destruction or anonymization.

Best Dental Istanbul Oral and Dental Health Services Ltd. Şti. acts in accordance with the above-mentioned technical and administrative measures, relevant legislation provisions, Board decisions and this Policy in deleting, destroying or anonymizing personal data. All transactions made within this scope are recorded and these records are kept for at least three years, excluding other legal obligations.

Unless a contrary decision is taken by the Board, the appropriate method of deletion, destruction or anonymization regarding the destruction of personal data is selected.

For the destruction of personal data, Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. The main technical and administrative measures taken by the company are listed below:

Best Dental Istanbul Oral and Dental Health Services Ltd. Şti. informs and trains its employees on the periodic and proper destruction of personal data.

Personal data destruction process, Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. carried out by.

Best Dental Istanbul Oral and Dental Health Services Ltd. Şti. evaluates and monitors the personal data inventory on the basis of retention and data destruction periods, and conducts audits.

Provisions have been added to the contracts and documents signed with third parties regarding the legal processing of personal data, their storage and elimination of the purpose of processing, the expiration of the storage period or their destruction upon the request of the data owner.

Methods of Disposal of Personal Data

1-Deletion of Personal Data

Deletion of personal data is the process of making personal data inaccessible and non-reusable for relevant users. Best Dental Istanbul Oral and Dental Health Services Ltd. Şti. can use the following methods to delete personal data, depending on the environment in which the data is recorded:

2-Destruction of Personal Data

Destruction of personal data is the process of making personal data inaccessible, unrecoverable and unusable by anyone in any way. Best Dental Istanbul Oral and Dental Health Services Ltd. Şti. can use one or more of the following methods, depending on the environment in which the data is recorded, to delete personal data:

3-Anonymizing Personal Data

Anonymization of personal data means that personal data cannot be associated with an identified or identifiable natural person in any way, even if it is matched with other data. In order for personal data to be anonymized; personal data should not be associated with the data controller, recipient or recipient groups, even by using appropriate techniques for the recording medium and the relevant field of activity, such as returning the data and matching the data with other data. In accordance with Article 28 of KVKK; Anonymized personal data may be processed for purposes such as research, planning and statistics. Since such processing will be outside the scope of KVKK, the explicit consent of the data owner will not be sought and the right to apply will not be valid for this data. Best Dental Istanbul Oral and Dental Health Services Ltd. Şti. may use one or more of the following methods to anonymize personal data:

Removing Variables: After the data collected by the method of extracting descriptive data, one or more of the high-descriptive variables in the data set are removed and the existing data set is anonymized.

Removing Records: By removing a data line containing singularity in the personal data set, the stored data is anonymized.

Aggregation: With the data aggregation method, many data are aggregated and personal data is rendered incapable of being associated with any person. For example, it is revealed that there are 50 service recipients born in 1982 without showing the birth years of the patients one by one.

Data Exchange: The data exchange method is record changes obtained by exchanging values belonging to a subset of variables between pairs selected from the records. In this method, which is used for data that can be categorized in general, the aim is to transform the database by interchanging the data of the data owners.

Titles, Units and Job Descriptions of Persons Involved in Personal Data Storage and Disposal Processes

You can find the titles and job descriptions of the personnel involved in the personal data storage and destruction process from the list in Annex-1 of this Policy.

Periodic Destruction Periods of Personal Data

Best Dental Istanbul Oral and Dental Health Services Ltd. Şti. deletes, destroys or anonymizes personal data in the first periodical destruction process following the date on which the obligation to delete, destroy or anonymize personal data arises.

In accordance with Article 11 of the Regulation, it has determined the period of periodic destruction as 6 months; however, it is accepted that the Board may shorten the periods specified in this article and the destruction period table in case of irreparable or impossible damages and if there is a clear violation of the law. Accordingly, periodic destruction is carried out in June and December each year.

DUTIES REGARDING THE STORAGE AND DISPOSAL OF PERSONAL DATA

Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. attaches importance to ensuring, maintaining, maintaining, managing and developing compliance with the personal data protection legislation.

In this context, the following tasks are fulfilled:

To prepare the basic policies regarding the processing, storage, protection and destruction of personal data, to ensure the implementation of the policies, to coordinate and manage the compliance process with the legislation and the practice policy,

Best Dental Istanbul Oral and Dental Health Services Ltd. Coordinating the communication with the relevant data owners within the scope of the activities carried out by the Company as a data controller,

To carry out the necessary activities and arrangements within the practice in relation to the requests, requests, complaints and notifications of the Board, to organize the processes,

To carry out the necessary activities and arrangements within the practice regarding the requests, requests, complaints and notifications from the relevant persons,

To update the personal data processing inventory and to monitor and report data processing activities and to make necessary updates in Verbis in case of changes,

To organize trainings for the awareness of the employees and to measure the efficiency, To inform the institutions with which it cooperates,

To decide how to carry out the supervision of personal data processing activities and to ensure the necessary coordination in this context,

To determine the risks that may occur in personal data processing activities within the scope of KVKK compliance and to ensure that the necessary measures are taken,

Managing processes and corrective actions regarding data privacy violations,

To follow the board announcements and developments regarding the legislation, to ensure that they are implemented in relevant places and to make necessary notifications.

UPDATES AND CHANGES

Best Dental Istanbul Oral and Dental Health Services Ltd. Sti. This Policy is revised as needed and the necessary sections are updated by the company.

Due to the changes made in the Law, the right to make changes in this Policy and other policies related to this Policy, in accordance with the Board decisions or in line with the developments in the sector or in the field of informatics, are reserved.

Changes made in the Policy are immediately recorded in the text and explanations regarding the changes are explained at the end of the Policy.

PUBLICATION AND STORAGE OF THE POLICY

The policy is published in two different media, with wet signature (printed paper) and electronically, and is disclosed to the public on the website. The printed paper copy is also kept in the file.

ENFORCEMENT AND ANNOUNCEMENT OF THE POLICY

The policy is deemed to have entered into force after its publication on the website. If it is decided to cancel it, old copies of the Policy with wet signatures are canceled and signed and kept for at least 5 years.

Attachments:

Annex-1: Table of Titles, Units and Job Descriptions of Persons Involved in Personal Data Storage and Disposal Processes

Annex-2: Table of Retention and Disposal Periods of Personal Data

Personal data will be kept for the periods specified in the table below, and will be anonymized or destroyed at the end of the period.

If the purpose of the polyclinic to use the relevant personal data has not expired, if the storage period stipulated for the relevant personal data in accordance with the legislation is longer than the periods in the table, or if the time-out period for the case requires the personal location to be kept longer than the periods in the table, the periods in the above table may not be applied. In this case, the purpose of use, special legislation or the statute of limitations for the case, whichever comes to an end, will be applicable for that period.

The above periods start from the date of termination of the employment contract for employees, from the date of termination of the contract for suppliers and service users, or from the date of the last transaction if there is no contract.

Best Dental Istanbul Oral and Dental Health Services Ltd. Sti.