Clarification Text on the Processing of Personal Data of Prospective Patients under Law No. 6698

Dr. Mehmet Sürmeli’s Private Practice

Dear prospective patient,

Within the scope of our practices relating to the processing of your personal data and the Law No. 6698 on the Protection of Personal Data (“Law”), we, Dr. Mehmet Sürmeli’s Private Practice, in our capacity as “Data Controller”, would like to inform you about your personal data that we process.

This text is the clarification text regarding your personal data that will be processed if you contact us through our communication channels in order to benefit from, or obtain information about, the treatments and services that our practice offers to prospective patients (“Services”), speak with our staff, share your requests and needs with us, or if we hold conversations with you.

1. What Are Our Purposes for Processing Your Personal Data and Which of Your Personal Data Do We Process?

Information Gathering and Appointment Scheduling Activities: If you request information about the medical services we offer by contacting us through the various communication channels of our practice in order to benefit from the Services (by calling our practice telephones or through calls we make at your request, by sending us an e-mail, by filling in a form on our website (www.drmehmetsurmeli.com), on health platforms or on other social media platforms, or by contacting us through social media accounts or instant online messaging applications), your identity (name and surname), contact (telephone number, e-mail address, country of residence) and customer transaction (the type of treatment you request, the notes you send us, appointment information) data will be processed in order to identify the Service you need and that is most suitable for you, to carry out the related information and communication processes with you, to prepare an offer for the Services once the necessary information has been obtained and to send it to you, to schedule an appointment, and to record the data we need in the system and access these records so that we can carry out communication activities with you.

Evaluation/Offer Processes: If, according to your preference, you speak with Dr. Mehmet Sürmeli at our practice or through digital channels and convey your requests and preferences, your visual and audio recordings (the photos and videos of the treatment area that you send us), customer transaction information (fee information, name of the procedure, the procedures requested and the prospective patient’s expectations) and health information (medical history, date of birth, gender, past surgeries, past illnesses, answers to the questions asked about your medical history, medications used, number of children, family history of illness/disease, pregnancy, height, weight, allergies, chronic conditions, information on the medical intervention planned for the patient, and other health notes taken by the physician depending on the situation) will be processed in order to determine whether you are suitable for the Service you request and whether there is any legal/medical obstacle, and to determine the fee for the Service.

Legal Processes: Your identity (name and surname, date of birth), contact (telephone number, e-mail address, country of residence) and customer transaction (date, channel, method and scope of the clarification) data will be processed for the purposes of exercising all kinds of lawsuit, reply and objection rights before official institutions and organisations such as courts, enforcement offices, mediation and arbitral tribunals in any disputes that may arise between us, carrying out warning notice processes, carrying out negotiation and settlement processes regarding disputes, and proving, in the event of a possible complaint or investigation, the clarification provided and the explicit consents obtained under the Law.

If you submit a data subject application to us, your identity (name and surname, TR identity number, signature if the application is made in writing), contact (e-mail address, telephone number, fax number) and customer transaction (the services requested and their details) data will be processed so that your application can be answered in accordance with the Law.

2. To Whom and for What Purpose May We Transfer Your Personal Data?

We share your personal data with:

  • Suppliers: service providers from which we receive product and service support in information technologies or in consultancy and similar matters requiring expertise (suppliers of maintenance/repair/development services, suppliers of website server services, providers of legal consultancy services, providers of e-mail server services, health platforms providing form collection services, suppliers of patient tracking and management system services, and suppliers of shared workspace and calendar application services);
  • Public Institutions and Organisations: authorised public institutions and organisations and judicial authorities, with the information they request from us, in order to fulfil our obligations towards them to provide information and documents and our other related obligations, and to exercise our legal rights such as the right to bring a lawsuit and the right of reply.

Transfer of Data Abroad: Because the servers of the suppliers used in the communication, patient management and operational processes carried out within the information technology infrastructure of our practice (e-mail server service providers, patient tracking and management system (CRM) software, shared calendar and data storage applications, and instant messaging platforms) are located abroad, your identity, contact, financial transaction and customer transaction data, your visual/audio recordings relating to patient diagnosis and treatment processes, and your health data are transferred abroad.

3. What Is the Method and Legal Basis for Collecting Your Personal Data?

Your personal data will be collected by automated means, such as obtaining information through our communication channels (telephone, e-mail, correspondence through social media accounts, instant online messaging applications, the website (drmehmetsurmeli.com), health platforms providing form-filling services, form filling through social media) and/or recording the information obtained in our systems, entering your appointment information into our appointment registration system, digital communications from official institutions and organisations (UYAP, case files, warning notices, official notifications, etc.) and recording in our systems the digital records relating to the obligation to inform; or by non-automated means, such as the physician filling in patient information forms if you come to our practice for an examination, physical communications from official institutions and organisations (case files, warning notices, official notifications, etc.) and obtaining written records relating to the obligation to inform.

Your personal data will be processed on the following legal bases:

  • for Information Gathering and Appointment Scheduling activities: “processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract” and “processing of data is necessary for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject”;
  • for Examination/Evaluation processes: “processing of data is necessary for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject”, and, for your health data within this scope, “processing by persons under an obligation of confidentiality for the purpose of carrying out medical diagnosis, treatment and care services”;
  • for Legal Processes: “processing is necessary for the data controller to fulfil its legal obligation”, “processing of data is necessary for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject”, “it is expressly provided for by the laws” and “processing of data is necessary for the establishment, exercise or protection of a right”.

4. How Long Do We Keep Your Personal Data?

Medical records and photographs of patients who have surgery or any procedure with us are kept for at least 10 years, as required by health legislation. Information from people who contact us or complete a pre-evaluation but do not proceed is deleted or anonymised at our next periodic destruction, at the latest six months after the last contact, unless a legal obligation requires longer or you ask us to delete it sooner.

5. What Are Your Rights?

You may apply to us at any time regarding your rights set out in Article 11 of the Law concerning your personal data processed by us. You may submit your applications to Mehmet Sürmeli, as the Data Controller, by a written application to the address below or by sending an e-mail from your e-mail address registered in our system. (We would like to remind you that the relevant request must comply with the conditions set out in the Communiqué on the Procedures and Principles of Application to the Data Controller.)

Address: Harbiye mahallesi Mim Kemal Öke Caddesi, Kristal Apt. No:17 Kat:2, 34367 Nişantaşı Şişli/İstanbul

E-mail: info@drsurmeli.com