Personal Data Processing and Protection Policy

Our principles for processing, retaining, sharing and protecting personal data.

This is an informational translation. If interpretation differs, the Turkish original prevails.

Effective and last updated: 11 September 2026

1. Purpose and Scope

This policy governs how Medicus Clinic Özel Sağlık Hizmetleri ve Tic. Ltd. Şti. processes, stores, shares and protects personal data and special categories of personal data. It has been prepared in accordance with Personal Data Protection Law No. 6698 (KVKK), Basic Health Services Law No. 3359, Decree-Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliates, legislation on private healthcare providers, the Regulation on Personal Health Data and other relevant legislation. It covers all related processes within our clinic.

2. Principles

  • Lawfulness and fairness: data are processed lawfully and fairly, with respect for data subjects’ rights.
  • Specific, clear and legitimate purposes; transparency and limitation: data are collected for predetermined purposes, used only for those purposes, and data subjects are informed.
  • Retention: data are kept for the period required by law or necessary for their purpose, including periods mandated by regulators.
  • Accuracy: data are kept accurate and current; incomplete or incorrect data are corrected, deleted or updated when necessary.
  • Confidentiality and security: technical and organisational measures protect data against unauthorised access, unlawful processing or distribution, loss, alteration and destruction.

3. Collection Methods

Data are obtained via websites and mobile applications, physical premises, and verbal, written, visual or electronic channels.

4. Personal and Special-Category Data Processed

  • Identity: name, surname, Turkish identity or passport number, place and date of birth, sex, marital status, emergency contacts and their details.
  • Contact: telephone, email and address.
  • Financial: bank account and IBAN.
  • Health and sexual life: laboratory and imaging findings, test results, examination and prescription information.
  • Service assessments: responses and comments.
  • Visual and audio: camera and sound recordings.
  • Insurance and social security: private health insurance and Social Security Institution data.
  • Web and mobile usage: IP address, browser details, medical documents, survey and form data, and location.
  • Other: occupation, education, vehicle registration plate and information sent through clinic communication channels.

5. Purposes of Processing

  • Protecting public health; preventive medicine; diagnosis, treatment and care;
  • sharing information with the Ministry of Health and other public bodies as required by law;
  • meeting legal and regulatory obligations;
  • financing healthcare and checking entitlement to services in patient and financial processes;
  • measuring, improving and researching patient satisfaction;
  • sharing data with cooperating educational institutions for training and education;
  • appointment notifications and identity verification;
  • internal planning, management and audit;
  • service development, risk management and quality improvement;
  • employee training and development;
  • marketing, campaigns, promotions and communications;
  • responding to patient-rights matters and complaints;
  • system and data security.

6. Recipients

In accordance with applicable law, data may be shared only to provide services or meet legal obligations with the Ministry of Health and its units, family medicine centres, the Social Security Institution, private insurers and assistance companies, law-enforcement bodies, judicial and administrative authorities, regulators and supervisory bodies, cooperating healthcare providers, laboratories and ambulance services, debt collection advisers and lawyers, authorised suppliers, IT infrastructure and archiving providers, and cooperating domestic or—only with explicit consent where necessary—foreign business partners. Data are transferred with appropriate safeguards and are not otherwise shared with third parties.

7. Data-Subject Rights

Under the KVKK, you may learn whether your data are processed; request information if they are; access and request personal health data; learn the purposes and whether data are used accordingly; learn the recipients; request correction or erasure/destruction; object to an adverse result produced by automated systems; and claim compensation for damage from unlawful processing.

Send requests in writing or through a notary. For further information, see www.medicus.com.tr and Law No. 6698.