Clarification Text

NFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

This information notice has been prepared in order to inform data subjects about the procedures and principles regarding the processing of Personal Data of patients/clients who apply to the clinic operated under the ownership of Prof. Dr. Arda LEMBET, pursuant to the Law No. 6698 on the Protection of Personal Data (“KVKK”) in Turkish law and the European Union General Data Protection Regulation (“GDPR”).

Ensuring the security of the Personal Data of patients/clients is one of the primary objectives of Prof. Dr. Arda LEMBET. For this reason, in order to ensure the secure processing of patients’/clients’ Personal Data and to prevent any unlawful access or data leakage, all necessary security measures are taken by Prof. Dr. Arda LEMBET in compliance with the applicable legislation.

Data Controller

Your Personal Data will be processed by Prof. Dr. Arda LEMBET, operating at the address “Bağdat Caddesi 225 Palmiye İş Merkezi 3. Kat 34730 Göztepe/Kadıköy/İstanbul”, within the scope of Law No. 6698. Prof. Dr. Arda LEMBET is deemed a “Data Controller” under KVKK and a “Data Controller” under the GDPR.

Within the scope of the GDPR, Prof. Dr. Arda LEMBET has concluded an agreement with a law firm that has expertise in Personal Data Protection as “Data Protection Officer”, and the compliance process regarding the Protection of Personal Data within the clinic under KVKK and GDPR has been carried out under the consultancy and guidance of this specialized law firm, while the responsibility for implementation remains with the Data Controller.

Personal Data to be Processed

Your Personal Data listed below will be processed by Prof. Dr. Arda LEMBET in accordance with the fundamental principles set out in Article 4 of KVKK and Article 5 of GDPR, within the scope of the Personal Data Processing Conditions and Purposes set forth in Articles 5 and 6 of KVKK and Articles 6 and 9 of GDPR, and for the purposes specified in this Information Notice; lawfully, in connection with the purpose of processing, limited and proportionate, in accordance with the principles of fairness and transparency, accurately and up to date, and by taking all technical and administrative measures stipulated in the legislation to ensure data security:

Identity Information:
Your name, surname, Turkish ID Number and/or Passport Number and/or Temporary Turkish ID Number, identity details, passport details, place and date of birth, marital status, gender, profession, your signature and other identity data that can identify you.

Contact Information:

Your address (residential/workplace), your telephone numbers (home/work landline and/or mobile numbers you have provided), e-mail address, IP address, social media accounts and other contact data.

Health Information:

Your blood type, laboratory and imaging results, test results, allergies, chronic diseases, venereal diseases, infectious diseases, information on surgeries/operations you have undergone, medications you regularly use, information relating to Covid-19, your medical treatments, prescription information, skin analysis data, body measurement/analysis data, harmful habits detrimental to health and other health data necessary for the treatments and procedures to be applied to you.

Photograph, Video and Audio Data:

Your image and audio data contained in photographs and/or videos recorded before, during and/or after the medical procedure, as well as your image and sound recordings captured by security cameras with closed-circuit recording used for workplace security.

Financial Information:

Your bank account number, IBAN number, credit card details, billing and invoice information and other financial data.

Transfer and Accommodation Information:

If you are a health tourist coming within the scope of International Health Tourism, your transfer information, round-trip flight details, hotel accommodation information.

Purposes of Processing Your Personal Data

Your Personal Data are processed by Prof. Dr. Arda LEMBET in compliance with KVKK and GDPR for the following purposes:

To create a patient file
To carry out your examination, medical diagnosis, treatment and care services
To perform your follow-up examinations after medical diagnosis and treatment processes
To manage possible complication processes
To communicate with you directly
To manage appointment processes
To carry out patient satisfaction and request management
To fulfil legal and contractual obligations
To retain health data that must be stored pursuant to the relevant legislation for the periods stipulated
To obtain consultation services from other relevant specialist physicians when necessary in order to ensure that your treatment is carried out correctly
To fulfil legal obligations under the legislation on health tourism
To plan transfer, accommodation and interpretation services for patients/clients coming within the scope of health tourism
To announce innovations concerning medical treatments and procedures
To inform third parties from a medical perspective about the medical procedures performed
To plan and manage health services and their financing
To ensure workplace security
To fulfil the obligations arising from the legal relationship established between doctor and patient
To fulfil financial and administrative obligations
To ensure technical and commercial security
To fulfil public obligations

Your Personal Data will be processed by Prof. Dr. Arda LEMBET under KVKK and GDPR in the following situations and conditions:

Identity Data:

Will be processed in order to carry out examination, preventive medicine, medical diagnosis, treatment and care services, to create a patient file, to carry out patient satisfaction and request management, and to plan transfer, accommodation and interpretation services for patients/clients coming within the scope of Health Tourism.

Contact Data:

Will be processed in order to perform follow-up examinations after medical diagnosis and treatment processes and to manage appointment processes; and, subject to your explicit consent, may also be processed to introduce, inform and announce innovations regarding medical treatments and procedures and to send greetings and congratulations on special occasions.

Health Data:

Will be processed in order to successfully carry out your medical treatments and medical aesthetic procedures, to obtain consultations from another specialist physician where deemed necessary during your treatment process, to create a patient file, to retain information relating to health data that must be stored within the period required by the relevant legislation, and to fulfil legal obligations under the applicable Health Law and Health Tourism legislation.

Photograph, Video and Audio Recording Data:

Will be processed by Prof. Dr. Arda LEMBET to monitor and manage the treatment process and to ensure workplace security and, subject to your explicit consent, may also be processed to inform third parties about the medical procedures carried out and for medical promotional purposes.

Financial Data:

Will be processed to control your payments, issue invoices and, where there is any overpayment, to refund such amount.

Transfer and Accommodation Data:

Will be processed in order to plan transfer and accommodation services for patients/clients coming within the scope of health tourism.

Your above-mentioned Personal Data will be processed in accordance with the purposes and legislation specified above, in order to perform your medical treatment and fulfil the related obligations. If you fail to provide the relevant Personal Data, Prof. Dr. Arda LEMBET, who will provide medical services in your treatment process, will not be able to duly fulfil his legal obligations, and your treatment and/or recovery processes may not be successfully carried out.

Method of Collection of Personal Data

Depending on the healthcare service provided by Prof. Dr. Arda LEMBET, your Personal Data are collected:

By visiting Prof. Dr. Arda LEMBET for examination and treatment and submitting your health reports, laboratory and imaging results, tests, medical reports and statements regarding your health data in order to carry out a medical evaluation relating to the treatment to be applied to you,
By filling in the “Patient Information and Consent Form” relating to the treatment to be applied by Prof. Dr. Arda LEMBET,
By visiting the corporate website of Prof. Dr. Arda LEMBET (https://drardalembet.com) and via the contact form you fill out on this website,
By the e-mails you send to the corporate e-mail address of Prof. Dr. Arda LEMBET (info@drardalembet.com),
By photographs/video recordings taken before, after and/or during the medical procedures applied by Prof. Dr. Arda LEMBET,
Upon your request and where necessary, for the purpose of remote diagnosis and follow-up by Prof. Dr. Arda LEMBET through online access, via written/audio/visual (photograph and/or video recording) messages you send and audio/visual calls you make using remote connection application providers (WhatsApp/zoom.us/FaceTime/Skype/Messenger/Google/Instagram/Facebook etc.) whose Privacy Policies and Cross-Border Transfer Principles you have accepted,
Via direct messages or comments you send to the profile accounts of Prof. Dr. Arda LEMBET on social media platforms (Instagram, YouTube, Facebook, Twitter, LinkedIn, etc.) whose Privacy Policies and Cross-Border Transfer Principles you have accepted and whose servers are located abroad,
Via the information you have permitted to be automatically processed and transferred by giving consent through “contact us” or “get information” panels in advertisements and promotions of Prof. Dr. Arda LEMBET published on social media platforms (Instagram, YouTube, Facebook, Twitter, LinkedIn, Google, etc.) whose Privacy Policies and Cross-Border Transfer Principles you have accepted and whose servers are located abroad,
Through log-record devices (firewalls) used within the scope of technical measures required by the legislation, in case you wish to join the existing wireless internet network (Wi-Fi) of Prof. Dr. Arda LEMBET as a guest user,
Via security cameras with audio recording feature used under legitimate interest in order to ensure workplace security, which continuously record on a closed-circuit basis within the premises of Prof. Dr. Arda LEMBET,

and will be processed under KVKK and GDPR throughout examination, medical diagnosis, treatment and care services, in order to fully and properly fulfil the contractual and legal obligations of Prof. Dr. Arda LEMBET.

Purpose, Method and Legal Basis for Processing Personal Data

Your Personal Data may be processed:

By real or legal persons authorized by Prof. Dr. Arda LEMBET as “Data Processor”,
Orally, in writing, and by means of camera and photographic recordings,
By keeping records in physical and electronic media with the necessary technical and administrative security measures,

and, where required under the relevant provisions of KVKK and GDPR, with your explicit consent.

Situations Where Your Explicit Consent is Required

Pursuant to Article 6(1)(a) GDPR and Article 5(1) KVKK, your Personal Data may only be processed with your explicit consent in the following cases:

Sending you SMS messages and/or e-mails and contacting you via mobile communication in order to promote, announce and inform you of innovations related to the medical services provided by Prof. Dr. Arda LEMBET shall only be possible with your explicit consent.
Sharing your photograph and/or video recordings taken before, during and/or after the medical procedure for monitoring the development of the treatment on the social media accounts (Instagram, YouTube, Facebook, Twitter, LinkedIn, etc.) and corporate websites of Prof. Dr. Arda LEMBET shall only be possible with your explicit consent.
Since sharing your data through service providers whose servers are located abroad is considered as “transfer abroad” and “explicit consent” is required for transfer abroad, your explicit consent shall be obtained in such cases.

Cases Where No Cross-Border Transfer is Deemed to be Made by Prof. Dr. Arda LEMBET and Thus Your Explicit Consent Will Not Be Sought by Him (Your Consent is Deemed to Have Been Obtained by the Service Provider)

In the following cases, no cross-border transfer is deemed to be made by Prof. Dr. Arda LEMBET and therefore your explicit consent will not be sought by him, as your explicit consent is deemed to have been obtained by the relevant service provider:

When you send written/audio messages and/or photographs/video recordings to Prof. Dr. Arda LEMBET or make audio/visual calls using service providers (WhatsApp/zoom.us/FaceTime/Skype/Messenger/Google/Instagram/Facebook, etc.) whose Privacy Agreements and Cross-Border Transfer Principles you have accepted and whose servers are located abroad, or when you request remote examination/diagnosis services by being contacted through such channels; by accepting the policies of these applications and sharing your Personal Data and Special Category Personal Data through such applications with Prof. Dr. Arda LEMBET, you are deemed to have accepted that your data will be processed by Prof. Dr. Arda LEMBET in accordance with the PDPL Information Notice and Privacy Principles provided to you via the application belonging to Prof. Dr. Arda LEMBET and to have given explicit consent to the relevant service provider for the transfer of your data abroad pursuant to the policies of these applications whose servers are located abroad.
Where you request communication via electronic mail service providers (Hotmail, Gmail, Yahoo, etc.) whose servers are located abroad and whose Privacy Policies and Cross-Border Transfer Principles you have accepted; you are deemed to have accepted that Prof. Dr. Arda LEMBET will process your Personal Data and Special Category Personal Data shared in such communications in accordance with his PDPL Information Notice and Privacy Principles and, pursuant to the policies of such service providers whose servers are located abroad, to have given explicit consent to your e-mail service provider for the transfer of your data abroad.
Where you apply to advertisements and promotions of Prof. Dr. Arda LEMBET published on social media service providers (Facebook, Instagram, Google, WhatsApp, etc.) whose servers are located abroad and whose Privacy and Cross-Border Transfer Principles you have accepted; your data, which you have permitted to be automatically processed and transferred abroad, will be transferred by the relevant social media service provider to Prof. Dr. Arda LEMBET and will be processed and retained by Prof. Dr. Arda LEMBET in accordance with this Information Notice and Privacy Principles you are currently reading. In such cases, you are deemed to have accepted this Information Notice and Privacy Principles of Prof. Dr. Arda LEMBET and the processing of your Personal Data and Special Category Personal Data accordingly.
Where you send a direct message to the profile account of Prof. Dr. Arda LEMBET on social media accounts (Instagram, YouTube, Facebook, Twitter, LinkedIn, etc.) whose Privacy Policies and Cross-Border Transfer Principles you have accepted and whose servers are located abroad; you are deemed to have accepted that Prof. Dr. Arda LEMBET will process your data in accordance with his PDPL Information Notice and Privacy Principles.

Situations Where Your Data May Be Processed Without Explicit Consent

Pursuant to Article 9(2)(h) GDPR and Article 6(3) KVKK:

Your Health Data, which is considered Special Category Personal Data, will be processed by Prof. Dr. Arda LEMBET, who is under a legal obligation of confidentiality, without seeking your explicit consent, for the purpose of carrying out examination, medical diagnosis, treatment and care services.

Pursuant to Article 6(1)(b) GDPR and Article 5(2)(c) KVKK:

Your Personal Data will be processed without your explicit consent by Prof. Dr. Arda LEMBET in order to carry out your post-treatment follow-up examinations, to communicate with you directly and to manage appointment processes.

Pursuant to Article 6(1)(f) GDPR and Article 5(2)(f) KVKK based on our legitimate interests:

Your Personal Data will be processed without your explicit consent by Prof. Dr. Arda LEMBET in order to carry out patient satisfaction and request management.

Pursuant to Article 6(1)(c) GDPR, Article 5(2)(a) KVKK and Article 5(2)(ç) KVKK, based on legal obligations, your Personal Data will be processed without your explicit consent for the following purposes:

Creation of patient files
Retention of information relating to health data that must be stored pursuant to the relevant legislation
Control of your payments and issuance of invoices
Fulfilment of tax payment obligations
Fulfilment of obligations under the legislation of the Ministry of Health
Fulfilment of obligations under Health Tourism legislation
Ensuring your data security
Fulfilment of legal obligations before judicial authorities
Fulfilment of administrative obligations before administrative authorities and institutions

Transfer of Your Personal Data and Recipients

Your Personal Data collected in line with the Personal Data Processing Conditions set out in Articles 5 and 6 of KVKK and Articles 6 and 9 of GDPR may be transferred by Prof. Dr. Arda LEMBET, in accordance with Articles 8 and 9 of KVKK and Articles 45 and 49 of GDPR, to the following third parties for the purposes of carrying out and improving examination, medical diagnosis, treatment and care services, obtaining consultation services from other specialist physicians when necessary, fulfilling administrative obligations under health tourism legislation, planning transfer, accommodation and interpretation services for patients coming within the scope of health tourism, communicating with patients, managing follow-up appointment processes, planning and managing health services and their financing, fulfilling the responsibilities arising from the legal relationship established between doctor and patient, fulfilling financial, legal and administrative obligations, ensuring technical and commercial security, fulfilling public obligations and promoting the medical services provided; to the extent necessary to achieve these purposes, and by signing necessary confidentiality agreements and taking all administrative and technical security measures required by the legislation:

In this context, your Personal Data processed by Prof. Dr. Arda LEMBET may be transferred to:

Other specialist physicians for consultation purposes
His insured employees
Suppliers
Certified public accountants, tax and financial advisors and auditors
Legal Counsel
Database (server) providers
“Clinic Management Software Program” service providers
Web consultants
Interpreters
Data Protection Officer
IT consultants
Travel agencies
Public institutions and organizations authorized by law
Judicial authorities

Personal Data Retention Period

Your Personal Data will be retained by Prof. Dr. Arda LEMBET to the extent and for the duration required by statutory retention obligations. Documentation and retention obligations arise from local norms relating to commercial, tax and health legislation. The retention periods of your Personal Data are set out in the table below:

Your Personal Data	Retention Period
Identity Information	20 years after the termination of the service provided to the Data Subject
Contact Information	20 years after the termination of the service provided to the Data Subject
Health Information	20 years after the termination of the service provided to the Data Subject
Photograph and Video Information	20 years after the termination of the service provided to the Data Subject
Financial Information	5 years after the termination of the service provided to the Data Subject

Age Limit of Data Subjects under the Legislation

Under KVKK, patients/clients may personally give consent to the processing of their personal data provided that they are at least 18 years of age. For patients/clients below this age, consent must be given by their legal representatives.

Under the GDPR, patients/clients who are citizens of European Union countries or residents in European Union countries may personally give consent to the processing of their personal data provided that they are at least 16 years of age or have reached the age limit required in their country. For patients/clients below this age, consent must be given by their legal representatives.

Withdrawal of Consent

If you give consent to Prof. Dr. Arda LEMBET for the processing of your Personal Data, we hereby inform you that you may withdraw your consent at any time for the purposes stated above, pursuant to Article 6(1)(a) GDPR and Article 5(1) KVKK. Once you send your declaration of withdrawal of consent to our contact address indicated below in the manner described, your consent will be withdrawn.

Rights of Data Subjects under the GDPR

Your Personal Data are also protected under the GDPR. Where the GDPR is applicable (for citizens of the European Union or residents in European Union countries), the rights of Data Subjects are as follows:

Right of Access (Article 15 GDPR):
The Data Subject has the right to verify whether personal data concerning him/her are being processed by applying to Prof. Dr. Arda LEMBET and, where such processing is taking place, to obtain the details set out in Article 15 GDPR.

Right to Rectification (Article 16 GDPR):
The Data Subject has the right to request at any time that Prof. Dr. Arda LEMBET rectifies personal data concerning him/her that are inaccurate or updates data that have changed.

Right to Erasure (Article 17 GDPR):
The Data Subject has the right to request the erasure of personal data held by Prof. Dr. Arda LEMBET. If the conditions set out in Article 17 GDPR are fulfilled, your personal data will be erased by Prof. Dr. Arda LEMBET without undue delay.

Right to Restriction of Processing (Article 18 GDPR):

Data Subjects have the right to request the restriction of the use of their data in the following situations:

Where they contest the accuracy of their Personal Data, until the accuracy of the Personal Data is verified by Prof. Dr. Arda LEMBET;
Where they request the erasure of their Personal Data due to unlawful processing, until their request is fulfilled;
Where Prof. Dr. Arda LEMBET no longer needs the Personal Data for the purposes of the processing, but the Data Subject requires the data for the establishment, exercise or defence of legal claims;
Where they object to processing pursuant to Article 21(1) GDPR, until it is verified whether the legitimate grounds of Prof. Dr. Arda LEMBET override those of the Data Subject.

Right to Data Portability (Article 20 GDPR):
The Data Subject has the right, where technically feasible, to request at any time that Personal Data concerning him/her, held by Prof. Dr. Arda LEMBET, be transmitted to another controller. This right may be exercised where processing is based on consent or on a contract.

Right to Object (Article 21 GDPR):

The Data Subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of Personal Data concerning him/her, including profiling, where processing is based on Article 6(1)(e) or (f) GDPR. In such a case, Prof. Dr. Arda LEMBET shall no longer process the Personal Data unless he demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of legal claims.
The Data Subject has the right to object at any time to the processing of Personal Data concerning him/her for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.
Where the Data Subject objects to processing for direct marketing purposes, the Personal Data shall no longer be processed for such purposes.

Rights of Data Subjects under the KVKK

The rights of natural persons whose Personal Data are processed under Article 11 KVKK are as follows:

To learn whether their personal data are being processed,
To request information if their personal data have been processed,
To learn the purpose of processing personal data and whether they are used in line with such purposes,
To know the third parties to whom personal data are transferred, whether within the country or abroad,
To request correction of personal data in case they are incomplete or inaccurate and to request notification of such correction to third parties to whom the personal data have been transferred,
To request the deletion or destruction of personal data in the event that the reasons requiring their processing cease to exist, despite having been processed in accordance with KVKK and other relevant legislation, and to request notification of such deletion or destruction to third parties to whom the personal data have been transferred,
To object to the occurrence of a result against the person himself/herself by means of analysis of processed data exclusively through automated systems,
To demand compensation for damages arising from the unlawful processing of personal data.

If you wish to exercise any of your rights listed above, or if you have any requests, you may submit your written application, clearly and understandably stating which rights under the GDPR and/or which rights under Article 11 of KVKK you wish to exercise, together with documents proving your identity, with your wet signature:

In person to the branch address “Bağdat Caddesi 225 Palmiye İş Merkezi 3. Kat 34730 Göztepe/Kadıköy/İstanbul” which is also indicated on the corporate websites of Prof. Dr. Arda LEMBET, or
By sending it via notary public, or
By signing it with a secure electronic signature and sending it to the e-mail address info@drardalembet.com,

or by using other methods stipulated in KVKK.

Pursuant to the “Communiqué on the Procedures and Principles of Application to the Data Controller”, it is mandatory that your applications contain your name and surname, signature, Turkish ID Number/Passport Number/Temporary Turkish ID Number, residential or workplace address, e-mail address, telephone and fax number, and the subject of your request.

Prof. Dr. Arda LEMBET will finalize your request free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. However, if responding to the request incurs an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

Consent and Acknowledgement

By reading and accepting this Information Notice, you are deemed to have fully and completely understood the data processing activities carried out by Prof. Dr. Arda LEMBET, to have learned your rights stipulated under KVKK and GDPR, and to have freely and willingly given your consent to the processing of your Personal Data and Special Category Personal Data by Prof. Dr. Arda LEMBET within the scope of this Information Notice.

You have the right not to accept this Information Notice after reading it.

Prof. Dr. Arda LEMBET hereby notifies you that he acts in the capacity of “DATA CONTROLLER” under KVKK and “CONTROLLER” under GDPR.

Kind regards.