KVKK

Datura Clinic
Explicit Consent Form Regarding the Transfer of Personal Data Abroad
I have read the ‘Information Text Regarding the Processing of Personal Data of Patients of Dr.
Datura Health ’ shared with me. In this context, I authorize the transfer of my personal
data (identity, contact, customer transaction, professional experience, financial, visual and
auditory recordings, health categories) to be processed during the treatment process due to the
servers of applications we use in our communication processes (all social media platforms,
instant messaging applications) or the suppliers providing product and service support in the
field of information technologies (calendar application, email server service) being located
abroad by Datura Health.
Name surname :
Date:
Signature:
Datura Health
Public Disclosure Consent Form
I have read the ‘Information Text Regarding the Processing of Personal Data of Patients of Dr.
Datura’ shared with me. In this context, I authorize the processing of my personal
data (full name, profession, before and after operation photos, videos, interviews conducted
with me, photos and videos taken by me during the recovery process, and my health data
including the name and scope of the applied treatment, date) by Dr. Görkem Atsal for the
purpose of being published publicly on social media platforms and the website as part of the
business’s advertising and marketing activities, being shown to other prospective patients in
disclosure and persuasion processes, being used for medical, educational, and informative
purposes. I also consent to the sharing of my personal data with contracted suppliers for the
purpose of being published publicly on social media platforms and the website, and being
shown to other prospective patients in disclosure and persuasion processes, as well as with
prospective patients receiving appointment services and individuals participating in relevant
events for medical and educational purposes, such as medical meetings, scientific studies, and
presentations.
Due to the use of the above-mentioned personal data, I will not request any fee from Dr. Görkem
Atsal.
Name surname :
Date:
Signature:
Information Text Regarding the Processing of Personal Data of Patients
Dear patient,
As the “Data Controller” within the scope of the practices regarding the processing of
personal data and the Law No. 6698 on the Protection of Personal Data (“Law”), we would
like to inform you about the personal data processed by Dr. Görkem Atsal.
This text includes the information about the personal data that may be processed during and
after your benefit from the services (“Services”) provided by our clinic.
1.Purposes of Processing Your Personal Data and Which Personal Data We Process
Organization processes: In order to create the necessary organization for the Service and
operation, to open necessary records and appointments in our systems, and to use these
records when necessary, your identity (name, surname, ID number), customer transaction
information (details of the medical interventions planned to be applied to the patient
(application date, fee)) will be processed.
Health data: Your health data (medical history (past illnesses, responses to questions about
medical history, medications used, information about medical interventions planned to be
applied to the patient, and other health reports that may be requested by the physician
depending on the condition), tests, and compliance letters that may be obtained from other
physicians) will be processed in order to determine whether there are any legal/medical
obstacles for the operation and to take additional precautions specific to your current health
condition, if necessary, before of the service/medical procedure that is going to be applied to
you.
Partner organization: Your identity (name, surname, passport number/ID number), customer
transaction (operation date and time), and health information (name and detail of the
operation to be applied) will be processed in order to create the necessary operation
appointment in the contracted partner hospital where the operation will be applied and to
open records.
Protocol book: Your identity (name, surname, ID number/passport number, age, gender),
contact (address), and health information (diagnosis, decision, thoughts) will be processed in
order to record the information regarding the health service provided according to legal
obligations in the protocol book kept at the clinic.
Accounting Processes: Your identity (name, surname, ID number, passport number if you are
from a foreign country, contact (address), finance (bank account information), and customer
transaction information (service fee, service content, invoice information, tax office, invoice
number) will be processed for the execution of collection and accounting processes after the
service sale, recording of these transactions in our systems, invoice issuance, payment to you
if necessary, and tracking of payments.
If you make a relevant individual application to us, your
identity (name, surname, if the application is in writing,
signature), contact information (email address, phone
number, fax number), and customer transaction information
(subject of the request) will be processed in order to respond
to the application in accordance with the Law.

2. To Whom and for What Purposes We May Transfer Your Personal Data?
   We may transfer your personal data to the following persons:
   Suppliers/Business Partners: (i) For the purpose of obtaining services such as IT or
   specialized consultancy support, we may transfer data to service providers in relevant fields
   (suppliers providing maintenance/support/development services, banks and payment
   institutions, legal and financial/accounting consultancy service providers, lawyers, certified
   public accountants, e-invoice service providers, contracted social media agencies, contracted
   Health Tourism Intermediary Institutions and Authorized Agencies), and we may transfer data
   to hospitals that are contracted business partners for the provision of medical services.
   Public Institutions and Organizations: In order to fulfill our obligations to provide
   information and documents to authorized public institutions and organizations and to exercise
   our legal rights such as the right to litigation and response, we may transfer the requested
   information to such institutions, organizations, and authorities.
   Public Disclosures: Additionally, with your permission (explicit consent), we may transfer
   your identity (name, surname), professional experience (occupation), visual and auditory
   recordings (pre- and post-operation photos, videos, interviews conducted with you), and health
   data (name and scope of the treatment applied, date) for the purpose of being published publicly
   on social media platforms and our website as part of our clinic’s advertising and marketing
   activities, being shown to other prospective patients in disclosure and persuasion processes, and
   being used for medical and educational purposes in medical meetings, scientific studies, and
   presentations.
   International Transfer: Additionally, with your permission (explicit consent), due to the
   servers of applications we use in our communication processes (social media platforms, instant
   messaging programs) or suppliers providing product and service support in the field of
   information technologies (calendar application, email server service) being located abroad, we
   may transfer your personal data (identity, contact, customer transaction, professional
   experience, financial, visual and auditory recordings, health categories) to abroad for the
   processing of your treatment process.
   Signature
   3.What is the method and legal reason for collecting your personal data?
   Your personal data will be collected through various methods, both automated and physical, at
   our clinic. These methods include the recording of information obtained through our
   communication channels (telephone, email, correspondence via social media accounts, instant
   messaging applications), financial information related to payments obtained through banks,
   digital sharing made by official institutions and organizations (such as UYAP, court files, legal
   notices), and the taking of pre- and post-operation photos by us and/or shared with us through
   our communication channels by you. Additionally, with your explicit consent, interviews
   conducted with you will be recorded, and digital records related to information obligations and
   explicit consents will be stored in our systems. Non-automated methods include the recording
   of notes about you by the physician in the clinic’s records, entering necessary records into the
   protocol book, signing informed consent forms and other documents, physical sharing made by
   official institutions and organizations (such as court files, legal notices), sharing documents
   with us via courier, and obtaining written records related to information obligations and explicit
   consents.
   Your personal data:
   For organization processes, related to partner organization, based on the legal basis of “the
   necessity of processing personal data for the performance of a contract to which the data subject
   is party or in order to take steps at the request of the data subject prior to entering into a contract”
   and “the processing is necessary for the purposes of the legitimate interests pursued by the
   controller or by a third party, except where such interests are overridden by the interests or
   fundamental rights and freedoms of the data subject.”

• For health data processes and other processes involving health data as outlined in this
  document, based on the legal basis of “the processing is necessary for the purposes of the
  legitimate interests pursued by the controller or by a third party, except where such interests are
  overridden by the interests or fundamental rights and freedoms of the data subject,” and your
  health data in this context is processed under the legal basis of “processing is necessary for the
  purposes of preventive or occupational medicine, for the assessment of the working capacity of
  the employee, medical diagnosis, the provision of health or social care or treatment or the
  management of health or social care systems and services on the basis of Union or Member
  State law or pursuant to contract with a health professional and subject to the conditions and
  safeguards.”
• For accounting processes, and tracking/request/complaint processes, based on the legal basis
  of “the necessity of processing personal data for the performance of a contract to which the data
  subject is party or in order to take steps at the request of the data subject prior to entering into
  a contract,” “the processing is necessary for the purposes of the legitimate interests pursued by
  the controller or by a third party, except where such interests are overridden by the interests or
  Signature
  fundamental rights and freedoms of the data subject,” and
  “the processing is necessary for compliance with a legal
  obligation to which the controller is subject.
• For Appointment Control processes, based on the legal basis of “the processing is necessary
  for the purposes of the legitimate interests pursued by the controller or by a third party, except
  where such interests are overridden by the interests or fundamental rights and freedoms of
  the data subject.”
• For Protocol Book processes, based on the legal basis of “the processing is necessary for
  compliance with a legal obligation to which the controller is subject.”
• For Legal Processes and Internal Activities, based on the legal basis of “the processing is
  necessary for compliance with a legal obligation to which the controller is subject,” “the
  processing is necessary for the purposes of the legitimate interests pursued by the controller
  or by a third party, except where such interests are overridden by the interests or fundamental
  rights and freedoms of the data subject,” “it is expressly provided for by law,” and “processing
  is necessary for the establishment, exercise, or defense of legal claims.
  Furthermore, your personal data related to public disclosures will be processed based on your
  “explicit consent.” You can withdraw your consent at any time without stating any reason,
  thereby terminating the processing activities based on explicit consent.
  4.What are your rights?
  You can always apply to us regarding your personal data processed by us in accordance with
  the rights specified in Article 11 of the Law. You can submit your applications by sending a
  written application to Datura health as the Data Controller at the following address or by
  sending an email from your registered email address in our system. (We would like to remind
  you that the relevant request must comply with the conditions specified in the Regulation on
  the Principles and Procedures for Application to the Data Controller.)
  Address: ZIYA GÖKALP MAH. SÜLEYMAN DEMIREL BUL. THE OFFICE NO: 7E IÇ KAPI NO: 136 BASAKSEHIR / ISTANBUL
  Email: info@daturaclinic.com
  I read the clarification text. (Please write in your handwriting)
  Name surname:
  Date:
  Signature:
  İmza

At datura Health Tourism, we are committed to protecting the privacy and security of your personal information. This Privacy Policy outlines how we collect, use, and safeguard your data when you visit our website or engage with our services.

In compliance with the Personal Data Protection Law No. 6698 (“KVKK”), our Company, acting as the Data Controller, processes your personal data for various business purposes as outlined below. We uphold the highest standards of security and privacy to safeguard your data against unlawful processing, unauthorized access, and ensure its integrity.

This statement is addressed to all individuals, excluding our Company’s employees or job applicants, whose personal data is processed by us.

Personal data processed by us as the data controller includes, but is not limited to:

– Name, surname, TR ID number, address, telephone number, email address, signature
– Physical location/security video recording, call center/service quality voice recording
– Bank account number, cookie records

Purposes and legal reasons for processing personal data:
Your personal data, provided by you, is processed for the following purposes:

– Implementing our Company’s commercial and business strategies, conducting marketing activities, and business development.
– Managing administrative operations related to communication conducted by our company.
– Ensuring physical security and control of company locations.
– Establishing relationships with business partners/customers/suppliers (officials or employees).
– Fulfilling contractual requirements and financial reconciliation with business partners, suppliers, or other third parties.
– Execution of human resources policies.
– Participation in training, seminars, or events organized by our company.

Method of collection and storage of personal data:
Your personal data may be collected verbally, in writing, or electronically, through various channels such as offices, branches, call centers, websites, social media channels, and mobile applications. We ensure your data is stored securely in electronic and/or physical media to prevent unauthorized access, manipulation, loss, or damage.

Your personal data is processed and stored during the legal retention period or as required by the processing purpose. Upon expiration, your data is removed from our Company’s systems through deletion, destruction, or anonymization methods.

Transfer of Personal Data:
Your personal data may be transferred to:

– Türk Telekomünikasyon A.Ş. and Turkish Telecommunication group companies.
– Authorized companies operating on behalf of our Company.
– Regulatory and supervisory authorities, public institutions, or organizations as mandated by law.
– Business partners, supplier and contractor companies, banks, credit risk and financial institutions, and other relevant entities.
– Tax consultants, legal entities, auditors, and other third parties domestically and abroad.

Your Rights under KVKK Article 11:
You have the right to:

– Know whether your personal data is processed and request information about its processing.
– Object to automated decision-making.
– Seek compensation for damages resulting from unlawful processing.
– Exercise your rights by submitting a written request to our Company or as determined by the Personal Data Protection Board.

To exercise your rights, you can personally deliver your request with necessary identification information, send it via a notary, or use other methods specified by the Personal Data Protection Board.