1.INTRODUCTION

1.1 Purpose

This Personal Data Retention and Disposal Policy (“Policy”) is applied to the entirety of Prof.Dr.Ahmet Murat BÜLBÜL’s Office (hereinafter referred to as the “Examination”) within the framework of the current legislation and is based on the nationally accepted basic principles regarding personal data destruction. It includes the framework and principles regarding the necessary destruction works within the scope of the relevant legislation.

In the third paragraph of Article 7 of the Law on the Protection of Personal Data (“Law”), there is the provision “The procedures and principles regarding the deletion, destruction or anonymization of personal data are regulated by a regulation”. Pursuant to this provision and subparagraph (e) of the first paragraph of Article 22 of the Law, the Regulation on the Deletion, Destruction or Anonymization of Personal Data (“Regulation”) has been prepared by the Personal Data Protection Board (“Board”) and dated 28 October 2017. It was published in the Official Gazette numbered 30224.

Based on the above regulation, the purpose of this Policy is to determine the procedures and principles regarding the deletion, destruction or anonymization of the personal data processed in the course of the practice in accordance with the Regulation.

1.2.Scope

The personal data of the patients, relatives, employees, employees/authorities of the companies receiving/provided services and suppliers with whom our practice has legal relations are within the scope of this Policy. is applied.

1.3. Abbreviations and Definitions

4. EXPLANATIONS ON STORAGE AND DISPOSAL

   By the practice; Personal data of patients, relatives, employees, company employees/authorities from whom services are provided/provided, and suppliers are stored and destroyed in accordance with KVKK.

   In this context, detailed explanations regarding storage and disposal are given below, respectively.

   4.1 Remarks on Retention

   In Article 3 of the Law, the concept of processing personal data is defined, in Article 4 it is stated that the personal data processed should be related to the purpose for which they are processed, limited and measured and should be kept for the period required for the purpose for which they are processed or as stipulated in the relevant legislation. counted.

   Accordingly, personal data within the scope of practice activities are stored for a period of time stipulated in the relevant legislation or suitable for our processing purposes.

   4.1.1 Legal Reasons for Retention

   The practice preserves the personal data processed within the framework of its activities for the period stipulated in the relevant legislation. In this context, personal data;

   Tax Procedure Law No. 213
   Labor Law No. 4857
   Social Insurance and General Health Insurance Law No. 5510
   Law No. 5651 on Regulation of Broadcasts on the Internet and Combating Crimes Committed Through These Broadcasts
   Turkish Code of Obligations No. 6098
   Turkish Commercial Code No. 6102
   Health Services Basic Law No. 3359
   Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliates,
   Private Hospitals Regulation
   Law No. 6698 on the Protection of Personal Data

   It is stored as long as the storage periods specified in the other secondary legislation in force, especially

4.1.2. Processing Purposes Requiring Storage

The system stores business ID data:

Fulfillment of Employment Contract and Legislative Obligations for Employees
Execution of Benefits and Benefits Processes for Employees
Execution of Activities in Compliance with the Legislation
Execution of Finance and Accounting Affairs
Follow-up and Execution of Legal Affairs
Execution of Communication Activities
Planning of Human Resources Processes
Execution of Goods / Services Purchasing Transactions
We are on the way of production and operations of goods / services
Execution of Storage and Archive Activities
Execution of Contract Processes
Execution of Supply Chain Processes
Execution of Medical Diagnosis, Treatment and Care Services
Providing Information to Authorized Persons, Institutions and Organizations

4.2. Reasons for Destruction

Personally;

Making, or repealing, the entity’s principal doing
without processing or use
To withdraw your personal data, only in cases where the business is based on express consent conditions,
Obtaining the ‘acceptance’ of the KVKK’s 11th education by the people involved in the upbringing,
Deletion of personal data by the persons concerned or not taking advantage of the training with no reason, not keeping it within the time limit; Remuneration to the Board and the appropriate type and form of this request beforehand.

In the expiry of the period in which the personal data is held and the personal data are valid, the examination room is requested by the relevant persons, is absent, ex officio, destroyed or for a short time.

TECHNICAL AND ADMINISTRATIVE MEASURES

All of the personal data is received in a way, when it is received in order to be accepted in accordance with the law, and in order to be delivered in accordance with the personal data, the 12th target of the KVKK and the 6th application for the 4th application are targeted by the board to be received. Technique and preparation are done by the practice.

5.1. Technical Measures

Sent by the sender in connection with inspection by inspection;

Current anti-virus systems are used.
Firewalls are used.
Encryption is done.

5.2. Administrative Measures

Sent by the sender in connection with inspection by inspection;

Confidentiality commitments are made.
Preparations for entry to trainings related to personal data.
Preparations for entry to trainings related to personal data.
Environments containing personal data are exposed to external risks, floods, etc. about protection.
From the creators of the media containing personal data.
It is made customizable.
6. PERSONAL DATA DISPOSAL TECHNIQUES

It is destroyed by signs, as appropriate, for use by the practice ex officio or in relation to the target, for the relevant training planning intended for the time used in the delivery or for the purpose that can be processed.

6.1. Deletion of Personal Data

Your personal data allocated in Table-3 is deleted.

Table 3: Deletion of personal data

6.3. Anonymization of Personal Data

Anonymization of personal data means making personal data not associated with an identified or identifiable natural person under any circumstances, even if it is matched with other data.

In order for personal data to be anonymized; Personal data must be rendered unrelated to an identified or identifiable natural person, even by using appropriate techniques for the recording medium and the relevant field of activity, such as returning the personal data by the data controller or third parties and/or matching the data with other data.

STORAGE AND DISPOSAL TIMES

Regarding the personal data being processed by the practice within the scope of its activities;

The retention periods on the basis of personal data regarding all personal data within the scope of the activities carried out in connection with the processes are in the Personal Data Processing Inventory;
Storage periods on the basis of data categories are recorded in VERBIS;
Process-based retention periods are included in this Personal Data Retention and Disposal Policy.

The destruction process of personal data is carried out by the Practice in accordance with the retention periods determined in accordance with the relevant legislation in accordance with each relationship. Personal data whose storage period has expired are deleted, destroyed or anonymized in periodic destruction periods determined by the Practice.

Table 5: Process-Based Storage and Disposal Times Table

Ex officio deletion, destruction or anonymization of personal data whose storage period has expired is carried out by Prof.Dr. It is carried out by Ahmet Murat BÜLBÜL.

8. PERIODIC DISPOSAL TIME
   In accordance with Article 11 of the Regulation, the period of periodic destruction has been determined by the practice as [6] months. Accordingly, periodic destruction is carried out by the Practice in June and December each year.

   PUBLICATION AND STORAGE OF THE POLICY
   The policy is published in two different media, with wet signature (printed paper) and electronically, and is disclosed to the public on the website.

   UPDATE PERIOD OF THE POLICY
   The policy is updated as needed and changed processes are found.

   EFFECT AND REVOCATION OF THE POLICY
   This Policy is deemed to have entered into force after its publication on the website of the Practice.