Personal Data and Special Personal Data Storage and Destruction Policy

1. INTRODUCTION

1.1 Purpose

Personal Data Storage and Destruction Policy ("Policy") has been prepared to determine the procedures and principles regarding the storage and destruction activities carried out by "Damla Demir Clinic" ("Institution").

The Institution; has prioritized the processing of personal data belonging to Institution employees, job applicants, patients, suppliers, service providers, visitors, and other third parties in accordance with the Turkish Constitution, international agreements, Law No. 6698 on the Protection of Personal Data ("Law"), and other relevant legislation, and ensuring that the rights of relevant individuals are effectively exercised. The storage and destruction of personal data are carried out by the Institution in accordance with the Policy prepared for this purpose.

1.2 Scope

Personal data belonging to Institution employees, job applicants, patients, suppliers, service providers, visitors, and other third parties fall within the scope of this Policy, and this Policy applies to all record environments where personal data owned or managed by the Institution is processed and to all activities related to the processing of personal data.

1.3 Abbreviations and Definitions

• Recipient Group: The category of real or legal persons to whom personal data is transferred by the data controller.
• Explicit Consent: Consent based on information on a specific subject and declared with free will.
• Anonymization: Rendering personal data unable to be associated with an identified or identifiable natural person by any means whatsoever, including when combined with other data.
• Employee: Personnel of "Damla Demir Clinic" Institution.
• Patient: Individual receiving health or medical treatment services from "Damla Demir."
• Electronic Environment: Environments where personal data can be created, read, modified, and written with electronic devices.
• Non-Electronic Environment: All other environments excluding electronic environments such as written, printed, visual, etc.
• Service Provider: Real or legal person providing services to the Personal Data Protection Board within the framework of a specific contract.
• Related Person: Natural person whose personal data is processed.
• Related User: Individuals processing personal data within the data controller organization or, except for the person or unit responsible for technically storing, protecting, and backing up data, persons processing personal data within the data controller organization in accordance with the authority and instructions received from the data controller.
• Destruction: Deletion, destruction, or anonymization of personal data.
• Law: Law No. 6698 on the Protection of Personal Data.
• Record Environment: Any environment where personal data processed entirely or partially automatically or non-automatically, provided that it is part of any data recording system.
• Personal Data: Any information relating to an identified or identifiable natural person.

Personal Data Processing Inventory

Processing of Personal Data

Any kind of operation performed on data including obtaining, recording, storing, preserving, altering, rearranging, disclosing, transferring, taking over, making data available, classifying, or preventing the use of data, whether performed fully or partially automatically or non-automatically within the framework of any data recording system.

Special Categories of Personal Data

Racial or ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs, dress and clothing, membership of associations, foundations, or trade unions, health, sex life, criminal conviction, and security measures related to individuals as well as biometric and genetic data.

Periodic Destruction

The deletion, destruction, or anonymization process to be resolutely carried out at regular intervals as stated in the personal data storage and destruction policy when all the conditions for the processing of personal data specified in the law are no longer valid.

Data Processor

A natural or legal person who processes personal data on behalf of the data controller based on the authorization given by the data controller.

Data Recording System

The system where personal data is processed by being structured according to certain criteria.

Data Controller

A natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

Data Controllers Registry Information System (VERBIS)

An information system accessible via the internet, created and managed by the Presidency, which data controllers will use for applications to the Registry and other relevant transactions.

Regulation

The Regulation on the Deletion, Destruction, or Anonymization of Personal Data published in the Official Gazette dated October 28, 2017.

2. RESPONSIBILITIES AND TASK DISTRIBUTIONS

All units and employees of the Institution actively support the responsible units in the implementation of technical and administrative measures taken within the scope of the Policy, ensuring that they are implemented properly, increasing the training and awareness of unit employees, monitoring and continuously auditing to prevent the unlawful processing of personal data, preventing unauthorized access to personal data, and ensuring the lawful storage of personal data by taking technical and administrative measures to ensure data security in all environments where personal data is processed. The titles, units, and job descriptions of those involved in the storage and destruction processes of personal data are given in Table 1.

Table 1: Storage and Destruction Processes Task Distribution

TITLE	RESPONSIBILITY
Data Manager	Responsible for ensuring employees' compliance with the policy. Responsible for the preparation, development, implementation, publication, and updating of the Policy in relevant environments and for its cancellation and storage by decision of the Institution.
Data Security Officer	Responsible for providing the technical solutions required for the implementation of the Policy.
Other Units	Responsible for the implementation of the Policy and tasks defined by the internal directive according to their duties.

Table 2: Personal Data Storage Environments

Electronic Environments	Non-Electronic Environments
Servers (Domain, backup, email, database, web, file sharing, etc.) Software (office software, portal, EBYS, VERBIS.) Information security devices (firewall, intrusion detection and prevention, log file, antivirus, etc.) Personal computers (Desktop, laptop) Mobile devices (phone, tablet, etc.) Optical disks (CD, DVD, etc.) Removable memories (USB, Memory Card, etc.)	Printer, scanner, photocopier Paper Manual data recording systems (survey forms, visitor logbook) Written, printed, visual environments

4. Explanations Regarding Storage and Destruction

The personal data of employees, job applicants, patients, suppliers, visitors, and third parties in relationships such as service providers with whom the institution interacts are stored and destroyed in accordance with the law. In this context, detailed explanations regarding storage and destruction are sequentially provided below.

4.1 Explanations Regarding Storage

The concept of processing personal data is defined in Article 3 of the Law, Article 4 emphasizes that the processed personal data should be relevant, limited, and proportionate to the purposes for which they are processed and should be kept for the period stipulated in the relevant legislation or necessary for the processing purpose. Articles 5 and 6 list the processing conditions for personal data. Accordingly, personal data within the scope of our institution's activities are stored for the duration stipulated in the relevant legislation or for a period compatible with our processing purposes.

4.1.1 Legal Grounds Requiring Storage

In the institution, personal data processed within the scope of activities is kept for the duration stipulated in the relevant legislation. In this context, personal data is retained under the following laws:

• Law on the Protection of Personal Data No. 6698,
• Law No. 5651,
• Turkish Code of Obligations No. 6098,
• Turkish Commercial Code No. 4721,

These personal data are stored for the periods stipulated within the framework of other secondary regulations in force under these laws.

4.1.2 Processing Purposes Requiring Storage

The institution stores personal data processed within the scope of its activities for the following purposes:

• Performance of healthcare services
• Billing processes
• Execution of human resources processes
• Ensuring the security and audit of the institution.
• Ensuring data security.
• Ensuring physical security within the institution's premises.
• Personnel training.
• Execution of tasks and transactions as a result of signed contracts and protocols.

Within the VERBIS Scope

• Determining the preferences and needs of employees, data controllers, contact persons, data controller representatives, and data processors, arranging the services accordingly, and updating them if necessary.
• Ensuring compliance with legal obligations as required or mandatory by legal regulations.

Business Relationships

• Establishing contact with individuals/entities having a business relationship with the institution.
• Sending informational SMS, electronic messages on social media accounts, responding to questions and complaints, especially within the scope of healthcare services.
• Procurement of financial consultancy and legal consultancy services.

Reasons Requiring Destruction

• Personal data;
• Changes or revocation of the relevant legislation provisions underlying its processing.
• Termination of the purpose requiring its processing or storage.
• In cases where the processing of personal data occurs solely based on explicit consent, withdrawal of the explicit consent by the relevant individual.

Deletion and Destruction of Personal Data

In accordance with Article 11 of the Law, the acceptance by the Institution of the application made by the relevant individual within the framework of their rights for the deletion and destruction of personal data,

If the Institution rejects the request of the relevant individual for the deletion, destruction, or anonymization of personal data, finds the response inadequate, or fails to respond within the period prescribed in the Law; the relevant individual may lodge a complaint with the Personal Data Protection Authority, and if the Authority deems the request appropriate,

If the maximum storage period required for personal data has elapsed and there are no conditions justifying the storage of personal data for a longer period, the Institution shall delete, destroy, or anonymize the personal data upon the request of the relevant individual or ex officio.

Technical and Administrative Measures

In accordance with Article 12 of the Law and Article 6 paragraph four of the Law regarding special categories of personal data, within the framework of the adequate measures determined and announced by the Board for the secure storage of personal data, prevention of unlawful processing and access to personal data, and lawful destruction of personal data, the Institution takes technical and administrative measures.

Technical Measures

1. Penetration tests are conducted to identify risks, threats, vulnerabilities, and potential vulnerabilities to the Institution's information systems, and necessary measures are taken.
2. Real-time analysis is conducted with information security incident management to monitor risks and threats that may affect the continuity of information systems.
3. Necessary measures are taken for the physical security of the Institution's information system equipment, software, and data.
4. Hardware and software measures are taken against environmental threats to ensure the security of information systems.
5. Risks to prevent the unlawful processing of personal data are identified, appropriate technical measures are taken for these risks, technical controls are performed, and regular IT support is obtained.
6. Access procedures are established within the Institution, and reporting and analysis studies on accessing personal data are conducted.
7. Access to storage areas where personal data are located is recorded, inappropriate accesses or access attempts are monitored, and controlled.
8. The Institution takes necessary measures to ensure that deleted personal data is inaccessible and cannot be reused for the relevant users.
9. A system and infrastructure suitable for reporting to the relevant individual and the Board in case personal data is unlawfully obtained by others are established by the Institution.
10. Security vulnerabilities are monitored, appropriate security patches are installed, and information systems are kept up to date.
11. Strong passwords are used in electronic environments where personal data is processed.
12. Secure logging systems are used in electronic environments where personal data is processed.
13. Data backup programs ensuring the secure storage of personal data are used.
14. Access to personal data processed in electronic or non-electronic environments is restricted according to access principles.
15. Informing has been made for special categories of personal data, explicit consents have been obtained where legally required, and privacy agreements have been made, and the authorities of users with access to data have been defined.
16. Adequate security measures are taken for physical environments where special categories of personal data are processed, stored, and/or accessed, and physical security is ensured to prevent unauthorized entry and exit.
17. If personal data needs to be transmitted via email, it is encrypted using the corporate email address or KEP account. If it needs to be transferred via portable memory, CD, DVD, cryptographic methods are used for encryption, and cryptographic keys are kept in different media. If transfer between servers in different physical environments is required, data transfer is performed between servers via VPN or FTP method. If transfer via paper is required, necessary precautions are taken against risks such as theft, loss, or unauthorized access to documents, and documents are sent in "confidential" format.

Administrative Measures

• Internal trainings are provided for the improvement of employees' qualifications to prevent the unlawful processing of personal data, prevent unauthorized access to personal data, and ensure the protection of personal data.
• Privacy agreements are signed with employees and suppliers, etc., who provide services to the institution regarding activities conducted by the institution.
• Legal action is taken against employees who do not comply with security policies and procedures.
• A Disciplinary Policy for the Protection of Personal Data (KVKK) has been prepared.
• An Internal Directive for the Protection of Personal Data (KVKK) has been prepared.
• A Cookie Policy for the Protection of Personal Data (KVKK) has been prepared.
• An Application Form for Personal Data Protection (KVKK) has been prepared.
• Prior to starting the processing of personal data, the relevant individuals are informed by the institution, and the consents of the relevant individuals are obtained in cases required by the law.
• Information and Consent Forms have been prepared.
• Personal Data Protection briefings are available within the clinic/physical space.
• Personnel Contracts comply with KVKK.
• A personal data processing inventory has been prepared.
• Internal periodic and random audits are conducted.
• Information security training is provided to employees.
• Security is ensured for physical environments containing personal data against external risks (fire, flood, etc.).
• Personal data is minimized wherever possible.
• Protocols and procedures for the security of special category personal data have been established and implemented.
• KVKK measures required by the pandemic process have been taken, and necessary information and explanations are provided to our patients and personnel.

Techniques for the Destruction of Personal Data

At the end of the period foreseen in the relevant legislation or for the purpose for which they were processed, personal data are destroyed by the Institution in accordance with the relevant legislation and the techniques listed below, ex officio or upon the application of the data subject.

6.1 Deletion of Personal Data

Personal data are deleted using the methods provided in Table-3.

Data Recording Environment	Description
Personal Data on Servers	For those whose storage period requiring personal data on servers has expired, the system administrator removes access rights of the relevant users and performs deletion.
Personal Data in Electronic Environment	For those whose storage period requiring personal data in electronic environment has expired, except for the database administrator, other employees (relevant users) cannot access and reuse it in any way.
Personal Data in Physical Environment	For those whose storage period requiring personal data in physical environment has expired, except for the unit manager responsible for document archives, other employees cannot access and reuse it in any way. Additionally, a blackout process is applied by crossing out/painting/erasing it so that it cannot be read.
Personal Data on Portable Media	For those whose storage period requiring personal data on flash-based storage environments has expired, they are encrypted by the system administrator and stored in secure environments with encryption keys given only to the system administrator.

6.2 Destruction of Personal Data

Personal data are destroyed by the Institution using the methods provided in Table-4.

Table 4: Destruction of Personal Data

Personal Data in Physical Environment	Those whose storage period requiring personal data in physical environment has expired are destroyed in a way that cannot be retrieved.
Personal Data on Optical / Magnetic Media	Those whose storage period requiring personal data on optical media and magnetic media has expired are physically destroyed by melting, burning, or turning into powder. Additionally, magnetic media is rendered unreadable by subjecting it to a high-value magnetic field from a special device.

6.3 Anonymization of Personal Data

Anonymization of personal data refers to rendering personal data unidentifiable or not associable with any identifiable natural person in any way, even if they are matched with other data.

For personal data to be anonymized, appropriate techniques in terms of the recording environment and the relevant field of activity, such as the reversal of personal data by data controllers or third parties and/or the matching of data with other data, should be used to ensure that the personal data cannot be associated with any identifiable natural person.

7. STORAGE AND DESTRUCTION PERIODS

In relation to personal data processed within the scope of its activities, the institution:

• The storage periods of all personal data related to activities carried out within processes are specified on a personal data basis in the Personal Data Processing Inventory;
• The storage periods by data categories are recorded in the VERBIS;
• The storage periods by processes are included in the Personal Data Storage and Destruction Policy.

The institution's manager may make updates to these storage periods when necessary. The process of deleting, destroying, or anonymizing personal data that has reached the end of its storage period is carried out by the Data Security Officer.

Table 5: Storage and destruction periods by process

Activity	Storage Period	Destruction Period
Preparation and Execution of Contracts	10 years following the termination of the contract	During the first periodic destruction period following the end of the storage period
Execution of Corporate Communication Activities	10 years following the end of the activity	During the first periodic destruction period following the end of the storage period




Storage and Destruction Periods

PROCESS	STORAGE PERIOD	DESTRUCTION PERIOD
Execution of patient registration and diagnosis and treatment processes	20 years from the completion of the process	During the first periodic destruction period following the end of the storage period
Execution of institutional services other than treatment processes (communication, etc.) Preparation of Contracts	10 years from the completion of the process	During the first periodic destruction period following the end of the storage period

Processing and Measures for Special Category Personal Data

Processing of Special Category Personal Data

Special Category Personal Data is processed in compliance with the Law, provided that adequate measures determined by the Board are taken. If there is explicit consent from the Data Subject or if there is no explicit consent from the Data Subject; Special category personal data, except for the health and sexual life of the data subject, are processed in cases prescribed by laws.

Measures for the Processing of Special Category Personal Data

In the processing of Special Category Personal Data as stipulated in Article 6 of the Law, in accordance with the decision of the Board dated 31.01.2018 and numbered 2018/10, the data controller takes the following measures:

Publication, Storage, Update Period, and Enforcement of Policy

Transfer of Special Category Personal Data

Special Category Personal Data obtained lawfully is not transferred to third parties for purposes of data processing.

Publication and Storage of the Policy

The Policy is published in two different media, wet-signed (printed paper) and electronic, and disclosed to the public on the website. A printed paper copy is also kept in the data controller's file.

Update Period of the Policy

The Policy is reviewed and necessary sections are updated as required.

Enforcement and Revocation of the Policy

The Policy is deemed effective as of the date written below. In case of decision to revoke, the wet-signed old copies of the Policy are canceled (by stamping or writing canceled) and signed by the data controller, and kept by the data controller for at least 5 years. June 10, 2023