TR
EN
Purpose and Scope
This Personal Data Retention and Destruction Policy has been prepared in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and relevant secondary legislation in order to determine the procedures and principles regarding the retention and destruction of personal data processed by Dr. Serdar Saraç, operating at Fahrettin Kerim Gökay Cad. 26/3 Hocaalioğlu Apt. (Minibüs Cad. Sahra-i Cedit Bus Stop) Göztepe – Kadıköy / Istanbul.
This policy covers the retention periods and destruction methods of personal data belonging to patients, patient relatives, employees, employee candidates, suppliers, and website visitors.
Legal Basis
This policy has been prepared based on Article 7 of the KVKK, the Regulation on the Deletion, Destruction or Anonymization of Personal Data, and other relevant legislative provisions.
Legal Grounds Requiring the Retention of Personal Data
Personal data is retained for the purposes of providing healthcare services, carrying out diagnosis and treatment processes, ensuring patient safety, fulfilling contractual obligations, fulfilling accounting and financial obligations, conducting occupational health and safety processes, and complying with retention obligations stipulated under applicable legislation.
In addition, data may be retained for limitation periods in order to serve as evidence in potential legal disputes.
Retention Periods
Personal data is retained for the periods specified under applicable legislation and for the duration required by the purpose of processing. Health data is retained in consideration of the periods stipulated under healthcare legislation. Accounting and financial records are retained in accordance with the Tax Procedure Law and relevant legislation. Data related to job applications is deleted after a reasonable period.
Personal data whose retention period has expired is destroyed ex officio or upon the request of the data subject.
Destruction of Personal Data
Personal data is destroyed by using one of the methods of deletion, destruction, or anonymization.
Deletion is carried out by rendering personal data inaccessible and non-reusable for relevant users.
Destruction refers to the process of rendering personal data completely inaccessible, irretrievable, and non-reusable in any way.
Anonymization refers to the process of rendering personal data incapable of being associated with an identified or identifiable natural person, even when matched with other data.
Periodic Destruction
Pursuant to the Regulation on the Deletion, Destruction or Anonymization of Personal Data, personal data whose retention period has expired is evaluated within the scope of the periodic destruction process. Periodic destruction procedures are carried out at least once a year.
Technical and Administrative Measures
Dr. Serdar Saraç takes the necessary technical and administrative measures to ensure the secure retention of personal data and to prevent unlawful processing. Data stored electronically is protected by security software, and data stored physically is kept in locked cabinets and in areas with restricted access.
Access authorizations are limited and necessary audits are conducted in order to prevent unauthorized access.
Rights of the Data Subject
Pursuant to Article 11 of the KVKK, data subjects have the right to learn whether their personal data is processed, to request information if it has been processed, to learn the purpose of processing, to request correction if it has been processed incompletely or incorrectly, to request deletion or destruction, and to claim compensation if they suffer damage due to unlawful processing.
Applications within this scope may be submitted in writing or via e-mail to info@serdarsarac.com. Applications will be concluded within the periods specified under the KVKK.
Entry into Force and Amendments
This policy enters into force on the date it is published. It may be revised in line with amendments in legislation or updates to data processing processes.