Personal Data Protection Information

Flash Therapy (website address: https://en.flashtherapy.com.tr/) and the clinic team (“the Clinic”), led by Prof. Dr. Semih Keskil, place great importance on the security of your personal data. We store all types of personal data shared by our patients with great attention to patient privacy and take all necessary technical and administrative measures to ensure an appropriate level of security for your personal data.
This “Personal Data Protection Information” explains our policy on personal data protection and processing and describes how we collect, transfer, use, and protect your personal data during the services provided by the Clinic.

Personal Data Collected by the Clinic

We collect various types of information from our patients within the scope of the healthcare services we provide. The information is always collected in accordance with the principles and conditions of data processing set out in the Personal Data Protection Law No. 6698 (KVKK). The information we collect within the framework of the purposes explained in Section 2 below may include the following:

Your first and last name,
Your ID details, Turkish ID number, passport number,
Your place and date of birth,
Your gender,
Your address,
Your phone number,
Your email address,
Your patient protocol number assigned to you,
Financial information such as payment and invoice details,
Your private health insurance and Social Security Institution information,
Generally, biometric and genetic data,
Your laboratory results,
Results of tests, analyses, and examinations,
Your examination data,
Prescription details, and other health data,
Other data you share with us via mail, phone, fax, email, or other channels.

Purposes of Processing Your Personal Data

In accordance with the KVKK, as a clinic, the personal data we collect within the scope of the services you receive from us may be processed for various purposes, including the following:

Fulfillment of our legal obligations under the Health Services Basic Law No. 3359, the Decree-Law No. 663 on the Organization and Duties of the Ministry of Health and Affiliated Organizations, the Regulation on Private Healthcare Institutions Providing Outpatient Diagnosis and Treatment, the Regulation on Processing Personal Health Data and Ensuring Privacy, and other relevant regulations;
Protection of public health, preventive medicine, conducting medical diagnosis, treatment, and care services, and planning and managing healthcare services and their financing;
Providing you with information about your appointment if you schedule one;
Planning and managing the internal operations of the clinic;
Analyzing your use of healthcare services to improve the services we provide;
Billing;
Verifying your identity;
Verifying your relationship with contracted institutions;
Responding to requests from the Ministry of Health and other public institutions and organizations in accordance with applicable legislation;
Responding to questions or complaints related to our services;
Monitoring the suitability of the service provided at the clinic;
Measuring patient satisfaction after receiving healthcare services and enhancing patient satisfaction;
Contacting you for informational purposes regarding our services;
Providing medication or medical devices.
Furthermore, your personal data will not be used for commercial purposes except in cases required by the activities listed above and relevant regulations.

Persons and Organizations to Whom Your Personal Data May Be Transferred

In accordance with the KVKK and relevant healthcare regulations, and by ensuring the necessary technical and administrative measures to maintain an appropriate level of security, as a clinic, we may transfer your personal data for the purposes outlined in Section 2 to the following entities, within the limits permitted by law:

Institutions or organizations authorized under the Health Services Basic Law No. 3359, the Decree-Law No. 663 on the Organization and Duties of the Ministry of Health and Affiliated Organizations, the Regulation on Private Healthcare Institutions Providing Outpatient Diagnosis and Treatment, the Regulation on Processing Personal Health Data and Ensuring Privacy, and other relevant regulations
Private insurance companies
Auditors
Consultants
Business partners
Domestic and international organizations with which we have contractual agreements to carry out our operations
Other third parties and administrative or official authorities to whom data must be legally transferred due to legal obligations and within the limits of the law.

Method and Legal Basis for Collecting Personal Data

Your personal data is processed within legal boundaries for the purposes of issuing invoices for goods and services received in accordance with the Tax Procedure Law, sending promotional and informational messages via electronic communication as per the Law on the Regulation of Electronic Commerce, and providing you with better products and services. Your personal data is processed lawfully, in good faith, for specific, explicit, and legitimate purposes, and in a limited and proportional manner necessary for these purposes. The data is collected in verbal, written, or electronic form to fulfill the contractual and legal obligations of the clinic.

Your personal data is collected and processed through various methods, including in-person transactions, emails, mail, fax, social media interactions, face-to-face meetings, and conversations conducted via phone, teleconference, or video conference. It is processed under the legal grounds specified in Articles 5 and 6 of Law No. 6698, including:

• Your explicit consent
• Explicit stipulations in laws
• Necessity due to physical impossibility in cases where obtaining consent is not possible, or if processing is required to protect the life or physical integrity of you or another person
• Processing necessary for the establishment or execution of a contract
• Compliance with legal obligations
• Data being made public by the data subject
• Processing required for the establishment, exercise, or defense of a legal right
• Legitimate interests of the data controller, provided that fundamental rights and freedoms are not harmed
• Processing of personal data related to health and sexual life only by persons or institutions bound by confidentiality obligations for public health protection, preventive medicine, medical diagnosis, treatment, care services, and the planning and management of healthcare services and financing.

Your Rights Regarding Your Personal Data

To the extent that your personal data is processed by the clinic as a data controller, you have the following rights under Article 11 of the Personal Data Protection Law (KVKK):

a) To learn whether any of your personal data is being processed;
b) To request information regarding the processing of your personal data;
c) To learn the purposes of processing your personal data;
d) To find out whether your personal data has been transferred to third parties within the country or abroad;
e) To request the correction of any incomplete or inaccurate personal data;
f) To request the deletion or destruction of personal data if the reasons requiring its processing no longer exist, or if the clinic has no legal basis or legitimate interest to process the data;
g) To object to any unfavorable outcomes resulting from the automated processing of personal data; and
h) To demand compensation if you suffer damages due to the unlawful processing of your personal data.

Application Methods for Exercising Your Rights

Pursuant to Article 13, paragraph 1 of the Personal Data Protection Law (KVKK), you may submit your request to exercise the above-mentioned rights to the clinic in writing or through other methods determined by the Personal Data Protection Board. Since the Board has not yet specified any other methods, you must submit your request in writing as required by KVKK. The available channels and procedures for submitting your written application under Article 11 of KVKK are explained below.

To exercise your rights, you must submit a request including identifying information and a detailed explanation of the specific right you wish to exercise. You can do this by:

• Completing the contact form available at [address] and delivering a signed copy along with identity-confirming documents in person,
• Sending your request via a notary,
• Using other methods specified under the KVKK,
• Sending an email from your registered electronic mail (KEP) address, or
• Sending an email from the address you previously provided to the clinic and which is registered in the clinic’s system to [email address].

The clinic will process your request free of charge as soon as possible and no later than thirty days, depending on the nature of the request. However, if the process incurs additional costs, the clinic may charge the fee determined by the Personal Data Protection Board’s tariff.