Corporate
Personal Data Protection Notice
How Biruni University Hospital processes patient personal data under Turkish Law No. 6698, who it is shared with, how long it is kept and what rights you hold.
Biruni University Hospital processes personal data as a data controller under Turkish Law No. 6698 on the Protection of Personal Data, referred to below as the Law. This notice explains what data is collected when you use the hospital, why it is processed, who it is shared with, how long it is kept, and what you can require the hospital to do with it. It applies to patients treated in Turkey regardless of which country they travelled from.
Who is responsible for your data
Biruni University Hospital is the data controller for the personal data described in this notice. Data is processed lawfully, fairly, and only to the extent required to provide the service you came for.
What data is collected
Four categories of personal data are processed when you attend the hospital. Data is collected only to the extent necessary for the service being provided.
| Category | What it includes |
|---|---|
| Identity data | Name, surname, Turkish national identity number or, for foreign nationals, passport number and foreign identity number, and date of birth. |
| Contact data | Postal address, telephone number and e-mail address. |
| Health data | Diagnosis, treatment history, laboratory results, imaging studies, prescriptions and clinical notes. Health data is a special category of personal data under Article 6 of the Law and is subject to stricter protection than the other categories listed here. |
| Financial data | Insurance details and payment records. |
Why it is processed
Personal data is processed in order to provide medical diagnosis and treatment services, to manage appointments and laboratory processes, to meet legal obligations, to enable the exercise of rights arising from Turkish social security legislation, and to improve hospital services.
Legal basis for processing
Article 10 of the Law requires a data controller to state the legal ground it relies on, and not only the purpose. The Turkish source text of this notice did not state one.
Health data is processed under Article 6, paragraph 3 of the Law, which permits the processing of health data without explicit consent by persons under an obligation of confidentiality, or by authorised institutions, for the purposes of protecting public health, preventive medicine, medical diagnosis, and the operation and financing of treatment and care services. Identity, contact and financial data are processed under Article 5, paragraph 2, on the grounds that processing is expressly provided for by law, is necessary for the performance of a contract, is necessary for the data controller to fulfil its legal obligations, and is necessary for the establishment or exercise of a legal right.
How the data is collected
Data is collected when you register at the hospital, when you attend a consultation, when clinical tests and imaging are carried out, and when you contact the hospital by telephone, e-mail, the website contact form, or messaging applications.
Records you send to the international patients office before travelling are collected at the point you send them.
Who the data is shared with
No transfer disclosure appeared in the Turkish source text of this notice. That is the most significant gap in it, because a data controller has to name the recipients of personal data and the purpose of each transfer.
A hospital of this type ordinarily transfers data to the Ministry of Health and its reporting systems, to the Social Security Institution where treatment is covered, to private and international insurers where a claim is made, to contracted external laboratories and pathology services, to information technology and archiving suppliers acting as data processors, and to legal, financial and audit advisers. Transfers abroad, including any transfer to an insurer or a referring physician in your own country, are governed by Article 9 of the Law and require their own legal basis.
How long it is kept
Medical records are retained for the periods set out in Turkish health legislation and in the hospital's personal data retention and destruction policy. At the end of the applicable period, data is erased, destroyed or anonymised.
Your rights under Article 11
Article 11 of the Law grants nine rights. The Turkish source text listed five of them. All nine are set out below, in the order the Article sets them out.
You have the right to learn whether your personal data is processed; to request information about it if it has been processed; to learn the purpose of processing and whether the data is used in accordance with that purpose; to know the third parties to whom your data is transferred, in Turkey or abroad; to request the correction of data that is incomplete or inaccurate, and to require that correction to be notified to the third parties it was transferred to; to request the erasure or destruction of your data where the grounds for processing it no longer exist, and to require that action to be notified to the third parties it was transferred to; to object to a conclusion drawn about you exclusively by automated processing where that conclusion works to your disadvantage; and to claim compensation where you suffer loss because your data was processed unlawfully.
One limit is worth stating plainly. A request to erase your medical records will not usually be granted while the hospital is under a statutory obligation to retain them, and that obligation runs for years after your treatment ends. The right to erasure applies where the legal ground for keeping the data has fallen away, which for clinical records is rarely immediate.
How to exercise your rights
Applications are made in writing to Biruni University Hospital. The hospital responds within thirty days of receiving a valid application, free of charge, unless the response requires a separate cost, in which case the fee set by the Personal Data Protection Board may be charged.
Data protection contact
Applications under Article 11 of the Law, and questions about how your data is handled, go to the address below. Do not send clinical questions or medical records to this address; it is for data protection matters only.
An application must state your name, surname and signature, your Turkish national identity number or, for foreign nationals, your nationality and passport or identity number, your address for notification, and the subject of your request, together with any supporting documents.
This notice was last updated on EDITOR_FILL_LAST_UPDATED_DATE.