Privacy Policy

Effective Date: [... /01/2024]

As Central Hospital Health Group and its affiliates (“Central Hospital,” “we,” “us,” “our”), we know how important privacy is to our hospitals and strive to be transparent about how we collect, use, disclose, transfer and store your information. This Privacy Policy provides a general framework for our information practices. The Privacy Policy applies to the Central Hospital Health Group website, online transactions on the site, and services performed in Central Hospital hospitals (collectively, “Our Services”) and the Medicard app.

We may change this Privacy Policy from time to time for a variety of reasons, such as to reflect changes in laws and regulations, changes in industry practices and technological developments. Please note that this Privacy Policy applies to our website, your online transactions and your Medicard transactions, as well as your transactions at our hospitals that are covered by this Privacy Policy. The Privacy Policy applies regardless of whether you use a computer, mobile phone, tablet, TV or any other device to access our Services and your physical access in person. It is very important that you read the Privacy Policy carefully, as you approve of the practices we set out in the Privacy Policy each time you use our Services. By using our services, you consent to the practices described in the Privacy Policy.

It is also very important that you check frequently whether the Privacy Policy has been updated. When we update the Privacy Policy, we will notify you of changes that we consider important by adding a note to the relevant Services. After we add this notice, by accessing or using our Services, you acknowledge the new practices specified in the update. The latest applicable version of the Privacy Policy will always be available on our website. You can check the “effective date” at the top to see when the Privacy Policy was last updated.

What information do we collect about you?

Information you provide directly:

Some Services allow you to provide us with information directly. For example:

• Our Health Services, which we offer in our hospitals, oblige our patients to communicate all identification information such as name, surname, Turkish ID number, etc. For example, if you apply for a medical examination at our hospitals, you will need to provide us with your credentials so that we can provide services to you.
• In order for you to make an appointment through the Online Transactions section of our website, we may ask for your credentials.
• We may ask for your credentials so that you can benefit from our Medicard service.
• In order for you to apply for a job from the HR department on our website, we may ask for your credentials, information about your work experience and your learning life.

Information about your use of the Services:

In addition to the information you provide, we may collect information about your use of our Services that you have received from other Central Hospital hospitals. For example, we may collect the following information:

Credentials—All credentials, such as name, surname, identification number, etc.

Health information— Information on all treatments you have received in our hospitals

Contact information—Information to help contact you, such as email, phone number, etc.

can be communicated to us.

Information from third-party sources:

We may obtain information about you from publicly available and commercially available sources (to the extent permitted by law) and combine this information with other information we receive from you or about you. We may also request information about you from your relatives in a third party location for the purpose of the facility of our Services.

Other Information We Collect:

We may also collect other information about you, your health status, or your use of the Services, at the time of collection or by other means, with your consent.

You may choose not to provide us with certain types of information (e.g. up-to-date information about your health status), but failure to provide this information may result in you being unable to use or use some of the Services as you wish.

Automatically Collected Information:

We collect certain personal data automatically when you use our website or products. This information may include some or all of the following types of information:

• your Internet Protocol (“IP”) address;
• Your user and account names and data related to them;
• Phone number;
• SIM (Subscriber Identity Module) card number;
• Device ID numbers such as Machine ID, IMEI and/or MEID;
• Geolocation based on GPS/Wi-Fi/communication network local information.

Except where we need to retain the identifying qualities of the data, we anonymize the data we collect and store it in a form that does not identify you. For example, when we collect your IP address, we anonymize your IP address by hiding the last group of digits (e.g. 192.168.1.1 to 192.168.1.XXX).

How Do We Collect Your Information?

Your information may be collected orally, in writing or in electronic form by common methods such as our website, our Medicard service, our Online Transactions and HR service available on our website, our call center service, physical applications that you have made to our hospitals.

How do we use your information?

We may use the information we collect for the following purposes:

• To enable us to enroll you in a Service;
• To provide a Service that you have requested;
• To provide you with personalized services based on your past activities in our Services;
• For advertising activities, such as providing sponsored content with customized ads and sending you promotional communications;
• For evaluation and analysis of our market, patients, products and services (this includes asking for your opinion about our products and services and conducting patient surveys);
• To improve our Services by understanding how our Services are used and to develop services with new products;
• To organize free prize draws, prize contests or promotions to the extent permitted by law; and
• For other purposes with your consent.

By combining the information we collect from you, we may use it for purposes consistent with this Privacy Policy.

Who do we disclose your information to?

We will not disclose your information to third parties without your consent to use them for their own independent marketing or business purposes. However, we may disclose your information to the following organizations:

Affiliates. For the purpose of the Privacy Policy, your information may be shared with affiliates of Central Hospital Health Group.

Service providers. We may also disclose your information to companies that provide services on our behalf or for us, such as companies that assist us with billing processes or send emails on our behalf. These organizations may only use your information for the purpose of providing services to us.

Patient/Patient Relatives We may disclose information about your health status for the purpose of informing your first-degree relatives within the framework of relevant health legislation.

Other Parties Where Required by Law or Necessary for Us to Protect Our Services. We may disclose your information to other parties for the following reasons:

• To comply with the law or respond to mandatory legal notices (such as a search warrant or other court order);
• To verify or enforce the policies governing our Services; and
• To protect the rights, property or safety of Central Hospital Health Group or our related subsidiaries, business partners or patients.

• Other Parties in Connection with Corporate Transactions. As part of a merger or transfer, or in the event of bankruptcy, we may disclose your information to a third party.

• Other Parties with Your Consent or Request. In addition to the disclosures set out in this Privacy Policy, we may share information about you with third parties upon your consent or request.

How do we ensure the security of your information?

To ensure the integrity of all types of data necessary for the support and maintenance of the Services we provide to our patients, to archive them for periods in accordance with the legal regulations and to prevent them from being shared with third parties other than the medical team that will carry out the diagnosis and treatment;

• The necessary software and hardware are determined,
• For the uninterrupted provision of the necessary software and hardware, the necessary resources are allocated,
• What needs to be done in terms of protecting patient information has been transferred to our staff through trainings, and their responsibilities have been made in writing with work flows,
• The necessary infrastructure for the backup of all data has been identified and the responsible persons have been identified,
• All types of access operations (read, change, delete, add) are restricted in our hospital information system,
• Patient files and information are provided only to our patients themselves, their relatives to whom they have given written consent, to the relevant public institutions and organizations within the framework of health legislation, and to the competent judicial authorities in judicial cases.

The 3 basic principles of information security of our hospital are confidentiality, integrity and accessibility by the authorities.

Who Controls Your Data?

Within the scope of the Personal Data Protection Law No. 6698, we have designated a “Data Controller” for each company within Central Hospital as follows.

1. Önem Sağlık A.Ş.
2. Metcer Health Services Inc.
3. Erengazi Private Health Services Inc.

We indicate that the above-mentioned persons with the title of “Data Controller” have been collected within the scope of this Privacy Policy and that these persons have the rights and obligations stipulated in Law No. 6698 as “Data Controller”.

Data Retention

We take reasonable steps to ensure that information about you is retained only for as long as the purpose for which it was collected or as required by applicable law or contract.

What Are Your Rights Regarding Your Data

in relation to your data processed by Central Hospital Health Group;

• To find out if your data has been processed,
• To obtain information about them if your data is being processed,
• To find out what the purpose of processing your data is and whether your personal data is being used in accordance with its purpose,
• To find out who the third parties to whom the data is transferred at home or abroad and which data are transferred, if any,
• To request that the data be corrected if it should be incomplete or incorrect,
• To request the deletion or destruction of your processed data in the event that the reasons that require the processing of your data disappear or if the data is out of date,
• If you have requests for correction or deletion of your data, you can always send us your requests to request that the third parties to whom the data is transferred be notified.

What Principles Do We Observe When Processing Your Personal Data?

Central Hospital observes the following principles when processing your personal data:

• Processing in a manner consistent with the law and the rule of honesty;
• The correctness of the data processing,
• The extent of processing is specific,
• Carrying out processing for legitimate purposes,
• that the processing is linked, limited and measured to the purpose for which the data is collected or reprocessed,
• The data being up to date,
• Retention of data for as long as is necessary for the purpose for which they are processed

Third-Party Connections and Products in Our Services

Our Services may include links to third-party websites and services beyond our control. The security or confidentiality of information collected by websites or other services is not our responsibility. Please be careful and remember to review the applicable privacy notices regarding the third-party websites and services you use.

If you are underage

As Central Hospital Health Group, we are concerned about the privacy and safety of minors online. Our Website is intended for the general public and not for use by minors.