Protection of Personal Data

ANATOLIA IVF AND WOMEN 'S HEALTH SERVICES INC.
CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA

In order to comply with the Personal Data Protection Law No. 6698 (“PDPL”) published in the Official Gazette dated 07.04.2016 and numbered 29677, the Regulation on the Processing of Personal Health Data and Ensuring Privacy (“Regulation”) published in the Official Gazette dated 20.10.2016 and numbered 29863 and the regulations regarding the amendment of this Regulation and the relevant legal regulations, this Clarification Text has been drawn up within the scope of the procedures and principles adopted and to be applied by Anatolia IVF and Women's Health Services Inc., and within the scope of the clarification liability of the data controller. 

With regard to your personal data processed by Anatolia IVF and Women's Health Services Inc., the principles of the processing of personal data and personal health data, the purposes and conditions of the processing of this data, the transfer of this data in the country and abroad, its disposal and the practices and principles regarding your rights over the processed data are notified to you as follows. In order to comply with the PDPL and other relevant regulations, and processing, use, disposal, transfer of your personal data and in other matters in accordance with the Law and other regulations, Anatolia IVF and Women's Health Services Inc. (hereinafter referred to as “Anatolia”) will act in accordance with the procedures and processes set forth in this Clarification Text.

I. DEFINITIONS 

Explicit Consent: Freely given, specific and informed consent.
Recipient Group: Category of natural or legal persons to which the personal data are transferred by the data controller.
Anonymization: Rendering personal data impossible to link with an identified or identifiable natural person, even though matching them with other data.
Direct Identifiers: Identifiers that, by themselves, directly reveal, disclose and make the person distinguishable, with whom they are in a relationship. 
User concerned: Persons who process personal data within the organization of the data controller, or upon authorization and instructions received from the data controller, other than the person or department, which is responsible for the technical storage, protection and back up of personal data,
Disposal: Erasure, destruction or anonymization of personal data.
Law: Personal Data Protection Law numbered 6698 and dated 24/3/2016. 
Obscuration: The process of scratching, painting and icing all of the personal data in such a way that it cannot be associated with an identified or identifiable natural person. 
Recording Medium: Any type of environment that keeps the personal data processed wholly or partially by automated means or non-automated means which provided that form part of a data filing system. 
Personal Data: Any information related to an identified or identifiable natural person. 
Personal Data Processing Inventory: The inventory which is detailed by explanations of the followings: personal data processing activities of data controllers according to their business processes; purposes and legal ground of personal data processing; data category; maximum data storage period required for the purposes formed related to the recipient group, to whom the data are transferred and with data subject groups, and for personal data processing; personal data envisaged to be transferred to foreign countries; and measures taken related to the data security. 
Processing of Personal Data: Any operation performed on personal data, wholly or partially by automated means or non-automated means which provided that form part of a data filing system, such as collection, recording, storage, protection, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization, preventing the use thereof, 
Personal Data Owner: The natural person whose personal data are processed. 
Board: Personal Data Protection Board. 
Special Categories of Personal Data: People's data such as race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, disguise and dress, association, foundation or union membership, health, sexual life, criminal conviction, infertility examinations, pregnancy or abortion history, laboratory results, test results, examination data, prescription information, current and past diseases, previous operations, drugs being used or previously used, treatments received within the context of reproductive health and their characteristics, menstrual cycle and characteristics, duration of sexual abstinence, DNA fingerprinting report, health data obtained within the scope of sperm or oocyte freezing indication, genetic samples taken from embryo, testicular biopsy results, which are obtained during the execution of medical diagnosis and treatment services; and, including but not limited to, other health, biometric and genetic data to be requested within the scope of treatment, blood and religion information in the identity photocopy. 
Periodic Disposal: Erasure, destruction or anonymization process which is determined in the personal data storage and disposal policy and to be carried out periodically ex officio, in the event that all of the conditions for processing laid down in the Law no longer exist. 
Registry: Data Controllers’ Registry kept by Personal Data Protection Authority 
Deletion: Making personal data inaccessible and unusable in any way for the relevant users. 
Data Filing System: The filing system where personal data processed by structuring according to specific criteria. 
Data processor: The natural or legal person who processes personal data on behalf of the data controller upon his/her authorization. 
Data Controller: The natural or legal person who determines the purpose and means of processing personal data and is responsible for the establishment and management of the data filing system. 
Destruction: The process of rendering personal data inaccessible, irretrievable or non-reusable by anyone, by no means.

II. PRINCIPLES OF PROCESSING PERSONAL DATA

Anatolia IVF and Women's Health Services Inc. carries out personal data processing activities within the framework of the principles and rules listed below in accordance with Article 4 of the PDPL regulation, the procedures and principles regarding the processing of personal data.

a. Compliance with Law and Good Faith 
Anatolia IVF and Women's Health Services Inc. processes your personal data in accordance with the PDPL and other laws and regulations that are obligatory to comply with the work done.

b. Being Accurate and Up-to-Date 
Anatolia IVF and Women's Health Services Inc. carries out the necessary procedures to ensure that the personal data provided by the data owner is not changed without permission and contrary to facts; performs the necessary procedures for updating the personal data in case of a change in the processed data, if requested by the data owner; and takes technical and administrative measures.

c. Processing for Specific, Explicit and Legitimate Purposes
Your personal data processed by Anatolia IVF and Women's Health Services Inc. is processed in accordance with the processing purpose and within the framework notified to you.

d. Associability, Boundness, and Proportionality with the Purpose of Processing
Anatolia IVF and Women's Health Services Inc. does not process personal data that does not overlap its activities, that is not required within the framework of the company's activities, and that exceeds the purpose of processing. 

e. Storing as Long as Required for the Purpose of Processing or Envisioned in the Relevant Legislation
Your data, which is processed within the framework of PDPL, other relevant laws and regulations, is stored as long as envisaged in the relevant legislation or required to be stored due to the nature of the processed personal data.

III. CONDITIONS FOR PERSONAL DATA PROCESSING AND EXCEPTIONAL CASES

Data can be processed within the framework of company activities without the explicit consent of the data owner, if
a) Provided that the explicit consent of the data owner is obtained or data related to security measures; biometric and genetic data are special categories of personal data.   
b) Explicitly envisaged in the laws,
c) Obligatory for the protection of the life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility, or whose consent is not legally valid,
d) Necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or fulfillment of a contract,
e) Obligatory for the data controller to fulfill its legal obligation,
f) Made public by the person concerned; or
g) data processing is mandatory for the establishment, exercise or protection of a right,
h) data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Special categories of personal data to be processed within the framework of company activities;  
a) Data will not be processed unless the explicit consent of the data owner is obtained.  
b) Data can be processed without the explicit consent of the data owner in cases envisaged by the laws except for sensitive personal data related to health and sexual life.  
c) Special categories of personal data related to health and sexual life may be processed without the explicit consent of the data owner for the purposes of protecting public health, preventive medicine, medical diagnosis, implementation of treatment and care services, planning and management of health services and its financing.

IV. CLASSIFICATION OF PERSONAL DATA TO BE PROCESSED

Data of Identity:  Name, surname, TR Identity number, mother's name, father's name, place of birth, date of birth, marital status, religion, blood group, registered province, district and neighborhood and including but not limited to, all information written in the identity card, photocopy of identity card, in case of not being Turkish citizen; passport information, photograph, photocopy of marriage certificate, marriage history data.
Contact Data: Your contact data such as home phone number, mobile phone number, residential address or other address information, e-mail address requested from or given by you in order to be able to communicate with you.
Personnel Data: Copy of identity card, Identity register copy, Certificate of Residence, Health report, Photocopy of Diploma, Criminal record, Passport photograph, Document stating personal status, Military status document, Employment Contract / Service Contract, SSI employment statement, Information and documents related to your health status.  Your
Patient Registration Data: Your patient/protocol file number, data of private health insurance or Social Security Institution,  
Your Data of Family and Relatives: Your family history information (data obtained about genetic disorders if your family relatives such as mother, father, sibling, uncle, aunt have a history of illness)  
Your Payment and Financial Data: Bank account number, IBAN, other information of credit and debit card, payment and billing information. This refers to the type of data such as budget information, financial performance information, credit and risk information, asset information. 
Your Data of Demand and Complaint Management: Your answers and comments you share with the aim of evaluating our services,  
Your Visual and Audio Data: Your camera recordings obtained in the event that you visit the company campus, your audio recordings obtained by automatic recording of your interviews with the company and its employees,  
Your Vehicle Data: Your vehicle and license plate/license data in case you use parking lot/valet services,  
Curriculum Vitae Data: Your education data written in your CV or requested by Anatolia IVF and Women's Health Services Inc. or given by you, school information about your education, certificate information, data about your education status and your trainings, The place, date and duration of your work experience written in your CV or requested by Anatolia IVF and Women's Health Services Inc. or given by you, data about your previous job and positions, any data about your work experience,   Your photo included in your CV or requested by Anatolia IVF and Women's Health Services Inc. or given by you,   Your driver's license requested by Anatolia IVF and Women's Health Services Inc. or given by you, and the data in your driver's license written in your CV,  Your references written in your CV or requested by Anatolia IVF and Women's Health Services Inc. or given by you and data about your references,  
Visitor Data: Name, surname, visiting hours, license plate if any, the person visited and other information of the visitors paying a visit to the company,   
Health Data: Laboratory and imaging results provided by patients visiting our center or obtained through procedures performed in our center, test results, examination data, prescription information, check-up information, including but not limited to, data on health and sexual life obtained during the execution of medical diagnosis, treatment and care services,  
Data Regarding the Data Processing Security: IP address information, website login and logout information, password information,  
Legal Action and Compliance Data: Personal data processed within the scope of determination and follow-up of our legal receivables and rights, fulfillment of our debts and compliance with our legal obligations and our Company's policies,  
Data of Employee Candidate: Personal data processed regarding individuals who have applied to become an employee of our Company or who have been evaluated as an employee candidate in line with the human resources needs of our Company in accordance with the rules of commercial practice and good faith, or who have a working relationship with our Company,  
Audit and Inspection Data: Personal data processed within the scope of our company's legal obligations and compliance with company policies,  
Data of Processing Security:  IP address information, Website login and logout information, Password etc.  
Risk Management Data:  Information processed for the management of commercial, technical, administrative risks, etc.  
Special Categories of Data: Persons' costume and clothing, health, sexual life, criminal conviction, infertility tests, pregnancy or abortion history, laboratory results, test results, examination data, prescription information, current and past diseases, previous operations, drugs being used or previously used, treatments received within the scope of reproductive health and its characteristics, menstrual cycle and its characteristics, duration of sexual abstinence, DNA fingerprinting report, health data obtained within the scope of sperm or oocyte freezing indication, genetic and cell samples taken from the embryo, genetic indication information, blood samples, data obtained during the implementation of medical diagnosis and treatment services such as testicular biopsy results and including but not limited to, other health, biometric and genetic data to be requested within the scope of treatment, blood type information in the identity card photocopy.  

V. PURPOSE OF PROCESSING PERSONAL DATA

Within the scope of your business relationship with Anatolia, your personal data which are subject to your disclosure to us, can be processed for the purposes listed below within the personal data processing conditions specified in Articles 5 and 6 of the Law No. 6698:

• Execution of patient admission and registration procedures,
• Carrying out patient examination processes,
• Informing, notifying and reminding you about your appointment in case of carrying out patient appointment processes and making an appointment,
• Making notifications and reminders by phone or message within the process as well as the initiation and continuation of IVF treatment,
• Initiation and continuation of intrauterine insemination (impregnation) therapy,
• Performing sperm analysis and creating the relevant report,
• Fulfillment of sperm freezing processes,
• Carrying out the transfer of frozen patient samples to Anatolia or another center,
• Carrying out disposal processes of frozen samples upon the request of patient,
• Conducting annual extension processes of the frozen samples,
• Implementation of oocyte freezing processes,
• Execution of sample decoding processes,
• Transfer of genetic samples to genetic laboratories in Turkey and abroad,
• Taking blood samples from the patients and conducting the necessary studies,
• Protecting public health, performing preventive medicine, medical diagnosis, treatment and care services,
• Sharing the essential information in line with the requests of the Ministry of Health and other relevant public institutions and organizations in accordance with the legislation implemented,
• Evaluating and executing fee policies within the scope of the patient treatment plan,
• Execution of fee payment and invoicing processes,
• Sharing the requested information by the finance and accounting units with institutions and organizations within the scope of financing your health services, covering your examination, diagnosis and treatment expenses,
• Planning and managing the internal operation of the institution by the administration of our center,
• Confirmation of your identity by our health professionals and secretariat units,
• Responding to any questions or complaints regarding the services we provide,
• Measurement and evaluation of patient satisfaction.
• Preserving the data that must be stored by us as per the relevant legislation,
• Ensuring identity verification by the relevant units,
• Carrying out the administrative, commercial and economic activities of our company,
• Orientation and training of employees,
• Ensuring the security of our company,
• Fulfilling our company's legal and contractual obligations,
• Risk management, quality improvement, prevention of abuse and violations,
• Confirming the relations of patients with the institutions contracted with our center,
• Conducting research and development studies,
• Supply of equipment, medicine and other equipment,
• Providing necessary information to regulatory and supervisory public/private legal entities and official institutions upon request or audit,
• We process the personal data of patients served at our center, visitors, business partners, employees and employee candidates with the aim of answering questions and complaints sent to us and measuring patient/visitor satisfaction as well as making improvements in the areas deemed necessary and including but not limited to, within the scope of all our administrative and commercial activities.

VI. ENSURING THE SECURITY OF PERSONAL DATA  

As Anatolia IVF and Women's Health Services Inc., in accordance with the PDPL and relevant legislation, we fulfill the technical and administrative measures considered necessary, within the framework of the required technological infrastructure, to ensure the security of your personal data stored, which we process within the framework of the activities of company. In this regard, we take precautions against data breaches, unauthorized access, data loss, unauthorized modification of data and other threats, and carry out the necessary controls. In this context, we identify current risks and threats, train our employees and carry out awareness activities, and determine policies and procedures regarding personal data security. The following technical and administrative measures are taken within our company, and necessary controls are carried out in order to properly implement these measures.

• Technical Measures Taken to Ensure the Legal Storage of Your Personal Data, the Prevention of Unlawful Processing and Access Your Data;
• Personal data storage, processing and access activities are supervised by the established technical systems.
• The technical measures taken are reported to the person concerned.
• Staff with technical knowledge is employed.
• Access authorizations are limited, cryptographic control and key management are used, and authorizations are regularly reviewed.
• Software and hardware including virus protection systems and firewalls are used.
• In order to ensure the safe storage of personal data, backup programs are used in accordance with the law.
• Access to data storage areas where personal data are stored are logged, and inappropriate access or access attempts are instantly communicated to those concerned.

Technical Measures Taken to Ensure the Legal Storage of Your Personal Data and the Prevention for Unlawful Processing and Access Your Data;

• Employees are informed and trained about the law of protection, storage and processing of personal data.
• Personnel who will process, store and access personal data in the personal data processing inventory have been designated.
• All activities carried out are analyzed in detail in all departments, and as a result of this analysis, personal data processing activities specific to the commercial activities carried out by the relevant business units are revealed.
• Awareness is created and implementation rules are determined specifically for the relevant departments in order to ensure the legal compliance requirements determined on the basis of departments; necessary administrative measures are implemented through internal policies and trainings to ensure the supervision of these issues and the continuity of implementation.
• Employees are informed that, in violation of the provisions of Personal Data Protection Law No. 6698, they cannot disclose the personal data they have acquired to anyone else and cannot use it for purposes rather than processing, and that this obligation will continue after they leave the job, and necessary commitments are given by them in this direction.
• Apart from the instructions of Anatolia IVF and Women's Health Center Inc. and the exceptions brought by the law, the records that impose the obligation not to process, disclose and use personal data are included in the contracts and documents governing the legal relationship between the employees; and the awareness among the employees is created in this regard.

In addition to these, in accordance with the data security principles envisaged within the scope of LPPD, we ensure personal data minimization, create the necessary confidentiality agreements with data processors, provide our employees the essential training to ensure the security of personal data and prevent violations, and finally take the necessary measures for the security of personal data stored in the physical and electronic environments. Our company has been entitled to receive the ISO 9001-2015 certificate in line with our practices in information security management. In addition, our studies for ISO-15189 continue.

VII. TRANSFER OF PERSONAL DATA IN THE COUNTRY AND ABROAD 

For the purposes described in this policy text and within the framework of the Basic Law on Health Services No. 3359, the Decree Law No. 663 on the Organization and Duties of the Ministry of Health and Affiliated Institutions, Personal Data Protection Law No. 6698, the Regulation on the Processing Personal Health Data and Protection of Privacy and other Regulations and for the purposes set forth in this Clarification Text, your personal data and personal health data are transferred to;

• The Ministry of Health, sub-units and family medicine centers affiliated to the ministry,
• Social Security Institution,
• General Directorate of Security and other law enforcement agencies,
• General Directorate of Population, courts and enforcement offices,
• Turkish Pharmacists' Association,
• Regulatory and supervisory authorities,
• Insurance companies (health, retirement, life insurance, etc.)
• Representatives authorized with a power of attorney issued by the patients with special authorization,
• Laboratories, medical centers and other centers in the country and abroad with which we cooperate for medical diagnosis and treatment,
• In vitro fertilization centers and state or private university hospitals where the patient's frozen samples (embryo, sperm, egg) are transferred or the patient himself/herself applies,
• Third parties from which we receive consultation, including lawyers, tax consultants and auditors who work with us,
• Our suppliers from which we receive services to carry out our activities, and domestic/overseas organizations, 
• Electronic Medical Records and Electronic Health Records systems,
• The third parties sometimes in order to improve the efficiency and employment policies of Anatolia IVF and Women's Health Services Inc., and to ensure sustainability,
• Banks in order to fulfill the obligations of the employer within the scope of the employment contract,
• Third parties, SAP practices and backup systems we work with, in order to administer and manage the business within our company, to carry out company business, to implement company policies, and to manage and execute the workflow efficiently.

VIII. METHODS OF COLLECTION OF PERSONAL DATA AND LEGAL REASONS: 

Provided that the data are given by you and third parties during the establishment and continuation of your patient relationship with Anatolia, your personal data shall be collected, stored and processed through electronic media such as internet, e-mail, channels like telephone, mail, fax, and physically printed forms or commitments, within the scope of the purposes specified above, based on the following legal compliance reasons listed in the provisions of Articles 5, 6 and 8 of the Law:

• Your explicit consent,
• Provided that it is directly related to the establishment or execution of a contract, necessity of processing the personal data of the parties in the contract, providing the requested products and services, and fulfilling the requirements of the contracts you have concluded, 
• Being revealed to the public by the person concerned,
• Necessity of data processing for the establishment, use or protection of a right,
• Provided that the fundamental rights and freedom of the person concerned are not harmed, necessity of processing data for the legitimate interests of data controller. 

Your special quality personal data are collected, stored and processed based on the following legal compliance reasons:

• Your explicit consent,
• Regarding the personal data except health, without seeking explicit consent in cases envisaged by the law,
• Regarding the personal data related to health, for the purposes of protecting public health, implementation of preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing by persons or authorized institutions and organizations under confidentiality obligation, without seeking the explicit consent of the person concerned.

IX- DISPOSAL OF PERSONAL DATA 

Personal data processed within the framework of the activities of Anatolia IVF and Women's Health Services Inc. shall be stored within the framework of the purpose of processing, and during the periods required to achieve this purpose and for the storage, envisaged within the framework of the relevant legislation. The data that have lost their function, of which its storage period has expired, or the data requested to be disposed by the data owner, if possible, within the framework of the legislation, shall be disposed by using the appropriate method of erasure, destruction or anonymization of the personal data listed in Article 7 of the PDPL. If you would like to examine the procedures and principles of Anatolia IVF and Women's Health Services Inc. regarding the disposal of personal data with more details, you can review the text of the "POLICY ON DISPOSAL OF PERSONAL DATA" on our website.

X. RIGHTS OF PERSONAL DATA OWNER 

In accordance with the provisions of Article 11 of the Law, you have the following rights in relation to your personal data.

•    Learning whether personal data and/or personal health data are processed,
•    Requesting information if your personal data and/or personal health data have been processed, 
•    Accessing and requesting personal health data,
•    Learning the purpose of processing personal data, and whether the data are used in accordance with its purpose,
•    Learning the third parties, to which personal data are transferred in the country or abroad,
•    Requesting correction of personal data and/or personal health data in case in which the data are incomplete or incorrectly processed,
•    Requesting the erasure or destruction of personal data within the framework of the conditions envisaged in Article 7 of the PDPL; and the erasure of personal health data within the framework of the conditions envisaged in the amended Article 9 of the Regulation,
•    In case of correction, erasure or destruction of personal data, requesting the notification of these processes to third parties to which personal data have been transferred,
•    Objecting to the emergence of a result against himself/herself as the data owner by being analyzed of processed data solely by automatic systems,
•    Requesting compensation in case of suffering loss due to unlawful processing of the personal data.

XI. IF YOU WANT TO CONTACT US FOR YOUR RIGHTS AND REQUESTS

In accordance with your legal rights envisaged in the relevant law and other legislation, you can personally submit your requests to our address at Cinnah Caddesi No: 54, Çankaya/Ankara, with a petition, or send it through a notary public. In addition, you can forward your requests to anatoliatupbebek@hs01.kep.tr by using the registered e-mail (KEP) address, secure electronic signature, mobile signature or the e-mail address you have previously notified to our Company and registered in our systems, in accordance with Article 5 of the "Communiqué on the Procedures and Principles of Application to the Data Controller".   You will be required to submit your request regarding the application of your above-mentioned rights in Turkish in accordance with the 1th sub-article of Article 13 of the PDPL and the "Communiqué on the Procedures and Principles of Application to the Data Controller" No. 30356, dated 10.03.2018.

 Your application should include;

• Your name, surname and your signature if the application is in writing,
• R.T. identification number for citizens of the Republic of Turkey, nationality, passport number or identification number, if any, for foreigners,
• Residential address or workplace address for notification,
• The e-mail address, telephone and fax numbers, if any, for notification, and
• The subject of your request. 

Applications to be made within this scope will be accepted by us following the identity verification, and your requests will be concluded as soon as possible or within 30 days at the latest, depending on the nature of the request. In case in which a written response is given to the application, no fee will be charged for up to 10 pages, and 1 Turkish Lira may be charged as processing fee for each page over 10 pages. If the response to the application is given in a recording medium such as a CD or flash memory, a fee may be charged for the cost of the recording medium.

Anatolia’s vision is that quality control and improvement is an indefinite process and “there is always room for improvement”.

Anatolia operates with its experienced team. Professor Polat has been working at Anatolia since it's foundation by Professor Yaralı in 2005. The majority of the staff (~70%) have been working at Anatolia for the last 10+ years.

The high success rates of Anatolia with reasonable price permits a very cost-effective treatment plan for international patients in 2023.