ASLI ÇOBAN ARSLAN PRACTICE 

PERSONAL DATA STORAGE AND DESTRUCTION POLICY

ARTICLE 1- PURPOSE

Personal data storage and destruction policy ASLI ÇOBAN ARSLAN PRIVACY It has been prepared to determine the procedures and principles regarding the work and transactions regarding the storage and destruction of personal data processed by.

ARTICLE 2 – SCOPE

Personal data of employees, prospective employees, product and service buyers, potential product and service buyers, visitors and suppliers are within the scope of this policy. This policy applies to all recording environments where personal data owned or managed by the Workplace is processed and activities related to personal data processing.

ARTICLE 3 – DEFINITIONS

recipient group                                      : Category of natural or legal person to whom personal data is transferred by the data controller.

Explicit consent                                          Consent regarding a specific issue, based on information and expressed with free will .

Anonymization                    : Making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching it with other data.

Worker                                 : Workplace personnel

Electronic environment                            : Environments where personal data can be created, read, changed and written with electronic devices

non-electronic media            : All written, printed, visual, etc. except electronic media. other media

Service provider                              : Real or legal person who provides services within the framework of a specific contract with the workplace.

Related person                                 : Natural person whose personal data is processed

Related user  Persons who process personal data within the data controller organization or in line with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of the data .

Destruction  : Deletion, destruction or anonymization of personal data

Law                                  : Personal Data Protection Law No. 6698

recording media  : Any environment where personal data is processed by fully or partially automatic or non-automatic means, provided that it is part of any data recording system.

personal data  : Any information regarding an identified or identifiable natural person

Personal data processing inventory : Personal data processing activities carried out by data controllers depending on their business processes; The inventory they create by associating the personal data with the purposes and legal reason for processing personal data, data category, transferred recipient group and data subject person group, and detailing the maximum retention period required for the purposes for which personal data are processed, personal data envisaged to be transferred to foreign countries and measures taken regarding data security.

Processing of personal data               Obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or using personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system . Any action performed on data, such as blocking

Board  : Personal Data Protection Board

Special personal data  : Data regarding people’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data .

periodic destruction  : In case all the conditions for processing personal data specified in the law are eliminated, the process of deletion, destruction or anonymization is specified in the personal data storage and destruction policy and will be carried out ex officio at recurring intervals.

Policy                                 : Personal Data Storage and Destruction Policy

Workplace                                             : ASLI ÇOBAN ARSLAN PRACTICE

Product and service buyer : Patient

data processor                                     : Natural or legal person who processes personal data on behalf of the data controller, based on the authority given by the data controller.

Data recording system                            : Registration system where personal data is structured and processed according to certain criteria

Data controller  : Natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

Data controllers registry information system : Information system created and managed by the Presidency, accessible over the internet, to be used by data controllers in applying to the Registry and other relevant transactions related to the Registry.

VERBIS                      : Data Controllers Registry Information System

regulation                                      : Regulation on Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated 28 October 2017, 21.06.2019 dated 30808 numbered Official in the newspaper Regulation on Personal Health Data, which came into force after being published

ARTICLE 4 – RESPONSIBILITIES AND DUTIES

Employees and units of the workplace; It provides full and active support to the units responsible for obtaining, processing and storing personal data in accordance with the law. All employees and units support the responsible units in the implementation of administrative and technical measures taken within the scope of the policy, in training unit employees, in ensuring, increasing and monitoring the awareness of employees, in preventing unlawful access to personal data and in maintaining personal data in accordance with the law. Storage and destruction of personal data . The distribution of the titles, units and job descriptions of those involved in the processes is shown in ANNEX TABLE: 1 .

ARTICLE 5 – RECORDING MEDIA

Personal data is kept securely by the workplace in accordance with the law in the environments listed in ANNEX TABLE: 2 .

ARTICLE 6 – LEGAL REASONS REQUIRING STORAGE

Personal data processed in the workplace within the scope of activities are kept for the period stipulated in the relevant legislation and within the scope of the relevant legislation. The reasons that require storage in this context are as follows:

  • Storing personal data because it is directly related to the establishment and execution of contracts,
  • Storing personal data for the purpose of establishing, exercising or protecting a right
  • It is mandatory to keep personal data for the legitimate interests of the workplace, provided that it does not harm the fundamental rights and freedoms of individuals.
  • Storing personal data for the purpose of fulfilling any legal obligations of the workplace
  • Storage of personal data is clearly stipulated in the legislation
  • Explicit consent of data owners is required for storage activities that require explicit consent of data owners.

ARTICLE 7 – PURPOSE OF PROCESSING THAT REQUIRES STORAGE

The workplace may process the personal data of the data subject or third parties specified by the data subject for various purposes, including but not limited to:

  • Fulfillment of obligations arising from employment contracts and legislation for employees
  • Managing goods and services purchasing processes
  • Follow-up and execution of legal affairs
  • Carrying out activities in accordance with the legislation
  • Carrying out marketing processes of products and services
  • Carrying out after-sales support services for goods and services
  • Carrying out communication activities
  • Carrying out fringe benefits and benefits processes for employees
  • Managing goods and services purchasing processes
  • Creating and tracking visitor records
  • Carrying out occupational health and safety activities
  • Providing information to authorized persons, institutions and organizations
  • Performance of the service
  • Ensuring physical space security

PROCESSING OF SPECIAL PERSONAL DATA

race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress And outfit, society, foundation either in union membership, health, sexual vital, punishment conviction And security with its measures relating to datas with biometric And genetic datas special qualified personal data.

workplace private qualified personal of data in processing to the law And other Complies with the provisions of the legislation . In this regard, special personal data the following to the principles suitable aspect is processed:

  • to law And honesty to the rules suitable being
  • TRUE And when necessary current being
  • They are processed for the purpose connected, annoyed And measured being
  • Clear, open  and legitimate purposes processing for
  • in legislation predicted either in were committed aim for   necessary the one which… duration much

casing not to be

  • Special categories of personal data are collected in cases where the explicit consent of the data owner is obtained by the workplace or when required by law. predicted in cases is being processed.
  • Health data is collected with the explicit consent of the data owner. diagnosis, treatment and care in cases services execution, for the purpose of is being processed.

Health of your data in processing 21.06.2019 dated 30808 numbered Official in the newspaper in accordance with the provisions of the Regulation on Personal Health Data, which came into force after being published also respect is done.

ARTICLE 8 – LEGAL REASONS REQUIRING DESTRUCTION

Personal data is deleted or destroyed by the workplace upon the request of the relevant person or ex officio in case of the following situations:

  • Changing or removing the relevant legislative provisions that form the basis for the processing of personal data
  • Elimination of the purpose requiring processing or storage of personal data
  • In cases where processing of personal data occurs only on the basis of explicit consent, the relevant person may withdraw his/her explicit consent
  • In accordance with Article 11 of the Law, the application made by the relevant person for the deletion and destruction of his personal data within the framework of his rights is accepted by the data controller.
  • The maximum period requiring personal data to be stored has passed and there are no conditions that justify storing personal data for a longer period of time.

ARTICLE 9 – TECHNICAL MEASURES

The technical measures taken by the workplace regarding the personal data it processes are as follows:

  • Network security and application security are ensured.
  • Personal data is backed up and the security of the backed up personal data is ensured.
  • Up-to-date anti-virus systems are used
  • Encryption is done.

ARTICLE 10 – ADMINISTRATIVE MEASURES

Administrative measures taken by the workplace regarding the personal data it processes are as follows:

  • Employees are informed and informed about data security.
  • The authorities of employees who change their duties or leave their jobs in this area are removed.
  • The signed contracts contain data security provisions.
  • Personal data security policies and procedures have been determined.
  • Personal data security issues are reported quickly.
  • Personal data security is monitored.
  • Necessary security measures are taken regarding entry and exit to physical environments containing personal data.
  • The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
  • The security of environments containing personal data is ensured.
  • Personal data is reduced as much as possible.
  • Periodic and/or random audits are carried out within the institution.
  • Current risks and threats have been identified.
  • In case the processed personal data is obtained by others through illegal means, it notifies the relevant person and the Board as soon as possible.

ARTICLE 11- METHODS OF DELETION OF PERSONAL DATA

Personal data is deleted by the methods specified in ADDITIONAL TABLE: 3.

ARTICLE 12- METHODS OF DESTRUCTION OF PERSONAL DATA

Personal data is destroyed by the methods specified in ADDITIONAL TABLE: 4.

ARTICLE 13 – STORAGE AND DISPOSAL PERIOD

When determining the storage period of personal data by the workplace; First of all, if a period of time is stipulated in the legal legislation for the storage of personal data in question, this period is respected. Except that; The storage and destruction period table in ANNEX TABLE: 5 is taken as basis.

ARTICLE 14 – PERIODIC DESTRUCTION PERIOD

Periodic destruction of the workplace is carried out every year in January and June .

ARTICLE 15- PUBLISHING, STORING AND UPDATING THE POLICY

The policy is kept within the workplace as a printed paper copy with wet signature. The policy is reviewed as needed and necessary sections are updated. If it is decided to repeal the policy, the old copies with wet signatures are canceled and signed (with a cancellation stamp or written cancellation) and kept by the workplace for at least 5 years.

ARTICLE 16 – ENFORCEMENT

This Personal Data Storage and Destruction Policy …… /…. ./……  It entered into force after it was signed by the workplace official on . Procedures for any changes that can be made to the Policy are regulated in Article 15 of this Policy .

ADDITIONAL TABLE: 1 Storage and disposal processes task distribution

TITLEUNIT OFDUTY
business ownerWorkplaceResponsible for employees to comply with the policy.
business ownerWorkplaceResponsible for the preparation, development, execution, publication and updating of the policy in relevant media.
business ownerWorkplaceIt is responsible for providing the technical solutions needed in the implementation of the policy.
business ownerWorkplaceHe is responsible for the execution of the Policy in accordance with his duties.

 

ADDITIONAL TABLE: 2 Personal Data Storage Environments

Electronic MediaNon-Electronic Media
Computers

Mobile Devices

Printers, scanners, copiers

Removable and portable memories

papers

Written and printed media

visual recordings

Manual data recording systems

ADDITIONAL TABLE: 3 Methods of Deletion of Personal Data

Data Recording EnvironmentDeletion Method
Electronic environmentThe period requiring personal data stored electronically has expired.

for other employees (relevant users) except the database administrator

 is rendered inaccessible and unusable in any way.

physical environmentThe period requiring personal data kept in physical media to be stored has expired.

 Except for the person responsible for the document archive for employees, there is no

 is rendered inaccessible and unusable. Also, it cannot be read

 The darkening process is also applied by drawing/painting/erasing.

portable mediaStoring personal data kept in Flash-based storage media

whose required period has expired are encrypted and accessed by the business owner.

 It is secured with encryption keys, with authority given only to the system administrator.

in environments .

 

ADDITIONAL TABLE: 4 Anonymization of Personal Data through Destruction Methods

Data Recording EnvironmentDestruction Method
physical environmentPersonal data on paper whose storage period has expired,

 It is irreversibly destroyed in document shredder machines.

Optical or magnetic mediaThe period requiring personal data to be stored on optical media and magnetic media has expired.

objects , such as melting, burning, or pulverizing them

is applied .

 

Anonymization of special personal data

Personal of data anonymous halo bringing, personal of data Another with data under no circumstances with an identified or identifiable natural person, even if matched not relatable halo is to be brought.

 

Personal of data anonymous halo brought to be for; personal of data, data responsible or  third persons by back rotating and/or of data Another Appropriate recording environment and relevant field of activity, such as matching with data an identified or identifiable fact, even through the use of techniques with person not relatable halo bringing must.

 

APPENDIX TABLE: 5 Storage and Disposal Period Table

Sequence Number:Data categorydocument containing dataSTORAGE PERIODDESTRUCTION PERIOD
oneCommunicationForms, Patient consent form, Employment contracts10 years following the end of the employment relationship

20 years following receipt from Patient – Parent/Guardian/ Representative

180 days following the end of the storage period
2IdentityIdentity card sample, Family status statement, Passport photo, Patient consent form, Confidentiality agreements, Employment contracts10 years following the end of the employment relationship

20 years from date of receipt from Patient – Parent/Guardian/ Representative

180 days following the end of the storage period
3Professional experienceFamily status statement, Diplomas and certificates,10 years following the end of the employment relationship180 days following the end of the storage period
4Health information 

Health report

10 years following the end of the employment relationship /

In reports received due to occupational health and safety, the termination of the employment relationship

Following 15 years / Obtained from Patient -Parent/Guardian/ Representative

20 years following the

180 days following the end of the storage period
5personnelSample of identity card, Military status certificate10 years following the end of the employment relationship180 days following the end of the storage period
6Audiovisual RecordsPhoto-videos taken of patients10 years following acquisition180 days following the expiration of the storage period or, in the case of withdrawal of express consent, immediately from the withdrawal of consent.

 

…/…./….

ASLI ÇOBAN ARSLAN EXAMINATION ROOM

STAMP – SIGNATURE