As Specialist Dr. Armin Müştak, we attach importance to the privacy of our patients, their relatives, our employees, visitors, and individuals who contact us through our website, as well as to the security of their personal data.
Within the scope of Personal Data Protection Law No. 6698 (the “KVKK”), the data controller is Specialist Dr. Armin Müştak.
This Information Notice has been prepared to inform you about the purposes and legal grounds for processing your personal data, the persons and organisations to whom such data may be transferred, the methods by which it is collected, and your rights regarding your personal data.
Identity and Contact Details of the Data Controller
Data Controller: Specialist Dr. Armin Müştak
Address: Yıldızevler Mahallesi, Turan Güneş Bulvarı, 709. Sokak, No: 2/13, Floor: 4, 06550 Çankaya / Ankara, Türkiye
Email: info@arminmustak.com.tr
Telephone: +90 531 517 51 51
Website: https://www.arminmustak.com.tr/
Personal Data Processed
Depending on the nature of the healthcare service provided and the method by which you communicate with us, the following personal data may be processed:
- Identity data: First name, surname, Turkish ID number, passport number, date and place of birth, and gender.
- Contact data: Telephone number, email address, and address information.
- Health data: Examination findings, medical and family history, diagnosis and treatment information, medications used, allergies, laboratory and imaging results, prescriptions, procedure records, and follow-up information.
- Visual and audio data: Photographs and images taken for medical assessment or treatment follow-up where necessary and where the relevant legal conditions are met. Telephone calls are not audio-recorded.
- Security camera footage: Images recorded for security purposes in the entrance, waiting, and common areas of the practice. No security camera recording is made in examination or procedure areas where privacy must be protected.
- Appointment and communication data: Appointment date, reason for application, messages, and request content.
- Financial data: Payment, invoice, bank, and private health insurance information.
- Legal transaction data: Requests, complaints, applications, litigation, and official correspondence.
- Digital transaction and security data: Website access data, IP address, cookie records, and technical logs kept to ensure the security of information systems.
- Professional, personnel, education, and employment data relating to employees and job applicants.
Health data, biometric data, and genetic data constitute special categories of personal data under the KVKK. Our practice processes only the data necessary for the services provided, in a manner that is relevant, limited, and proportionate to the purpose.
Purposes of Processing Personal Data
Your personal data may be processed for the following purposes:
- Verifying your identity and creating your patient record,
- Providing medical examination, diagnosis, treatment, care, and follow-up services,
- Planning appointment processes and providing appointment-related information,
- Creating and retaining patient files and medical records,
- Carrying out prescription, report, test, and treatment processes,
- Protecting public health and planning healthcare services,
- Fulfilling record-keeping, notification, and archiving obligations arising from applicable legislation,
- Responding to requests from the Ministry of Health and other authorised public institutions,
- Carrying out payment, invoicing, and accounting transactions,
- Preparing invoices and necessary documents for private health insurance procedures upon request,
- Responding to patients’ requests, questions, and complaints,
- Assessing patient satisfaction and improving service quality,
- Ensuring the security of information systems, patient records, and the physical premises of the practice,
- Establishing, exercising, or protecting a legal right in the event of a legal dispute,
- Fulfilling legal obligations towards authorised institutions.
The use of patients’ photographs and images for promotional, social media, educational, or publication purposes is different from their use for medical records and treatment follow-up. Such use is carried out only to the extent permitted by applicable legislation and, where required, after obtaining separate explicit consent or permission.
Electronic communications for promotional or marketing purposes are assessed separately from mandatory communications required for the provision of healthcare services, and the individual’s separate consent is obtained where necessary.
Methods of Collecting Personal Data
Your personal data may be collected through the following methods:
- Your application to the practice and face-to-face interviews,
- Medical examinations, tests, treatments, and procedures,
- Telephone, WhatsApp, email, and similar communication channels,
- The website and online communication channels,
- Appointment and patient registration systems,
- Healthcare, appointment, patient follow-up, and practice record systems such as HSYS–MBYS, İxirlife, DoktorTakvimi, and Noa Notes,
- Laboratories, healthcare institutions, private insurance providers, and authorised public institutions,
- Security cameras located in the entrance, waiting, and common areas of the practice,
- Reports, test results, prescriptions, photographs, and other documents provided by the patient.
Your personal data may be processed by automatic or partially automatic means, or by non-automatic means provided that it forms part of a data recording system.
Legal Grounds for Processing Personal Data
Your personal data is processed on the basis of one or more of the conditions specified in Articles 5 and 6 of the KVKK.
Your identity, contact, appointment, financial, and legal transaction data may be processed on the following legal grounds:
- Processing is expressly provided for by law,
- Processing is necessary for compliance with a legal obligation,
- Processing is directly related to the establishment or performance of a contract,
- Processing is necessary for the establishment, exercise, or protection of a right,
- Processing is necessary for the legitimate interests of the data controller, provided that it does not prejudice your fundamental rights and freedoms.
Your health data is processed by a healthcare professional under a duty of confidentiality, on the basis of the conditions set out in Article 6 of the KVKK, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services.
Where explicit consent is required, your personal data is processed only after you have been informed and have provided your freely given explicit consent. You may withdraw your explicit consent at any time in respect of processing activities based on consent.
Parties to Whom Personal Data May Be Transferred
Your personal data may be transferred, only to the extent necessary and proportionate to the purpose of processing, to the following persons and organisations:
- The Ministry of Health and systems affiliated with the Ministry,
- Provincial and district health directorates,
- Courts, public prosecutors’ offices, law enforcement authorities, and other authorised public institutions,
- The Social Security Institution,
- Private health insurance providers where requested by the individual and where the relevant legal conditions are met,
- Laboratories, imaging centres, pharmacies, and other healthcare institutions,
- Accountants, certified public accountants, lawyers, and authorised advisers,
- Banks and payment service providers,
- Appointment, patient follow-up, practice management, data storage, and information technology service providers, including HSYS–MBYS, İxirlife, DoktorTakvimi, and Noa Notes,
- Website, email, server, backup, and technical support service providers,
- Other persons and organisations authorised to receive information for the fulfilment of legal obligations.
Transfers are made only where necessary and in accordance with the conditions specified in the KVKK.
If personal data is transferred abroad, the transfer conditions and appropriate safeguards set out in Article 9 of the KVKK are complied with.
Processing of Security Camera Footage
Security camera recordings are made in the entrance, waiting, and common areas of the practice in order to ensure the security of the practice, patients, employees, and visitors; to identify possible unlawful incidents; and to protect legal rights.
The camera system does not record sound. No camera recording is made in examination rooms, procedure areas, toilets, or areas where individuals have a high expectation of privacy.
Camera footage is protected so that it can be accessed only by authorised persons and is retained only for the period required by the purpose of processing. In the event of a legal incident or official request, the relevant footage may be retained until the dispute or legal process has been concluded.
Retention and Security of Personal Data
Your personal data is retained for the periods prescribed by applicable healthcare and tax legislation and for as long as required by the purpose of processing.
When the retention period expires and the legal ground requiring the processing of the data no longer exists, the personal data is erased, destroyed, or anonymised.
Appropriate technical and administrative security measures are taken to protect personal data against unauthorised access, loss, unlawful use, or disclosure.
Your Rights Under the KVKK
Under Article 11 of the KVKK, you have the right to apply to the data controller and:
- Learn whether your personal data is being processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing and whether the data is used in accordance with that purpose,
- Learn the third parties in Türkiye or abroad to whom your personal data has been transferred,
- Request the correction of incomplete or inaccurate personal data,
- Request the erasure or destruction of personal data under the conditions prescribed by law,
- Request that correction, erasure, or destruction operations be notified to third parties to whom the data has been transferred,
- Object to any adverse result arising from the analysis of your data exclusively through automated systems,
- Claim compensation for damage suffered as a result of the unlawful processing of your personal data.
Application Method
You may submit your requests under the KVKK by an application that explains your identity and request, using one of the following methods:
- Applying in person to Yıldızevler Mahallesi, Turan Güneş Bulvarı, 709. Sokak, No: 2/13, Floor: 4, 06550 Çankaya / Ankara, Türkiye,
- Sending your application to the same address through a notary public,
- Writing to info@arminmustak.com.tr from the email address that you previously notified to our practice and that is registered in our system,
- Using any other application method accepted under applicable legislation.
Your application must clearly state your first name, surname, contact details, information enabling verification of your identity, and the details of your request.
Applications will be concluded free of charge as soon as possible, depending on the nature of the request, and no later than 30 days. If the transaction requires an additional cost, the fee specified in the tariff determined by the Personal Data Protection Board may be charged.
Updates to the Information Notice
This Information Notice may be updated in accordance with changes in legislation or in the personal data processing activities of the practice. The current version is available at https://www.arminmustak.com.tr/.
Data Controller
Specialist Dr. Armin Müştak
