This is a working draft based on the current website. Organisational details and actual practices are subject to review by legal counsel.
Purpose and scope
This policy sets out principles for handling special-category personal data such as health information. Medical reports or clinical photographs are not requested through the general contact form; a separate explanation should be provided when such data is needed for care.
Processing conditions and minimisation
Special-category data should be processed only for specific, legitimate purposes, to the extent necessary, and under an applicable condition in Article 6 of Turkish Law No. 6698. Where explicit consent is required, it should be requested separately after appropriate information is provided.
Administrative and technical approach
Role-based access, confidentiality, secure storage and transfer, access logs, backups and permission reviews are measures to assess for this category of data. The measures actually in place must be confirmed in internal procedures.
Disclosure and deletion
Recipients and the legal grounds for disclosing health data should be specified in the patient notice. When no processing or retention ground remains, data should be deleted, destroyed or anonymised using an appropriate method.
