Outpatient Services

Imaging Services

Laboratory Services

Check-up

INTERMED DATA BREACH RESPONSE PLAN

SECTION ONE

Purpose, Scope, and Definitions

Purpose

Article 1 – In order to take all necessary technical and administrative measures in the processing of personal data, aimed at ensuring the appropriate level of security, particularly as İntermed Sağlık Hizmetleri Anonim Şirketi and all other affiliates of it and other companies and healthcare centers within it (“Intermed”), in order to protect the fundamental rights and freedoms of individuals, particularly the right to privacy, to prevent unlawful processing of personal data, to prevent unlawful access to personal data and to ensure the retention of personal data; the purpose of this Plan is to define the roles and responsibilities and to set out the procedures and principles regarding the issues such as who will be reported by Intermed, as the data controller, within it, in case personal data processed are obtained by others through unlawful means, and who is responsible within it for the notifications to be made under the Law and for the evaluation of the possible consequences of the data breach.

Scope

Article 2 – The scope of this Plan covers those employees assigned in the processing of personal data processed by Intermed physically or electronically.

Definitions

ARTICLE 3 – In the implementation of this Plan;

  • Express consent: Refers to a consent in relation to a specific matter, which is given upon being informed and of one’s own free will,
  • Data Subject: Refers to a natural person whose personal data are processed,
  • Intermed: Refers to Intermar Sağlık Hizmetleri A.Ş., Intermed Laboratuvar Hizmetleri Ltd. Şti., Intermet Sağlık Hizmetleri A.Ş. Ultra Görüntüleme Merkezi A.Ş., Unimed Anadolu Sağlık Hizm. Ve Tic. A.Ş., Unimed Sağlık Hizmetleri ve Tic. A.Ş., EWRS Tıbbi Cihazlar Ticaret Ltd. Şti, and Affidea Sağlık Hizmetleri ve Tic.A.Ş., particularly Intermed Sağlık Hizmetleri A.Ş.
  • Law: Refers to the Law on the Protection of Personal Data no. 6698,
  • Personal data: Refers to any information related to an identified or identifiable natural person,
  • Processing of personal data: Refers to any operation performed on data, such as obtaining, recording, storing, retaining, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, by fully or partly automated means or by non-automated means provided that they are part of a data recording system,
  • Board: Refers to the Personal Data Protection Board,
  • Private personal data: Refers to biometric and genetic data of persons as well as data with respect to their race, ethnicity, political view, philosophical belief, religion, sect or other beliefs, appearance, association, foundation or trade union membership, health, sexual life, criminal conviction and security measures (the term "personal data" used hereinafter also covers "private personal data" as applicable),
  • Plan: Refers to Intermed Data Breach Response Plan,
  • Data processor: Refers to the natural or legal person who processes personal data on behalf of and based on the authority granted by the data controller,
  • Data processor: A real or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller,
  • Data recording system: Refers to any recording system in which personal data are processed by being structured according to specific criteria,
  • Data supervisor: Refers to the natural or legal person who determines the purposes and means of processing of personal data, and is responsible for the establishment and management of the data recording system,

means.

SECTION TWO

Data Breach

Data Breach

Article 4 – In accordance with paragraph 5 of article 12 of the Law, a data breach is the unlawful acquisition by others of personal data processed by Intermed.

In addition to the above definition, an accidental unlawful destruction, loss, alteration, unauthorized disclosure and/or access to personal data transmitted, retained or processed shall also be considered as a Data Breach within the scope of the Plan.

SECTION THREE

Objectives, Officials and Responsibilities

Objectives

Article 5 – In case of a Data Breach, objectives of Intermed within the framework of the Plan are:

  • To investigate the incident that caused the Data Breach internally in all relevant departments (in cooperation with law enforcers and other public institutions and organizations when necessary),,
  • To identify the source of the Data Breach,
  • To identify the groups of persons/parties affected by the Data Breach,
  • To identify the personal data categories affected by the Data Breach,
  • To identify the potential impacts that the parties affected by the Data Breach have currently suffered and are likely to suffer, and to ensure that the damages arising from these impacts, if any, are minimized,
  • To identify the extent of the effects of the Data Breach on Intermed's organization as well as the commercial losses, reduction in operations, reputational losses and/or financial losses which have arisen as a result of the Data Breach, and to ensure that they are minimized lawfully,
  • To identify the duration of recovery following the Data Breach,
  • If there is a cyber attack, to identify;
    • Whether information systems were affected by the cyber attack,
    • The breach element that occurred as a result of the attack,
    • The effects of the cyber attack on Intermed's organization, and
    • The duration of recovery following the Data Breach,
  • To determine the steps to be taken to prevent the breach from recurring, and to calculate the estimated time it will take to complete them,
  • To notify the incident that caused the Data Breach or the loss that has arisen as a result of the incident,
    • To the Board, within 72 hours in accordance with the Law,
    • To the data subjects affected by the Data Breach, as soon as possible, by appropriate methods,
    • To the employees, as soon as possible,
    • To other domestic organizations or institutions, if necessary, within a time period in accordance with the relevant legal obligations,
  • To other data protection authorities or relevant institutions abroad, within a time period in accordance with the relevant legal obligations,
  • To organize internal audits and training activities and to ensure internal communication after the incident that caused the Data Breach, in order to minimize possible Data Breaches that may occur in the future; and
  • Record the information related to data breaches, their effects, and the measures taken, and keep them available for the Board's review.

Officers and Responsibilities

Article 6 – In case a Data Breach occurs, the departments in charge within Intermed shall be determined according to the nature of the incident that caused the Data Breach, in accordance with this Plan, however, in all cases, minimum one representative shall be assigned from each of the departments listed in the below table. The responsibilities of the representatives are also specified in the same table.

Department in Charge Responsibilities in Case of a Data Breach
Data Protection Officer (DPO) 1. Investigate the incident that caused the Data Breach internally with all relevant departments (in cooperation with law enforcement and other public institutions and organizations, if necessary).
2. Determine the source of the Data Breach.
3. Determine the personal data categories affected by the Data Breach.
4. Determine the person groups/parties affected by the Data Breach.
5. Determine the current and potential impacts that the parties affected by the Data Breach are likely to experience and ensure that the damages arising from these impacts, if any, are minimized.
6. Determine the extent of the impacts, commercial losses, reduction in operations, reputational losses and/or financial damages on İntermed's organization as a result of the Data Breach and ensure that they are minimized in a legal manner.
7. Determine the time frame for recovery following the Data Breach.
8. Determine the steps taken to prevent the breach from recurring and calculate the estimated time it will take to complete them.
9. Report the incident that caused the Data Breach or the resulting loss to the Board within 72 hours in accordance with the Law.
10. Notify other data protection authorities or relevant institutions abroad within the timeframe in accordance with the relevant legal obligations.
11. Record information, effects and measures taken regarding data breaches and keep them ready for the Board's review.
12. Organize internal audits, organize training activities and ensure internal communication after the incident leading to the Data Breach in order to minimize possible Data Breaches in the future.
13. In the event that personal data held by the data processor is obtained by others through illegal means, ensure that the necessary notification is made to the Board if the data processor notifies the data controller without any delay.
14. Ensure that the plan is reviewed every 6 (six) months from the effective date.
IT Department In case the data breach occurs through a cyber attack or other electronic means;
1. To identify whether information systems were affected by the Data Breach.
2. To identify the breach element that occurred as a result of the Data Breach.
3. To identify the effects of the Data Breach on Intermed's organization.
4. To identify the duration of recovery following the Data Breach.
HR Department 1. To identify whether the data breach was committed by an employee of Intermed.
2. To identify whether the employees of Intermed were affected by the Data Breach.
3. To identify the breach element that occurred as a result of the Data Breach, the effects of the Data Breach on Intermed's organization, and the duration of recovery following the Data Breach.
4. To prepare training activities and to achieve internal communication after the incident that caused the Data Breach.
5. To notify the incident that caused the Data Breach or the loss that has arisen as a result of the incident, to the employees, as soon as possible.
6. To perform internal audit after the incident that caused the Data Breach.
7. To notify the incident that caused the Data Breach or the loss that has arisen as a result of the incident, to the data subjects affected by the Data Breach, as soon as possible, by appropriate methods.
8. To notify the same to other domestic organizations or institutions, if necessary, within a time period in accordance with the relevant legal obligations.
Table 1: Officials Within the Scope of the Data Breach Response Plan and Their and Responsibilities

SECTION FOUR

Notification

Notification by the Data Controller

Article 6 – In case a Data Breach occurs, the departments in charge within Intermed shall be determined according to the nature of the incident that caused the Data Breach, in accordance with this Plan, however, in all cases, minimum one representative shall be assigned from each of the departments listed in the below table. The responsibilities of the representatives are also specified in the same table.

  • Notify the Data Breach to the Board, without delay and within 72 hours at the latest from the date when it comes to know the Data Breach,
  • Notify the Data Breach to the data subjects as well, as soon as reasonably possible, following the identification of the persons affected by the aforementioned data breach, directly, if the data subject’s contact address can be reached, or through appropriate methods such as by publishing it on the data controller’s own website, if the data subject’s contact address cannot be reached.
  • In case it fails to notify the Board within 72 hours, with a justified reason, disclose to the Board the reasons for the delay, along with the notification to be made,
  • Use the Personal Data Breach Notification Form, which is available at “https://ihlalbildirim.kvkk.gov.tr/”, in the notification to be made to the Board.
  • In case it uses the Personal Data Breach Notification Form, which is available at https://ihlalbildirim.kvkk.gov.tr/, in the notification to be made to the Board, read the “Personal Data Breach Notification Form (Internet) Guide” which is available at the same address,
  • In cases where it is not possible to provide the information in the form at the same time, provide such information gradually without delay, and
  • Record the information related to data breaches, their effects, and the measures taken, and keep them available for the Board's review.

Intermed carries out all the aforementioned processes regarding notification, through its departments specified in Article 5 of this Plan and detailed in the table in the same article.

Principles of Notification to the Data Subject

Article 7 – In accordance with the Decision No. 2019/271 dated 18.09.2019 of the Personal Data Protection Board, the notification to the data subjects affected or suspected to have been affected by the data breach shall be made in a clear and plain language, and include the following elements at a minimum:

  • On the basis of personal data categories (by distinguishing between personal data/private personal data), information on the personal data that are affected by the breach,
  • Possible consequences of the personal data breach,
  • Measures taken or suggested to be taken to mitigate the adverse effects of the data breach,
  • The names and contact details of the contact persons who will provide information to the data subjects about the data breach or the full address of the data controller's website, call center number and similar communication methods yolları

Notification by the Data Processor

Article 8 – In case personal data held by the data processor are obtained unlawfully by others, the data processor must notify Intermed, which is the data controller in this respect without any delay. Following the notification by the data processor, Intermed shall notify the Board by following the process in Article 6 of the Plan.

Data Breach Abroad

Article 9 – In the case the data breach occurs in a data controller resident abroad, if the consequences of such breach affect the data subject resident in Türkiye and the data subjects utilize the goods and services provided, in Türkiye, this data controller shall also notify the Board within the framework of the principles specified in article 6 of the Plan.

SECTION FIVE

Miscellaneous

Entry into force

Article 10 – This Plan, which was prepared by Intermed, is valid from the date when it enters into force in accordance with the decision taken by the management body.

Plan Review

Article 11 – This Plan, which was prepared and put into force, shall be reviewed periodically once a year.

DATE OF UPDATE/VERSION

The changes made to this Plan are set out in the below table.

UPDATE DATE/VERSION SCOPE OF UPDATES
8.2.2021 / 00 Initial publication of the plan