Privacy Policy & Data Protection

1. Introduction

DRFK Turkish International Day Surgery Center LLC ("we", "us", or "DRFK") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with:

• UAE Federal Law No. 45 of 2021 on the Protection of Personal Data
• Turkish Personal Data Protection Law (KVKK - Law No. 6698)
• EU General Data Protection Regulation (GDPR) where applicable
• Healthcare data protection regulations

2. What Personal Data We Collect

2.1 Patient Information

• Full name, date of birth, gender, nationality
• Contact details (phone number, email address, residential address)
• Emirates ID or passport information
• Insurance details and policy information
• Emergency contact information

2.2 Medical Information

• Medical history and current health conditions
• Diagnostic test results and medical imaging
• Treatment plans and prescriptions
• Surgery and procedure records
• Consultation notes and doctor observations
• Allergy information and medication history

2.3 Website Usage Data

• IP address and browser type
• Pages visited and time spent on site
• Referring website and search terms
• Device information and operating system
• Cookies and similar tracking technologies

2.4 Appointment and Communication Data

• Appointment booking details and preferences
• Communication records (emails, phone calls, chat messages)
• Feedback and survey responses
• Social media interactions

3. How We Use Your Personal Data

We process your personal data for the following purposes:

3.1 Healthcare Services

• Providing medical diagnosis, treatment, and care
• Managing your appointments and medical records
• Communicating with you about your treatment
• Coordinating care with other healthcare providers
• Processing insurance claims and payments

3.2 Legal and Regulatory Compliance

• Complying with UAE healthcare regulations
• Meeting legal obligations and responding to legal requests
• Maintaining accurate medical records as required by law
• Quality assurance and clinical audits

3.3 Communication and Marketing

• Sending appointment reminders and follow-up messages
• Providing health tips and wellness information (with consent)
• Informing you about new services and special offers (with consent)
• Conducting patient satisfaction surveys

3.4 Website and Service Improvement

• Analyzing website usage to improve user experience
• Troubleshooting technical issues
• Preventing fraud and ensuring security
• Enhancing our services based on feedback

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for the performance of a contract with you (e.g., providing healthcare services)
• Legal Obligation: Processing is necessary to comply with legal obligations (e.g., maintaining medical records)
• Vital Interests: Processing is necessary to protect your vital interests or those of another person
• Legitimate Interests: Processing is necessary for our legitimate interests (e.g., improving services, fraud prevention)

5. Data Sharing and Disclosure

We may share your personal data with the following parties:

5.1 Healthcare Providers

We may share your medical information with:

• Referring physicians and specialists
• Laboratories and diagnostic centers
• Hospitals and emergency services
• Pharmacies for prescription fulfillment

5.2 Insurance Companies

We share necessary information with your insurance provider for claim processing and payment authorization.

5.3 Service Providers

We work with trusted third-party service providers who assist us with:

• IT infrastructure and cloud hosting
• Payment processing
• Email and SMS communication services
• Website analytics and marketing tools

5.4 Legal and Regulatory Authorities

We may disclose your information when required by law or to:

• Comply with legal processes or government requests
• Enforce our terms and conditions
• Protect our rights, privacy, safety, or property
• Respond to emergency situations

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

• Encryption of data in transit and at rest (SSL/TLS)
• Secure server infrastructure with regular security updates
• Access controls and authentication mechanisms
• Regular security audits and vulnerability assessments
• Staff training on data protection and confidentiality
• Backup and disaster recovery procedures
• Physical security measures at our facilities

Despite our best efforts, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but strive to use commercially acceptable means to protect your data.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy and to comply with legal obligations:

• Medical Records: Retained for a minimum of 25 years as per UAE healthcare regulations
• Financial Records: Retained for 7 years as per UAE commercial laws
• Marketing Data: Retained until you withdraw consent or for 3 years of inactivity
• Website Analytics: Aggregated data retained indefinitely; personal identifiers deleted after 26 months

After the retention period expires, we securely delete or anonymize your personal data unless we are required to retain it for legal or regulatory purposes.

8. Your Rights

Under data protection laws, you have the following rights regarding your personal data:

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience and analyze site usage.

Types of Cookies We Use:

• Essential Cookies: Required for the website to function properly (e.g., session management)
• Analytics Cookies: Help us understand how visitors interact with our website (e.g., Google Analytics)
• Marketing Cookies: Track visitor behavior for advertising purposes (e.g., Google Ads, Facebook Pixel)
• Preference Cookies: Remember your settings and preferences

You can control and manage cookies through your browser settings. However, disabling cookies may affect the functionality of our website.

10. International Data Transfers

Your personal data may be transferred to and processed in countries outside the UAE, including Turkey and the European Union. When we transfer your data internationally, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by data protection authorities
• Data processing agreements with third-party service providers
• Adequacy decisions by UAE or EU authorities
• Encryption and security measures during transmission

11. Children's Privacy

Our services are not directed to children under the age of 18, except for pediatric medical services. When providing healthcare to minors, we obtain consent from parents or legal guardians. We do not knowingly collect personal data from children for marketing purposes.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending you an email notification (if you have provided your email address)
• Displaying a notice on our website homepage

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us: