Skip to content
One Dose

Privacy Policy

Privacy Policy

This Notice on the Processing of Personal Data has been prepared by our company, One Dose Sağlık Teknolojileri Anonim Şirketi (“Company” or “One Dose”), in its capacity as “Data Controller”, pursuant to the Personal Data Protection Law No. 6698 (“KVKK”) published in the Official Gazette dated 7 April 2016 and numbered 29677, the Regulation on Personal Health Data published in the Official Gazette dated 21 June 2019 and numbered 30808, the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform published in the Official Gazette dated 10 March 2018 and numbered 30356, and other applicable legislation. As One Dose, pursuant to Article 10 of the KVKK, we wish to inform you about our personal data processing activities within the scope of the remote healthcare services we provide through our website and our One Dose – Health application.

1. Data controller

Pursuant to the KVKK, One Dose, as data controller, may process, record, store, classify and update your personal data accurately and so that it remains up to date, in connection with, limited to and proportionate to the purposes explained below, in accordance with the law and the principle of good faith, and may disclose or transfer it to third parties where the legislation permits and/or limited to the purposes for which it is processed.

“Personal data” means any information relating to an identified or identifiable natural person.

“Special category personal data” means data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, denomination or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

“Processing” means any operation performed on data, including but not limited to those regulated in the KVKK, such as collecting, recording, storing, retaining, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, wholly or partly by automated means, or by non-automated means provided that the data form part of a data filing system. Your personal data may be processed by personnel authorized within the Company.

2. Personal data we process

We process your personal data in the categories below, including data you share with us when registering for the One Dose application and afterwards while receiving remote services.

  • Identity: Full name, Turkish identity number, gender, date of birth
  • Contact: Email address, telephone number, contact address
  • Customer transaction: Appointment details, information about your service history
  • Transaction security: Device operating system and version, type and model, IP address, user activity logs, passwords (stored in encrypted form)
  • Health: Height, weight and current illnesses; medical history including medicines used regularly, habits and past surgeries; anamnesis, examination findings, laboratory results, radiology images and reports and other test reports, prescriptions, information on the specialty to which you are referred, reports of consultations with clinical psychologists and dietitians, diet prescriptions, visual and audio recordings of consultations with physicians, and other health information you record in our system
  • Insurance: Social Security Institution data and data relating to private health insurance
  • Finance: Bank account number, IBAN, credit card number, invoice details

3. Purposes of processing

Your personal data are collected by the Company through electronic communication channels so that the purposes described in this notice can be carried out, and on the basis of those purposes.

  • Registering users through the application
  • Recording users’ appointments through the application
  • Meeting the obligations required by the Regulation on the Provision of Remote Healthcare Services and other applicable legislation
  • Carrying out the sale, provision and performance of the products and services offered by the Company, including medical diagnosis, treatment and care provided by physicians and healthcare institutions registered in our system
  • Carrying out storage and archiving
  • Financing and planning healthcare services
  • Sharing information requested by private insurance companies
  • Ensuring the security of the data controller’s operations
  • Carrying out service operations and organization
  • Providing intermediary services within remote healthcare
  • Carrying out finance and accounting

Legal basis: KVKK Article 5/2(ç), “processing is necessary for the data controller to comply with a legal obligation”; KVKK Article 5/2(c), “processing is necessary for the performance of a contract to which the data subject is party, provided that it is directly related to the establishment or performance of that contract”; KVKK Article 5/2(f), “processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”; and explicit consent.

4. Transfer of your personal data

Personal data processed for the purposes explained above may be transferred to, shared with and/or made accessible to the parties listed below, in line with the general principles of the KVKK and within the conditions and purposes for processing personal data set out in Article 8 of the KVKK.

  • Your identity, contact and customer-transaction data may be shared with the Ministry of Health under KVKK Article 5/2(a), because remote healthcare transactions must be recorded in the central health system, and under KVKK Article 5/2(c), because sharing is necessary for the performance of the contract, for the performance of products and services, medical diagnosis, treatment and care, and storage and archiving.
  • Your health data may be shared, based on your explicit consent, with physicians and healthcare institutions registered in our system who are bound by a duty of confidentiality, so that the patient can be assessed, tests and examinations can be carried out, diagnosis and treatment can be provided, patient relations can be managed and medical services can be delivered.
  • Your health data may be shared, based on your explicit consent, with contracted insurance companies for the financing and planning of healthcare services and to meet those companies’ requests for information.
  • Your identity, contact, insurance and finance data may be shared with the insurance company and support or consultancy providers under KVKK Article 5/2(e) for financing, confirmation of contracted institutions and eligibility checks.
  • Your identity, contact, customer-transaction and transaction-security data may be shared with our cloud service provider under KVKK Articles 5/2(c) and 5/2(ç) so that the services can be performed, and with the identity-verification sharing service of the Ministry of the Interior for identity verification.
  • Your identity, contact, customer-transaction and finance data may be shared with our contracted accountants under KVKK Article 5/2(ç) for finance and accounting.
  • Your identity, contact and customer-transaction data may be shared with contracted service providers that support our CRM system under KVKK Article 5/2(f) for service performance, personalization, handling questions and complaints, and marketing and advertising.
  • Your health data may be made accessible to our CRM support providers for the same purposes, based on your explicit consent.
  • Your contact data may be shared with the Ministry of Trade of the Republic of Türkiye and with TOBB under KVKK Article 5/2(ç), because commercial electronic messages must be registered with the Message Management System (İYS).
  • Your identity and contact data may be shared with the relevant software or portal provider under KVKK Article 5/2(f) in order to track permissions for commercial electronic messages and records of explicit consent.

The Company undertakes to keep personal information strictly private and confidential, and to take every necessary measure and exercise due care to prevent unauthorized use of personal information or its disclosure to a third party.

5. Your rights as a data subject under Article 11 of the KVKK

If you submit a request concerning these rights in writing, together with documents that identify you and a KVKK application form explaining the right you wish to exercise, either in person or by registered mail with return receipt to Konutkent Mah. 3028. Cad. No: 8D İç Kapı No: 27 Çankaya/ANKARA, or by email to info@onedose.io, the Company will assess the request and conclude it within 30 (thirty) days at the latest, as provided by the KVKK. No fee is charged for requests as a rule; however, the Company reserves the right to charge the fee set in the tariff determined by the Personal Data Protection Board.

Without prejudice to the cases set out in Article 28 of the KVKK, titled “Exceptions”, we inform you, in our capacity as “Data Controller” under the KVKK, that by applying to the Company you have the right to learn whether your personal data are being processed; if they are, to request information about that processing; to learn the purpose of processing and whether the data are used in line with that purpose; to know the third parties to whom the data are transferred in Türkiye or abroad; to request notification of the operations carried out by those third parties; to request correction if the data have been processed incompletely or inaccurately; to request erasure or destruction when the reasons requiring processing no longer exist; to request that these operations be notified to third parties to whom your personal data have been transferred; to object to a result to your detriment reached solely by automated analysis; and to claim compensation if you suffer damage because your data were processed contrary to the KVKK.

One Dose Sağlık Teknolojileri A.Ş. — Registered office: Konutkent Mah. 3028. Cad. No: 8D İç Kapı No: 27 Çankaya/ANKARA — Tel: 0 850 450 06 06 — Mersis No: 0544128049300001