01Data controller
The company below is the data controller for personal data processed through the BHT Quality portal. This notice has been prepared under the duty to inform in Article 10 of the Law.
- Company
- BHT CLINIC SAĞLIK ANONİM ŞİRKETİ
- Address
- Atakent Mahallesi 4. Cadde No: 36, 34307 Küçükçekmece / İstanbul
- info@bhtclinic.com.tr
- Phone
- 0850 811 34 00
02Which data do we process?
These are the data we collect from you or that the system generates during membership, application and evaluation:
| Type of data | Examples |
|---|---|
| Identity | Full name, Turkish ID or passport number |
| Contact | Email, phone, province, district, address |
| Professional | Organisation represented, duty, title, letter of authorisation; CV and references for BHT Ambassador applications |
| Organisation | Licence and tax details, scope of services, capacity and staff numbers |
| Application content | Form answers, self-assessment answers, uploaded documents and evidence, messages |
| Transaction security | Session data, failed login attempts, activity records on the application |
03For what purpose and on what legal basis?
Your data is processed for the purposes below, based on the legal grounds listed in Article 5 of the Law:
| Purpose | Legal basis |
|---|---|
| Creating membership and verifying authority | Establishing and performing a contract (Art. 5/2-c) |
| Application, document check, self-assessment and evaluation | Performing a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Contract, decision and certificate records | Legal obligation (Art. 5/2-ç); establishing, exercising or protecting a right (Art. 5/2-e) |
| Process notifications and messaging | Performing a contract (Art. 5/2-c) |
| Portal security and activity records | Legal obligation (Art. 5/2-ç); legitimate interest (Art. 5/2-f) |
| Answering questions from the contact form | Legitimate interest (Art. 5/2-f) |
04Who do we share your data with?
Your data is not sold or shared for marketing. It is only made available to the following, as far as the process requires:
- The evaluation team assigned to your application: sees your answers and evidence but cannot see your ID number.
- Programme administrators: have access for the document check and decision processes.
- Hosting and email service providers: only to run the service, under confidentiality obligations.
- Competent authorities: only when legally required.
If a transfer abroad becomes necessary, the conditions in Article 9 of the Law will be met and this notice updated.
05How long do we keep it?
Data is kept for as long as the purpose requires and for the periods set by law, and is then deleted, destroyed or anonymised.
| Record | Period |
|---|---|
| Membership, application and evaluation records | Throughout the programme relationship and until the end of statutory retention periods |
| Contact form messages | Until the request is closed and for any possible dispute period |
| Session data | 14 days or until you log out |
| Email verification and password links | Verification and invitation links are valid for 3 days, password reset for 2 hours |
| Failed login records | Until a successful login; login is blocked for 15 minutes after 5 failed attempts |
06How do we protect your data?
The main technical and organisational measures we take under Article 12 of the Law:
- ID numbers are stored encrypted with AES-256, and only the last four digits are shown on screen.
- Passwords are stored in a non-reversible form; nobody can see your password.
- Access depends on role: an organisation sees only its own application, an evaluator only those assigned to their team.
- Any administrator viewing an ID number is written to the activity history.
- The type, content and size of uploaded files are checked, and files are served only to signed-in authorised users.
- Login is temporarily blocked after repeated failed attempts.
07Cookies
Only the two cookies below are used for the portal to work:
| Cookie | Purpose | Period |
|---|---|---|
| bhtq_session | Remembers that you are logged in (required) | 14 days |
| bhtq_locale | Remembers your language preference | 1 year |
No advertising or visitor tracking cookies are used. Fonts and icons load from our own server, so your visit is not passed to third parties.
08Your rights
Under Article 11 of the Law you may apply to the data controller to:
- Learn whether your personal data is processed
- Request information if it has been processed
- Learn the purpose of processing and whether data is used accordingly
- Know the third parties to whom data is transferred in Türkiye or abroad
- Request correction of incomplete or inaccurate data
- Request deletion or destruction under the conditions in Article 7 of the Law
- Request that corrections and deletions be notified to third parties who received the data
- Object to a result against you that arises solely from automated analysis
- Claim compensation for damage caused by unlawful processing
09How can you apply?
You can send your request with details verifying your identity through the contact page or to the address above. Requests are concluded free of charge within 30 days at the latest; if the action involves a separate cost, the tariff set by the Board may apply.
If your request is rejected, the reply is inadequate or it is not answered in time, you may complain to the Personal Data Protection Board under Article 14 of the Law.