Data controller

Who is the data controller in a clinic?

The clinic decides why it collects patients' data, how long it keeps it and who it shares it with, so the clinic is the data controller. In a private practice that is often the doctor personally; in a clinic run as a company, it is the company. Informing people, obtaining explicit consent where needed, keeping data secure, answering people's requests and registering with VERBİS where required are all the controller's duties.

Under the Board's decision 2020/71, what counts is who decides why and how data is processed: which data is collected, from whom and how, how long it is kept and who it is shared with. The same company can be a controller for one activity and a processor for another, so the role is assessed activity by activity. The controller can give the privacy notice itself or authorise someone else to do it.

In Klinikbook

For patient data in Klinikbook, the controller is the clinic or agency that opened the workspace, and SetteTech, which runs Klinikbook, is its processor. For its own website, user accounts and subscription invoices, SetteTech is the controller. The compliance centre gathers the texts, requests and records you need as a controller in one place.