Protection of Personal Data

Basic Principles in Processing Personal Data:

Processing in Accordance with Law and the Principle of Fairness

Our company; It acts in accordance with the principles brought by legal regulations and the general rule of trust and honesty in the processing of personal data.

Accuracy and Being Up-to-Date When Necessary

Necessary measures are taken to ensure that the personal data processed by the Company is accurate and up-to-date, and in order to ensure that the processed data reflects the real situation, information is provided and relevant opportunities are granted to data subjects.

Processing for Specific, Explicit and Legitimate Purposes

Our company clearly and precisely determines the legitimate and lawful purpose of personal data processing. Our company processes personal data in connection with the service it provides and as much as is necessary for them. The purpose for which personal data will be processed by our company is revealed before the personal data processing activity begins.

Being Connected to the Purpose for Which They Are Processed, Limited and Measured

The company processes data in accordance with the KVKK and other relevant legislation, in a way that is suitable for achieving the purposes determined according to data categories, related to the fulfillment of the purpose, and proportionate, while avoiding the processing of personal data that is not needed.

Retention for the Period Prescribed in the Relevant Legislation or Necessary for the Intended Purpose

Personal data processed by the Company is retained only for the period required by the relevant legislation or for the purpose for which they are processed. In this context, the Company complies with the period stipulated in the relevant legislation for the storage of data if such a period exists; if no such period exists, it retains the data only for the period necessary for the purpose for which they were processed. The Company does not store data based on the possibility of future use.

• All personnel comply with the rules established within the framework of physical security measures (entry and exit doors, office rooms, product delivery areas, security of warehouses, and use of personnel identification cards, etc.).
• Protection from viruses and attackers belongs to the IT Officer. The responsible person notifies senior management of the necessary hardware and software for protection from viruses and attackers and takes the necessary measures. These measures consist of the minimum requirements requested by the Ministry of Health, including hardware and software devices such as antivirus software and firewalls. The updating of these software is the responsibility of the Information Management System Officer. When it is time to update, they inform senior management and carry out the updates.

Conducting Personal Data Processing Activities in Compliance with the KVKK

The conditions for the processing of personal data are regulated by the Personal Data Protection Law (KVKK), and the Company processes personal data in accordance with the conditions specified below.

Except for the exceptions listed in the Law, the Company processes personal data only by obtaining the explicit consent of the data subjects. In the presence of the following cases listed in the Law, personal data may be processed even without the explicit consent of the data subject.

• To be explicitly provided for in the laws,
• The necessity for protecting the life or bodily integrity of oneself or another person of a person who is unable to express consent due to actual impossibility or whose consent is not legally valid,
• The necessity of processing the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract.
• Requirement for the data controller to fulfill their legal obligation.
• Being made public by the data subject themselves,
• The necessity of processing data for the establishment, exercise, or protection of a right,
• Processing of data for the legitimate interests of the data controller is mandatory, provided that it does not harm the fundamental rights and freedoms of the data subject.
• In the processing of special categories of personal data, which are believed to be of more critical importance from the perspective of data subjects, the Company demonstrates special sensitivity. Within this context, provided that adequate measures determined by the Quality Management Unit are taken, such data is not processed without the explicit consent of the data subjects. However, special categories of personal data other than health and sexual life can be processed without the explicit consent of the data subject in cases provided by law.

Data related to health and sexual life can be processed without explicit consent, provided that adequate measures are taken and one of the reasons listed below exists:

• Protection of public health,
• Preventive medicine,
• Medical diagnosis,
• Execution of treatment and care services,
• Planning and management of health services and their financing.

Making statements about the personal data processing activities lawfully carried out by the company and the systems adopted for the protection of personal data, within this scope, is to ensure transparency by informing individuals whose personal data is processed by our company, primarily including our customers, potential customers, employees, job applicants, company officials, visitors, employees and officials of institutions we cooperate with, and third parties whose personal data is processed.

• In accordance with the Medical Center's BY.YD.002 Information Management System Institutional Policy, a domain structure has been established, and all computers operate in a 'login' state on the domain. Computers not connected to the domain are removed from the local network, and no information exchange occurs between devices on the local network.
• Except for official documents, programs, and educational documents, file exchange cannot be conducted through computers.
• Internet access and email usage connections are monitored by the firewall device located in the Medical center.
• A corporate email address is created for all authorized personnel starting work at the medical center.
• Emails and passwords are delivered to the relevant personnel during training.
• The user acknowledges that all statements expressed during the email belong to them. The user is responsible for sending messages that could constitute a crime; threatening, illegal, insulting, containing swearing or slander, or immoral.
• The user cannot include material and documents that constitute a legal offense in their account, and cannot use applications that harm personal account owners.
• One cannot use another system's server or another user's account without the person's permission for the purpose of sending messages.
• The user may not use their account for commercial and profit purposes. They cannot send bulk emails to many users for advertising, promotion, announcement, etc. (SPAM) purposes.
• The user is responsible for any legal liabilities that may arise from the publishing rights of any information contained in their account.

Informing and Notifying the Personal Data Owner

Our company, in accordance with Article 10 of the KVKK Law, informs data subjects during the collection of personal data. Within this scope, the company provides information on the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal reason for collecting personal data, and the rights of the data subject.

Article 20 of the Constitution establishes that everyone has the right to be informed about their personal data. Accordingly, Article 11 of the KVKK Law also lists "requesting information" among the rights of the personal data owner. In this context, our company provides the necessary information if the personal data owner requests information, in accordance with Article 20 of the Constitution and Article 11 of the KVKK Law.

Purposes of Processing Personal Data

Your personal data, including but not limited to your sensitive personal data, especially your health data, may be processed by the Company in a limited and measured manner in connection with the purposes listed below;

• Your name, surname, Turkish ID number, temporary Turkish ID number, passport number, place and date of birth, marital status, gender, insurance or patient protocol number, and other identification data that identifies you.
• Your address, phone number, email address
• Your test results, laboratory and imaging results, examination data, prescription information, and health and sexual life-related data obtained during the provision of medical diagnosis, treatment, and care services, and without being limited to these, your health data,
• Your IBAN number, credit card information,
• During your visit to our medical center, your images and audio recordings taken by the closed-circuit camera system,
• If you contact Patient Admission/Consultation, your recorded voice calls,
• Your data related to private health insurance for the purpose of financing and planning health services

Our company processes personal data limited to the purposes and conditions specified within the personal data processing conditions stated in Article 5, paragraph 2, and Article 6, paragraph 3 of the Personal Data Protection Law No. 6698.

These purposes and conditions;

• The explicit legal provision in the Laws regarding the Company’s engagement in activities related to the processing of your personal data,
• The processing of your personal data by our Company being directly related and necessary for the establishment or performance of a contract,
• The processing of your personal data being necessary for our Company to fulfill its legal obligations,
• Provided that your personal data has been made public by you; the processing of your personal data by our Company in a limited manner for the purpose of publicizing it,
• The processing of your personal data by our Company being necessary for the establishment, use, or protection of the rights of our Company, you, or third parties.
• Provided that it does not harm your fundamental rights and freedoms, it is necessary for our Company to engage in the processing of personal data for its legitimate interests,
• The processing of personal data by our company is necessary for the protection of the life or physical integrity of the data subject or another person, and in this case, the data subject is unable to give consent due to physical impossibility or legal invalidity.
• The processing of special categories of personal data other than the health and sexual life of the data subject being provided for in laws,
• Processing of special categories of personal data concerning the health and sexual life of the data subject is carried out for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing, by persons under a duty of confidentiality or by authorized institutions and organizations.

Under the conditions mentioned above; Our company may process personal data for the following purposes, including but not limited to:

• Protection of public health, preventive medicine, provision of medical diagnosis, treatment, and care services,
• For the purpose of planning and managing health services and their financing
• Verification of your identity
• Ability to inform you about your appointment if you make one.
• Verify your relationship with institutions that have agreements with the medical center.
• Fulfillment of legal and regulatory requirements
• The financing of your healthcare services, coverage of examination, diagnosis, and treatment expenses by the Patient Services, Financial Affairs, and Marketing departments,
• The sharing of requested information with the Ministry of Health and other public institutions and organizations in accordance with the relevant legislation,
• Sharing any information requested by private insurance companies in the scope of financing health services
• Analyzing your use of health services for the purpose of improving the services we provide
• In order to carry out the commercial activities conducted by the company, the necessary work is carried out by our relevant business units and associated business processes are conducted accordingly;
• Planning and execution of business activities and business continuity activities,
• Monitoring of finance and/or accounting operations,
• Providing information to authorized institutions as required by legislation,
• Planning and execution of corporate communication activities,
• Ensuring the execution of our company's human resources policies;
• Ensuring the legal and commercial security of our Company and the persons who have a business relationship with our Company;
• Carrying out satisfaction evaluation activities for our existing customers, organization, and event management,
• Conducting occupational health and safety activities,
• Execution of information and physical security processes
• Verifying the information of the person performing transactions through our corporate website and mobile applications,

Deletion, Destruction, or Anonymization of Personal Data

Subject to the provisions of other laws regarding the deletion, destruction, or anonymization of Personal Data, if the reasons requiring the processing of Personal Data cease to exist, the Company, even if it has processed it in accordance with this Law and other legal provisions, deletes, destroys, or anonymizes the Personal Data ex officio or upon the request of the Personal Data Owner / Relevant Person, within the framework of the principles set out in the BY.PR.004 Information Security and Personal Data Protection Procedure.

Deletion of personal data; is the process of making Personal Data completely inaccessible and unusable for the relevant users.

Destruction of data, on the other hand, is the process by which Personal Data becomes inaccessible, irretrievable, and unusable by anyone under any circumstances.

By anonymizing the data, it is ensured that Personal Data cannot, under any circumstances, be associated with an identified or identifiable natural person, even if matched with other data.

Transfer of Personal Data

Your personal data processed within the scope of the disclosed purposes; in accordance with the fundamental principles foreseen in the KVKK and within the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK,

• Ministry of Health and its affiliated subunits,
• Your authorized representatives,
• Private insurance companies,
• Social Security Institution,
• General Directorate of Security and other law enforcement forces,
• General Directorate of Population,
• Turkish Pharmacists' Association,
• Courts and all kinds of judicial authorities, central and other third parties,
• Lawyers,
• Laboratories, medical centers, ambulances, medical devices, and healthcare service institutions with which we cooperate for medical diagnosis and treatment,
• Our suppliers, limitedly, for the purpose of providing services,

can be shared with.

Transfer of Personal Data Abroad

Our company, in accordance with lawful personal data processing purposes, can transfer the personal data and special categories of personal data of the data subject to third parties abroad by taking the necessary security measures. Personal data processed by our company are transferred to foreign countries that have been declared by the Personal Data Protection Board to have sufficient protection ("Foreign Country with Adequate Protection") or, if sufficient protection is not available, to foreign countries where the data controllers in Turkey and the relevant foreign country have provided a written commitment to provide adequate protection and have obtained the permission of the Personal Data Protection Board ("Foreign Country Where the Data Controller Commits to Adequate Protection"). Our company acts in accordance with the regulations stipulated in Article 9 of the Personal Data Protection Law in this regard.

Building and Facility Entrances, Personal Data Processing Activities Conducted Inside, and Website Visitors

• The personal data processing activities carried out by the company at the entrances of building facilities and within the facility are conducted in accordance with the Constitution, the KVKK Law, and other relevant legislation.
• For the purpose of ensuring security by our Company, personal data processing activities are carried out for monitoring by security cameras in our Company’s buildings and facilities and for tracking visitor entry and exit.
• By using security cameras and recording the entry and exit of guests, our Company carries out personal data processing activities.
• The company's security camera monitoring activity is intended to protect the interests related to ensuring the safety of the company and other individuals, and within this scope, our company acts in accordance with the Constitution, the KVKK Law, and other relevant legislation.
• Image recordings of our visitors are taken by means of the camera monitoring system at the entrances of our company's buildings, facilities and inside the facility.
• Our company, within the scope of monitoring activities with security cameras, aims to improve the quality of the service provided, ensure its reliability, ensure the safety of the company, customers, and other individuals, and protect the interests of customers regarding the service they receive.
• The monitoring activity with cameras conducted by our company for security purposes is carried out in accordance with the regulations set forth in the KVKK Law. The camera monitoring activity carried out by our company is conducted in compliance with the Law on Private Security Services and the relevant legislation.
• Only a limited number of Company employees have access to records saved and preserved in digital format. The limited number of people who have access to the records declare that they will protect the confidentiality of the data they access with a confidentiality agreement.
• In accordance with Article 12 of the KVKK Law, our company takes the necessary technical and administrative measures to ensure the security of the personal data obtained as a result of the camera monitoring activity.

Apart from the recording with the camera mentioned above, our Company conducts personal data processing activities for the purposes stated in this Policy and for ensuring security, to monitor guest entries and exits in the Company's buildings and facilities.

• When obtaining the first and last names of individuals who come to our Company buildings as guests, or through texts posted at the Company or made accessible to guests in other ways, the relevant personal data subjects are informed within this scope. The data obtained for the purpose of guest entry-exit tracking is processed only for this purpose or the relevant personal data is recorded in a physical data recording system.
• For the purpose of ensuring security and for the purposes specified in this Procedure; our Company can provide internet access to Visitors who request it during their stay within our Buildings and Facilities. In this case, log records related to your internet access are recorded in accordance with Law No. 5651 and the mandatory provisions of the legislation enacted according to this Law; these records are processed only if requested by authorized public institutions and organizations or to fulfill our related legal obligations in audit processes carried out within the Company.
• In this context, only a limited number of Company employees have access to the log records obtained. The Company employees who have access to the mentioned records access these records only to use them in response to requests from authorized public institutions or in audit processes, and share them with legally authorized persons. The limited number of people who have access to the records declare that they will protect the confidentiality of the data they access through a confidentiality commitment.
• Visitors to the Website are informed through the Cookie policy.

Categories of Personal Data

• Identity (name and surname, mother's and father's name, mother's maiden name, date of birth, place of birth, marital status, identity card serial number, Turkish ID number, etc.)
• Communication (such as address number, e-mail address, contact address, registered electronic mail address (KEP), phone number)
• Location (location information of the place where one is)
• Personal (payroll information, disciplinary investigation, employment entry-exit records, asset declaration information, resume information, performance evaluation reports, etc.)
• Legal Transaction (information in correspondence with judicial authorities, information in case files, etc.)
• Customer Transaction (such as call center records, invoice, promissory note, check information, information on teller receipts, order information, request information)
• Physical Space Security (such as entry-exit registration information of employees and visitors, camera recordings)
• Transaction Security (such as IP address information, website login and logout information, password and passcode information)
• Risk Management (such as information processed for managing commercial, technical, and administrative risks)
• Finance (balance sheet information, financial performance information, credit and risk information, asset information, etc.)
• Professional Experience (such as diploma information, attended courses, in-service training information, certificates, transcript information)
• Marketing (shopping history information, surveys, cookie records, information obtained through campaign studies)
• Visual and Audio Records (such as visual and audio recordings)
• Race and Ethnic Origin (such as information on race and ethnic origin)
• Political Thought Information (information indicating political thought, such as political party membership information)
• Philosophical Belief, Religion, Sect, and Other Beliefs (information about religious affiliation, information about philosophical belief, information about sect affiliation, information about other beliefs, etc.)
• Clothing and Attire (information related to clothing and attire)
• Association Membership (such as association membership information)
• Foundation Membership (such as foundation membership information)
• Union Membership (such as union membership information)
• Health Information (such as information about disability status, blood type, personal health information, and used devices and prosthetics)
• Sexual Life (information regarding sexual life, etc.)
• Criminal Conviction and Security Measures (information regarding criminal conviction, information regarding security measures, etc.)
• Biometric Data (palm print information, fingerprint information, retina scan information, facial recognition information, etc.)
• Genetic Data (such as genetic data)
• Other Information (such as data types to be determined by the user)

Groups of Data Subjects

• Job Candidate
• Employee
• Subject
• The person subject to the news
• Shareholder/Partner
• Potential Product or Service Recipient
• Exam candidate
• Intern
• Supplier Employee
• Supplier Representative
• Person Receiving Product or Service
• Parent / Guardian / Representative
• Visitor
• Other

Technical and Administrative Measures Taken for Processing and Protecting Personal Data

The company takes all necessary technical and administrative measures to ensure an appropriate level of security required for the protection of personal data. The measures stipulated in Article 12 of the GDPR are as follows:

• To prevent the unlawful processing of personal data,
• To prevent unlawful access to personal data,
• Ensuring the protection of personal data

As the Data Controller, the Company has initiated the necessary process to implement the following Technical and Administrative Measures to improve the KVKK Compliance process.

• Permission Matrix
• Access Control
• Access Logs
• User Account Management
• Network Security Practice
• Security Encryption Penetration
• Log Records Data Masking
• Data Loss Prevention Software
• Backup Firewalls
• Current Anti-Virus Systems
• Deletion, Destruction or Anonymization Key Management
• Preparation of a Personal Data Processing Inventory
• Corporate Policies (Access, Information Security, Usage, Retention, and Destruction, etc.) Contracts (Data Controller - Data Controller, Data Controller - Data Processor),
• Confidentiality Agreements
• Periodic and/or Random Inspections Within the Institution
• Risk Analyses
• Employment Contract, Discipline Regulation (Adding Provisions in Accordance with the Law), Corporate Communication (Crisis Management, Committee and Relevant Person Notification Processes, Reputation Management, etc.)
• Training and Awareness Activities (Information Security and Law) Notification to the Data Controllers Registry Information System (VERBIS)

Rights of the Personal Data Owner Listed in Article 11 of the Personal Data Protection Law

As personal data subjects, if you submit your requests regarding your rights to our Company through the methods set out below in this Personal Data Protection Law Information Text, our Company will conclude the request free of charge within 30 (thirty) days at the latest, depending on the nature of the request. However, if a fee is prescribed by the Personal Data Protection Board, the fee in the tariff determined by our Company will be charged.

Within this scope, personal data owners;

• Learning whether personal data is processed or not,
• To request information if personal data has been processed,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• Knowing the third parties to whom personal data is transferred domestically or abroad,
• To request the correction of personal data if it is incomplete or incorrectly processed, and in this context, to request that the action taken be notified to third parties to whom personal data has been transferred,
• Requesting the deletion or destruction of personal data when the reasons requiring its processing no longer exist, even though it has been processed in accordance with the provisions of the Personal Data Protection Law (KVK) and other relevant laws, and requesting that the third parties to whom the personal data has been transferred be notified about the action,
• Objection to the emergence of a result against the person by analyzing the processed data solely through automated systems,
• In case of damage due to the unlawful processing of personal data, a person has the right to request compensation for the damage.

As the relevant person, you need to submit your rights claims in writing to our Company. Within this framework, in order for the applications you will make to our Company under Article 11 of the KVKK Law to be managed accurately and quickly, we recommend that you use the 'Request for Information Form for the Relevant Person' document under the Personal Data Protection heading on our website, providing the documents/information that may be requested according to your request, as well as the necessary documents to identify your identity, and submit it personally or by registered mail with return receipt. In addition, you can also send us your request through .............................com.tr as an Online user (with the Email Address you have previously provided to our Company and which is recorded in our system) using the relevant person information request form.

Detection

Institution personnel report incidents in suspicious situations such as lost or newly emerged files against intention, problems occurring in the antivirus agent operation, programs running unintentionally or pop-up windows, unauthorized personnel being present in critical information processing facilities, confidential files being open to external interference, failure to follow written procedures, etc.

Evaluation and Reporting

When information security breach incidents are reported to the Quality Management Unit via the İO.FR.001 Unwanted Incident Notification Form, the Quality Management Unit evaluates the breach incident and, if it decides that a breach has occurred, informs senior management with a report.

The report contains at least the following headings;

• Collected evidence.
• Type of evidence.
• Evidence storage location.
• Date and time of evidence.
• Corrective action form if a corrective action has been initiated regarding the incident
• Date and time of detection of the violation.

Matters to be considered for information security incident reporting are as follows:

• Physical security arrangements and access information in environments.
• Ineffective security control.
• Violation of the confidentiality, integrity, and availability of information.
• Human errors.
• Uncontrolled software or hardware system changes.
• Malfunctions.
• Access control.
• Non-compliance with policies and procedures.
• Vulnerabilities detected by system security software.

The records opened for the topics mentioned above are evaluated in quality management assessment meetings. Violation incidents are measured within the scope of risk assessment.

The evaluation mechanism is as follows:

• The number of incidents and the impact of the incidents are taken into account when evaluating violation incidents.
• Data from violation incidents are used as measurements in risk assessments.
• The impact value is discussed in information security meetings and is reflected in the risk probability values according to the number of records and the impact of the records.
• If there is an increase of 7% to 10% in the number of records at the end of the year, additional awareness trainings are provided to users.
• An additional meeting is held to review procedures if there is an increase of 11% to 30% in the number of records at the end of the year.
• If there is an increase of 31% or more in the number of records at the end of the year, awareness trainings, procedure updates, investment, and structural change decisions are made.

Intervention

• No shutdown operation shall be carried out for any vulnerability that would destroy or corrupt evidence.
• For all events detected through controls or reported situations and whose evidence has been collected, the vulnerability that caused the event is corrected before any other actions.
• The BY.PR.001 Business Continuity Procedure is implemented when intervention is deemed necessary.

Taking Precautions and Gaining Experience

Necessary measures are taken to prevent information security breach incidents that have been detected and whose evidence has been collected from occurring again in the future. All experienced information security breach incidents are reviewed in order to gain experience, and the learned information is recorded. Gaining experience aims to prevent any breach incident from recurring or to find a solution more quickly if it occurs again.

Any of the following actions can be taken to prevent a security breach incident:

• The created records are reviewed and the necessary information for solutions is recorded.
• Written procedures must be created for incidents resulting from incorrect practices.
• Procedures caused by procedural events are reviewed and corrected.
• It is checked whether there is a risk record for the information security incident that has occurred; if it exists, the risk is reassessed, if not, a risk record is created for evaluation.
• Access rights are re-checked for access-related issues, and other similar access permissions are also reviewed.
• In incidents arising from software and applications, updates are checked, and the incident is closed using methods such as vulnerability closure, updating, or patch development.
• Measures taken for problems arising from physical equipment are also applied to other similar equipment.
• For incidents caused by malicious code, the source of the problem is identified and the adequacy of security software is examined. The measures found are definitely applied to all systems.

Recording and Evidence Collection

• During the recording and evidence collection stage, it is first checked that the integrity of the records that can identify the incident and the responsible party has not been compromised.
• Only records whose integrity is preserved are used as evidence.
• Evidence collected for information security breach incidents is preserved for 3 years.
• In cases related to the detection of information security breach incidents, if available, camera recordings, access logs, control logs, records maintained by system security software, cost records necessary for problem resolution, records needed for the evaluation of information security breach incidents, and records that will determine the frequency, damage, and cost limits of future incidents are preserved.

Improvement

• Employees are provided with awareness training on information security and personal data protection.
• Passwords used in the information management system are compatible with the Ministry's password policies.
• Confidentiality agreements are signed by information management system officers and users.
• Risk assessment is conducted regarding physical hazards to the information management system, software and hardware problems, information security, information confidentiality, personal data protection, user errors, and similar issues.
• In the event of information security breaches, corrective actions should be taken and a situation analysis assessment should be conducted, improvements should be made, and after the improvements, senior management and employees should be informed.