Protection of Personal Data

Optimed Sağlık Hizmetleri ve Ticaret A.Ş. (“Optimed”) and its affiliated companies (together referred to as “Optimed Health Services”) process your personal data as a data controller within the scope of Law No. 6698 on the Protection of Personal Data (“Law” or “KVKK”) and the relevant secondary legislation.

Your personal data may be processed in accordance with the framework set out below; and in line with Law No. 3359 on Basic Health Services, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, the Private Hospitals Regulation, regulations of the Ministry of Health and other applicable legislation.

• Optimed Hospital – Çerkezköy

• Optimed Hospital – Çorlu

• Optimed Hospital – Kapaklı

All kinds of personal data shared by our patients are stored with the highest level of care for patient privacy, and we take all necessary technical and administrative measures to ensure an appropriate level of security for personal data.

This Personal Data Protection Information Notice explains our personal data protection and processing principles, and how we collect, transfer, use and protect your personal data during the provision of healthcare services by our hospitals.

1) Personal data collected by the hospital

Within the scope of the healthcare services we provide, we collect various types of information from our patients. Such information is collected in all circumstances in accordance with the data processing principles and conditions set out in Law No. 6698 on the Protection of Personal Data (“KVKK”).

Among the information we collect from our patients for the purposes explained in Section 2 below, the following may be included:

• Name and surname

• Turkish ID information, passport number

• Place of birth

• Date of birth

• Gender

• Full address

• Telephone number

• E-mail address

• “Patient protocol number” created for you by the hospital

• Payment and billing information / financial data

• Private health insurance or Social Security Institution (SGK) data

• Biometric data within the scope of services financed by the Social Security Institution

• All health data including laboratory results, test results, examination data, check-up information, prescription information

• Voice recordings, if you contact us via our call center or similar channels

• CCTV footage recorded by closed-circuit camera systems during your visit to our hospitals

• Health data and identification information you share when using the online services offered on our website optimed.com.tr

• Other data you share with us via e-mail, call center or other communication channels

2) Purposes of processing your personal data

The personal data we collect within the scope of the services you receive from us are processed for various purposes, including but not limited to the following:

• Fulfilling our legal obligations arising from Law No. 3359 on Basic Health Services, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, the Private Hospitals Regulation, the Regulation on the Processing of Personal Health Data and Ensuring Privacy, and other relevant legislation

• Protecting public health; carrying out preventive medicine, medical diagnosis, treatment and care services; and planning and managing healthcare services and their financing

• Providing information regarding your appointment, if you have made an appointment

• Planning and managing the internal functioning of the hospital

• Conducting analyses in order to improve our services

• Billing

• Identity verification

• Verifying your relationship with contracted institutions

• Responding to requests from the Ministry of Health and other public institutions and organizations in accordance with the applicable legislation

• Responding to your questions or complaints regarding our services

• Analysing your use of healthcare services in order to improve the services we provide

• Ensuring compliance with the internal policies and principles of the hospital

• Measuring and improving patient satisfaction following the receipt of healthcare services

• Contacting you via online/offline and mobile channels for the purpose of providing information regarding our services

• Supplying medicines or medical devices

Apart from the activities listed above and the cases required by the relevant legislation, your personal data will not be used for any commercial purpose.

3) Parties to whom your personal data may be transferred

In line with KVKK and the relevant healthcare legislation, and by taking the necessary technical and administrative measures to ensure an appropriate level of security, your personal data may be transferred for the purposes set out in Section 2; to institutions and organizations permitted under Law No. 3359 on Basic Health Services, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, the Private Hospitals Regulation, the Regulation on the Processing of Personal Health Data and Ensuring Privacy and other applicable legislation; to private insurance companies; to our direct/indirect domestic or foreign shareholders, subsidiaries and/or affiliates; to our group companies; to auditors; to consultants; to business partners; to domestic/foreign organizations from which we receive services under contract and/or with which we cooperate in order to carry out our activities; and to other third parties.

4) Method and legal grounds for collecting personal data

Your personal data are collected and processed in any verbal, written, visual or electronic medium, for the purposes stated above and in order to carry out, within the legal framework, all kinds of activities that fall within the field of activity of Optimed; and to enable Optimed to fulfil its contractual and legal obligations fully and properly.

The legal grounds for collecting your personal data are:

• Law No. 6698 on the Protection of Personal Data

• Law No. 3359 on Basic Health Services

• Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions

• Private Hospitals Regulation

• Regulation on the Processing and Protection of Personal Health Data and Privacy

• Regulations of the Ministry of Health and other relevant legislative provisions

In addition, as stated in Article 6/3 of the Law, personal data relating to health and sexual life may be processed without the explicit consent of the data subject by persons under an obligation of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, carrying out preventive medicine, medical diagnosis, treatment and care services, and planning and managing healthcare services and their financing.

5) Your rights regarding your personal data

To the extent that your personal data are processed by the hospital in its capacity as data controller, you may exercise the following rights under Article 11 of KVKK by filling in the “KVKK Access / Information Request Form” below and delivering it by hand to the address of the hospital where you received services, or by sending it via notary public:

• To learn whether your personal data are being processed or not

• To request information if your personal data have been processed

• To learn the purposes for which your personal data are processed

• To learn the third parties to whom your personal data are transferred, whether at home or abroad

• To request the correction of your personal data if they have been processed incompletely or inaccurately

• To request the deletion or destruction of your personal data if the reasons requiring their processing cease to exist, or if the data controller has no legal ground or legitimate interest to continue processing such data

• To object to any adverse result arising from the analysis of your personal data exclusively by automated systems

• To request compensation for damage in case you suffer damage due to the unlawful processing of your personal data

The hospital will conclude your application as soon as possible and at the latest within thirty days, free of charge, depending on the nature of the request. However, if the process requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

6) Data security

Optimed protects your personal data in full compliance with all technical and administrative security controls that must be implemented in accordance with information security standards and procedures. These security measures are provided at a level appropriate to the possible risks, taking into account technological possibilities.

7) Complaints and contact

Your personal data are carefully protected within the bounds of technical and administrative capabilities, and the necessary security measures are taken at a level appropriate to the possible risks, taking into account technological possibilities. You may contact us through the channels below:

• You may send a petition bearing your wet signature to the address “M.K.P. Mah. Atatürk Cad. No: 118, Çerkezköy / Tekirdağ, Turkey” to the attention of the Corporate Communication department by cargo, with the phrase “Information Request within the Scope of the Law on the Protection of Personal Data” written on the envelope;

• You may send it via notary public;

• You may send it to info@optimed.com.tr with your secure electronic or mobile signature, from your registered e-mail address or the e-mail address registered in our system.