PRIVATE ÜNYE ÇAKIRTEPE HOSPITAL
PROTECTION OF PERSONAL DATA GUEST CLARIFICATION TEXT

The purpose of the Personal Data Protection Law No. 6698 is to protect the fundamental rights and freedoms of individuals, primarily the privacy of personal life, in the processing of personal data, and to regulate the obligations of natural and legal persons processing personal data and the procedures and principles they must comply with.

As the Data Controller within the scope of the Personal Data Protection Law No. 6698 (“Law”) and relevant legislation, Çakırtepe Sağlık Hizmet ve Turizm Tic. Ltd. Şti. (“PRIVATE ÜNYE ÇAKIRTEPE HOSPITAL”) may process your personal data only within the framework explained below and in accordance with the Private Hospitals Regulation, Ministry of Health regulations, and other relevant legislation.

A. OBTAINING PERSONAL DATA

Your personal data is obtained by PRIVATE ÜNYE ÇAKIRTEPE HOSPITAL for the purposes of public health protection, preventive medicine, records related to your applications to our health institutions, conducting medical diagnosis, treatment, and care services, planning and managing health services and their financing; orally, in writing, visually or electronically, online through the SSI (SGK) system, from records shared when benefiting from a private insurance company, through the records of other health institutions if you arrive by referral to our health institutions, emails you send, call center call records, electronic identity verification system, ID card scanning, website, visual records obtained from hospital cameras, and through verbal, written, and similar channels.

When you enter PRIVATE ÜNYE ÇAKIRTEPE HOSPITAL as a guest, your following data is processed by our guest services personnel for the purpose of registering you in our Hospital Information Management System based on the legal grounds of "it is necessary to process the personal data of parties of a contract, provided that the processing is directly related to the execution or performance of the contract" and "it is mandatory for the controller to be able to perform his legal obligations".

• Your Identity Information: Your name, surname, citizenship number, passport number or temporary citizenship number, place and date of birth, marital status, gender, insurance and/or patient protocol number, and other identity data that can identify you,
• Your Contact Information: Your address, phone number, email address, and other contact data,
• Your Visual Records: Your hospital camera records,
• Electronic Identity Verification (EKDS): Your fingerprint and palm vein information obtained during verification,
• ID Card Scanning
• Voice Call Records: Your voice call records kept by customer representatives or patient services in accordance with call center standards, and your personal data obtained when you contact us via email, letter, or other means,
• Your Accounting Information: Your financial data such as bank account number, IBAN number, the information on the credit card slip only, billing and invoice information,
• Insurance Data: Your data regarding private health insurance and Social Security Institution (SGK) data for the purpose of financing and planning health services,
• Your Health Information: All kinds of health information and data obtained during or as a result of conducting medical diagnosis, treatment, and care services, including but not limited to patient medical reports, diagnostic data, biometric and genetic data, laboratory results, test results, examination data, appointment information, prescription information,
• Notifications: Your notifications such as surveys filled out by patients, letters of thanks and complaints, satisfaction results,
• Parking: Your vehicle license plate information if you use the parking lot,
• Security Camera: Your images obtained from camera recordings that constantly record in common areas in our hospital as required by legislation,
• Events: Your personal data obtained when you attend training, seminars, or organizations organized by PRIVATE ÜNYE ÇAKIRTEPE HOSPITAL,
• Web Data: Your health data and other personal data you submit or enter on all websites belonging to PRIVATE ÜNYE ÇAKIRTEPE HOSPITAL.

An instant transfer is made to the Medula System belonging to the Social Security Institution through the Patient Information Management System where all this data is processed.

During the patient registration process, an SMS is sent by us to the relevant person recipients who have registered to complete the registration procedures of our guests and to ensure they can access explicit consent and clarification texts in accordance with the personal data protection law. The sent SMS content includes 2 separate single-use confirmation codes for our guests who want to give approval within the scope of the PDPL and the Law on the Regulation of Electronic Commerce No. 6563 (“ETK”).

If our guest, to whose phone the confirmation codes are sent, notifies our personnel of these codes, a record is created indicating that the necessary explicit consent and approvals under PDPL and ETK have been given. The given explicit consent and approvals will remain valid until revoked by using the right to reject.

B. PROCESSING OF PERSONAL DATA AND PURPOSES OF PROCESSING

All kinds of your personal data obtained by PRIVATE ÜNYE ÇAKIRTEPE HOSPITAL (including but not limited to special categories of personal data) may be processed for the following purposes:

Confirming Your Identity: Your personal data obtained through ID card scanning and electronic identity verification system is processed by recording it in the Patient Information Management System ("HBYS").

Personal Data Processed During Patient Registration: When you come to our hospital as a guest, your data such as name-surname, TR ID Number, passport number or temporary TR number for non-TR Citizens, address, phone, email, place and date of birth, marital status, gender information, private health insurance or SGK data, ID card scan, electronic identity verification system finger and palm scan, appointment information is processed by our guest services personnel for the purpose of registering you in the Patient Information Management System ("HBYS") based on the legal grounds of "it is necessary to process the personal data of parties of a contract, provided that the processing is directly related to the execution or performance of the contract" and "it is mandatory for the controller to be able to perform his legal obligations". An instant transfer is made to the Medula system belonging to the Social Security Institution ("SGK") via the HBYS where all this data is processed.

Personal Data Processed During Healthcare Service: During the provision of the healthcare service needed by our guests, it will be processed by our healthcare personnel and physicians under the obligation of secrecy based on the legal ground of "protection of public health, preventive medicine, medical diagnosis, execution of treatment and care services" primarily, and the situations explicitly foreseen in the Private Hospitals Law No. 2219 and Basic Law on Health Services No. 3359, and Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, Private Hospitals Regulation, Health Implementation Communiqué, Patient Rights Regulation, and Turkish Code of Obligations No. 6098, and will be recorded in the HBYS. Health data (including but not limited to those obtained as a result of Medical Diagnosis, treatment, and care services) – All this data is instantly transferred to the E-Nabız system affiliated with the T.R. Ministry of Health ("Ministry").

Personal Data Processed During Patient Discharge Procedures: After the completion of the treatment service period of our guests, personal data such as name-surname, bank account information, credit card number, invoice are processed based on the legal grounds of "it is necessary to process the personal data of parties of a contract, provided that the processing is directly related to the execution or performance of the contract" and "it is mandatory for the controller to be able to perform his legal obligations" within the scope of sharing the requested information with private insurance companies for the financing and planning of health services according to their relevant insurance status, receiving the service fee, and issuing an invoice.

Your Personal Data Processed During Your Calls with Our Call Center: When you call our hospital call center, your personal data such as name-surname, phone number, TR ID Number, Email address, Appointment Information, Phone Call Voice Recording, All Call Records, including patient rooms, are processed based on the legal grounds of "it is necessary to process the personal data of parties of a contract, provided that the processing is directly related to the execution or performance of the contract" and "it is mandatory for the controller to be able to perform his legal obligations" for the purposes of creating your appointment requests, answering your information requests, informing you about your appointment, and/or if you have any other requests.

Patient Rights: If you wish to exercise your rights within the scope of the Patient Rights Regulation, your personal data such as name-surname, phone number, TR ID Number, Email address, Content of Your Request, Your Medical Information will be processed by our relevant administrative unit based on the legal ground of "it is mandatory for the controller to be able to perform his legal obligations" for the purposes of processing and resolving your requests and complaints.

Guest Satisfaction Survey: After Patient Appointment and Patient Discharge Procedures, our hospital's Guest Satisfaction Survey is sent via SMS as a link to the mobile phone number based on our guest's HBYS record for the purposes of evaluating the service you received from our hospital, increasing the quality of the healthcare services provided, and measuring your experience. There are questions to measure your satisfaction in the guest satisfaction survey that opens when the relevant link is clicked. When the answers given here match the record on the HBYS, they are automatically transferred to the relevant unit of our Hospital, and an automatic thank you message is sent to our guests. If a patient opens a complaint record via institutional websites, various social platforms, or complaint websites, the guest/patient is contacted to resolve or respond to the complaint.

Physical Space Security (Camera Records): An IP camera system is used in our hospital, and video and audio recording is performed. The physical space security and visual and audio records of all our visitors visiting our hospital will be processed automatically based on the legal ground of "it is mandatory for the controller to be able to perform his legal obligations, provided that it does not harm the fundamental rights and freedoms of the data subject" for the purpose of ensuring the security of the data controller's operations and creating and tracking visitor records.

Parking Service: We have a Parking service in our hospital. If our visitors who visit our hospital with their vehicles want to benefit from these services, vehicle brand/model and vehicle license plate data will be processed automatically based on the legal ground of "processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject" for the purpose of ensuring the security of the data controller's operations and creating and tracking visitor records.

Online Appointment: Our visitors have the opportunity to make an online appointment by clicking the "APPOINTMENT" link on our hospital website. The first step to making an online appointment via our hospital website is selecting the Department for which an appointment will be made and creating the appointment day and time; the second step is entering the personal data of the relevant person, such as TR ID No, Father's Name, Date of Birth, in appropriate places on the page. In the final step, by confirming your mobile phone number registered in the system by clicking the "Confirm" button, the appointment process is completed, and an Appointment Code is created. If an online appointment is requested to be canceled, the "Appointment Inquiry/Cancel" tab is clicked, and the appointment cancellation process is completed by entering the relevant person's TR ID No, Father's Name, Date of Birth, and Appointment Code in the relevant fields.

Video Call (LiveMedy): You can make a video call appointment by booking an appointment with our Psychiatry department by clicking the "ONLINE APPOINTMENT" link on our hospital website. In the appointment booking process, the first step is entering personal data such as Email, Phone, Name-Surname, Date of Birth, Gender, and TR ID Number if the relevant person is a "New User", and personal data such as Email and Mobile Phone if they are a "Registered User" in appropriate places on the page. The second step is entering the messages sent via "LiveMedy" to your SMS and Email address into relevant fields. If you add your credit card information to make a payment within the application, your credit card information will be processed by the "LiveMedy" payment service provider from which we purchase services in this regard, for the purpose of receiving payment and with the legal basis of performance of the contract. Your credit card information will strictly not be saved and seen by Private Ünye Çakırtepe Hospital. If you enter your credit card information through the application, you will have made a payment for the service you received. During the realization of the video call/examination appointment, your visual and audio data will be processed for the purpose of providing the video consultancy service, with the legal basis of the establishment and performance of a contract. You can access information regarding the processing of your health data within the scope of the video call from the heading "Personal Data Processed During Healthcare Service" of this Clarification Text.

Contact Form: You can send your complaints, suggestions, requests, and thanks to our Hospital with your message, whose content will be created by you, along with your Name-Surname, Email, Phone number, on the page where the requests and complaints of our guests are received via the "Contact Form" found under the "Contact" tab on our hospital website. These personal data will be processed based on your explicit consent for the purpose of carrying out activities aimed at patient satisfaction in patient rights center and guest satisfaction processes.

Test Results: Relevant persons who want to benefit from the "TEST RESULTS" service on our hospital website can access their analysis and imaging results performed within our hospital by entering their TR ID Number, Father's Name, Date of Birth, File No data if they are TR Citizens, and Date of Birth, File No data if they are "Foreign Patients" in necessary fields. However, in the results displayed here, all identity and contact data regarding the patient are shown masked.

Our Hospital's Information Activities: In accordance with the Private Hospitals Regulation and limited only to information activities, informational messages in the nature of protecting and improving health in the form of commercial electronic messages such as SMS, E-Mail, etc., are sent to our guests who have given PDPL and Communication Consent. If recipients do not want to receive messages, they can exercise their right to reject included in the message content. Consent is valid until the right to reject is exercised.

Visual and audio records such as photographs and/or videos of some of our guests are processed solely for the purpose of carrying out information activities about our Hospital by obtaining the explicit consent of the relevant persons. Relevant persons can withdraw their explicit consent in this regard at any time.

Other Purposes:

• Fulfilling legal and regulatory requirements,
• Confirming your relationship with institutions contracted with our Hospitals and Medical Centers or providing financial reconciliation regarding healthcare services provided to you with these institutions,
• Sharing requested information with the Ministry of Health and relevant public institutions and organizations in accordance with relevant legislation,
• Taking all necessary technical and administrative measures within the scope of data security of the systems and applications of our Hospitals and Medical Centers,
• Analyzing your healthcare service use and retaining your health data to develop and improve the healthcare services we offer you,
• Providing necessary information in line with the requests and audits of regulatory and supervisory institutions and official authorities,
• Retaining information related to your health data that must be kept as per relevant legislation, and including but not limited to these, execution, development of medical diagnosis, treatment and care services, planning and management of health services and financing, increasing patient satisfaction, research, and similar purposes.

In addition, your personal data specified above may be processed within the framework of the Basic Law on Health Services No. 3359, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, Private Hospitals Regulation, Regulation on the Processing of Personal Health Data and Protection of Privacy, and Ministry of Health regulations and other legislative provisions, and can be transferred to the physical archives and/or information systems belonging to PRIVATE ÜNYE ÇAKIRTEPE HOSPITAL and kept under protection in both digital and physical environments.

C. TRANSFER OF PERSONAL DATA

Your personal data will be transferred based on the legal ground of "protection of public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and financing" for the purpose of providing health services; to persons assigned by authorized authorities, primarily but not limited to the Ministry, Provincial and District Health Directorates, Public Health Centers, and other units affiliated with the Ministry within the scope of laws and other legislation, or to authorized institutions and organizations within the scope of established automated systems such as Medula, E-Nabız, etc. within our notification and/or reporting obligations; to laboratories in Turkey and abroad with which we cooperate for medical diagnosis and treatment, ambulances, medical devices, and institutions providing health services, to our subsidiaries and/or affiliates and/or group companies via the common HBYS used by our hospital; to SGK for patients under SGK coverage, to your insurance company if you have private insurance, to your institution if your invoicing will be made to your working institution, to the relevant health institution when you need to be referred, to the relevant health institution abroad if you request a second opinion from a physician located abroad, and to legal representatives you have authorized.

All personal health data of the relevant person, such as name, surname, mobile phone number, invoice information, medical diagnosis, processed for the presentation of treatment for the purpose of benefiting from private health insurance, supplementary insurance, or any other insurance product or contracted institution agreement in our hospital, is transferred to the consultant, insurance company, or contracted institutions with which a cooperation agreement has been made, based on the legal ground of "protection of public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and financing". The post-transfer process is carried out directly by the relevant consultant, insurance company, or contracted institution.

Your personal data will be transferred to our subcontractors, business partners, lawyers we work with, consultants, auditors, legal representatives we authorize and third parties from whom we receive consultancy, domestic/foreign organizations and other third parties and their legal representatives from whom we contractually receive services to carry out our activities, with whom we cooperate, only in connection with the service received, limited and proportionate, and during the service period, with the precondition of obtaining commitments regarding all technical and administrative measures required by the PDPL.

Your personal data is transferred to education/teaching institutions cooperating with our hospital for the purpose of carrying out education and research activities based on the legal grounds of "processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject" and "protection of public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and financing".

D. METHOD AND LEGAL REASON FOR OBTAINING PERSONAL DATA

Your personal data is collected and processed in all kinds of oral, written, or electronic media, within the framework of relevant legal legislation provisions, for the purposes stated above and to provide health services within the determined legal framework and to fully and properly fulfill the contractual and legal obligations of ÇAKIRTEPE HOSPITAL within this scope.

E. YOUR RIGHTS AS A DATA SUBJECT

As a personal data owner, in accordance with the legislation regarding your processed personal data, we inform you that you have the right to:

• Learn whether personal data is processed or not,
• Request information if personal data has been processed,
• Learn the purpose of processing personal data and whether they are used appropriately for their purpose,
• Know the third parties to whom personal data is transferred domestically or abroad,
• Request correction of personal data in case of incomplete or incorrect processing,
• Request the deletion or destruction of personal data,
• Request notification of the operations regarding the correction of incomplete or incorrectly processed personal data and/or the deletion or destruction of personal data to third parties to whom personal data has been transferred,
• Object to the occurrence of a result against the person themselves by analyzing the processed data exclusively through automated systems,
• Request compensation from us for the damage in case you suffer damage due to unlawful processing of personal data.

F. DATA SECURITY

PRIVATE ÜNYE ÇAKIRTEPE HOSPITAL protects your personal data in full compliance with all technical and administrative security controls that must be taken in accordance with information security standards and procedures, and at an appropriate level against possible risks.

G. CONTACT

As the relevant person, you can submit your requests regarding your rights listed above to our hospital via the PDPL/Data Subject Application Form in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

Requests coming to us will be evaluated and concluded within 30 (thirty) days. Although we do not charge any fee for your requests, we reserve the right to charge a fee based on the tariff determined by the Personal Data Protection Board.