ENT, HEAD AND NECK SURGERY SPECIALIST OP. DR. SEDAT KOYUNSEVER’S CLINIC PERSONAL DATA PROCESSING INFORMATION TEXT

This information text is prepared in accordance with the Turkish Legal Legislation, Personal Data Protection Law No. 6698 (“KVKK”), and the European Union General Data Protection Regulation (“GDPR”), to enlighten the personal data owners about the procedures and principles regarding the processing of personal data of the patients/consultants who apply to ENT, HEAD AND NECK SURGERY SPECIALIST OP. DR. SEDAT KOYUNSEVER’S CLINIC (“OP. DR. SEDAT KOYUNSEVER”).

Ensuring the security of patients’/consultants’ personal data is a primary goal of OP. DR. SEDAT KOYUNSEVER. Thus, to ensure the safe processing of personal data and to prevent any unauthorized access or leakage, necessary security measures compliant with current legislation are taken by OP. DR. SEDAT KOYUNSEVER.

DATA CONTROLLER

Your Personal Data will be processed by OP. DR. SEDAT KOYUNSEVER’S CLINIC, operating at the address “Ziyapaşa Blv. Çınarlı Mh. 61025 Sk. Sunar Nuri Çomu İş Merkezi A.Blok No:28 İç Kapı No:56, 01120 Adana”. Registered under Beyoğlu Tax Office, Tax Identification No. 7030092123, OP. DR. SEDAT KOYUNSEVER is considered as “DATA CONTROLLER” under KVKK and as “DATA CONTROLLER” under GDPR.

YOUR PERSONAL DATA TO BE PROCESSED

Your personal data and special category personal data listed below will be processed by OP. DR. SEDAT KOYUNSEVER in accordance with the fundamental principles stipulated by KVKK Article 4 and GDPR Article 5, and in line with the Personal Data Processing Conditions and Purposes specified in KVKK Articles 5 and 6, and GDPR Articles 6 and 9, within the scope of purposes mentioned in this Information Text; lawfully, in connection with the purpose of processing, limited and measured, taking into account the principles of fairness and transparency, accurately and up-to-date, by taking all technical and administrative measures stipulated in the legislation for data security.

IDENTITY INFORMATION: Your name, surname, Turkish ID number and/or passport number and/or temporary Turkish ID number, identity information, passport information, place and date of birth, marital status, gender, profession, signature, and other identity data that can identify you. CONTACT INFORMATION: Your address (residence/workplace), phone number (home/workplace landline and/or mobile phone numbers you provided), email address, IP address, social media accounts, and other contact data. HEALTH INFORMATION: Your blood group, laboratory and imaging results, tests, allergies, chronic diseases, venereal diseases, infectious diseases, data related to surgeries/operations you have undergone, medications you use regularly, Covid-19 disease information, medical treatments, prescription information, hormonal information, information about your sexual life, body analysis and measurement information, skin analysis information, harmful habits to your health, and other health data required for the treatment and applications to be applied to you. PHOTO/VIDEO IMAGES and AUDIO DATA: Images and sound recording data in photographs and/or videos recorded before, during, and/or after the medical procedure. FINANCIAL INFORMATION: Your bank account number, IBAN number, credit card information, billing and invoice information, and other financial data. TRANSFER AND ACCOMMODATION INFORMATION: If you are a Health Tourist coming within the scope of International Health Tourism, your transfer information, round-trip flight ticket information, hotel accommodation information. PURPOSES FOR PROCESSING YOUR PERSONAL DATA

Your Personal Data will be processed by OP. DR. SEDAT KOYUNSEVER in accordance with KVKK and GDPR for the purposes of creating a patient file, conducting examination, preventive medicine, medical diagnosis, providing your treatment and care services, conducting your controls after medical diagnosis and treatment processes, managing complication processes, communicating directly with you, managing appointment processes, conducting patient satisfaction and request management, fulfilling legal and contractual obligations, preserving health data for the periods required by relevant legislation, consulting with another relevant specialist physician when necessary for the correct conduct of the treatment, fulfilling legal obligations in accordance with international health tourism regulations, planning transfer and accommodation services for patients/consultants coming within the framework of health tourism, announcing innovations related to medical treatment and applications, informing third parties about the medical procedure applied, planning and managing health services and their financing, fulfilling responsibilities arising from the legal relationship established between doctor and patient, fulfilling financial and administrative obligations, ensuring technical and commercial security, fulfilling public obligations. Your Personal Data will be processed by OP. DR. SEDAT KOYUNSEVER under KVKK and GDPR in the following conditions and circumstances:

Your Identity Data; to carry out examination, preventive medicine, medical diagnosis, treatment, medical applications, and care services, to create a patient file, to realize patient satisfaction and request management, to plan transfer, accommodation, and interpreter services for Health Tourist patients/consultants coming within the scope of health tourism. Your Contact Information; to carry out your controls after medical diagnosis and treatment processes, to manage appointment processes, and also, with your explicit consent, to promote, inform, and announce innovations related to medical treatment and applications and for greetings and celebrations on special occasions. Your Health Information; to successfully carry out your medical treatments, to consult another specialist physician when necessary during your treatment process, to create a patient file, to preserve health data for the periods required by relevant legislation, to fulfill legal obligations under current Health Law and Health Tourism Legislation. Your Photo, Video, and Audio Recording Information; to be processed by OP. DR. SEDAT KOYUNSEVER for managing the treatment process, and also, with your explicit consent, to inform foreign individuals who want to receive health services in our country medically within the scope of Health Tourism Legislation about the medical procedure applied. Your Financial Information; to control your payment and to issue invoices and, if there is any excess fee, to process it for the purpose of refund. Your Transfer and Accommodation Information; to be processed for planning the transfer and accommodation services of Health Tourist patients/consultants coming within the scope of Health Tourism. The above-mentioned personal data will be processed in accordance with the above-mentioned purposes and legislation for the conduct of your medical treatment and the fulfillment of related obligations. If you do not provide the relevant personal data, the legal obligations imposed on OP. DR. SEDAT KOYUNSEVER serving your medical treatment will not be fulfilled properly, and your treatment and/or recovery processes cannot be carried out successfully.

METHOD OF COLLECTING PERSONAL DATA

Your Personal Data and Special Category Personal Data will be collected depending on the health services provided by OP. DR. SEDAT KOYUNSEVER;

Via health reports, laboratory and imaging results, tests, health reports, and statements you provide related to your health data, and examination findings you provide for medical evaluation related to the treatment to be applied to you when you come to OP. DR. SEDAT KOYUNSEVER for examination and treatment purposes, Via the “Patient Information and Consent Form” you fill out for the treatment to be applied by OP. DR. SEDAT KOYUNSEVER, Via the contact form you fill out on the corporate website of OP. DR. SEDAT KOYUNSEVER “https://drsedatkoyunsever.com”, Via electronic mails you send to the corporate email address of OP. DR. SEDAT KOYUNSEVER “info@drsedatkoyunsever.com”, Via photo/video recordings recorded before, during, and/or after the medical procedure applied/performed by OP. DR. SEDAT KOYUNSEVER, Upon your request and when necessary, via written/verbal/visual (photo and/or video recording) messages you send to OP. DR. SEDAT KOYUNSEVER and online voice/video calls you establish via remote connection application service providers (whatsapp/zoom.us/facetime/skype/messenger/google/instagram/facebook/bip/telegram/clubhouse etc.) that you receive service by accepting their Privacy Policies and Data Transfer Abroad Policies for the online diagnosis and controls to be carried out by OP. DR. SEDAT KOYUNSEVER remotely, Via direct messages you send to OP. DR. SEDAT KOYUNSEVER’s profile account located in social media accounts (instagram/youtube/facebook/twitter/linkedin/clubhouse etc.) whose servers are located abroad and which you are already a user of by accepting their Privacy Policies and Data Transfer Abroad Policies, and via comments you make on posts, Via information you transfer by allowing automatic processing via panels such as “contact us” or “get information” in the promotions and information posted by OP. DR. SEDAT KOYUNSEVER on social media accounts (instagram, youtube, facebook, twitter, linkedin, google etc.) whose servers are located abroad and which you are already a user of by accepting their Privacy Policies and Data Transfer Abroad Policies, Via log-record devices (firewall) used within the scope of technical measures required by legislation in case you want to join the wireless internet network (wi-fi) available in the clinic of OP. DR. SEDAT KOYUNSEVER as a guest user, and will be processed in accordance with KVKK and GDPR throughout the examination, medical diagnosis, treatment, and care services for OP. DR. SEDAT KOYUNSEVER to fulfill his contractual and legal obligations properly and completely.

PURPOSE, METHOD, AND LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

Your personal data will be processed by real or legal persons authorized by OP. DR. SEDAT KOYUNSEVER as “DATA PROCESSOR/PROCESSOR”; verbally, in writing, by taking camera and photo records, and with necessary technical and administrative security measures, recorded in physical and electronic media, in accordance with the relevant provisions of KVKK and GDPR, and additionally with your explicit consent when required.

SITUATIONS REQUIRING YOUR EXPLICIT CONSENT

In accordance with GDPR Article 6/1/a and KVKK Article 5/1, your personal data will be processed only with your explicit consent in the following situations:

Sending SMS messages and/or emails to you and establishing mobile communication for the purpose of promoting, announcing, and informing about medical services provided by OP. DR. SEDAT KOYUNSEVER can only be possible with your explicit consent. Sharing your photo and/or video recordings taken before, during, and/or after the medical procedure to observe the progress of the treatment on social media accounts (Instagram, YouTube, Facebook, Twitter, LinkedIn, Clubhouse, etc.) and corporate websites of OP. DR. SEDAT KOYUNSEVER will only be possible with your explicit consent. Transferring your data through service providers whose servers are located abroad will be considered as “international data transfer” and will require explicit consent for such transfer. However, in the following situations, there will be no international data transfer by OP. DR. SEDAT KOYUNSEVER, so YOUR EXPLICIT CONSENT WILL NOT BE SOUGHT, and IT WILL BE CONSIDERED THAT YOU HAVE GIVEN YOUR EXPLICIT CONSENT TO THE SERVICE PROVIDER YOU ARE USING:

When you send written/verbal/visual messages (photos/videos) or make voice/video calls to OP. DR. SEDAT KOYUNSEVER using service providers (WhatsApp, Zoom, FaceTime, Skype, Messenger, Google, Instagram, Facebook, Telegram, Clubhouse, etc.) whose servers are located abroad, which you are already a user of and have accepted their Privacy Agreements and Data Transfer Abroad Policies, requesting remote examination/diagnosis services; by accepting the policies of these applications and sharing your Personal Data and Special Category Personal Data with OP. DR. SEDAT KOYUNSEVER through these applications, you have consented to the processing of your data in accordance with OP. DR. SEDAT KOYUNSEVER’s KVKK Illumination Text and Privacy Principles, and to communicate with you through these applications, and you have given explicit consent to these applications for the transfer of your data abroad as per their previously accepted policies. When you request to be contacted via electronic mail service providers (Hotmail, Gmail, Yahoo, etc.) whose servers are located abroad, which you are already a user of and have accepted their Privacy Policy and Data Transfer Abroad Policies; you are considered to have given explicit consent for OP. DR. SEDAT KOYUNSEVER to process the Personal Data and Special Category Personal Data shared in the mails in accordance with his KVKK Illumination Text and Privacy Principles, and for the transfer of your data abroad by your electronic mail service provider as per their previously accepted policies. When you apply to advertisements and promotions published by OP. DR. SEDAT KOYUNSEVER on social media service providers (Facebook, Instagram, Google, WhatsApp, etc.) whose servers are located abroad; by accepting the Privacy and Data Transfer Abroad Policies of the relevant social media service providers, you automatically consent to the processing and international transfer of your data, which will be transferred to OP. DR. SEDAT KOYUNSEVER by the relevant social media service provider and will be processed and preserved by OP. DR. SEDAT KOYUNSEVER in accordance with the Illumination Text and Privacy Principles you are reading. In these cases, you are considered to have accepted OP. DR. SEDAT KOYUNSEVER’s Illumination Text and Privacy Principles and the processing of your Personal Data and Special Category Personal Data in this direction, and have given explicit consent for OP. DR. SEDAT KOYUNSEVER to reach you and communicate with you through the contact information you provided. When you send a direct message to the profile account of OP. DR. SEDAT KOYUNSEVER located on social media accounts (Instagram, YouTube, Facebook, Twitter, LinkedIn, etc.) whose servers are located abroad, which you are already a user of and have accepted their Privacy Policies and Data Transfer Abroad Policies; you are considered to have consented to OP. DR. SEDAT KOYUNSEVER processing your data in accordance with his KVKK Illumination Text and Privacy Principles and to communicate with you through the respective application.

CIRCUMSTANCES WHERE YOUR DATA MAY BE PROCESSED WITHOUT THE NEED FOR CONSENT

In accordance with GDPR Article 9/2/h and the Personal Data Protection Law (KVKK) Article 6/3:

Your Special Category Personal Data, which includes Health Data classified as Special Category Personal Data, will be processed by OP. DR. SEDAT KOYUNSEVER without the need for your explicit consent in order to carry out medical examination, diagnosis, treatment, and care services as required by the law regarding the obligation of medical confidentiality. In accordance with GDPR Article 6/1/b and KVKK Article 5/2/c:

Your Personal Data will be processed by OP. DR. SEDAT KOYUNSEVER without the need for your explicit consent for the purpose of conducting follow-up checks after medical diagnosis and treatment processes, establishing direct communication with you, managing appointment processes, and handling your Personal Data. In accordance with GDPR Article 6/1/f and KVKK Article 5/2/f, based on our legitimate interests:

Your Personal Data will be processed by OP. DR. SEDAT KOYUNSEVER without the need for your explicit consent for the purpose of managing patient satisfaction and requests. In accordance with GDPR Article 6/1/c, KVKK Article 5/2/a, and KVKK Article 5/2/ç, your Personal Data will be processed without obtaining your explicit consent in the following cases due to legal obligations:

Creation of patient files. Preservation of information related to health data that must be kept in accordance with relevant legislation. Verification of your payments for invoice issuance. Execution of tax payments. Fulfillment of obligations in accordance with the legislation of the Ministry of Health. Fulfillment of obligations in accordance with the legislation on Health Tourism. Ensuring data security. Fulfillment of legal obligations before Judicial Authorities. Fulfillment of administrative obligations before Administrative Institutions and Organizations. TRANSFER OF PERSONAL DATA AND THE PURPOSE OF SUCH TRANSFER

Your Personal Data collected within the scope of Personal Data Processing Conditions specified in Articles 5 and 6 of KVKK No. 6698 and Articles 6 and 9 of GDPR will be transferred to third parties and institutions by OP. DR. SEDAT KOYUNSEVER as required by law and will be processed in accordance with KVKK No. 8 and 9 and GDPR No. 45 and 49, provided that Privacy Agreements prescribed by the legislation are concluded and all necessary administrative and technical security measures are taken for the following purposes: conducting medical examinations, preventive medicine, medical diagnosis, treatment, and care services, improving these services, obtaining consultation services from other specialist physicians when necessary, fulfilling administrative obligations related to International Health Tourism Legislation, planning the transfer, accommodation, and translation services of foreign individuals who come to our country as Health Tourists within the framework of Health Tourism, establishing communication with patients, managing control and appointment processes, planning and managing health service financing, fulfilling the responsibilities arising from the legal relationship established between the doctor and the patient, fulfilling financial, legal, and administrative obligations, ensuring technical and commercial security, and fulfilling public obligations in accordance with Health Tourism Legislation. Within this scope, Personal Data processed by OP. DR. SEDAT KOYUNSEVER may be transferred to:

Other specialist physicians for consultation purposes, Insured employees, Suppliers, Financial Consultants, Tax and Financial Advisors, and Auditors, Legal Advisors, Database (Server) Providers, Interpreters, Web Consultants, Data Protection Officer, IT Consultants, Tourism Agencies, Authorized Public Institutions and Organizations in accordance with the laws, Judicial Authorities. DURATION OF PERSONAL DATA PROCESSING

Your Personal Data will be stored by OP. DR. SEDAT KOYUNSEVER as long as it is legally required to do so. Documenting and storage obligations arise from local norms related to trade, tax, and health legislation. The table below shows the retention periods of your Personal Data.

YOUR PERSONAL DATA

RETENTION PERIODS

Your Identity Information

20 Years After the End of the Service Provided to the Service Recipient

Your Contact Information

20 Years After the End of the Service Provided to the Service Recipient

Your Health Information

20 Years After the End of the Service Provided to the Service Recipient

Your Photo and Video Information

20 Years After the End of the Service Provided to the Service Recipient

Your Financial Information

5 Years After the End of the Service Provided to the Service Recipient AGE LIMIT OF DATA SUBJECTS WITHIN THE FRAMEWORK OF LEGISLATION

Under the scope of KVKK, patients/clients who are at least 18 years old can give their consent for the processing of their personal data. Patients/clients below this age limit must have their consent given by their legal representatives.

Under GDPR, European Union citizens or residents in European Union countries can personally give their consent for the processing of their personal data if they are at least 16 years old or the age limit required in their countries. The consent of patients/clients below this age must be given by their legal representatives. WITHDRAWAL OF CONSENT

If you have given your consent to OP. DR. SEDAT KOYUNSEVER for the processing of your Personal Data, you are informed that you can withdraw your consent at any time for the purposes mentioned above in accordance with GDPR Article 6/1/a and KVKK Article 5/1. Your consent will be revoked if you submit your withdrawal statement to the contact address provided below in accordance with the following procedure.

RIGHTS OF DATA SUBJECTS UNDER GDPR

Your Personal Data is also protected as Data Subjects under GDPR. In cases where the scope of GDPR is involved (European Union citizens or residents in European Union countries), Data Subjects have the following rights:

Right of Access (GDPR Article 15): Data Subjects have the right to confirm whether personal data concerning them is being processed, to obtain information about the processing of their personal data, and to obtain a copy of the personal data undergoing processing, as specified in GDPR Article 15. Right to Rectification (GDPR Article 16): Data Subjects have the right to have their personal data corrected by OP. DR. SEDAT KOYUNSEVER if the personal data is inaccurate or incomplete. Right to Erasure (GDPR Article 17): Data Subjects have the right to request the erasure of their personal data by OP. DR. SEDAT KOYUNSEVER under the conditions specified in GDPR Article 17. If the conditions specified in GDPR Article 17 are met, OP. DR. SEDAT KOYUNSEVER will erase your personal data without delay. Right to Restriction of Processing (GDPR Article 18): Data Subjects have the right to obtain from OP. DR. SEDAT KOYUNSEVER the restriction of processing of their personal data where one of the following applies: The accuracy of the personal data is contested by the Data Subject, for a period enabling OP. DR. SEDAT KOYUNSEVER to verify the accuracy of the personal data. The processing is unlawful, and the Data Subject opposes the erasure of the personal data and requests the restriction of its use instead. OP. DR. SEDAT KOYUNSEVER no longer needs the personal data for the purposes of the processing, but it is required by the Data Subject for the establishment, exercise, or defense of legal claims. Data Subjects have the right to obtain from OP. DR. SEDAT KOYUNSEVER the restriction of processing of their pe