CLARIFICATION TEXT ON PROCESSING OF PERSONAL DATA

As Global Health Services Danışmanlık Sağlık Turizmi A.Ş. ("Global"), as the Data Controller prepared this clarification text ("Clarification Text") for the purpose of informing about the collection, processing, and transfer of your personal data, being the Relevant Person ("Data Subject") in contact with Global within the framework of the Law on the Protection of Personal Data No. 6698 ("PDPL") and the relevant legislation.

You can learn detailed information about your personal data collected, processed, and transferred through the Data Controllers Registry Information System of the Personal Data Protection Board ("VERBİS").

You can access the VERBİS records of Global at https://verbis.kvkk.gov.tr by searching the company title above in the "Registry Inquiry" section.

1- The Personal Data Processed

Detailed information about your personal data collected and processed is included in the VERBİS under the heading "Data Categories".

Among your personal data collected and processed;

(a) Identity data such as name, surname, Republic of Turkey ("T.R.") identification number, passport number or temporary T.R. identification number for non-T.R. citizens, place and date of birth, marital status, gender,

(b) Contact data such as address, telephone number, e-mail address,

(c) Personal data obtained during the execution of medical diagnosis, treatment, and care services such as examination, diagnosis, analysis data and test, laboratory and imaging results, prescription information,

(d) Medical data relating to previous examinations, diagnoses, and tests that you have communicated with your own consent,

(e) Data on private health insurance and Social Security Institution data for financing and planning of health services

(f) Financial data such as bank account number depending on possible payments,

(g) The responses and comments shared in order to evaluate the services received,

(h) Closed circuit camera system images and audio recordings taken during the hospital visit,

(ı) Voice call records kept if contacted by your Call Center,

(i) Vehicle license plate information in case of utilization of parking and valet service,

(j) Location information, IP address, browser information, form information obtained during the use of the website and mobile application are included.

2- Processing of Personal Data

Detailed information about the purposes of processing your personal data is included in the VERBİS under the heading "Personal Data Processing Purposes".

Purposes of processing your personal data;

(a) Public health protection, preventive medicine, medical diagnosis, execution treatment and care services,

(b) Sharing the requested information with the Ministry of Health and other public institutions and organizations in accordance with the relevant legislation,

(c) Sharing the medical information requested with private insurance companies within the scope of financing of health services, examination, diagnosis and treatment expenses,

(d) Invoicing for services you receive,

(e) Planning and managing the internal functioning of the institution,

(f) Monitoring and prevention of misconduct and unauthorized transactions,

(g) To be able to answer all your questions and complaints about the health services you have received, to measure, increase and investigate patient satisfaction,

(h) Providing information about the services, complementary services and new services you are receiving.

3- Collection of Personal Data and Legal Reason

Detailed information about the retention periods of your collected personal data and the data security measures taken to protect the stored data is included in the VERBİS under the headings of "Data Retention Periods" and "Data Security Measures".

Among the means of collecting your personal data;

(a) Data entry into the company and hospital management software,

(b) Forms issued or printed electronically,

(c) Audible or silent security camera recordings,

(d) Call center audio recordings are available.

Your personal data within this scope are processed by Global in accordance with the following issues in the relevant legislation and Article 5 of the PDPL for the realization of the above-mentioned purposes;

(a) it is clearly stipulated by law and is mandatory for the data controller to fulfill its legal obligation;

(1) Health Services Basic Law No. 3359

(2) Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliates,

(3) Private Hospitals Regulation,

(4) Emergency Health Regulation,

(5) Patient's Rights Regulation

(6) Regulation on the Processing of Personal Health Data and Protection of Privacy,

(7) Infectious Diseases Surveillance and Control Principles Regulation

(b) Provided that it is directly related to the conclusion or performance of a contract, if it is necessary to process personal data of the parties to the contract

(c) In the event that data processing is required for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the relevant person are not damaged.

Global retains the personal data collected and processed for as long as it deems necessary for the purposes of establishing the obligations arising from the contracts, providing that they are not shorter than the periods specified by the relevant laws and legislation, to constitute evidence in possible legal disputes, to assert rights or to establish a defense.

4- Transfer of Personal Data:

Detailed information about the transfer of your personal data collected and processed is included in the VERBİS under the headings of "Data Transfer Recipient Groups" and "Information to be Transferred to Foreign Countries".

Your personal data are transferred to:

(a) Health institutions related to the Ministry of Health, sub-units affiliated to the Ministry and family medicine centers

(b) Private insurance companies within the scope of financing of health services, examination, diagnosis and treatment expenses,

(c) Social Security Institution,

(d) General Directorate of Security and other law enforcement agencies,

(e) General Directorate of Population and Citizenship Affairs,

(f) Turkish Pharmacists' Association,

(g) Judicial authorities,

(h) Laboratories, medical centers, ambulances, medical devices and institutions that provide health services with which you cooperate for medical diagnosis and treatment,

(ı) Health institution to which you are referred or to which you applied yourself,

(i) The legal representatives you have authorized,

(j) in the event of a potential legal dispute, to Global lawyers, tax advisors and auditors, third parties consulted, who are legally or contractually bound to keep secrets,

(k) Regulatory and supervisory bodies and official authorities,

(l) If the invoicing is to be made to the employer, to the workplace physician,

(m) Global affiliates and subsidiaries within the legal limits in terms of the continuity of the services you receive,

(n) In accordance with the legislation, to our business partners who provide bulk SMS and e-mail in order to provide information on the services you receive, complementary services, new services, etc..

5- Legal Rights Regarding Personal Data

Within the scope of the PDPL and the relevant legislation, regarding your personal data; you have the following rights

(a) Learning whether your personal data has been processed or not,

(b) If personal data has been processed, requesting information about it,

(c) Learning the purpose of processing the personal data and whether they are used in line with its purpose,

(d) To know about the third parties to whom personal data are transferred in the country or abroad,

(e) Requesting the data's correction in the event that it was processed incompletely or inaccurately.

(f) Requesting the deletion or destruction of personal data under the conditions stipulated in the Article 7.

(g) Requesting notification of the operations carried out in compliance with sub-paragraphs (e) and (f) to third parties to whom your personal data has been transferred,

(h) Objecting to any result to the detriment of the data subject by analyzing the processed data exclusively by automated systems,

ı) Requesting compensation for the damages in case of incurring damages due to unlawful processing of personal data.

6- Use of Legal Rights Regarding Personal Data

You can submit your requests regarding your personal data to Global through the following channels in accordance with the Communiqué on Application Procedures and Principles to the Data Controller:

Application Method

With your handwritten signature and a valid identity document in person or through a notary public

Via your e-mail address registered in Global's system, [email protected]

"Application within the scope of PDPL" should be written in the subject section of the e-mail.

Via the e-mail address that is not registered in Global's system, including secure electronic signature or mobile signature, to [email protected], www.bookingsurgery.com

"Application within the scope of PDPL" should be written in the subject section of the e-mail.

If you are applying on behalf of another person, together with your own identification information; you need to share the below attachments with your application

(a) a copy of the civil registry record or relevant document showing your relationship and authority with your parent or guardian,

(b) in other cases, a copy of the power of attorney to which you have been specifically authorized;

Pursuant to the Communiqué on Application Procedures and Principles to the Data Controller, the following information must be included in the application:

(a) Signature if name, surname and application is written,

(b) For Turkish citizens, Turkish ID number; for foreigners, nationality, passport number and, if any, identity number,

(c) The place of residence or place of business for notification,

(d) e-mail address, phone and fax number for notification, if any

(e) Subject of the request.

You can be informed about the innovations and developments of the Global Health Group via www.bookingsurgery.com.