CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA

Prof. Dr. Öztekin OTO and his staff present this text, which has been prepared to inform you about the collection, storage and processing of your personal data that you have provided to us during the health service provided to you by Prof. Dr. Öztekin OTO and his staff, to the attention of you, our valued patients.

This information is provided by Prof. Dr. Öztekin OTO practice as the data controller in accordance with the provisions of the Personal Data Protection Law No. 6698 ("KVKK"), the Basic Law on Health Services No. 3359, the Decree Law No. 663 on the Organisation and Duties of the Ministry of Health and Affiliated Institutions, the Regulation on Private Hospitals and the regulations of the Ministry of Health and other legislation.

Within the scope of the legislation, we will be able to record, archive, update, transfer, classify, classify your personal data and "special quality" personal data specific to health services as described in this clarification text, and process them in the ways listed in the KVKK and the relevant legislation.

It is possible to share your personal data with third parties and institutions in cases where the legislation is mandatory and you have given your written consent. These third parties/institutions include relatives of the person receiving the service, public and/or private legal entities of which the person receiving the service is an employee/insured, other public and/or private legal entities, third parties from which our company receives services or cooperates to carry out its activities for the purposes specified in the legislation to which our company is subject.

Your personal data subject to this information text is obtained during the health services provided by Prof. Dr. Öztekin OTO and his staff. Data collection may take place during face-to-face interviews, as well as through call centre, website, e-mail, digital messaging platforms and social media channels.

1- Your Personal Data that we may process in accordance with your explicit consent and the purposes of processing them

Your Identity Information: Your name, surname, Turkish ID number, passport number or temporary Turkish ID number, place and date of birth, marital status, gender, insurance or patient protocol number and other identification data that we can identify you;

Your Contact Details: Your address, telephone number, e-mail address and other contact data, your voice call records kept by customer representatives or patient services in accordance with call centre standards, and your personal data obtained when you contact us via e-mail, letter or other means;

Your Accounting Information: Your financial data such as your bank account number, IBAN number, credit card information, billing information; your data on private health insurance and Social Security Institution data for the purpose of financing and planning of health services; your camera recordings images kept for security and audit purposes if you visit our practice, your vehicle registration plate information if you use the car park;

Your Health Information: Examination data, data on your medical curriculum vitae, data on your medical family history, laboratory results, medical imaging results, test results, examination appointment information, prescription information, pre- and post-operative photographs, three-dimensional visual data, clinical follow-up and endoscopy videos. All conversations and correspondence with your doctor in digital environment (e-mail, SMS, social media, digital messaging platforms, etc.) during the pre-examination consultation, diagnosis, treatment and follow-up process. All clarification texts and consent forms provided to you before the procedure. Your health data recorded in other health institutions and deemed medically necessary to be in your file in our clinic (consultation notes, surgery notes, examination results) are also within this scope. Your personal data on social, family and sexual life obtained during or as a result of the execution of medical diagnosis, treatment and care services are within this scope.

Your personal data obtained by Prof. Dr. Öztekin OTO practice will be used primarily for the purpose of providing you with an effective, safe and quality health service. The general purposes of using your personal data include confirming your identity, ensuring doctor-patient communication, protection of public health, preventive medicine, planning and effective execution of medical diagnosis, treatment and care services, planning and management of health service financing, planning and management of the internal functioning of our practice and daily operations, supply of medicines and materials. If you make an appointment at our clinic, we will use your contact data to inform you about the appointment.

Your personal data may be used for internal risk management, fulfilment of quality improvement activities, training and development of our employees, ensuring patient and employee safety, monitoring unauthorised transactions within the institution, measuring patient satisfaction, improving health services, fulfilling legal and regulatory requirements.

Your personal data may be processed in order to confirm your relationship with our contracted institutions, to make invoicing for our health services, to share the requested information with private insurance companies within the scope of financing health services.

Your personal data may be used to share the information requested with the Ministry of Finance, the Ministry of Health and relevant public institutions and organisations in accordance with the relevant legislation, to provide the necessary information in line with the requests and audits of regulatory and supervisory institutions and official authorities, to maintain the information regarding your health data that must be kept in accordance with the relevant legislation, to respond to all kinds of questions and complaints regarding our health services.

Your personal data of special nature may be used for training and informing other patients and the public, scientific research and training purposes in line with your explicit consent. Visual data obtained during your treatment process will be used to evaluate the cosmetic results obtained after aesthetic surgeries.

2- Cases where Explicit Consent is Not Required for Processing Personal Data Pursuant to KVKK

If at least one of the following conditions is present, it will be possible to process your personal data in the absence of your Explicit Consent.

• It is clearly stipulated in the laws,
• It is necessary for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid,
• It is mandatory for Öztekin OTO to fulfil its legal obligations,
• It has been publicised by the person concerned,
• Data processing is mandatory for the establishment, exercise or protection of a right,
• Data processing is mandatory for the legitimate interests of Dr Öztekin OTO, provided that it does not harm the fundamental rights and freedoms of the data subject.

In addition, your personal data related to health and sexual life can only be processed by Dr Öztekin OTO without seeking your explicit consent for the purposes of protecting public health, preventive medicine, conducting medical diagnosis, treatment and care services, planning and managing the health services and financing you receive.

3- Transfer of Your Personal Data Domestically or Abroad

Personal data created and collected during the health services provided by Dr. Öztekin OTO may be transferred to other health service providers for consultation purposes. In case of your explicit consent, your personal data of special nature may be shown to candidate patients in the clinic or transferred via file sharing over the internet. In case of your explicit consent, qualified health data, including your photos and videos, may be transferred to international scientific organisations. Images of patients are frequently included in the preparation, presentation or printing processes of scientific articles, books, congress papers. Visual materials and other personal data of patients may be transferred to scientific and publishing organisations with their explicit consent.

Your personal data belonging to our service areas may be transferred to private insurance companies, Ministry of Health and its sub-units, Social Security Institution, General Directorate of Security and other law enforcement agencies, General Directorate of Population, Turkish Pharmacists Association, Turkish Courts and all kinds of judicial authorities, central and other third parties, your authorised representatives, lawyers, tax and financial consultants and third parties from whom we receive consultancy including auditors, regulatory and supervisory institutions, business partners and other third parties with whom we cooperate to develop or carry out health services for the above-mentioned purposes, including official authorities, and other third parties. and 9. of the Law within the framework of the personal data transfer conditions and purposes specified in Articles 8 and 9 of the Law, to third parties in the country as well as abroad.

4- Method and Legal Reasons for Collecting and Processing Your Personal Data

Your personal data may be obtained and processed in any verbal, written, visual or electronic environment. It is a legal obligation to keep patient records regularly in the execution of health services and to present them to the patient and legal authorities when necessary. Keeping financial records regularly is also mandatory in terms of tax obligations of individuals and institutions. Especially in plastic surgery, the physician-patient relationship is considered within the scope of "work contract" in various judicial decisions. In this context, it may be necessary to collect standardised visual data at various stages of treatment in order to determine whether the obligations of the work contract are fulfilled. These data may be requested by the patient, their lawyers or the courts in charge in case of any dispute. You can access the legal reasons for the collection and processing of your personal data by reviewing the Personal Data Protection Law No. 6698, the Basic Law on Health Services No. 3359, the Decree Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions, and the Regulations on Private Health Institutions.

5- Storage of Your Personal Data

As a requirement of the principle of purpose limitation, your personal data is processed by Dr Öztekin OTO for a limited period of time that requires processing, and after the expiration of the period, it is deleted, destroyed or anonymised. This period may vary from patient to patient and from data to data. Some of your personal data are stored in writing in our clinical files, protocol books and financial records. Your contact data is stored in the internal and SIM card memory of the mobile phone of our clinic. Your electronic and digital data are stored in both clinic computers, backup hard discs, memory cards, USB drives, e-mail servers and cloud-based data storage systems. Personal data generated through social media during the preliminary interview, diagnosis, treatment and follow-up process are stored in the relevant accounts and records of the platforms where they were created. Your personal data are kept locked in our clinic. Your electronic data is stored with a minimum two-step data protection system. In principle, your health data will be released and stored "indefinitely" unless an unforeseen disaster, accident, theft, etc. occurs.

6- Rights of the Personal Data Owner as a Relevant Person

If you, our esteemed patients, as the owner of the personal data collected, processed and transferred by Dr. Öztekin OTO, wish to exercise your rights mentioned under this heading and / or within the scope of KVKK within the procedures and principles stipulated in this Clarification Text and the legislation or if you apply to Dr. Öztekin OTO practice, your requests in your application will be concluded free of charge within thirty (30) business days at the latest, depending on the nature of the request.

However, if the transaction requires an additional cost for Dr Öztekin OTO, the fee in the tariff determined by the Personal Data Protection Board may be requested.

Pursuant to Article 11 of the LPPD, data subjects (data owners - service recipients);

(i) to learn whether personal data concerning them have been processed, (ii) to request information if personal data have been processed, (iii) to learn the purpose of processing personal data and whether they are used in accordance with their purpose, (iv) to know the third parties to whom personal data are transferred domestically or abroad, (v) to request correction of personal data in case of incomplete or incorrect processing and to request notification of these changes to third parties to whom personal data are transferred, (vi) collected in accordance with the provisions of the law and relevant legislation, (vii) to object to the occurrence of a result to the detriment of the person himself/herself by analysing the processed data exclusively through automated systems and (viii) to demand the compensation of the damage in case of damage due to unlawful processing of personal data.

Requests for the use of such rights may be communicated to us by the personal data owners by the methods specified within the scope of Law No. 6698.

Regarding the issues on this form, there may be changes in line with legal and technological developments.

In case you have rights or requests that you want to use within the scope of the above articles, you can send an e-mail signed with your secure electronic signature to the e-mail address oztekinoto@oztekinoto.com. Alternatively, you can send a petition bearing your wet signature by post or courier to Prof. Dr. Öztekin OTO Muayenehanesi, Özbaş Apt, Alsancak Şair Eşref Bulvarı, 1402. Sk. No:2 D:2, 35220 Konak, Izmir, Turkey.