Personal Data Clarification Text and Consent Form

Relevant Legislative Provisions

• Personal Data Protection Law No. 6698
• Regulation on Personal Health Data
• Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Clarify
• Private Hospitals Law No. 2219
• Basic Law on Health Services No. 3359
• Decree-Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions
• Private Hospitals Regulation, Health Implementation Communiqué, and Regulation on Patient Rights
• Turkish Code of Obligations No. 6098
• Law on the Regulation of Electronic Commerce No. 6563

In accordance with the Personal Data Protection Law No. 6698 ("KVKK"), the Basic Law on Health Services No. 3359, the Decree-Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, Ministry of Health regulations, and other legislative provisions; Letoon Hospital provides you with certain disclosures within the scope of this Clarification Text in order to lawfully collect and process your personal data, including your special categories of personal data, which you have provided to us while benefiting from our healthcare and other services.

Letoon Hospital, acting in the capacity of Data Controller, may record, store, update, share with third parties where permitted and/or required by legislation or contracts (including the relatives of the service recipient and/or public and/or private law legal entities of which the service recipient is an employee/insured, other public and/or private law legal entities, and third parties from whom our hospital receives services or cooperates with to carry out activities subject to the purposes specified in the legislation to which our hospital is subject), transfer, classify, and otherwise process your personal data as set forth in the KVKK and relevant legislation, as explained in this Clarification Text.

Among the special categories of personal data, the health data of the data subjects may be processed without seeking the explicit consent of the data subject only by persons under an obligation of confidentiality or authorized institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, the execution of treatment and care services, and the planning and management of healthcare services and financing. Furthermore, regardless of its type, all special categories of personal data may only be processed by law if adequate measures determined by the Personal Data Protection Board are taken.

Your personal data are obtained by Letoon Hospital through oral, written, visual, or electronic means, via the call center, website, and similar channels, for the purposes of protecting public health, preventive medicine, medical diagnosis, the execution of treatment and care services, and the planning and management of healthcare services and financing provided by Letoon Hospital.

Your Processed Personal Data and Their Purposes of Processing

Your personal data listed below, including your special categories of personal data and primarily your health data, may be processed by Letoon Hospital in a connected, limited, and proportionate manner for the purposes specified in this article, including but not limited to the following:

• Your Identity Information: Your name, surname, T.R. identity number, passport number or temporary T.R. identity number, place and date of birth, marital status, gender, insurance or patient protocol number, and other identity data by which we can identify you;
• Your Contact Information: Your address, telephone number, electronic mail address, and other communication data; your voice call recordings maintained by customer representatives or patient services in accordance with call center standards; and your personal data obtained when you contact us via electronic mail, letter, or other means;
• Your Accounting Information: Your financial data such as bank account number, IBAN number, credit card information, and billing information; your private health insurance data and Social Security Institution data for the purpose of financing and planning healthcare services; and your camera system recordings kept for security and audit purposes when you visit our Hospital.
• Your Health Information: Any personal data concerning your health and sexual life obtained during or as a result of medical diagnosis, treatment, and care services, including but not limited to your laboratory results, test results, medical examination data, appointment information, and prescription information; other personal data including your resume provided in the event that you apply for a job at Letoon Hospital; and any personal data related to your employment contract if you are an employee or associated worker of Letoon Hospital.

Any personal data obtained by Letoon Hospital may be processed in line with the listed purposes, including: verifying your identity; protecting public health; preventive medicine; executing medical diagnosis, treatment, and care services; planning and managing healthcare services and financing; planning and managing the functioning and daily operations of our Hospital; procurement of medication; informing you about your appointment if you schedule one; executing risk management and quality improvement activities; making evaluations and conducting research to improve healthcare services; fulfilling legal and regulatory requirements; confirming your relationship with institutions contracted with the Hospital; invoicing in return for our healthcare services; sharing requested information with private insurance companies within the scope of financing healthcare services; sharing requested information with the Ministry of Health and relevant public institutions and organizations pursuant to the relevant legislation; responding to all your questions and complaints regarding our healthcare services; taking all necessary technical and administrative measures within the scope of data security for our Hospital's systems and applications; analyzing your use of healthcare services and storing your health data to develop and improve the healthcare services we offer; providing necessary information to regulatory and supervisory institutions and official authorities in line with their requests and audits; training and developing our employees; monitoring, preventing, and reversing abusive and unauthorized transactions; retaining information regarding your health data that must be stored pursuant to the relevant legislation; ensuring financial reconciliation with contracted institutions regarding the healthcare services provided to you; measuring patient satisfaction; and, without limitation, executing and developing medical diagnosis, treatment, and care services, planning and managing healthcare services and financing, increasing patient satisfaction, research, and similar purposes.

Cases Where Explicit Consent Is Not Required for Processing Personal Data Under the KVKK

In the presence of at least one of the following conditions, it will be possible to process your personal data even in cases where your Explicit Consent is not present:

1. It is clearly envisaged in the laws,
2. It is mandatory for the protection of the life or physical integrity of the person or another person who is unable to express their consent due to actual impossibility or whose consent is not granted legal validity,
3. It is necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract,
4. It is mandatory for Letoon Hospital to fulfill its legal obligation,
5. It has been made public by the data subject themselves,
6. Data processing is mandatory for the establishment, exercise, or protection of a right,
7. Data processing is mandatory for the legitimate interests of Letoon Hospital, provided that it does not harm the fundamental rights and freedoms of the data subject.
8. In addition, your personal data concerning health and sexual life may be processed by Letoon Hospital without seeking your Explicit Consent solely for the purposes of protecting public health, preventive medicine, medical diagnosis, the execution of treatment and care services, and the planning and management of healthcare services and financing.

Transfer of Your Personal Data

Your personal data belonging to our service recipients may be transferred to third parties in the country as well as abroad within the framework of the personal data transfer conditions and purposes specified in Articles 8 and 9 of the Law, for the purposes of: carrying out the necessary work by business units to enable data subjects to benefit from the services offered by Letoon Hospital and executing the relevant business processes; planning and executing the commercial or scientific strategies of Letoon Hospital; and ensuring the legal, technical, and commercial security of persons in a relationship with Letoon Hospital. Recipients include private insurance companies, the Ministry of Health and its subordinate sub-units, the Social Security Institution, the General Directorate of Security and other law enforcement forces, the General Directorate of Population and Citizenship Affairs, the Turkish Pharmacists' Association, courts and all kinds of judicial authorities, central and other third parties, representatives authorized by you, attorneys to whom you have granted a power of attorney regarding the matter, third parties from whom we receive consultancy services including tax and financial consultants and auditors, regulatory and supervisory institutions, official authorities, business partners, and other third parties with whom we cooperate to develop or carry out healthcare services for the purposes stated above.

Method and Legal Grounds for Collecting and Processing Your Personal Data

Your personal data are obtained in any oral, written, visual, or electronic environment for the purposes mentioned above and to provide healthcare services within the determined legal framework, thereby enabling our Hospital to fully and properly perform its contractual and statutory obligations.

Rights of Data Subjects Under the Law

By applying to Letoon Hospital at any time, you may exercise your rights to:

• Learn whether your personal data are processed or not, learn the purpose of processing and whether they are used in accordance with their purpose, and request information if they have been processed,
• Learn the third parties to whom your information is transferred domestically or abroad in accordance with the Law,
• Request correction of your information if you think it has been processed incompletely or inaccurately,
• Request the erasure or destruction of your information within the framework of the conditions provided for in Article 7 of the Law,
• Request that your aforementioned requests be notified to the third parties to whom your information has been transferred and that they perform the same operations,
• Object to the occurrence of a result against you due to the analysis of your information exclusively through automated systems, or
• Demand compensation for the damage if you think that your data have been recorded or used unlawfully and you have suffered damage as a result.

In the event that the application you make for these purposes requires an additional cost, you will be required to pay the fee determined by the Communiqué on the Procedures and Principles of Application to the Data Controller issued by the Personal Data Protection Board. If a written reply is given to your application, no fee will be charged up to the first 10 (ten) pages, and a transaction fee of 1 TL will be charged for each page over 10 (ten) pages. If the response to your application is provided in a recording medium such as a CD or flash memory, the cost of the recording medium will be reflected to you.

The requests in your application will be finalized as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. To benefit from your rights under the Law, you can submit your applications in writing to Letoon Hospital and visit the website of the Personal Data Protection Authority for detailed information.

You can submit your applications using one of the following methods:

• After filling out the form available at www.letoonhospital.com.tr, a wet-signed copy can be delivered in person or via a notary public to the address: Pazaryeri Mahallesi, Ş. Hasan Küçükçoban Cd. No:22, 48300 Fethiye/Muğla,
• After filling out the form available at www.letoonhospital.com.tr and signing it with your secure electronic signature or mobile signature within the scope of the Electronic Signature Law No. 5070, the secure electronically signed form can be sent to our Hospital's KEP (Registered Electronic Mail) address via registered electronic mail or via your electronic mail address previously notified to our hospital and registered in our hospital's system.

In the application containing your explanations regarding the right you hold and request to exercise as a personal data owner; the matter you request must be clear and understandable, the subject of your request must be related to your person, or if you are acting on behalf of someone else, you must present your special power of attorney certified by a notary public.

Pursuant to the "Communiqué on the Procedures and Principles of Application to the Data Controller", it is mandatory that applications contain the following elements: name-surname, signature, T.R. identity number, residence or workplace address, e-mail address, telephone and fax number, and the subject of the request. Applications that do not contain these elements will be rejected by our Hospital.

Our Hospital always reserves the right to make changes to this clarification text for reasons arising from the Law, secondary regulations, and Board decisions. The changes to be made to the clarification text and the updated text shall become effective immediately as of the date they are notified to you.

FETMED ÖZEL SAĞLIK HİZM. TİC. A.Ş.
☐ I have read and understood. I have provided my personal data mentioned in the clarification text of my own free will and consent.