As “Eko Özel Sağlık İnşaat Turizm San. Tic. Ltd. Şti”; we show maximum care for the processing and protection of your personal data. In accordance with the Law on the Protection of Personal Data, the Basic Law on Health Services, the Regulation on Personal Health Data, the Private Hospitals Regulation, the Patient Rights Regulation, and relevant legislation, as the data controller; all necessary technical and administrative measures are taken to prevent the unlawful processing of personal data, to prevent unlawful access to personal data, and to ensure the preservation of personal data. Pursuant to Article 10 of the Law on the Protection of Personal Data; we inform you via this clarification text and policies created to cover our patients, patient companions, patient relatives, visitors, hospital administrators and employees, employee candidates, suppliers, service providers and their managers and employees, business/solution partners, company partners, employee candidates, public institutions and organizations with whom we are in contact, and employees of private legal entities and relevant third parties. This clarification text has been prepared by “Eko Özel Sağlık İnşaat Turizm San. Tic. Ltd. Şti” in the capacity of data controller within the scope of Article 10 of the Law on the Protection of Personal Data (“Law”), Article 5/8 of the Regulation on Personal Health Data, and the Communiqué on the Procedures and Principles to be Followed in the Fulfillment of the Obligation to Inform.

1- Data Controller:

“Eko Özel Sağlık İnşaat Turizm San. Tic. Ltd. Şti” (Mimar Sinan Mah. Dr. Mustafa Enver Beyi Cad. Manolya Apt. 37/1-A Konak/İzmir); processes your personal data in the capacity of “Data Controller” as defined in Article 3 of the Law on the Protection of Personal Data.

2– For What Purpose Personal Data Will Be Processed:

Your personal data collected in accordance with the Law on the Protection of Personal Data, Basic Law on Health Services, Regulation on Personal Health Data, Private Hospitals Regulation, Patient Rights Regulation, and relevant legislation is processed by being obtained, recorded, stored, changed, rearranged partially or completely, by automatic means or by non-automatic means provided that it is part of any data recording system, in accordance with the principles stipulated in the law. Your personal data is processed for the following purposes within the scope of company activities in accordance with Articles 4, 5, and 6 of the Law and the relevant legislation: ▪ Protection of public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services financing, ▪ In accordance with the relevant legislation to which we are subject, sharing the information we obtain regarding health services with the Ministry of Health, Social Security Institution, and other relevant public institutions and organizations, responding to the requests of institutions, making necessary notifications to relevant public institutions and organizations, fulfilling legal obligations, ▪ Ensuring the preservation of data that must be kept pursuant to legislation within the scope of the health service we offer, ▪ Confirming your identity, confirming your legal connection with contracted institutions within the scope of the health services offered, ensuring invoicing and financial reconciliation, making notifications arising from legislation to relevant institutions and organizations such as birth, death, and forensic cases, ▪ Making appointments within the scope of our health services, creating appointments, providing necessary information, ensuring the satisfaction of patients, patient relatives, and visitors, following up on request and complaint processes, conducting examinations and evaluations required by the health services offered, ▪ Improving Company services, sustaining corporate development activities, sustaining advertising and marketing activities, sustaining the company’s financial and accounting, administrative, legal, and technical business processes, fulfilling risk management and quality improvement processes, ▪ Planning and execution of human resources processes, fulfillment of job application processes, creation of personnel files for employees, fulfillment of financial obligations, determination of company wage policy, ▪ Establishment and ensuring the performance of contracts made or to be made between our Company and patients, suppliers, service providers, employees and consultants with whom it has a legal relationship, relevant institutions and organizations, and third parties, ▪ The Company’s burden of proof as evidence in legal disputes with third parties, ▪ Ensuring communication between our Company and relevant persons and organizations, ensuring necessary contact via our website and social media accounts, maintaining the necessary processes for you to fill out relevant electronic and physical forms, ensuring the transaction security of relevant persons, ▪ Providing necessary information to regulatory and supervisory official institutions and private legal entities, ▪ Ensuring the supply of medical drugs, materials, or devices, and the execution of invoicing and payment transactions related to the services offered; ▪ Through the closed-circuit camera recording system; tracking the security of our patients, visitors, employees, and relevant third parties, ensuring legal, technical, and commercial occupational safety, preventing behaviors of third parties that may constitute a crime, ensuring the physical security of company buildings, annexes, and surroundings, ▪ Performance evaluation, ensuring attendance and control via the personnel attendance control system within the scope of the employment contract made with employees and the company’s interest, ensuring the control of entries and exits of company buildings and annexes, In line with the purposes written above, limited to company activities, your personal data listed below is processed. ▪ Identity Information: (T.R. identity / foreign identity number, your name and surname, place and date of birth, mother’s and father’s name, marital status, gender, passport, foreign identity document, identity information on the driver’s license, your national identity card or other population identity information on the identity sharing system, patient number and patient protocol number for patients) ▪ Contact Information: (Your phone numbers, contact address, e-mail address) ▪ Personnel Information: (Personal information on contracts filled out for employees and interns, education, diploma information, certificate information, social security registration number information, general health insurance, private health insurance information, SSI entry and exit declarations, identity information written on the family status declaration, dependents, spouse, child relationship information, civil registry information of family members, embezzlement document taken according to the nature of the job, work certificate, resignation, termination, severance and notice pay payroll, salary payroll information, disciplinary investigation information, service record, resume information, leave information, personnel performance evaluation reports, occupational and work accident information, reference information, bank account information, IBAN number information, survey information, personal information taken within the scope of occupational health and safety, military service information, personnel attendance control system, personal information taken via personnel cards to ensure entry and exit transactions to relevant units, information in the job application form,) ▪ Financial Information: (Invoicing and payment information, bank account number, IBAN number, credit card information, private insurance information within the scope of financial payment, policy information, General Health Insurance information, financial information taken within the scope of notifications to be made to SSI and the Ministry of Health, salary payroll, expense advance information, tax identification number, tax office information, invoice, waybills, signature circulars, personal information on delivery and receipt documents, information in the annexes of contracts made with third parties) ▪ Legal Transaction Information: (Legal contact with relevant persons and services offered, personal information in correspondence with courts, prosecutor’s offices, mediators, arbitration committees, judicial authorities within the scope of legal disputes, information in lawsuit and execution files, identity and contact information processed into the system in legal notifications required to be made to police departments for identity verification for patients and companions, personal information in minutes and forms kept in cases of tort, legal dispute, and other situations occurring during the visits of patients, patient relatives, and visitors to our hospital, ▪ Professional Experience Information: (Education status information, school, diploma information, work life, reference information, internship, seminar, hardware used, software, computer knowledge, foreign language knowledge, former workplace, institution information, courses attended, in-service training information, certificates, driver’s license information, other information in notified forms, expertise, title, duty information), ▪ Visual and Audio Recordings: (Health reports issued within the scope of company activities, your photos on documents, photo information on job application forms, printed forms filled in electronic and physical environments, documents and official identity documents during appointment creation, communication with the company and follow-up of request and complaint processes, protection of public health, execution of medical diagnosis, treatment and care services) ▪ Physical Space Security Information: (Camera recording information capturing images), ▪ Promotional Information: Within the scope of company activities, in accordance with the employment contract and the legitimate interests of the company, for promotion, advertising, and information purposes; professional experience, promotion, information, resume, and photo information of employees on the company website, social media accounts, mobile applications, and promotional brochures, ▪ Patient Images: For the purpose of protecting public health, preventive medicine, executing medical diagnosis, treatment and care services, planning and managing health services and financing; images and personal data belonging to patients in photos and videos shared in written, visual media, on the website, and on our social media accounts, taken with the explicit consent of the person concerned by persons or authorized institutions and organizations under the obligation of confidentiality, ▪ Request and Complaint Information: (Information and records collected from relevant persons from electronic and physical environments, information regarding the evaluation and management process of requests and complaints coming via the internet and social media, online channels, call center) ▪ Criminal Conviction and Security Measure Information: (Criminal record, conviction, sentence information, judicial status information), ▪ Biometric Information: (Fingerprint, face recognition information within the scope of personnel attendance control for the purposes of identity verification and invoicing of health service, ensuring workflow for our personnel and performance evaluation) ▪ Health Information: (Processed within the scope of protecting public health, preventive medicine, medical diagnosis, treatment and care services for patients; examination, all kinds of laboratory, imaging and test results, patient diagnosis, diagnosis, treatment, prescription, drug information, doctor analysis and comments, patient history (anamnesis) information, check-up information, examination information, diagnosis and prescription information, health reports, nutrition, diet information and all health information taken within the scope of health services, Health status information written in the job application form, health reports for employees, health tests, blood group information, personal health and physical disability status information, health board reports, personal data regarding diagnosis and treatment procedures are processed) ▪ Sexual Life and Genetic Data: (Personal data within the scope of all kinds of sexual life and genetic data belonging to patients, limited to the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing within the scope of offered health services)

3- To Whom and For What Purpose Processed Personal Data Can Be Transferred

Your personal data processed by our Company is transferred to the relevant real and legal persons for the purposes written below in accordance with the relevant legislation to which our company is subject and Articles 8 and 9 of the Law on the Protection of Personal Data: ▪ To the Ministry of Health, its affiliated sub-units, family medicine centers, Social Security Institution, General Directorate of Security and its affiliated organizations, other law enforcement forces, General Directorate of Population and Citizenship Affairs, Turkish Pharmacists Association, Revenue Administration, Tax Offices, and all relevant public institutions and organizations, professional organizations in the nature of public institutions in order to fulfill the legal obligations stipulated in the relevant legislations, ▪ To university hospitals, public hospitals, private hospitals, medical faculties, laboratories, medical centers, and third parties providing health services, other health institutions with whom we cooperate for the realization of medical diagnosis, examination, treatment, and referral procedures, ▪ To the relevant persons and organizations from whom health services are received and private insurance companies regarding the health information of employees within the scope of occupational health and safety measures in order to carry out the occupational health and safety processes of the relevant persons, ▪ To written and visual media organs, relevant press institutions and organizations, third-party websites, and social media mediums regarding your photos, videos/images in camera recordings taken based on your explicit consent for the purposes of protecting public health, executing medical diagnosis, treatment and care services, promotion, and information, ▪ To banks, financial institutions, public and private legal entities, public officials in order to carry out the financial transactions of the relevant persons, ▪ To prosecutor’s offices, courts, mediators, enforcement offices, and relevant legal institutions and organizations limited to the purpose of demand regarding public security issues and legal disputes, upon request and as required by legislation, ▪ To software, hardware, informatics, and technology companies for the establishment of computer operating systems and computer programs used within our Company, ensuring the security of electronic data, and performing maintenance and repair operations of programs, ▪ Regarding special categories of personal data (sensitive data); your personal data is transferred in accordance with the legislation and limited to the purpose of transfer, without seeking the explicit consent of the person concerned for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, or by obtaining explicit consent when necessary as required by legal regulation.

4- Method and Legal Reasons for Personal Data Collection:

Your personal data is collected and processed in line with the services we offer and the personal data processing purposes stated above; through your use of software and hardware programs offered in electronic environments, our social media accounts, e-mail channels, filling out forms on the website, creating membership, receiving patient applications, performing registration procedures, arranging printed forms, performing medical diagnosis, treatment and health services within the scope of health services, creating personnel files, arranging and performing contracts, processing accounting, finance, fiscal, legal transaction information, by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system. Your personal data and special categories of personal data are processed in accordance with the legal regulations to which our company is subject, based on the explicit consent of the person concerned. Furthermore, your personal data is processed without seeking explicit consent based on the legal reasons written below. Accordingly, your personal data is processed, collected, and transferred limited to the purposes specified in accordance with Articles 5 and 6 of the Law on the Protection of Personal Data and Article 5/1-h of the Communiqué on the Procedures and Principles to be Followed in the Fulfillment of the Obligation to Inform, for the reasons that: ▪ It is clearly stipulated in the laws, ▪ It is mandatory for the protection of the life or physical integrity of the person or of another person who is unable to explain his/her consent due to actual impossibility or whose consent is not legally valid, ▪ It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of contracts between our Company and real and legal persons, ▪ The personal data has been made public by the person concerned himself/herself, ▪ Data processing is mandatory for the establishment, exercise, or protection of a right, ▪ Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned. Your personal data is stored and retained for the period written in the relevant legislations within the scope of company activities.

5- Rights of the Personal Data Owner (Right of Application):

You may submit your requests regarding your rights within the scope of Article 11 of the Law on the Protection of Personal Data “regulating the rights of the person concerned” as the data controller according to the Communiqué on the Procedures and Principles of Application to the Data Controller; To the address of “Eko Özel Sağlık İnşaat Turizm San. Tic. Ltd. Şti” (Mimar Sinan Mah. Dr. Mustafa Enver Beyi Cad. Manolya Apt. 37/1-A Konak/İzmir), by filling out the APPLICATION FORM located at www.metropolsaglik.com, you can submit a signed copy of the form to the company address personally with documents identifying your identity, by sending an e-mail to info@alsancakilketip.com using a secure electronic signature, mobile signature, or the electronic mail address you have previously notified to our company and which is registered in our company’s system, through a Notary, or by methods determined by the Personal Data Protection Authority. Pursuant to Article 11 of the Law; everyone has the right to apply to the data controller and regarding themselves; ▪ Learn whether personal data is processed, ▪ Request information if personal data has been processed, ▪ Learn the purpose of processing personal data and whether they are used in accordance with their purpose, ▪ Know the third parties to whom personal data is transferred domestically or abroad, ▪ Request rectification of personal data in case of incomplete or incorrect processing, ▪ Request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK, ▪ Request that these operations be notified to third parties to whom personal data has been transferred in case of rectification, deletion, or destruction of personal data, ▪ Object to the occurrence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems, ▪ Request compensation for damages in case of damage due to unlawful processing of personal data. Pursuant to Article 13/1 of the KVK Law No. 6698, you must submit your applications to exercise your rights stated above to our Company in writing or by the methods written above determined by the KVK Board. Our Company will conclude your requests in the application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Board will be requested. In this context, if the application of the person concerned is answered in writing, no fee will be charged up to ten pages, and a transaction fee of 1 TL will be charged for each page over ten pages. If the response to the application is given in an electronic recording medium such as a CD or flash memory, the fee that may be requested by our company will not exceed the cost amount required by the recording medium. I have read and understood this Clarification Text prepared regarding by whom and for what purpose my personal data will be processed, to whom and for what purpose the processed personal data can be transferred, the method and legal reason for collecting personal data, and my rights included in Article 11 of the Law, pursuant to Article 10 titled “Obligation of the Data Controller to Inform” of the Law on the Protection of Personal Data No. 6698, and possessing the capacity of data controller, I have been informed in detail about this subject by “Eko Özel Sağlık İnşaat Turizm San. Tic. Ltd. Şti”.