Personal Data Protection and Privacy Policy

1. IDENTITY OF THE DATA CONTROLLER

The Personal Data Protection Law No. 6698 (hereinafter referred to as “KVKK”) was published and entered into force on 07.04.2016. Within the scope of the said law, in its capacity as “Data Controller” within the scope of Article 10 of KVKK, our Company UĞUR SAĞLIK HİZMETLERİ ANONİM ŞİRKETİ “ÖZEL AKADEMİ HASTANESİ” (hereinafter referred to as AKADEMİ HOSPITAL) may process your personal data within the framework described below and in accordance with the Basic Law on Health Services No. 3359, the Regulation on the Processing of Personal Health Data and Protection of Privacy, Decree-Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions, the Regulation on Private Hospitals, the regulations of the Ministry of Health and other applicable legislation.

This AKADEMİ HOSPITAL Personal Data Protection and Privacy Policy (hereinafter referred to as the “Policy”) has been prepared, on condition that it is revised at least once every six months in accordance with current legislation, in order to inform the relevant parties and persons about the processes and principles of the processing of personal data by AKADEMİ HOSPITAL.

2. DEFINITIONS

3. BASIC PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

The personal data processing activities, the legal grounds and the basic principles for the processing of personal data are as follows;

a) Being in compliance with the law and the rules of good faith.

b) Being accurate and, where necessary, up to date.

c) Being processed for specific, explicit and legitimate purposes.

ç) Being relevant, limited and proportionate to the purposes for which they are processed.

d) Being retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

Persons working at health service providers may process and access the health data of the data subject only to the extent limited by the requirements of the health service to be provided.

3.1 LEGAL GROUNDS FOR DATA PROCESSING ACTIVITIES

Personal data processed within the framework of the operating activities of AKADEMİ HOSPITAL are retained for the period stipulated in the relevant legislation. In this context, personal data are processed within the framework of;

• Personal Data Protection Law No. 6698
• Turkish Code of Obligations No. 6098
• Turkish Penal Code No. 5237
• Turkish Commercial Code No. 6102
• Social Insurance and General Health Insurance Law No. 5510
• Health Services Law No. 3359
• Occupational Health and Safety Law No. 6331
• Labour Law No. 4857
• Regulation on Personal Health Data
• Regulation on the Processing of Personal Health Data and Protection of Privacy
• Regulation on Private Hospitals
• Regulation on Archive Services
• Decree-Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions,
• KVKK Decisions
• and the legal legislation in force pursuant to these laws and other secondary regulations, and are retained for the retention periods stipulated under the relevant laws.

3.2. CONDITIONS FOR THE PROCESSING OF PERSONAL DATA

Pursuant to Article 7 of the Regulation on the Processing of Personal Health Data and Protection of Privacy, personal health data may be processed without seeking the explicit consent of the data subject, by persons under an obligation of confidentiality or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning and management of health services and their financing.

In order for personal health data to be processed without being anonymised for purposes other than those listed in the first paragraph, the data subject must be informed in detail about the grounds for processing the data, his/her written consent must be obtained, and this consent must be retained.

Unless there is a legal regulation or judicial decision to the contrary, the data subject may withdraw at any time the consent he/she has given for the processing and transfer of his/her data. The withdrawal of consent shall not have effect with respect to operations carried out up to that date.

3.3. PURPOSES OF PROCESSING PERSONAL DATA

Your personal data obtained by AKADEMİ HOSPITAL are processed within the framework of the purposes described below.

• Conducting Emergency Management Processes
• Conducting Information Security Processes
• Conducting Employee Candidate / Intern / Student Selection and Placement Processes
• Conducting Application Processes of Employee Candidates
• Conducting Employee Satisfaction and Loyalty Processes
• Fulfilling Obligations Arising from Employment Contracts and Legislation for Employees
• Conducting Fringe Benefits and Benefits Processes for Employees
• Conducting Audit/Ethics Activities
• Conducting Training Activities
• Managing Access Authorisations
• Conducting Activities in Compliance with Legislation
• Conducting Finance and Accounting Affairs
• Conducting Company/Product/Service Loyalty Processes
• Conducting Assignment Processes
• Following Up and Conducting Legal Affairs
• Conducting Internal Audit/Investigation/Intelligence Activities
• Conducting Communication Activities
• Planning Human Resources Processes
• Conducting / Auditing Business Activities
• Conducting Occupational Health/Safety Activities
• Conducting Business Continuity Activities
• Conducting Logistics Activities
• Conducting Goods / Services Procurement Processes
• Conducting Goods / Services After-Sales Support Services
• Conducting Goods / Services Sales Processes
• Conducting Goods / Services Production and Operation Processes
• Conducting Customer Relationship Management Processes
• Conducting Activities Aimed at Customer Satisfaction
• Organisation and Event Management
• Conducting Marketing and Analysis Activities
• Conducting Performance Evaluation Processes
• Conducting Advertising/Campaign/Promotion Processes
• Conducting Risk Management Processes
• Conducting Storage and Archiving Activities
• Conducting Social Responsibility and Civil Society Activities
• Conducting Contract Processes
• Conducting Sponsorship Activities
• Conducting Strategic Planning Activities
• Following Up Requests/Complaints
• Ensuring the Security of Movable Property and Resources
• Conducting the Remuneration Policy
• Conducting Marketing Processes of Products/Services
• Ensuring the Security of Data Controller Operations
• Conducting Talent/Career Development Activities
• Providing Information to Authorised Persons, Institutions and Organisations
• Creating and Following Up Visitor Records

3.4. RETENTION PERIODS OF PERSONAL DATA

Personal data obtained by AKADEMİ HOSPITAL are stored and retained within the framework of the legal periods specified in the table below.

3.5. TRANSFER OF PERSONAL DATA

AKADEMİ HOSPITAL complies with KVKK and the relevant legislation regarding the sharing of personal data with third parties. Within this framework, personal data are not transferred by AKADEMİ HOSPITAL to third persons and parties without the explicit consent of the data subject. However, in the presence of one of the following conditions regulated by KVKK, personal data may be transferred by AKADEMİ HOSPITAL to third persons and parties without the explicit consent of the data subject.

• It is expressly provided for by law
• It is necessary for the protection of the life or bodily integrity of the person himself/herself or of another person, where the person is unable to express his/her consent due to actual impossibility or whose consent is not deemed legally valid
• Processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract
• It is necessary for the data controller to fulfil its legal obligation,
• It has been made public by the data subject himself/herself
• Data processing is necessary for the establishment, exercise or protection of a right
• Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

In this context, personal data may be shared with third parties, for reasons arising from the Law, for the purpose of developing or conducting health services for the purposes stated above, including private insurance companies, the Ministry of Health and its affiliated sub-units, the Social Security Institution (SGK), the General Directorate of Security and other law enforcement forces, the General Directorate of Population, the Turkish Pharmacists’ Association, courts and all kinds of judicial authorities, representatives you have authorised, third parties from whom we receive consultancy, including lawyers, tax and financial advisers and auditors, regulatory and supervisory institutions, and official authorities.

This is because, pursuant to Article 8 of the Regulation on the Processing of Personal Health Data and Protection of Privacy, personal health data may be transferred to the relevant public institutions and organisations for the purposes of protecting public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning and management of health services and their financing, provided that the measures determined by the Board are taken and the conditions set out in the third paragraph are met, where expressly provided for in their laws.

Except in the cases set out in the first paragraph, personal health data are transferred only after being anonymised, and are transmitted in such a way that the natural person who is the data subject cannot be matched by 3rd parties.

In the transfer of special categories of personal data, the conditions specified in the conditions for processing such data are also complied with.

4. OBLIGATION TO INFORM

The obligation to inform within the scope of Article 10 of KVKK is fulfilled separately for each data subject.

Within the framework of Article 28(1) of KVKK, AKADEMİ HOSPITAL has no obligation to inform in the cases listed below.

• Processing of personal data by natural persons within the scope of activities relating exclusively to themselves or to family members living in the same household, provided that the data are not disclosed to third parties and the obligations regarding data security are complied with
• Processing of personal data for purposes such as research, planning and statistics by being anonymised through official statistics
• Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defence, national security, public safety, public order, economic security, the privacy of private life or personal rights, or constitute a crime
• Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations authorised and charged by law to ensure national defence, national security, public safety, public order or economic security
• Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or enforcement proceedings

Within the framework of Article 28(2) of KVKK, the cases in which there is no obligation to inform:

• Processing of personal data is necessary for the prevention of crime or for a criminal investigation
• Processing of personal data made public by the data subject himself/herself
• Processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigation or prosecution, by public institutions and organisations and professional organisations having the status of public institutions that are charged and authorised on the basis of the authority granted by law
• Processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budgetary, tax and financial matters

5. RIGHTS OF THE DATA SUBJECT

According to Article 10 of the Regulation on the Processing of Personal Health Data and Protection of Privacy;

The data subject, by applying to the data controller, with respect to himself/herself;

a) Learn whether personal health data are being processed,

b) Request information in this regard if personal health data have been processed,

c) Access and request personal health data,

ç) Learn the purpose of processing of personal health data and whether they are used in accordance with their purpose,

d) Know the third parties in Türkiye or abroad to whom personal health data are transferred,

e) Request the rectification of personal health data in case they have been processed incompletely or inaccurately,

f) Request the erasure of personal data within the framework of the conditions set out in Article 9,

g) Request that the operations carried out pursuant to sub-paragraphs (e) and (f) be notified to the third parties to whom the personal health data have been transferred,

ğ) Object to the emergence of a result against the person himself/herself by means of the analysis of the processed personal health data exclusively through automated systems,

h) Request compensation for the damage in case he/she suffers damage due to the unlawful processing of personal health data,

has the rights listed above.

5.1. DATA SUBJECT APPLICATION PROCESS

AKADEMİ HOSPITAL will process your requests arising from KVKK through the “AKADEMİ HOSPITAL Personal Data Subject Application Form”. In accordance with Article 13 of KVKK, AKADEMİ HOSPITAL will conclude your application requests free of charge, depending on the nature of the request, within 30 (thirty) days at the latest. If the request is rejected, the reason for rejection shall be notified to you in writing or electronically, together with its justification.

Within the framework of Article 28(1) of KVKK, data subjects may not exercise the rights defined in Article 11 of KVKK in the cases listed below.

• Processing of personal data by natural persons within the scope of activities relating exclusively to themselves or to family members living in the same household, provided that the data are not disclosed to third parties and the obligations regarding data security are complied with
• Processing of personal data for purposes such as research, planning and statistics by being anonymised through official statistics
• Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defence, national security, public safety, public order, economic security, the privacy of private life or personal rights, or constitute a crime
• Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations authorised and charged by law to ensure national defence, national security, public safety, public order or economic security
• Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or enforcement proceedings

The rights defined in Article 11 of KVKK may not be exercised in the following cases.

• Processing of personal data is necessary for the prevention of crime or for a criminal investigation
• Processing of personal data made public by the data subject himself/herself
• Processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigation or prosecution, by public institutions and organisations and professional organisations having the status of public institutions that are charged and authorised on the basis of the authority granted by law
• Processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budgetary, tax and financial matters

6. MEASURES TAKEN TO ENSURE DATA SECURITY

AKADEMİ HOSPITAL takes the technical and administrative measures specified below for the protection of personal data.

6.1. ADMINISTRATIVE MEASURES

Administrative measures taken by AKADEMİ HOSPITAL to ensure personal data security:

• There are disciplinary regulations for employees that include data security provisions.
• Training and awareness activities on data security are carried out for employees at regular intervals.
• An authorisation matrix has been created for employees.
• Confidentiality undertakings are executed.
• The authorisations in this area of employees who change positions or leave employment are revoked.
• The contracts signed contain data security provisions.
• Extra security measures are taken for personal data transferred on paper, and the relevant documents are sent in the format of classified documents.
• Personal data security policies and procedures have been determined.
• Personal data security issues are reported promptly.
• Personal data security is monitored.
• The necessary security measures are taken regarding entry to and exit from physical environments containing personal data.
• The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
• The security of environments containing personal data is ensured.
• Personal data are minimised to the extent possible.
• Existing risks and threats have been identified.
• Protocols and procedures for the security of special categories of personal data have been determined and are being implemented.
• If special categories of personal data are to be sent by e-mail, they are always sent encrypted and by using KEP or a corporate e-mail account.
• Data processor service providers are audited at regular intervals with respect to data security.
• Awareness of data processor service providers regarding data security is ensured.

6.2. TECHNICAL MEASURES

Technical measures taken by AKADEMİ HOSPITAL to ensure personal data security:

• Network security and application security are ensured.
• A closed system network is used for transfers of personal data via networks.
• Key management is implemented.
• Security measures within the scope of the procurement, development and maintenance of information technology systems are taken.
• The security of personal data stored in the cloud is ensured.
• Access logs are kept regularly.
• Corporate policies on access, information security, use, storage and destruction have been prepared and put into practice.
• Data masking measures are applied when necessary.
• Up-to-date anti-virus systems are used.
• Firewalls are used.
• Personal data are backed up and the security of the backed-up personal data is also ensured.
• User account management and an authorisation control system are implemented and are also monitored.
• Periodic and/or random internal audits are carried out and commissioned.
• Log records are kept in such a way that there is no user intervention.
• If special categories of personal data are to be sent by e-mail, they are always sent encrypted and by using KEP or a corporate e-mail account.
• Secure encryption / cryptographic keys are used for special categories of personal data and are managed by different units.
• Intrusion detection and prevention systems are used.
• Cyber security measures have been taken and their implementation is continuously monitored.
• Special categories of personal data transferred via portable memory, CD or DVD media are transferred in encrypted form.
• Data loss prevention software is used.

7. DESTRUCTION OF DATA

The principles and procedures regarding the destruction of data processed by AKADEMİ HOSPITAL at the end of the legal periods have been set out, published and put into force in the AKADEMİ HOSPITAL Data Retention and Destruction Policy document, in accordance with the Regulation on the Erasure, Destruction or Anonymisation of Personal Data published in the Official Gazette No. 30224 dated 28.10.2017. Data transferred to the central health data system are erased from the local database in accordance with the legal legislation 10 years after the date of transfer.

8. OTHER MATTERS

• The Policy is published in two different media, namely with a wet signature (printed paper) and in electronic form, and is disclosed to the public on the website.
• In the event of any inconsistency between the provisions of KVKK and the relevant legislation and this Policy, the provisions of KVKK and the relevant legislation shall prevail.
• The Policy is announced to data subjects by being published on the corporate website of AKADEMİ HOSPITAL.
• In the event that the Policy is updated, the new policy document enters into force by being announced and published in the same manner.
• This Policy prepared by AKADEMİ HOSPITAL entered into force on 01.10.2026.