Personal Data Retention and Destruction Policy

1. INTRODUCTION

1.1 Purpose

This Personal Data Retention and Destruction Policy (the “Policy”) has been prepared by UĞUR SAĞLIK HİZMETLERİ ANONİM ŞİRKETİ “PRIVATE AKADEMİ HOSPITAL” (hereinafter referred to as “AKADEMİ HOSPITAL” and/or the “Company” ), in its capacity as data controller, for the purposes of determining the procedures and principles regarding the processes of retention, deletion, destruction and anonymisation of personal data in accordance with the Personal Data Protection Law No. 6698 (KVKK) (the “Law”), and the relevant legislation, in particular the Regulation on the Deletion, Destruction or Anonymisation of Personal Data (the “Regulation”), which constitutes secondary legislation of the Law and entered into force upon its publication in the Official Gazette dated 28 October 2017, together with the Regulation on the Processing of Personal Health Data and Protection of Privacy; informing the data subjects whose personal data are processed by AKADEMİ HOSPITAL; and fulfilling the obligations under the Law and the relevant legislation.

In line with its fundamental business principles, AKADEMİ HOSPITAL has set as a priority the processing of all personal data belonging to its employees, employee candidates, interns, supplier officials, supplier employees, direct or indirect natural person shareholders/partners, potential product and service recipients, all patients and patients’ relatives and companions, and other third parties in compliance with the Constitution of the Republic of Türkiye, international conventions, Personal Data Protection Law No. 6698, Decree-Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions, the Regulation on Private Hospitals, the regulations of the Ministry of Health and other legislation, and ensuring that data subjects exercise their rights effectively.

All acts and transactions relating to the retention, deletion, destruction and anonymisation of personal data are carried out by AKADEMİ HOSPITAL in accordance with this Policy, prepared accordingly.

1.2 Scope

All personal data belonging to the employees, employee candidates, interns, supplier officials, supplier employees, direct or indirect natural person shareholders/partners, potential product and service recipients, all patients and patients’ relatives and companions of AKADEMİ HOSPITAL, and other third parties fall within the scope of this Policy, and this Policy applies to all recording media owned by AKADEMİ HOSPITAL or managed by AKADEMİ HOSPITAL in which personal data are processed and to all activities relating to the processing of personal data.

1.3 Abbreviations and Definitions

2. DISTRIBUTION OF RESPONSIBILITIES AND DUTIES

Employees of AKADEMİ HOSPITAL are obliged to comply with the rules set out in this Policy and to provide the necessary support to the units responsible for the processing of personal data. Company employees who process personal data act in compliance with the fundamental principles, the conditions for processing personal data and the conditions for processing special categories of personal data while carrying out data processing activities.

Accordingly, the persons in charge selected from among the members of the Personal Data Protection Committee indicated below, their units and their duties in the processes of retention and destruction of personal data are explained in detail.

Table 1: Distribution of duties in retention and destruction processes

The distribution of the titles, units and job descriptions of those involved in the processes of retention and destruction of personal data is given in Table 1.

3. RECORDING MEDIA

Personal data are stored lawfully and securely by AKADEMİ HOSPITAL in the media listed in Table 2.

Table 2: Personal data storage media

4. EXPLANATIONS ON RETENTION AND DESTRUCTION

AKADEMİ HOSPITAL acts within the framework of the following principles in the retention and destruction of personal data.

4.1 Explanations on Retention

Article 4 of the Law provides that personal data must be relevant, limited and proportionate to the purposes for which they are processed and must be retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed, while Articles 5 and 6 set out the conditions for processing personal data.

Accordingly, personal data processed within the framework of our activities are retained subject to the relevant legislation and/or for a period appropriate to our processing purposes. These periods may be revised as needed at intervals of at least six months and are announced to data subjects through VERBİS.

4.1.1 Legal Grounds Requiring Retention

The personal data processed by AKADEMİ HOSPITAL are retained subject to the legislation relevant to its field of activity and/or for a period appropriate to our processing purposes. Accordingly, personal data will be retained within the scope of the legislation listed below and, without being limited to those listed, of other legislative provisions currently in force or that may enter into force.

• Personal Data Protection Law No. 6698
• Turkish Code of Obligations No. 6098
• Turkish Criminal Code No. 5237
• Turkish Commercial Code No. 6102
• Social Insurance and General Health Insurance Law No. 5510
• Health Services Fundamental Law No. 3359
• Occupational Health and Safety Law No. 6331
• Labour Law No. 4857
• Regulation on Personal Health Data
• Regulation on the Processing of Personal Health Data and Protection of Privacy
• Regulation on Private Hospitals
• Regulation on Archive Services
• Decree-Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions,
• KVKK Decisions
• Personal data are processed within the framework of the legislation in force pursuant to these laws and other secondary regulations, and are retained for the retention periods stipulated under the relevant laws.

4.1.2 Processing Purposes Requiring Retention

Personal data are retained securely by AKADEMİ HOSPITAL in physical or electronic media within the limits set out in KVKK and other relevant legislation, in particular for the purposes of carrying on commercial activities, fulfilling legal obligations, planning and managing personnel processes, and managing legal disputes, primarily lawsuits and enforcement proceedings.

Personal data are processed for the following purposes:

• Conducting Emergency Management Processes
• Conducting Information Security Processes
• Conducting Employee Candidate / Intern / Student Selection and Placement Processes
• Conducting Application Processes of Employee Candidates
• Conducting Employee Satisfaction and Loyalty Processes
• Fulfilling Obligations Arising from Employment Contracts and Legislation for Employees
• Conducting Fringe Benefits and Benefits Processes for Employees
• Conducting Audit/Ethics Activities
• Conducting Training Activities
• Conducting Access Authorisations
• Conducting Activities in Compliance with the Legislation
• Conducting Finance and Accounting Affairs
• Conducting Loyalty Processes for the Company/Products/Services
• Conducting Assignment Processes
• Following Up and Conducting Legal Affairs
• Conducting Internal Audit/Investigation/Intelligence Activities
• Conducting Communication Activities
• Planning Human Resources Processes
• Conducting / Auditing Business Activities
• Conducting Occupational Health/Safety Activities
• Conducting Activities to Ensure Business Continuity
• Conducting Logistics Activities
• Conducting Goods / Services Procurement Processes
• Conducting Goods / Services After-Sales Support Services
• Conducting Goods / Services Sales Processes
• Conducting Goods / Services Production and Operation Processes
• Conducting Customer Relationship Management Processes
• Conducting Activities Aimed at Customer Satisfaction
• Organisation and Event Management
• Conducting Marketing and Analysis Activities
• Conducting Performance Evaluation Processes
• Conducting Advertising/Campaign/Promotion Processes
• Conducting Risk Management Processes
• Conducting Storage and Archive Activities
• Conducting Social Responsibility and Civil Society Activities
• Conducting Contract Processes
• Conducting Sponsorship Activities
• Following Up Requests/Complaints
• Ensuring the Security of Movable Property and Resources
• Conducting the Remuneration Policy
• Conducting Marketing Processes of Products/Services
• Ensuring the Security of Data Controller Operations
• Conducting Talent/Career Development Activities
• Providing Information to Authorised Persons, Institutions and Organisations
• Creating and Following Up Visitor Records

4.2 Reasons Requiring Destruction

Personal data shall be deleted and/or destroyed and/or anonymised by AKADEMİ HOSPITAL in the following cases:

• Where the data subject’s request for the deletion or destruction of his/her personal data within the framework of his/her legal rights is examined and deemed appropriate by the data controller,
• Where the data subject withdraws his/her consent in cases where the processing of personal data is carried out solely on the basis of explicit consent,
• Where the provisions of the relevant legislation forming the basis for the processing, retention and destruction of personal data are amended or repealed,
• Where the legitimate purpose requiring the processing or retention of personal data ceases to exist,
• Where the maximum period requiring the retention of personal data has expired and there is no condition requiring the retention of personal data for a longer period,
• Where the data controller rejects the application made to it by the data subject requesting the deletion, destruction or anonymisation of his/her personal data, finds its response insufficient or fails to respond within the period stipulated in the Law, and a complaint is filed with the Board and this request is deemed appropriate by the Board.

CRITERIA FOR ACCESS BY HEALTHCARE PERSONNEL TO PERSONS’ HEALTH DATA

(1) Persons employed in the provision of healthcare services may access the health data of the data subject only to the extent limited to the requirements of the healthcare service to be provided.

(2) (Amended: OG-3/12/2025-33096) The health data of persons may be accessed, limited to the processing conditions set out in the third paragraph of Article 6 of the Law, only:

a) By the family physician with whom the person is registered, without any time limit,

b) By the physician to whom the person has applied in order to receive healthcare services; until the completion of the procedures directly connected with the healthcare service received, including the days on which the healthcare service is received and the consultation or follow-up examination period,

c) By the physicians employed at the healthcare provider to which the person has applied in order to receive healthcare services; until the completion of the procedures directly connected with the healthcare service received, including the days on which the healthcare service is received and the consultation or follow-up examination period,

ç) By the physicians employed at the healthcare provider where the patient is hospitalised, until the patient is discharged from the healthcare provider,

d) In respect of persons admitted through the emergency department, limited to the relevant healthcare service, by all physicians on duty at the healthcare facility where the emergency department of admission is located, until discharge.

(3) (Amended: OG-3/12/2025-33096) The health data of persons who have chosen a security setting through their e-Nabız account are accessed within the framework of their own security settings. Data subjects are informed in detail about the security settings and their consequences. The Ministry shall not be liable for any disruption or damage that may occur in the provision of healthcare services due to the security settings and the inability to view past health data. The first sentence of this paragraph shall not apply, limited to the processing conditions set out in the third paragraph of Article 6 of the Law, in the cases specified in subparagraphs (ç) and (d) of the second paragraph.

(4) (Paragraph annulled by the decision of the Tenth Chamber of the Council of State dated 17/10/2023, Docket No.: 2019/10544; Decision No.: 2023/5655) (Re-regulated: OG-3/12/2025-33096) The past health data of persons who do not wish their health data to be accessed in the situations covered by the security preferences offered may be accessed if the code sent to the telephone number declared by the person in his/her profile is shared with the physician and entered into the system by the physician.

(5) (Amended: OG-3/12/2025-33096) Even if persons have configured their e-Nabız security settings in line with the fourth paragraph, in cases where they are unable to receive the code to be sent under the fourth paragraph due to circumstances such as detention or conviction, no security setting check is performed, and the family physician and all physicians by whom the person is examined may access the person’s health data, limited to the processing conditions set out in the third paragraph of Article 6 of the Law. Once these circumstances cease to exist, the person may again choose security settings.

(6) Personal health data with a higher level of privacy, which carry the risk of adversely affecting the social life and mental health of persons if seen and known by others, are determined by the Ministry, and proportionate restrictions may be imposed on the access of healthcare personnel to such data.

5. TECHNICAL AND ADMINISTRATIVE MEASURES

The technical and administrative measures we take as AKADEMİ HOSPITAL in order to store personal data securely and to prevent their unlawful processing and access are set out below, without being limited to those listed.

5.1 Technical Measures

• Network security and application security are ensured.
• A closed system network is used for transfers of personal data via the network.
• Key management is implemented.
• Security measures are taken within the scope of the procurement, development and maintenance of information technology systems.
• Access logs are kept regularly.
• Corporate policies on access, information security, use, retention and destruction have been prepared and put into practice.
• Data masking measures are applied where necessary.
• Up-to-date anti-virus systems are used.
• Firewalls are used.
• Personal data are backed up and the security of the backed-up personal data is also ensured.
• A user account management and authorisation control system is implemented and also monitored.
• Periodic and/or random internal audits are carried out and commissioned.
• Log records are kept in a manner that does not allow user intervention.
• If special categories of personal data are to be sent by e-mail, they are always sent encrypted and by using a registered electronic mail (KEP) or corporate e-mail account.
• Secure encryption / cryptographic keys are used for special categories of personal data and are managed by different units.
• Intrusion detection and prevention systems are used.
• Penetration tests are performed.
• Cyber security measures have been taken and their implementation is continuously monitored.
• Encryption is performed.
• Special categories of personal data transferred on portable memory, CD or DVD media are transferred in encrypted form.
• Data loss prevention software is used.

5.2. Administrative Measures

• There are disciplinary regulations containing data security provisions for employees.
• Training and awareness activities on data security are carried out for employees at regular intervals.
• An authorisation matrix has been created for employees.
• Confidentiality undertakings are made.
• The authorisations in this area of employees who change duties or leave their employment are revoked.
• The contracts signed contain data security provisions.
• Additional security measures are taken for personal data transferred on paper, and the relevant documents are sent in a classified document format.
• Personal data security policies and procedures have been determined.
• Personal data security issues are reported promptly.
• Personal data security is monitored.
• Necessary security measures are taken regarding entry to and exit from physical environments containing personal data.
• The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
• The security of environments containing personal data is ensured.
• Personal data are minimised as far as possible.
• Existing risks and threats have been identified.
• Protocols and procedures for the security of special categories of personal data have been determined and are implemented.
• If special categories of personal data are to be sent by e-mail, they are always sent encrypted and by using a registered electronic mail (KEP) or corporate e-mail account.
• The data security of data processor service providers is audited at regular intervals.
• Awareness of data processor service providers regarding data security is ensured.

6. PERSONAL DATA DESTRUCTION TECHNIQUES

At the end of the period stipulated in the relevant legislation or the retention period required for the purpose for which they are processed, personal data are destroyed by AKADEMİ HOSPITAL ex officio or upon the application of the data subject, again in accordance with the provisions of the relevant legislation, using the techniques specified below.

For the destruction of Personal Data held by AKADEMİ HOSPITAL, the methods of deletion, destruction and anonymisation among the destruction methods under the Regulation have been adopted.

Table 3: Destruction of Personal Data

7. RETENTION AND DESTRUCTION PERIODS

Personal data processed by our Company within the scope of its activities are retained for the periods stipulated in the laws and for the duration of the statute of limitations, and the retention periods are, in general, as specified:

• The retention and destruction periods of personal data on a data basis, in the “Personal Data Processing Inventory”,
• On the basis of data categories, in the registration with VERBİS,
• and in the Personal Data Protection and Privacy Policy.

8. PERIODIC DESTRUCTION PERIOD

AKADEMİ HOSPITAL has set the periodic destruction period as 6 months.

9. PUBLICATION AND STORAGE OF THE POLICY

The Policy is prepared in two different media, namely with wet signature (printed paper) and in electronic form. It is published on our website [https://www.eregliakademihastanesi.com.tr] . The printed paper copy is also kept by the Human Resources Directorate.

10. UPDATE PERIOD OF THE POLICY

The Policy is reviewed as needed and the necessary sections are updated. Updated versions are republished.

11. ENTRY INTO FORCE OF THE POLICY

AKADEMİ HOSPITAL may make legally required amendments to this Policy to the extent required by its activities. The amended Policy text shall enter into force upon its publication on the website [https://www.eregliakademihastanesi.com.tr] . AKADEMİ HOSPITAL shall also notify all relevant data subject groups of the amendments to be made by e-mail.