Patient Privacy Notice

Pursuant to the Personal Data Protection Law No. 6698 (KVKK) (the “Law”), your personal data may be processed, within the scope described below, by Uğur Sağlık Hizmetleri Anonim Şirketi (“Özel Akademi Hospital”) (the “Institution”), acting in its capacity as data controller.

Categories and Types of Personal Data Processed

Personal Data Categories Data Types

• Identity Information: Your name, surname, T.R. identity number / foreign national identity number / passport number, date of birth, place of birth, gender, marital status, nationality
• Contact Information your address, e-mail address, telephone number
• Location information your area-based in-hospital location information generated by means of the medical tracking wristband used in all planned admission and surgery processes
• Legal transaction information your information in correspondence with judicial authorities, your information in case files
• Customer transaction information your information relating to your appointment-making transactions, application and service use processes, and your records relating to your use of additional services within our hospitals
• Physical premises security information your entry-exit records at our Institution, camera recordings
• Transaction security information your IP address, website and system usage information, user transaction records, log records, information relating to your device and connection security
• Financial information your invoice and current account information, bank account information, credit card information
• Marketing information your information relating to your commercial electronic message preferences, carried out to the extent permitted by the legislation, and your data relating to your satisfaction evaluations and information processes
• Visual and audio recording information your visual and audio recordings
• Health information your information relating to your state of health, your data relating to your examination, diagnosis, treatment and care processes, your anamnesis information, laboratory and imaging results, prescription information, medication use information, allergy information, reports, diagnosis and treatment information
• Sexual life information where applicable, your examination, diagnosis, treatment and follow-up information relating to your sexual health and reproductive health within the scope of the service you receive from our Institution
• Genetic data information where applicable, within the scope of the service you receive from our Institution, your genetic test results, molecular analysis results, evaluation information relating to hereditary diseases
• Transaction information your transaction information relating to your application, registration, provision, invoicing, collection, appointment and service delivery processes
• Education information your information relating to your educational status, occupation or title, specialty or branch
• Patient transaction information your patient number, file or protocol number, appointment information, application date, admission and discharge information, examination, diagnosis, treatment, consultation, testing and intervention records, and your records relating to your use of insurance and/or contracted institution services, your records relating to post-service processes and to your transportation/accommodation arrangements
• Family members and relatives information the name, surname, degree of kinship and contact information of your relatives, and information on the person to be contacted in an emergency and on your companion
• Request and complaint information your information relating to your requests, complaints, suggestions and satisfaction notifications, and your application and evaluation records

Personal Data Processed, Purposes of Processing and Legal Basis

Your personal data collected may be processed for the legal bases and purposes set out below (the “Purposes”) and within the personal data processing conditions specified in Articles 5 and 6 of the Law.

Personal Data Categories Purpose of Personal Data Processing

• Evaluation of the patient,
• Carrying out the inpatient or outpatient medical diagnosis and treatment of the patient,
• Carrying out the patient's care procedures and, within this scope, conducting the procedures relating to their provision by parties providing catering and cleaning support services,
• Providing appointment reminders, changes and other information relating to the delivery of the service,
• Conducting surgical activities,
• Performing the necessary tests and examinations and conducting the related processes,
• Procuring medicines and related materials, conducting medication preparation processes,
• Conducting communication activities,
• Conducting accommodation and transportation services,
• Conducting the processes relating to the provision and performance of the products and services offered by the Institution,
• Sending financial information to the e-mail address specified during registration,
• Conducting laboratory, imaging and similar activities within the scope of the diagnosis and treatment work carried out for the patient
• Providing air ambulance and ground ambulance rental services,
• Where necessary, by persons under an obligation of confidentiality or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, carrying out medical diagnosis, treatment and care services, and the planning, management and financing of health services, being expressly provided for by the laws
• Planning and execution of patient relations management processes,
• Conducting information security processes,
• Carrying out audit and ethics activities,
• Planning and execution of internal processes within the Institution.
• Conducting and auditing business activities aimed at the effective delivery of health services,
• Conducting data analysis processes for the purpose of improving health services,
• Conducting management activities,
• Ensuring physical premises security,
• Conducting access activities,
• Conducting promotion and information activities,
• Ensuring the automatic generation of anamnesis reports in the context of performing medical diagnosis, including examination, and health service delivery processes,
• Contacting the patient in order to obtain and evaluate feedback on the products and services offered by the Institution,
• Ensuring patient safety in all planned admission and operating room processes and conducting process tracking in operating room areas. Your identity, contact, legal transaction, customer transaction, transaction security, financial, visual and audio recording, transaction, education, patient transaction, family members and relatives, and request and complaint information
• Evaluation of the patient, carrying out the inpatient or outpatient medical diagnosis and treatment of the patient,
• Carrying out the patient's care procedures and, within this scope, conducting the procedures relating to their provision by parties providing catering and cleaning support services,
• Providing appointment reminders, changes and other information relating to the delivery of the service,
• Conducting surgical activities,
• Performing the necessary tests and examinations and conducting the related processes,
• Procuring medicines and related materials, conducting medication preparation processes,
• Conducting communication activities, Processing of personal data of the parties to a contract being necessary, provided that it is directly related to the establishment or performance of that contract
• Providing car park and valet services,
• Conducting accommodation and transportation services,
• Ensuring the management of patients' personal belongings and providing vehicle safekeeping services,
• Conducting the processes relating to the provision and performance of the products and services offered by the Institution,
• Sending financial information to the e-mail address specified during registration,
• Conducting laboratory, imaging and similar activities within the scope of the diagnosis and treatment work carried out for the patient
• Providing air ambulance and ground ambulance rental services. Your identity, contact, location, legal transaction, customer transaction, physical premises security, transaction security, financial, visual and audio recording, transaction, education, patient transaction, family members and relatives, and request and complaint information
• Planning and execution of patient relations management processes,
• Conducting information security processes,
• Carrying out audit and ethics activities,
• Planning and execution of internal processes within the Institution.
• Conducting and auditing business activities aimed at the effective delivery of health services,
• Conducting data analysis processes for the purpose of improving health services,
• Conducting management activities,
• Conducting emergency management processes. Processing being mandatory for the protection of the life or physical integrity of the person, or of another person, where the person is unable to disclose their consent due to actual impossibility or whose consent is not deemed legally valid Your health information and, where applicable, your sexual life and genetic information
• Receiving and evaluating requests and complaints,
• Monitoring and conducting legal affairs,
• Conducting accounting and finance processes,
• Archiving / retaining data relating to the health and financial services provided in accordance with the legislation,
• Providing information to authorised persons, institutions and organisations,
• Fulfilling the requests of public authorities.
• Being necessary, by persons under an obligation of confidentiality or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, carrying out medical diagnosis, treatment and care services, and the planning, management and financing of health services
• Being expressly provided for by the laws
• Data processing being mandatory for the establishment, exercise or protection of a right Your identity, contact, location, legal transaction, customer transaction, physical premises security, transaction security, financial, visual and audio recording, transaction, education, patient transaction, family members and relatives, and request and complaint information
• Receiving and evaluating requests and complaints,
• Monitoring and conducting legal affairs,
• Conducting accounting and finance processes,
• Archiving / retaining data relating to the health and financial services provided in accordance with the legislation,
• Providing information to authorised persons, institutions and organisations,
• Fulfilling the requests of public authorities.
• Being expressly provided for by the laws and being mandatory for the data controller to fulfil its legal obligation
• Data processing being mandatory for the establishment, exercise or protection of a right Your identity, contact and marketing information
• Sending commercial electronic messages for promotional and informational purposes to your preferred contact details, in accordance with the Regulation on Promotion and Information in Health Services. If you give your explicit consent, based on your explicit consent

Parties to Whom Your Personal Data Are Transferred and Purposes of Transfer

Your personal data collected may be transferred by our Institution, within the scope of the Purposes, to the parties specified below, in accordance with the fundamental principles set out in the Law and within the personal data processing conditions specified in Articles 8 and 9 of the Law.

Recipient Organisations Purpose of Transfer : Legal Basis To the Ministry of Health and its affiliated sub-units and digital portals/platforms, the Social Security Institution (SGK), courts and other judicial authorities, the General Directorate of Security, the General Directorate of Population, the Turkish Pharmacists' Association, the Turkish Pharmacovigilance Centre, the Turkish Medical Association, legally authorised public institutions including the Turkish Red Crescent (Kızılay), and legally authorised private persons Conducting legal processes, fulfilling our obligations arising from the legislation

• Being expressly provided for by the laws, being mandatory for the data controller to fulfil its legal obligation and/or data processing being mandatory for the establishment, exercise or protection of a right
• With respect to your special categories of personal data, being expressly provided for by the laws and being necessary, by persons under an obligation of confidentiality or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, carrying out medical diagnosis, treatment and care services, and the planning, management and financing of health services To our business partners with whom we cooperate and to laboratories, medical centres, ambulance, medical device and health service providing health institutions with which we cooperate and which are under an obligation of confidentiality, and, by means of the Hospital Information Management System (HBYS), to the hospitals, affiliates and group companies under the umbrella of Uğur Sağlık Hizmetleri A. Ş., to which the Institution is also affiliated Conducting health services and, within this scope, carrying out medical diagnosis, treatment and care processes, ensuring the planning, coordination and continuity of health services, and ensuring that the services provided can be maintained effectively and safely
• Processing of personal data of the parties to a contract being necessary, provided that it is directly related to the establishment or performance of that contract, and/or data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
• With respect to your special categories of personal data, being necessary, by persons under an obligation of confidentiality or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, carrying out medical diagnosis, treatment and care services, and the planning, management and financing of health services To our suppliers from whom we procure services for the purpose of conducting health services, in particular medical record archiving companies, digital health information management systems and cargo companies Conducting health services and, within this scope, archiving and managing medical records, operating digital health information management systems, delivering documents and materials relating to health services, and ensuring that these processes are conducted effectively, securely and without interruption
• Data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
• With respect to your special categories of personal data, in the presence of your explicit consent To your relatives or third parties whom you have specified by name Providing information, upon and limited to your request, about your treatment process, your invoicing transactions and/or your processes at the hospital • Data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
• With respect to your special categories of personal data, in the presence of your explicit consent conducting information security processes, managing access authorisations, conducting communication activities, conducting / auditing business activities, conducting contract processes, providing information to authorised persons, institutions and organisations, and conducting management activities The existence of a standard contract announced by the Board containing matters such as data categories, purposes of data transfer, recipients and recipient groups, technical and administrative measures to be taken by the data recipient, and additional measures taken for special categories of personal data

If, within the scope of agreements that may exist between contracted insurance companies and the Institution, facilities relating to the Institution's services are provided to your relatives, your personal data may also be obtained through the information and documents provided by such relative

Your legal rights regarding your personal data within the framework of Article 11 of KVKK are:

1. a)To learn whether personal data are being processed,
2. b)To request information in this regard if personal data have been processed,
3. c)To learn the purpose of processing of personal data and whether they are used in accordance with their purpose,
4. d)To know the third parties to whom personal data are transferred domestically or abroad,
5. e)To request the rectification of personal data if they have been processed incompletely or inaccurately,
6. f)To request the erasure or destruction of personal data within the framework of the conditions set out in Article 7 of the Law,
7. g)To request that the operations carried out pursuant to paragraphs (e) and (f) above be notified to third parties to whom the personal data have been transferred,
8. h)To object to the emergence of a result to the detriment of the person by means of the analysis of the processed data exclusively through automated systems,
9. i)To request compensation for damage in the event of suffering damage due to the unlawful processing of personal data

as defined above.

In order to exercise their rights over their personal data, data subjects may, after completing and signing the AKADEMİ HOSPITAL Application Form for Data Subjects Whose Personal Data Are Processed,

submit it in person / through a notary public to the address Uğur Sağlık Hizmetleri A. Ş. Müftü Mahallesi Şehit Ömer Halisdemir Bulvar No: 18/ Ereğli Zonguldak, or send it via the e-mail addresses previously notified to our company to bilgi@eregliakademihastanesi.com.tr with the subject line “KVKK Başvuru” (KVKK Application).