Dear our visitor, Some of your personal data will be processed during our communications with you. Pursuant to Personal Data Protection Law Nr. 6698 (the “Law”), we, Keia Clinic Seyahat ve Sağlık Turizmi Anonim Şirketi (“Keia/Clinic”), acting in the capacity of “Data Controller”, would like to inform you about your personal data that we will process.

This text is a privacy note about your personal data that can be processed during and after our communication with you to help patient candidates benefit from/be informed about services delivered by Keia (“Services”).

1. Why Do We Process Your Personal Data and What are Your Personal Data We Process?

Info Collection, Communication and Appointment Scheduling Activities: Your identity (name, surname), contact (phone number, e-mail, country) and customer transaction (type of treatment you requested, the notes you send to use, appointment information) details will be processed to determine the Service that you need and that meets your requirements best, inform you about the treatment and perform communication processes, create an offer for the Services after necessary information is obtained and to inform you about the offer, schedule an appointment and access to such information to contact you for saving the data we need to our system, if you contact us over various communication channels (you call our phone numbers. we call you upon your request, you send us an e-mail, you fill in a form over our web sites (www.keiahealth.com), health platforms or other social media platforms, you communicate us using social media accounts or instant online texting applications, you send us an e-mail) of our enterprise in order to benefit from the Services and to be informed about the Services.

PDPL Processes: The identity (name, surname, signature), communication (phone number, e- mail) and customer transaction (records of information/explicit consent processes) details that you write on the forms we will send to you pursuant to the Law are processed in order to keep records of the privacy notice and explicit consents obtained pursuant to the law, discriminate records of patient candidates, ensure safety and accuracy of approval processes and use legal rights and fulfill obligations in case of a potential complaint/legal dispute. Identity (name, surname, R.T. ID number and signature in case of written application), contact (e-mail, phone number, fax number) and customer transaction (subject of request) details are processed to reply your (the Data Subject’s) application according to the Law, if you apply to us.

Legal Processes: Your identity (name, surname and date of birth), contact (phone number, e- mail, country), customer transaction (date, channel, method, scope of the privacy notice) and legal transaction (details of the file on relevant legal dispute) details will be processed to use all legal rights and fulfill obligations before state bodies (courts, execution offices, arbiters, arbitration board and mediator) in case of any disagreement between you and our clinic, perform warning letter processes, conduct discussions and negotiations on disputes and prove the privacy notice and explicit consent forms required by the Law in case of any potential complaint/legal proceeding.

2. Who May We Transfer Your Personal Data? Why?

We may share your personal data with following people and organizations: Suppliers: BService suppliers in order to get product and service support in informatics technologies and other areas that require specialization, such as counseling (suppliers of maintenance/repair/development service, suppliers of website and e-mail related services, suppliers of legal counseling services, health platforms delivering form collection service, suppliers of patient tracking and management system service, suppliers of common area and calendar application services),

State Bodies: Authorized and relevant state bodies in order to fulfill the obligation of submitting information and document to authorized state bodies and judicial authorities and to use our legal rights, such as filing a suit and making counterclaims,

3. What is Collection Method of Personal Data and What is the Legal Basis?

Your personal data will be collected with (i) automated methods, such as getting information over our communication channels (phone, e-mail, communication over social media accounts, instant online texting applications and filling in a form over our web sites (www.keiahealth.com), health platforms delivering form collection service and social media) and saving obtained information to our systems, entering our appointment details to our appointment/patient tracking and recording system, sharing documentation with state bodies in electronic format (National Judiciary Informatics System, case file, warning letter, e-notice etc.) and recording your information in electronic format pursuant to our privacy notice obligation or (ii) non-automated methods by sharing printed documentations with state bodies (case file, warning letter, notice etc.) and recording the printed documentation of the privacy notice obligation.

Your personal data will be processed based on following legal bases:

• “It is necessary to process personal data of the parties of agreement, provided it is directly related with drawing up or executing an agreement” and “It is necessary to process personal data for legitimate interest of the data controller, provided fundamental rights and freedoms of the Data Subject are not violated” in relation with Info Collection, Communication and Appointment Scheduling activities,

• “It is mandatory to process data for data controller to fulfill its legal obligation”, “It is necessary to process data for legitimate interest of the data controller, provided fundamental rights and freedoms of the data subject are not violated”, “It is clearly laid down by the laws” and “It is necessary to process data to establish, use or protect a right” in relation with Legal processes and PDPL Processes.

4.What are your rights?

You may contact us at any time for your rights arising out of Article 11 of the Law regarding your personal data processed by us. You may communicate us by sending your written application letter to below written address or sending an e-mail from your e-mail address saved in our system. (We would like to emphasize that relevant request should fulfill provisions of Communiqué on the Procedures and Principles of Applications to Data Controllers.

Address for written application: Oba Mah. Fabrıka Cad. No: 13 /2 Ic Kapı No: 2 Alanya/Antalya E-mail: info@keiahealth.com