Personal data protection notice for patients under Law No. 6698

Purpose and Scope of This Notice

As Lamed Özel Sağlık Hizmetleri Anonim Şirketi, we take measures to protect your personal data under Law No. 6698 on the Protection of Personal Data (referred to as “KVKK” or “the Law”). We process your personal data in our capacity as “data controller”, within the scope of the KVKK and related legislation, for the reasons and by the methods described below.

This notice has been prepared pursuant to Article 10 of the KVKK, titled “Obligation of the Data Controller to Inform”, in order to inform you as transparently as possible about the identity of the data controller, the method and legal basis of collection, the purposes of processing, to whom and for what purpose the data may be transferred, the processing period, and the rights listed in Article 11 of the KVKK. Statements made in this notice regarding “your personal data” also cover “your special categories of personal data”.

Data Controller

Company name: Lamed Özel Sağlık Hizmetleri Anonim Şirketi

Address: Mimar Sinan Mahallesi 1355 Sk. No: 5-7a Konak/İzmir

Registered electronic mail (KEP): lamedozelsaglik@hs01.kep.tr

The Company is registered with the Data Controllers’ Registry Information System (VERBİS).

(Referred to as the “Company” within this notice.)

Method of Collection and Legal Basis

Your personal data may be collected verbally, in writing or electronically, by automated or non-automated means, through the Company’s affiliated units, the website, social media channels, the call centre, mobile applications and similar means. Your personal data may be created and updated for as long as your relationship with the Company continues, and may be kept in both digital and physical form.

In line with the purposes set out under “Personal Data Processed and Purposes of Processing”, your data is processed on the basis of explicit consent under Article 5(1) of Law No. 6698, or on the processing conditions set out in subparagraphs (a), (c), (ç), (e) and (f) of Article 5(2); your health data is processed and may be transferred within Türkiye pursuant to subparagraph (c) of Article 6(3).

Personal Data Processed and Purposes of Processing

Your personal data is processed securely and in compliance with the Law on the Protection of Personal Data, either because of legal obligations or in order to provide a more suitable service in the Company’s operations.

The following categories of personal data are collected:

• —Contact data: the data group used to reach a person (telephone, place of residence, e-mail).
• —Identity data: the data group containing a person’s identity information (full name, national ID number, place of birth, wet signature, e-signature, signature copy/scan).
• —Financial data: the data group containing a person’s financial information (bank account number, IBAN).
• —Physical premises security: security camera recordings of the areas where the person is present (camera recording).
• —Customer transaction data: information required to carry out the transactions of a person receiving a product or service (invoice and receipt details, bank receipt details, credit card slips).
• —Health data: this category covers data types such as disability status, blood group, personal health information, and information on devices and prostheses used.

Your collected personal data is processed for the following purposes:

• —Ensuring the safety of life and property, and the legal and commercial security, of the unit where the Company operates,
• —Storing camera footage to maintain discipline, security and supervision where you are physically present at the Company’s premises or affiliated units,
• —Fulfilling legal and regulatory requirements arising from all relevant laws and secondary regulations, and taking the necessary measures in that context,
• —Carrying out inspection and/or regulatory duties performed by authorised public institutions and professional organisations having the status of a public institution,
• —Meeting requests for information and documents from judicial bodies, consumer arbitration committees and/or administrative authorities,
• —Carrying out listing, reporting, verification and analysis work regarding how the products and services offered at our Company and all affiliated centres and units are used, improving our services, increasing satisfaction with our products and services, and making customisations for the user in this context,
• —Planning and managing the financing of all services provided, and issuing invoices,
• —Taking all necessary technical and administrative measures for systems and applications within the scope of data security.

Your health data, in turn, is processed solely for the purposes of:

• —Carrying out the necessary diagnostic processes,
• —Combating COVID-19, for the duration of the pandemic only.

To Whom and For What Purpose Data May Be Transferred

By ensuring that all necessary technical and administrative measures are taken to provide an appropriate level of security under the KVKK and related legislation, your personal data may be shared, only where necessary and in line with the purposes stated above, as follows.

Your personal data:

• —Persons, institutions and/or organisations permitted by the provisions of other relevant legislation,
• —Private insurance companies and banks,
• —Lawyers or law partnerships, for the follow-up of legal matters,
• —Certified public accountants, for the conduct of finance and accounting operations,
• —Consultants,
• —Domestic and international organisations from which we receive or to which we provide services on a contractual basis, and with which we cooperate, in order to carry out our activities.

Your health data:

• —Where you have given explicit consent on the matter, your relatives and the health institution carrying out your treatment process,
• —Authorised public institutions and organisations.

Pursuant to Article 8 of the KVKK, transfers may be made where one of the conditions set out in Article 5(2) of the KVKK exists, and within the framework of the processing conditions and purposes specified in Article 9, subject to explicit consent.

Processing and Retention Periods

Your personal data will be processed, limited to the purposes set out in this notice, in accordance with the processing and statute-of-limitation periods laid down in all laws and other legislation to which our Company and its affiliated centres and units are subject. Should the statutory processing periods change, the newly determined periods will apply.

As a requirement of the principle of purpose limitation, your personal data is processed only for as long as required to fulfil the purposes explained in this notice and, in any case, for the period required by statutory periods, company practice and commercial custom; once those periods expire, it is deleted, destroyed or anonymised. If you would like detailed information about retention periods, you may contact us using the addresses given in the section on the rights of the data subject. Body temperature readings taken in the context of combating COVID-19 are stored only for the duration of the pandemic and are destroyed thereafter.

Rights of the Data Subject

As a data subject, you hold the rights set out in Article 11 of the Law, which governs the rights of the data subject. You may exercise these rights by submitting your requests, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to Mimar Sinan Mahallesi 1355 Sk. No: 5-7a Konak/İzmir, or electronically to muhasebe@lamed.com.tr.