Customer / Patient Explicit Consent Form

By signing this form;

I hereby consent to sharing personal data with ODDO SAĞLIK A.Ş.(hereinafter referred to as " ODDO SAĞLIK A.Ş. ") in accordance with the purposes listed below and to the processing and transfer of this information with this Form in accordance with the Personal Data Protection Law No. 6698.

Data that I consent to processing and transferring;

1. ID datas such as name, surname, Turkey Republic ID number, passport informations, in case of being a foreign citizen passport number and temporary Turkey Republic ID number, birthplace and date, marital status, gender and the photocopy of the ID Card or Driving License,
2. Contact and location data such as address, location information, phone number, e-mail address,
3. Financial data such as bank account number, IBAN number,
4. Your health and sexual life data obtained during the execution of medical diagnosis, esthetics, treatment and care services such as your own laboratory and imaging results, test results, examination data, photographs of your body and video records, prescription information, blood type, past treatment informations, in order to be monitored in the file and to get service,
5. Responses and comments that I share in physical and / or digital media in order to evaluate your services,
6. Closed circuit camera system image and sound recording taken during the visit to Doctor’s office, clinic, ,hospitals, the hotel if you are staying there, (In order to ensure security, our Company records images with security cameras in accordance with the law. Records are processed in order to improve the quality of the service provided and to fulfill legal obligations, and may be transmitted to the authorized authorities when necessary and upon request, as required by legal obligation. Data is recorded in limited areas by respecting the privacy of private life and necessary administrative and technical measures are taken for its security.)
7. Written notes and voice conversation records kept in case of contacting our Call Center,
8. Data regarding private health insurance and Social Security Institution data for the purpose of financing and planning health services,
9. Vehicle license plate data if the parking lot and valet service is used,
10. Browsing information, IP address and medical documents, surveys, form information, location and contact data that have transmitted with consent, which are obtained during the use of our website and mobile application,
11. Accommodation data that is requested in case transportation and accommodation services are used, such as travel, flight, ticket information and accommodation data requested for the hotel, hostel, house etc. where you will stay in,
12. If the hotel service is used, in addition to the above information, information about the child/children (name, age, date of birth, etc.) if they will stay with the customer, credit card number in case of reservation, arrival and departure dates, your preferences and interests (for example smoking/non-smoking room, preferred floor, type of bedding, type of newspaper/magazine, sports, cultural interests, nutrition and beverage preferences, etc.). ) Technical information and locations applicable during your use of our websites and applications, services offered during your stay, information contained therein in case of completion of the customer satisfaction survey, information of the companion, if any (name, ID, license plate, etc.)

Your collected personal data are stipulated by Law No. 6698 and GDPR, a) Compliance with the law and the rules of honesty, b) Being accurate and up-to-date when necessary c) Being processed for specific, clear and legitimate purposes, d) Being linked, limited and proportionate to the purpose for which they are processed, e) In accordance with the basic principles of preservation for the period required by the relevant legislation or for the purpose for which they are processed; Law No. 6698;

Article 5/1 within this framework “Obtaining the explicit consent” of the Data Subject

Article 5/2 (a) “It is expressly permitted by any law”

Article 5/2 (b) “It is necessary to protect the life or physical integrity of the data subject or another person, and the data subject is unable to provide consent due to actual impossibility or lacks legal capacity to give valid consent”

Article 5/2 (c) “It is necessary to process the personal data of parties of a contract, provided that the processing is directly related to the execution or performance of the contract”

Article 5/2 (ç) “It is necessary for compliance with a legal obligation which the controller is subject to”

Article 5/2 (d) “the data has been made public by the data subject”

Article 5/2 (e) “Data processing is mandatory for the establishment, exercise or protection of a right”

Article 5/2 (f) “It is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed” it will be processed for the following purposes:

Similarly, your collected personal data are stipulated by Law No. 6698 and GDPR within the framework of:

Article 6/2 (a) “Obtaining the explicit consent” of the Data Subject,

Article 6/2 (b) “It is expressly permitted by any law,”

Article 6/2 (c) “It is necessary to protect the life or physical integrity of the person who is unable to express consent due to actual impossibility or whose consent is not legally valid,”

Article 6/2 (ç) “It concerns personal data made public by the Data Subject, provided that the processing aligns with the purpose of publicization,”

Article 6/2 (d) “It is necessary for the establishment, exercise, or protection of a right,”

Article 6/2 (e) “It is necessary for the purposes of public health protection, preventive medicine, medical diagnosis, treatment, and care services, or the planning, management, and financing of health services, by persons or authorized institutions and organizations obligated to maintain confidentiality,”

and it will be processed for the following purposes:

I give my explicit consent and permission to the processing of my personal data for the following purposes and to its transfer to third parties inside and outside the company;

For the fulfillment of the purposes required to execute the Patient/Customer agreement, particularly:

i. Conducting activities for the protection of public health, preventive medicine, medical diagnosis, aesthetics, treatment, and healthcare services,

ii. Sharing information requested by the Ministry of Health and other public institutions and organizations in accordance with relevant legislation,

iii. Sharing mandatory information requested by the Turkish National Police with the relevant public authorities when you utilize our hotel services,

iv. Sharing your necessary information with our suppliers and business partners (such as software companies providing information systems and technical support, consultancy firms, etc.), the Turkish National Police, other law enforcement authorities, and institutions such as the State Institute of Statistics, in cases where you utilize our hotel services and to the extent necessary for the fulfillment of services provided by our company,

v. Fulfilling legal and regulatory requirements,

vi. Financing healthcare services, covering costs of examinations, diagnosis, and treatments, and sharing requested information with private insurance companies within the scope of eligibility verification,

vii. Informing you about appointments through Call Centers and Digital Channels,

viii. Confirming your identity by Patient Services, Healthcare Professionals, and Call Center departments,

ix. Planning and managing the internal operations of clinics, medical offices, or hospitals,

x. Processing necessary personal data (such as name, surname, identification number, address, vehicle license plate, country, etc.) to carry out and manage procedures related to your accommodation when utilizing our hotel services,

xi. Monitoring and preventing misuse and unauthorized transactions by Audit and Information Systems departments,

xii. Issuing invoices for services rendered by the Patient Services, Financial Affairs, and Marketing departments,

xiii. Addressing all inquiries and complaints related to healthcare services provided or to be provided through the Call Center departments,

xiv. Reminding you of periodic processes related to continuous medical procedures,

xv. Ensuring data security for clinic systems and applications by taking all necessary technical and administrative measures,

xvi. Providing information about participation in campaigns and campaign details, and designing and delivering special content and benefits through web and mobile channels,

xvii. Measuring, enhancing, and researching patient satisfaction,

xviii. Informing the public via social media and other communication tools,

xix. Promoting the quality and processes of services provided by sharing photographs and video recordings showing pre- and post-treatment conditions through various digital, physical, and media channels,

xx. Distinguishing between justified and unjustified patient/customer complaints, increasing satisfaction, understanding customer/patient needs, and improving processes related to them,

xxi. Evaluating service quality and providing training for employees,

For the specific purpose of ensuring security within the clinic/hospital, particularly:

i. Ensuring workplace security,

And for other purposes, including:

i. Facilitating corporate transactions such as mergers, demergers, transformations, changes of control, or restructuring of the DATA CONTROLLER to ensure their smooth execution,

You explicitly grant consent and approval for the processing of your personal data and its transfer to third parties both within and outside the clinic/hospital for the above purposes.

1. Transfer of Your Personal Data

Your personal data can be transferred to public institutions (such as ministries and Presidency boards) within the scope of the purpose and limitations stipulated by the law, if requested in cases clearly stated in the laws.

We would like to emphasize that, pursuant to the Identity Reporting Law No. 1774, the identification information of personnel working at businesses and accommodation facilities, as well as guests and visitors, must be reported to law enforcement authorities such as the gendarmerie or police, and, upon request, to institutions such as the State Institute of Statistics. Accordingly, if you utilize our hotel services, it is mandatory for the requested information to be transmitted to the relevant authority. This requirement is not a condition imposed by us but a legal obligation applicable to all companies providing accommodation services.

Your personal data, within the framework of the Fundamental Law on Health Services No. 3359, the Decree-Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliates, the Personal Data Protection Law No. 6698, the Regulation on Private Hospitals, the Regulation on the Processing and Protection of Privacy of Personal Health Data, the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, the regulations of the Ministry of Health, and other relevant legislative provisions, and based on the following conditions: obtaining your explicit consent or compliance with the laws and regulations mentioned above in cases where data processing can be performed without explicit consent under the law, and for the purposes outlined herein, will be processed as follows:

Your personal data can be transferred to;

1. In order to fulfill the legal obligation, authorized official institutions and organizations and persons authorized by law, (Including the mandatory transmission of your identification information to the Police or law enforcement authorities, and, upon request, to institutions such as the State Institute of Statistics, in accordance with the scope of the Identity Reporting Law No. 1774, if you stay at our Hotel.)
2. Relevant judicial authorities and authorized attorneys for the execution or follow-up of judicial processes;
3. Professional consultants, accountants, and auditors employed by the data controller, for purposes such as business process development, conducting promotional and marketing activities, risk management, and fulfilling contractual obligations;
4. Private and official institutions, physicians, hotels, event organizations, and banks with which the data controller has commercial, administrative, or contractual relations, for the fulfillment of contractual obligations, the establishment of rights, compliance with legal obligations, and within the scope of legitimate interests;
5. Cargo, courier, and logistics companies providing transportation and distribution services for the execution of contractual obligations;
6. Group data controllers for the management of internal relations;
7. Domestic or international laboratories, medical centers, ambulance services, medical device providers, and healthcare institutions with which the data controller collaborates for medical diagnosis and treatment;
8. Another healthcare institution to which you are referred or have applied in the event of a referral;
9. Legal representatives you have authorized;
10. Consultants and service providers, including attorneys, tax advisors, accountants, and auditors with whom we work;
11. Regulatory and supervisory bodies and official authorities;
12. Your employer or certain third parties, if your billing is to be made on behalf of your employer or third parties;
13. Suppliers, support service providers, transportation and accommodation service providers, archive service providers, and business partners from whom you receive services or with whom you collaborate as the data controller.
14. Methods of Obtaining Personal Data

Although the methods of collecting personal data may vary depending on the service provided by ODDO SAĞLIK A.Ş. and the commercial activities of ODO SAĞLIK A.Ş., your personal data, with all contracts / information forms and other documents regarding transactions issued with your approval and / or signature; they can be collected with automatic or non-automatic methods, via website, social media channels, mobile applications, security cameras and similar means. It can be verbal, written or electronic.

The legal basis for the collection of this personal data is as follows:

1. The Personal Data Protection Law No. 6698,
2. The Fundamental Law on Health Services No. 3359,
3. The Decree-Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliates,
4. Identity Reporting Law No. 1774
5. The Regulation on Private Hospitals,
6. The Regulation on the Processing and Protection of Privacy of Personal Health Data,
7. The Turkish Code of Obligations,
8. The Tax Procedure Law and other tax laws,
9. Obtaining explicit consent,
10. The regulations of the Ministry of Health and other relevant legislative provisions.

Additionally, as stipulated in Article 6, Paragraph 3 of the Law No. 6698, personal data related to health and sexual life may be processed without your explicit consent in cases where:

1. It is explicitly permitted by law,
2. It is necessary to protect the life or physical integrity of a person who cannot express consent due to actual impossibility or whose consent is not legally valid,
3. The personal data in question have been made public by the data subject, provided that the processing aligns with the purpose of publicization,
4. It is necessary for the establishment, exercise, or protection of a right,
5. It is necessary for public health protection, preventive medicine, medical diagnosis, treatment, care services, or the planning, management, and financing of health services, by persons or authorized institutions and organizations obligated to maintain confidentiality,

Under these conditions, your personal data may be processed by persons or authorized institutions and organizations obligated to maintain confidentiality, without requiring your explicit consent.

1. Your Rights as a Data Subject listed in Article 11 of Law No. 6698 and GDPR

The rights of real persons, whose personal data are processed in accordance with Article 11 of Law No. 6698 are as follows;

1. Learning whether personal data is processed,
2. If personal data has been processed, to request information regarding this,
3. Learning the purpose of processing personal data and whether they are used appropriately for their purpose,
4. To learn whether personal data are transferred domestically or abroad, and to know the third parties to whom it is transferred,
5. To request correction of personal data in case of incomplete or incorrect processing and to request notification to be made about the correction to third parties to whom personal data have been transferred,
6. Although it has been processed in accordance with the provisions of Law No. 6698 and other relevant laws, to request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear, and to request notification to be made within this scope to third parties to whom personal data have been transferred,
7. Object to the occurrence of a result that is disadvantageous of analyzing the processed data exclusively through automated systems,
8. To request the compensation of the damage due to unlawful processing of personal data
9. You can also withdraw your explicit consent given within the scope of this text. However, if there are other reasons for compliance with the Law No. 6698, your personal data processed for these reasons will continue to be processed in accordance with the principles stipulated in the law. Therefore, if you withdraw your explicit consent, the processing of your data processed solely based on your explicit consent will be terminated immediately, but your personal data processed in line with both your explicit consent and other legal compliance reasons stipulated in law numbered 6698 will continue to be processed within the framework of legal provisions. If you withdraw your explicit consent, a detailed information text will be sent to you in accordance with the principles in the law numbered 6698.

You can transmit your application for your rights listed above, with your request which contains the necessary information identifying your identity and your explanations about your right to use the rights specified in Article

11 of Law No.6698 with following methods: You can fill in the Data Subject Application Form at www.oddoclinic.com and send a signed copy of the form to Adalet Mah. Manas Bulv. Folkart Towers A Kule K:20 D:2007, Bayraklı/Izmir, by hand with documents identifying you, you can send it via notary or other methods specified in the Law No. 6698. Or you can send the relevant form with secure electronic signature to oddosaglik@hs02.kep.tr

Depending on the nature of the request, the request will be concluded free of charge as soon as possible, within thirty (30) days at the latest. However, if the transaction requires an additional cost, we will charge the fee in the tariff determined by the Board of Protection of Personal Data.

Applications can be made in English or Turkish. In the application there must be name, surname and signature if the application is written, Turkey Republic ID number for Turkey citizens, on the other hand, nationality, passport number / identity number, place of residence or workplace address for notification, e-mail address, telephone or fax number and subject of request for foreigners.

In the application containing the explanations about the right that the relevant person has and that he / she will make in order to exercise the above-mentioned rights and that he / she has requested to use; the requested matter should be clear and understandable, the requested subject must be related to the person. If he / she is acting on behalf of someone else, he / she must be specially authorized in this regard and must document his / her authority, identification and address information and documents proving identity must be attached to the application.

I have read and understood the Information/Clarification Text on the Processing of Personal Data prepared by the DATA CONTROLLER.

I acknowledge that I have been informed about the purposes for which my personal data will be processed, the institutions, organizations, companies, and healthcare professionals to whom they may be transferred, the methods of data collection and the legal basis for processing, my rights regarding the protection of my personal data, data security, and my right to apply, all as detailed in the Information/Clarification Text on the Processing of Personal Data.

I consent to the processing and transfer of my personal and special category data to the extent necessary for the following purposes: performance of a contract, Explicitly permitted by law, Fulfilling the legal obligations of the DATA CONTROLLER, Protection of public health, Protection of the life or physical integrity of a person who is unable to express consent due to actual impossibility or whose consent is not legally valid, either for their own benefit or for the benefit of another, Necessity for the establishment, exercise, or protection of a legal right, Processing required for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject, Conducting preventive medicine, medical diagnosis, treatment, and care services, as well as planning and managing healthcare services and their financing.

Furthermore, I agree that my personal data will be retained, processed, and transferred in accordance with the conditions outlined in the Information/Clarification Text on the Processing of Personal Data, except in cases where the above purposes require otherwise.

We declare in the capacity of “Data Controller” within the scope of Law No. 6698 and GDPR.

Regards,

ODDO SAĞLIK A.Ş.

Adress: Adalet Mah. Manas Bulv. Folkart Towers A Kule K:20 D:2007, Bayraklı/Izmir

If you accept;

Please write in your handwriting "I understood what I read and I have been informed about the processing and transfer of my personal data and I have explicit consent":

………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………

I do not accept