Privacy Policy

PREFACE

Within the scope of the Law on the Protection of Personal Data, ESTELİT SAĞLIK HİZMETLERİ A.Ş. (“ELİT KLİNİK”) (hereinafter referred to as “ELİT KLİNİK” or “Company”), we attach importance to the protection of your personal data and / or sensitive personal data. We are sensitive about the storage of all personal data and / or special categories of personal data belonging to you transmitted to our company in various ways. In this context, we have taken the necessary technical and administrative measures as ELİT CLINIC in order to comply with the provisions of the Turkish Constitution and other legislation, especially the Law No. 6698 on the Protection of Personal Data. We share with you our Privacy Policy, which has been put into effect within ELİT CLINIC, which is particularly important for the protection of your personal data.

1. Definitions

Data Controller: It refers to ESTELİT SAĞLIK HİZMETLERİ A.Ş., which determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

Data Subject-Related Person: Refers to the real person whose personal data is processed.

Company: In accordance with this policy, ESTELİT SAĞLIK HİZMETLERİ A.Ş. is referred to.

Law Law No. 6698 on the Protection of Personal Data.

Personal Data: Any information relating to a natural person whose identity is specific or identifiable.

Sensitive Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership to associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, and biometric and genetic data refer to personal data of special nature.

Board: The Personal Data Protection Board.

Policy: This “Privacy Policy” refers to.

Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, retaining, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system.

Explicit Consent: Consent on a specific issue, based on information and expressed with free will.

Destruction It refers to making personal data inaccessible, irretrievable and non-reusable by anyone in any way.

Deletion: It refers to making personal data inaccessible and non-reusable in any way for the relevant users.

Anonymization: It refers to making personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even if it is matched with other data.

Destruction: It refers to the deletion, destruction or anonymization of personal data.

Data: Personal data and sensitive personal data are referred to together.

2. PURPOSE OF THE PRIVACY POLICY

Protection of personal data and compliance with the Law is our fundamental principle. In all the work we do as ELİT KLİNİK, the personal data and/or sensitive personal data we have received from you are kept confidential and not shared with third parties. In this context, our company has always shown the necessary sensitivity regarding the protection of personal data and/or sensitive personal data. Again, in accordance with the Law No. 6698 on the Protection of Personal Data (hereinafter referred to as the “Law” or “KVKK”), our internal regulations have been reorganized and all necessary technical and administrative measures have been taken. In the ongoing process, as ELİT CLINIC, we accept, declare and undertake to comply with all obligations imposed by the law.

3. SCOPE OF THE PRIVACY POLICY

This Privacy Policy has been prepared in accordance with the Personal Data Protection Law No. 6698. Our Company reserves the right to make changes without prior notice in order to keep our Privacy Policy up to date and to comply with the relevant legislation. In case of changes in the privacy policy, the updated policy will be announced on our website. This policy was last updated on …/…/2024.

Your personal data and/or sensitive personal data are processed with your consent or in compliance with the law. Your data in question;

• Execution of marketing processes to ensure company security,
• Providing you with a complete service,
• Quick resolution of your problems,
• It is used to improve our quality.

Some personal data and/or special categories of personal data received from you are depersonalized and anonymized in accordance with the procedures stipulated by the Law. Data used for statistical purposes is not currently regulated by the Law and is not covered by our policy. As ELİT KLİNİK, we have the right to change this policy in order to protect personal data within the scope of compliance with the Law.

Confidentiality policy The data obtained in any way from real and legal persons, clients, patients, employees and all other persons with whom ELİT KLİNİK is a solution partner

4. BASIC PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA

Our basic principles regarding the processing of personal data and/or sensitive personal data are as follows. In this context, these principles will apply to the data processed by ELİT CLINIC based on explicit consent or within the scope of compliance with the Law.

Compliance with the Law: ELİT CLINIC questions the source and lawfulness of personal data and/or special categories of personal data received from real and legal persons and collected by various means. In this context, obtaining data in accordance with the law is important for ELİT KLİNİK.

Compliance with the Rules of Honesty: ELİT KLİNİK inquires the source of personal data and/or sensitive personal data received from real and legal persons and collected in various ways. In this context, it is important for ELIT CLINIC to obtain data within the framework of honesty rules.

Being Limited, Measured and Connected to the Purpose for which they are Processed: ELİT KLİNİK uses personal data and / or sensitive personal data obtained in various ways in accordance with the purpose for which they are processed, limited to the purpose of processing, measured and to the extent required by the performance of the service.

Accuracy of Personal Data and/or Sensitive Personal Data: ELİT KLİNİK attaches importance to the fact that the personal data and/or sensitive personal data received from real and legal persons and collected by various means do not contain false information and are accurate. However, ELİT KLİNİK is not obliged to investigate the accuracy of personal data and/or sensitive personal data declared by its patients, clients or real and legal persons with whom it is in contact. This is not possible legally and in line with our working principles.

Being Up-to-Date When Necessary: If there has been a change in the personal data and/or special categories of personal data that ELİT KLİNİK obtains in various ways, it attaches importance to communicating the change to the company and updating the data if it is communicated.

Processing for Specific and Legitimate Purposes: ELİT KLİNİK processes personal data and/or sensitive personal data without obtaining explicit consent within the framework of the explicit consent given by the data owner or the exceptions stipulated by law. The purpose of processing each data is specific and personal data processing activities are not carried out for any illegitimate purpose.

Preservation for the period stipulated in the Law and/or for the time required for the purpose for which they are processed:

ELİT KLİNİK stores the personal data and/or special categories of personal data it obtains for the periods stipulated in the relevant laws and/or required for the purpose for which they are processed. Anonymize, destroy or delete the data when these purposes are no longer relevant.

5. SCOPE OF THE PRIVACY POLICY

Your personal data and/or sensitive personal data shall be deleted, destroyed or anonymized upon the expiration of the statute of limitations and retention periods stipulated in the Law, completion of judicial processes or other requirements appropriate for the purpose. Deletion, destruction and anonymization operations are carried out upon the request of the relevant data owner or ex officio (spontaneously) by ELİT KLİNİK.

6. THE PRINCIPLE OF PARSIMONY

The principle of austerity is also known as the principle of maximum austerity. Personal data and/or sensitive personal data received through various means are transferred to our company’s system. Pursuant to this principle, data is processed in the system to the extent necessary. The data to be collected by ELİT KLİNİK is determined in accordance with the purpose and varies. In this context, data are collected in accordance with the purpose and data that are not in line with the purpose are not collected. Any redundant data that is not for its intended purpose shall not be recorded in the company system and shall be deleted, destroyed or anonymized. However, these data can be used for statistical purposes.

7. CONFIDENTIALITY AND SECURITY OF DATA

As ELİT KLİNİK, we attach importance to the confidentiality of your personal data and/or sensitive personal data. In this context, your personal data and/or sensitive personal data that reaches our Company in any way are confidential. ELİT KLİNİK complies with the confidentiality of such data at every stage of its commercial activity. In this context, full compliance with this company privacy policy is ensured.

Necessary technical and administrative measures are taken to prevent unauthorized access to personal data and/or sensitive personal data collected through various means, to prevent damage to the rights of the data owner and to protect the data. In addition, data protection is requested from third parties with whom we share personal data and/or sensitive personal data in accordance with the law, where necessary. Again, our software programs are updated and renewed continuously. Technological requirements are fulfilled and standards are complied with to ensure a high level of protection.

8. TIMELINESS OF DATA

The principle of timeliness is essential within ELİT KLİNİK. Because personal data and/or sensitive personal data obtained in various ways can be updated when necessary or upon request. Necessary measures regarding the update are also taken by ELİT KLİNİK

9. ACCURACY OF DATA

The principle of accuracy of the declared personal data and/or sensitive personal data has been adopted by ELİT KLİNİK. ELİT KLİNİK is not obliged to investigate the accuracy of personal data and/or special categories of personal data declared by its patients, clients or real and legal persons with whom it is in contact. This is not possible legally and in line with our working principles. In this context, transactions are carried out on the grounds that the declared data is correct.

10. PURPOSES OF PROCESSING PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA

The processing of personal data and/or sensitive personal data is carried out in parallel with the purposes in the Clarification Texts of ELİT KLİNİK. Such Clarification Texts may vary according to the personal data and/or special categories of personal data processed. In parallel with the differences in the Clarification Texts, the purposes of processing personal data and/or sensitive personal data may also vary.

11. COLLECTION AND PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA WITHIN THE CONTRACTUAL RELATIONSHIP

If a contractual relationship has been established with patients, clients or prospective patients and clients, personal data collected pursuant to the contract may be processed by ELİT CLINIC without obtaining explicit consent. In case of processing of special categories of personal data, explicit consent or explicit consent in accordance with Article 6 of the Law is required. Data may be processed based on legal grounds within the scope of Art. The data in question are used within the framework of the performance of goods and/or services, execution of the contract, execution of the commercial activity. This data may be updated at any time by contacting patients or clients.

12. PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA PROCESSED THROUGH AUTOMATED SYSTEMS

Data obtained from information obtained through automated systems without the explicit consent of individuals cannot be used against individuals. ELİT KLİNİK acts in accordance with the provisions of the relevant legislation in personal data and/or sensitive personal data processed through automated systems.

13. PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA BELONGING TO EMPLOYEES OF ELİT KLİNİK

PROCESSING CARRIED OUT WITHIN THE FRAMEWORK OF LEGAL OBLIGATIONS:

Personal data belonging to employees can be processed by ELİT KLİNİK without obtaining their explicit consent in order to fulfill the legal obligation of the data controller or if there is an explicit provision in the relevant Law regarding the processing of the data.

PROCESSING OF PERSONAL DATA PURSUANT TO EMPLOYMENT CONTRACT AND BUSINESS RELATIONSHIP:

Personal data of employees may be processed without the explicit consent of the employees within the framework of proportionality to the extent necessary to ensure the business relationship between the company and the employees. ELİT KLİNİK undertakes to protect and confidentialize the data of employees under all circumstances and to take the necessary measures in this regard.

PROCESSING OF PERSONAL DATA OF SPECIAL NATURE BELONGING TO EMPLOYEES:

Pursuant to Law No. 6698 on the Protection of Personal Data, the processing of sensitive personal data requires the explicit consent of the person whose data is to be processed and, in addition, the necessary measures stipulated by the Board. ELİT KLİNİK Compliance with Law No. 6698 and the principles of the Board

When processing special categories of personal data, it takes both the explicit consent of the data subject and the necessary measures determined by the Board when necessary. However, special categories of personal data may be processed without the explicit consent of the data subject in exceptional cases stipulated in the Law, provided that it is limited and measured.

PERSONAL DATA PROCESSED THROUGH AUTOMATED SYSTEMS:

Some personal data of employees may be processed in automated systems. This data is used for employee performance evaluation, keeping statistical data, promotions and ratings for the company. Employees have the right to appeal against unfavorable outcomes. The appeal must be carried out in accordance with internal rules and procedure. The objection is subject to internal evaluation.

PROCESSING OF PERSONAL DATA FOR THE BENEFIT OF EMPLOYEES:

Personal data of employees can be processed by ELİT KLİNİK without obtaining explicit consent within the framework of the relationship provided by the employment contract for transactions related to the interests of the employee. Again, in disputes regarding the business relationship with ELİT KLİNİK, the Company may process the personal data of employees.

INTERNAL TELECOMMUNICATIONS, INTERNET AND COMMUNICATIONS:

In order to facilitate the performance of the work, ELİT KLİNİK may allocate computers, phones, cars, applications, software and e-mails to in-house employees. ELİT KLİNİK may control and audit personal data on the tools it allocates within the scope of its disclosure obligations. The employee may not use the vehicles allocated to him/her for private purposes. It is obligatory to use it only for the purpose of ensuring the performance of the work. Again, the employee accepts, declares and undertakes that he / she will not keep any data, information other than the necessity of work and work in the vehicles allocated from the moment the working relationship with ELİT KLİNİK starts.

14. TRANSFER OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA DOMESTICALLY AND ABROAD

ELİT KLİNİK may transfer data domestically and abroad in accordance with the conditions stipulated in the Law on the Protection of Personal Data and within the framework of the principles determined by the Board within the scope of compliance with the law or with the explicit consent of the person concerned. ELİT KLİNİK transfers personal data and/or special categories of personal data in accordance with Law No. 6698 8. and Article 9 of the Convention.

15. AUDIT AND TRANSACTION SECURITY

Necessary technical and administrative measures are taken to prevent unauthorized access to personal data and/or sensitive personal data collected through various means, to prevent damage to the rights of the data owner and to protect the data. In addition, data protection is also requested from the companies with which we share personal data and/or sensitive personal data in accordance with the law. Again, our software programs are updated, continuously renewed and developed. All technological requirements are met to ensure a high level of protection and compliance with standards. In parallel with all these, ELİT KLİNİK carries out all internal and external audits required for the protection of personal data and/or sensitive personal data.

16. NOTIFICATION OF DATA BREACHES

In the event of any breach of data, ELİT KLİNİK immediately takes action to do its part to remedy the breaches notified to it. It takes the necessary measures to minimize the damage to the person concerned. You can apply for notification of violations according to the procedures specified on our company’s website. In addition, in the event that personal data and/or sensitive personal data fall into the hands of unauthorized third parties from outside, the company notifies the Personal Data Protection Board directly.

17. RIGHTS OF THE DATA SUBJECT REQUESTING INFORMATION

11 of the Law No. 6698 on the Protection of Personal Data article provides for the rights of the data subject. ELİT KLİNİK accepts that the person concerned must be enlightened before data processing in accordance with the law and that the person concerned has the right to request information about the data, update, delete, destroy and anonymize the data after the data is processed.

The persons concerned have the following rights;

1. Learn whether personal data is being processed,
2. Request information if their personal data has been processed,
3. To learn the purpose of processing personal data and whether they are used for their intended purpose,
4. To know the third parties to whom personal data are transferred domestically or abroad,
5. Requesting correction of personal data if it is incomplete or incorrectly processed,
6. 7 Of the law entitled ”Deletion, destruction or anonymization of personal data”. Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in the article,
7. Requesting notification to third parties to whom personal data has been transferred that incomplete or incorrectly processed data has been corrected or that the data has been deleted or destroyed upon the request of the data subject,
8. Objecting to the emergence of a result that is unfavorable to the individual by analyzing the processed data exclusively through automatic systems,
9. Request compensation for damage in case of damage due to unlawful processing of personal data.

Information requests made on behalf of someone else will not be answered by the company. If it is determined by ELİT KLİNİK that the application for information has been made on behalf of someone else; ELİT KLİNİK reserves the right to file all kinds of lawsuits and requests. It will be answered as soon as possible and within thirty days from the date the relevant person reaches ELİT KLİNİK. If ELİT KLİNİK deems it necessary, it may request other information and documents from the relevant person.

ESTELİT SAĞLIK HİZMETLERİ A.Ş.