Notice on the Processing of Personal Data (KVKK)

1. Identity of the Data Controller

This Notice has been prepared by TURKAVIA Global Sağlık Limited Şirketi ("TURKAVIA" or the "Company") as data controller, pursuant to Article 10 of Turkey's Law No. 6698 on the Protection of Personal Data ("the Law") and the related Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

Data Controller: TURKAVIA Global Sağlık Limited Şirketi

Address: Barbaros Mah. Mor Sümbül Sk. Teknik Yapı Deluxia Palace No: 5 A İç Kapı No: 265 Ataşehir/ İstanbul

This notice is prepared to inform the patients, clients, visitors and business partners we serve within the scope of medical tourism, intermediary healthcare services, and aesthetics/beauty services.

2. Categories of Personal Data Processed

• Identity data: name-surname, national ID/passport number, date of birth, etc.

• Contact data: address, phone, e-mail.

• Special-category data (health data): diagnosis, treatment, medical history, laboratory/imaging results, etc.

• Travel, transfer and accommodation data: flight/transfer information, accommodation records.

• Transaction-security data: IP logs, entry-exit logs, camera footage (if any).

• Financial data: invoicing and payment-related information.

3. Purposes and Legal Bases for Processing

Articles 5 and 6 of the Law subject general personal data and special-category personal data (such as health data) to different legal bases; the legal bases are therefore set out separately below by data category.

3.1. General personal data (identity, contact, financial, transaction-security, travel/accommodation data): processed under Article 5(2) of the Law — being directly related to the establishment or performance of a contract (carrying out medical-tourism, accommodation and logistics services), being mandatory for the Company to fulfil its legal obligations (administrative/legal processes, statutory notification/reporting obligations), and being mandatory for the data controller's legitimate interest provided this does not harm your fundamental rights and freedoms (improving service quality, managing requests/complaints, use as evidence in possible disputes).

3.2. Special-category data (health data): health data is a special category of personal data under Article 6 of the Law and is processed only on one of the following legal bases: under Article 6(3) of the Law, it may be processed without seeking explicit consent by persons under a duty of confidentiality (physicians, health personnel, etc.) for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and financing of healthcare services; or, for processing activities that fall outside this exception (e.g., transferring health data to business partners abroad, use for marketing purposes), your explicit consent is obtained. Which health-data processing activity relies on which legal basis is further broken down by purpose in our separate Explicit Consent Text.

4. Purposes of Processing Personal Data

Carrying out communication activities; carrying out health and treatment operations; carrying out medical-tourism, logistics and accommodation activities; receiving and evaluating suggestions for improving service quality; carrying out Company activities and ensuring business continuity; carrying out administrative and legal processes; carrying out financial transactions; receiving and resolving requests/complaints and notifying you of the outcome; use as evidence in the event of a possible dispute.

5. Method of Collecting Personal Data

Your personal data is collected through the website, call centre, e-mail, WhatsApp/messaging applications, face-to-face meetings, contracts and application forms; fully or partially by automated means, by voice recording, and where necessary in physical/paper form.

6. Transfer of Personal Data

Limited to the purposes stated above and subject to necessary security measures, your personal data may be transferred to the following recipient groups: contracted hospitals, clinics and healthcare professionals for the provision of healthcare services; hotel, transfer and travel-agency partners for accommodation, transfer and travel organisation; competent public authorities, judicial/administrative bodies and law-enforcement agencies as required by applicable legislation; financial-advisory/accounting service providers for financial and accounting processes; lawyers and advisors for the management of legal disputes.

6.1. Cross-border transfer: within the scope of our medical-tourism activities, it may be necessary to share data with patients, insurance companies, intermediary institutions or business partners located abroad. In this context, your personal data may be transferred abroad in accordance with the conditions set out in Article 9 of the Law — to countries declared by the Personal Data Protection Board ("the Board") to have adequate protection, or, absent such a country, through a written undertaking approved by the Board (providing appropriate safeguards) or your explicit consent, or another mechanism envisaged under the Law. Cross-border transfer of your health data specifically is subject to the separate explicit consent described in the Explicit Consent Text.

7. Retention Period

Your personal data is retained for the periods stipulated under applicable legislation (e.g., retention periods set by specific legislation for healthcare records, or periods set by the Turkish Commercial Code and Tax Procedure Law for commercial books and documents), or for as long as necessary for the purpose of processing. Upon expiry of these periods, your personal data is deleted, destroyed or anonymised in accordance with the Company's Personal Data Retention and Destruction Policy.

8. Processing of Data Relating to Minors (Under 18)

Where the data subject benefiting from our services is under 18 years of age, the necessary approvals — including explicit consent for the processing of personal data — are given by their parent or legal guardian. A minor's health data is processed solely for the purpose of providing healthcare services and with the knowledge of the legal guardian.

9. Rights of the Data Subject

Under Article 11 of the Law, by applying to the Company you have the right to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of processing and whether it is used in accordance with that purpose; know the third parties to whom it is transferred domestically or abroad; request correction if it has been processed incompletely or incorrectly; request its deletion or destruction within the conditions of Article 7 of the Law; request that correction/deletion/destruction requests be notified to third parties to whom the data was transferred; object to a result that is to your detriment arising solely from analysis by automated systems; request compensation for damage suffered due to unlawful processing; and withdraw any explicit consent you have given at any time, provided there is no other legal basis for the continuation of the relevant processing.

You may submit your requests, together with documents verifying your identity, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to the address above or through other methods stipulated under the Law. Requests are concluded free of charge as soon as possible and no later than 30 (thirty) days, depending on the nature of the request.