Personal Data Processing and Protection Policy

1. Purpose and Scope

Barutçu Seyahat Oto. Tur. San. Tic. A.Ş. (hereinafter referred to as the “Company”), operating at İsmet Kaptan Mah. Gazi Osman Paşa Bulv. No:3 D:805, İzmir, Türkiye, provides healthcare tourism, travel and related services. The Company’s USHAŞ registration number is AK-1693.

The Company places great importance on the protection of personal data relating to its employees, customers, patients, visitors, suppliers, business partners and all other natural persons whose personal data is processed or with whom the Company interacts within the scope of its activities.

The Company conducts its personal data processing and protection activities primarily in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”), the applicable legislation, decisions of the Turkish Personal Data Protection Board, healthcare legislation, healthcare tourism legislation and, where applicable, the provisions of the European Union General Data Protection Regulation (“GDPR”).

This Personal Data Processing and Protection Policy (“Policy”) has been prepared to establish the fundamental principles and procedures applicable to the Company’s personal data processing activities and to ensure transparency regarding the collection, acquisition, recording, storage, use, transfer, classification, updating and, where necessary, deletion, destruction or anonymization of personal data.

2. Definitions and Abbreviations

Employee: A natural person working for the Company under an employment contract or a similar legal relationship.

Data Subject: A natural person whose personal data is processed. Employees, customers, patients, visitors and other natural persons receiving services from the Company may fall within this scope.

Personal Data: Any information relating to an identified or identifiable natural person.

Special Categories of Personal Data: Personal data subject to enhanced protection under KVKK, particularly health data, biometric data and genetic data, as well as other categories defined as special categories under applicable legislation.

Processing of Personal Data: Any operation performed on personal data, including collection, acquisition, recording, storage, alteration, transfer, classification, use, disclosure and similar operations.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and who is responsible for establishing and managing the data recording system.

KVKK: Turkish Personal Data Protection Law No. 6698.

GDPR: European Union General Data Protection Regulation.

USHAŞ: International Health Services Joint Stock Company (Uluslararası Sağlık Hizmetleri A.Ş.).

Confidentiality Agreement: An agreement that may be entered into prior to the commencement of treatment or healthcare services in order to regulate the parties’ rights and obligations concerning the confidentiality and protection of information, documents, personal data and special categories of personal data obtained during the treatment process.

3. Fundamental Principles for the Processing of Personal Data

3.1. Lawfulness and Fairness

The Company processes personal data in accordance with the Constitution of the Republic of Türkiye, KVKK, applicable legislation, other legal regulations and the principles of good faith.

3.2. Accuracy and, Where Necessary, Keeping Data Up to Date

The Company takes the necessary administrative and technical measures to ensure that the personal data it processes is accurate and, where necessary, up to date.

3.3. Processing for Specific, Explicit and Legitimate Purposes

Personal data shall be processed for specific, explicit and legitimate purposes. The Company processes personal data only for the provision of services, fulfilment of contractual and legal obligations and other purposes permitted by applicable legislation.

3.4. Being Relevant, Limited and Proportionate to the Purpose

The Company processes personal data to the extent necessary for achieving the specified purposes and does not process personal data that is irrelevant to the purpose or excessive in scope.

3.5. Retention for the Required Period

Personal data shall be retained for the period stipulated by applicable legislation or for the period necessary for the purposes for which it is processed.

4. Legal Grounds for the Processing of Personal Data

The Company processes personal data on the legal grounds set forth under Article 5 of KVKK.

Personal data may be processed without obtaining explicit consent where one of the following circumstances exists:

• It is expressly provided for by law;
• It is necessary for the establishment or performance of a contract;
• It is mandatory for the Company to fulfil its legal obligations;
• The relevant data has been made public by the data subject;
• Processing is necessary for the establishment, exercise or protection of a right;
• Processing is necessary for the legitimate interests of the Company, provided that such processing does not adversely affect the fundamental rights and freedoms of the data subject;
• Processing is necessary for the protection of the life or physical integrity of the data subject or another person where the data subject is physically or legally incapable of giving consent.

Where explicit consent is legally required, the Company shall obtain explicit consent from the data subject following adequate information and based on the data subject’s freely given and informed decision regarding a specific matter.

5. Processing of Special Categories of Personal Data

Health data, biometric data, genetic data and other data classified as special categories of personal data under KVKK are subject to enhanced protection.

The Company processes special categories of personal data only where the conditions prescribed under Article 6 of KVKK are met and the necessary security measures have been implemented.

Where necessary for healthcare tourism and healthcare services, the following information may be processed:

• Health condition and diagnostic information;
• Medical history;
• Medical examination and medical reports;
• Medication information;
• Blood group information;
• Information concerning disabilities;
• Information concerning medical devices and prostheses used;
• Laboratory results;
• Medical imaging results;
• Treatment and surgical procedure information;
• Other health information required for the provision of healthcare services.

6. Confidentiality Agreement Prior to Treatment

Within the scope of healthcare tourism and healthcare services provided by the Company, a Confidentiality Agreement may be entered into with the relevant data subject prior to the commencement of treatment or healthcare services, where deemed necessary.

The purpose of such agreement is to ensure the confidentiality of information and documents relating to the individual’s treatment process and to determine the parties’ respective rights and obligations regarding the protection of personal data.

The following information shall be subject to confidentiality protection in particular:

• Identification and contact information;
• Health and treatment information;
• Medical history;
• Diagnostic and medical examination results;
• Treatment plans;
• Information relating to the treatment process;
• Photographs and video recordings;
• Medical reports and documents;
• Other personal data and special categories of personal data.

Access to personal data obtained during the treatment process may only be granted to persons involved in the provision of treatment and healthcare services and only to the extent required by their duties.

The Company may establish appropriate confidentiality obligations for its employees, service providers, business partners and other persons involved in the treatment process.

The Confidentiality Agreement shall not eliminate or restrict the Company’s obligations arising from KVKK and other applicable legislation concerning information notices, explicit consent, data security and the transfer of personal data to competent authorities.

7. Methods of Collecting and Processing Personal Data

Personal data may be collected through physical forms, agreements, application forms, telephone conversations, e-mail, websites, electronic systems, online platforms, healthcare records, invoices, payment documents, call centre records and similar channels.

8. Categories of Personal Data Processed

9. Purposes of Processing Personal Data

• Provision of healthcare tourism and travel services;
• Organization and coordination of healthcare services;
• Creation and management of patient and customer records;
• Management of appointment and organizational processes;
• Conducting examination, diagnosis, treatment, surgical procedures and care processes;
• Conducting pre-treatment and post-treatment communication and follow-up activities;
• Management of patient and customer requests;
• Conducting call centre activities;
• Processing invoicing and payment transactions;
• Conducting accounting and financial operations;
• Fulfilment of legal and regulatory obligations;
• Fulfilment of obligations arising from healthcare and healthcare tourism legislation;
• Fulfilment of obligations towards the Ministry of Health and competent authorities;
• Notifications and reporting to USHAŞ and relevant institutions;
• Management of patient satisfaction and requests;
• Ensuring information security and business continuity;
• Conducting legal and administrative processes;
• Responding to requests for information and documents from competent authorities;
• Fulfilling statutory retention and notification obligations.

10. Transfer of Personal Data to Third Parties

Personal data processed by the Company may be transferred to third parties in accordance with KVKK and other applicable legislation, provided that such transfer is connected with, limited to and proportionate to the relevant processing purpose.

Personal data may be transferred for the safe and effective provision of treatment and healthcare services, planning and implementation of treatment processes, coordination of healthcare services, fulfilment of legal and administrative obligations and other purposes permitted by applicable legislation.

Where permitted or required by applicable legislation, personal data may be transferred to:

• The Ministry of Health of the Republic of Türkiye;
• USHAŞ;
• Competent public institutions and authorities;
• Public hospitals;
• Private hospitals;
• Private clinics;
• Medical centres;
• Polyclinics;
• Physicians and healthcare professionals;
• Laboratories;
• Diagnostic and medical imaging centres;
• Other authorized healthcare service providers;
• Insurance companies;
• Service providers and business partners;
• Financial, legal and consultancy service providers;
• Judicial and administrative authorities;
• Other persons and organizations authorized under applicable legislation.

11. Transfer of Data to Private Hospitals and Clinics for Treatment Purposes

Within the scope of healthcare tourism and treatment arrangements, the Company may transfer personal data and special categories of personal data to public or private healthcare institutions where necessary for the provision and coordination of treatment.

Within this scope, data may be transferred to:

• Private hospitals;
• Private clinics;
• Medical centres;
• Polyclinics;
• Physicians;
• Other healthcare professionals;
• Laboratories;
• Diagnostic and medical imaging centres;
• Other authorized healthcare service providers.

In particular, health status, medical history, diagnosis, examination results, laboratory results, imaging results, medication and treatment information, disability status, information concerning medical devices and prostheses used, and other health information necessary for the treatment process may be transferred.

Such transfers may be carried out for the purposes of planning and implementing treatment, conducting diagnostic and treatment procedures, enabling healthcare professionals to access necessary medical information, conducting pre- and post-treatment checks, coordinating healthcare services and ensuring patient safety.

When health data is transferred to private hospitals, private clinics or other healthcare service providers, the provisions of KVKK concerning special categories of personal data, healthcare legislation and other applicable legislation shall be complied with.

Personal data that is not necessary for the provision of treatment or healthcare services shall not be transferred.

12. Transfer of Data to the Ministry of Health and USHAŞ

Health data classified as a special category of personal data may, where necessary under KVKK and healthcare tourism legislation, be transferred to the Ministry of Health, USHAŞ and other competent public institutions and authorities.

Such transfers may be carried out for the following purposes:

• Conducting healthcare tourism activities;
• Planning and coordinating healthcare services;
• Fulfilling statutory notification and reporting obligations;
• Protection of public health;
• Supervision and regulation of healthcare services;
• Fulfilment of other legal and regulatory obligations.

Such transfers shall only be carried out where permitted or required by applicable legislation and to the extent necessary and proportionate for the relevant purpose.

13. Transfer of Personal Data Abroad

Transfers of personal data abroad shall be carried out in accordance with Article 9 of KVKK and the conditions prescribed by the applicable legislation.

Where an international transfer of personal data is necessary, the Company shall act in accordance with an adequacy decision, appropriate safeguards or other lawful transfer mechanisms prescribed by applicable legislation.

During international data transfers, the Company shall take the necessary measures to protect the fundamental rights and freedoms of data subjects and to ensure the security of personal data.

14. Retention of Personal Data

The Company securely stores personal data in physical and electronic environments for the period prescribed by applicable legislation or for the period required by the relevant processing purpose.

When determining retention periods, statutory retention periods, the processing purpose, legal obligations, limitation periods and the need to preserve evidence in potential legal disputes shall be taken into consideration.

Upon expiry of the applicable retention period or when the processing purpose ceases to exist, personal data shall be deleted, destroyed or anonymized in accordance with applicable legislation.

15. Measures Taken to Ensure Data Security

Pursuant to Article 12 of KVKK, the Company takes the necessary technical and administrative measures to prevent the unlawful processing and unlawful access to personal data and to ensure the secure storage of personal data.

15.1. Administrative Measures

• Internal policies and procedures concerning the protection of personal data are established.
• Employees receive training on KVKK and data security.
• Employee access rights are determined according to their duties and responsibilities.
• Necessary agreements are concluded with third parties to whom personal data is transferred.
• Confidentiality obligations are established for persons involved in treatment processes.
• Personal data processing activities are periodically reviewed.
• Necessary audits and controls are carried out.
• Necessary measures are taken in the event of a data security breach in accordance with applicable legislation.

15.2. Technical Measures

• Authorization and access control mechanisms are implemented.
• Information systems are protected through appropriate security measures.
• Encryption and similar security methods are used where necessary.
• Security controls are performed on information systems.
• Access rights to personal data are restricted.
• Technical infrastructure is used to prevent unauthorized access and data leakage.
• Necessary backup, logging and other technical security measures are implemented.

16. Rights of Data Subjects Under Article 11 of KVKK

Pursuant to Article 11 of Turkish Personal Data Protection Law No. 6698, data subjects may apply to the Company to exercise the following rights:

1. To learn whether their personal data is being processed;
2. To request information regarding the processing of their personal data;
3. To learn the purpose of processing their personal data and whether such data is used in accordance with that purpose;
4. To know the third parties to whom their personal data is transferred domestically or abroad;
5. To request correction of incomplete or inaccurate personal data;
6. To request deletion or destruction of personal data where the legal requirements are met;
7. To request notification of correction, deletion or destruction to third parties to whom the personal data has been transferred;
8. To object to a result arising against them through the analysis of their personal data exclusively by automated systems;
9. To claim compensation for damages arising from unlawful processing of personal data.

17. Rights of Data Subjects Under GDPR

Where the GDPR is applicable to the Company’s data processing activities, the rights granted to data subjects under the GDPR shall also be respected.

• Right of access to personal data;
• Right to rectification;
• Right to erasure;
• Right to restriction of processing;
• Right to data portability;
• Right to object to processing;
• Rights relating to automated decision-making and profiling.

The exercise of these rights is subject to the conditions, limitations and exceptions provided under the GDPR.

18. Updates to the Policy

The Company may update this Policy in the event of changes in applicable legislation, changes in its fields of activity, introduction of new personal data processing processes or modification of existing processes.

The updated Policy shall be made available to the relevant data subjects through communication channels deemed appropriate by the Company.

19. Final Provisions

The Company recognizes the protection of personal data as one of the fundamental principles governing all services it provides.

Particular importance is attached to the confidentiality and security of health data and other special categories of personal data processed within the scope of healthcare tourism and treatment processes.

Where deemed necessary, a Confidentiality Agreement shall be entered into with the relevant data subject prior to the commencement of the treatment process. Such agreement regulates the parties’ obligations regarding the confidentiality of personal data and special categories of personal data obtained during the treatment process and the prevention of unauthorized disclosure.

The Confidentiality Agreement shall not eliminate or restrict the Company’s obligations under KVKK and other applicable legislation concerning information notices, data security, retention, notification and the transfer of personal data to competent authorities.

Where permitted or required by applicable legislation, the Company may transfer personal data to the Ministry of Health, USHAŞ, public and private hospitals, private clinics, medical centres, polyclinics, physicians, laboratories, diagnostic and medical imaging centres and other authorized healthcare service providers.

Such transfers shall be carried out for purposes including diagnosis, treatment, medical follow-up, care, rehabilitation, coordination of healthcare services, fulfilment of legal obligations or other lawful purposes and shall in all cases be connected with, limited to and proportionate to the relevant processing purpose.

The Company undertakes to take all necessary measures to protect the privacy, personal data and health information of data subjects throughout all stages of service provision and the treatment process.