PERSONAL DATA PROTECTION AND PROCESSING NOTICE

In this Privacy Policy and Clarification Text, the principles regarding the processing of your personal data by the data controller DR. FATİH SÖYLEMEZ, in compliance with the Law No. 6698 on the Protection of Personal Data (“Law”) and the relevant legislation, are set forth below.

---

1. Processing of Personal Data

Your personal data are processed by the data controller DR. FATİH SÖYLEMEZ in accordance with the requirements of current technology and as required by the nature of the business, in the manners specified below.

---

2. About the Data Controller

As DR. FATİH SÖYLEMEZ Plastic Reconstructive and Aesthetic Surgery Clinic, we fulfill our responsibilities regarding the collection, purpose of use, processing, transfer, retention period, confidentiality, and protection of personal data within the scope of the Law No. 6698 on the Protection of Personal Data and related legislation.
For this purpose, we take the highest level of security measures and inform you about your rights, as we attach great importance to the protection of your personal data.
All personal data shared by our patients are preserved with utmost care for patient confidentiality, and all necessary technical and administrative measures are taken to ensure an appropriate level of data security.

This Personal Data Protection Notice explains how we collect, use, transfer, and protect your personal data during the provision of our services.

---

3. Recipients of Processed Personal Data and Purpose of Transfer

Within the scope of diagnostic and treatment services, your data may be transferred, in accordance with the Law, to the Ministry of Health, healthcare institutions, medical associations, business partners, suppliers, and, in exceptional cases, to private individuals.
The purposes of transferring personal data are parallel to the purposes of processing such data.

---

4. Method and Legal Basis for Collecting Personal Data

Your personal data are collected by our Clinic for the purpose of conducting Plastic Reconstructive and Aesthetic Surgery diagnostic and treatment activities, through various methods and in written and electronic form.
Your personal data may be processed and transferred for the purposes specified in this Clarification Text, in accordance with the fundamental principles, processing conditions, and exceptions stipulated under the Law.

---

5. Identity of the Data Controller

Pursuant to the Law No. 6698 on the Protection of Personal Data (hereinafter referred to as “PDPL”), which entered into force on April 7, 2016, your personal data may be processed by the data controller DR. FATİH SÖYLEMEZ within the scope described below.

---

6. Purposes and Legal Grounds for Processing Your Personal Data

Articles 5 and 6 of the PDPL regulate the conditions for processing personal data and sensitive personal data.
Sensitive personal data are explicitly limited under the Law and include information on individuals’ race, ethnic origin, political opinion, religion, sect or other beliefs, appearance and attire, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

Under Article 5, non-sensitive personal data may be processed under the following conditions:

• The data subject has given explicit consent.
• Data processing is expressly permitted by law.
• It is necessary to process data for the protection of life or physical integrity of the person or another person who is unable to express consent due to physical impossibility or whose consent is not legally valid.
• It is necessary to process personal data of the parties to a contract, provided that it is directly related to the conclusion or performance of the contract.
• It is necessary for the data controller to fulfill its legal obligations.
• The personal data have been made public by the data subject.
• It is necessary for the establishment, exercise, or protection of a right.
• It is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Under Article 6, sensitive personal data may be processed under the following conditions:

• The data subject has given explicit consent.
• For sensitive personal data other than those related to health and sexual life (such as race, ethnic origin, political opinion, religion, sect, beliefs, attire, association/foundation/trade union membership, criminal record, security measures, biometric and genetic data), processing is permitted by law.

Within these conditions, your personal data may be processed for the following purposes:

• Fulfilling our legal obligations under the relevant regulations,
• Protection of public health, preventive medicine, medical diagnosis, treatment and care services, and management of healthcare services and their financing,
• Providing information regarding your appointment,
• Planning and managing the internal operations of DR. FATİH SÖYLEMEZ,
• Conducting analyses to improve our services,
• Performing billing operations,
• Verifying your identity,
• Verifying your relationship with contracted institutions,
• Responding to requests from the Ministry of Health and other public authorities as required by law,
• Responding to your questions or complaints regarding our services,
• Analyzing your use of healthcare services to improve our services,
• Ensuring compliance with DR. FATİH SÖYLEMEZ’s internal policies and principles,
• Measuring and improving patient satisfaction following the receipt of healthcare services,
• Contacting you for informational purposes related to our services,
• Procuring medications or medical devices, archiving and processing data within the above-mentioned purposes under appropriate security, confidentiality, and legal safeguards.

Your personal data will not be used for any commercial purpose other than the activities and legal requirements specified above.

---

7. Personal Data Collected by Dr. Fatih Söylemez

Within the scope of the healthcare services we provide, we collect various types of information from our patients.
Such information is collected in full compliance with the data processing principles and conditions set forth under the PDPL.

The personal data we may collect from you include, but are not limited to:

• Name, surname, Turkish ID number, passport number, place and date of birth, gender, address, phone number, email address, patient protocol number assigned by DR. FATİH SÖYLEMEZ, payment and billing information, private health insurance or Social Security Institution data, biometric data financed by the SSI, medical examination, X-ray, tomography, and prescription data, and all other health-related information,
• Pre- and post-operation photographs or recordings,
• Voice recordings in case of communication by phone,
• CCTV footage during your visit,
• Vehicle license plate information when using parking/valet services,
• Health and identity information shared through online services on our website,
• Other data you share via email, website, social media, call center, or other channels.

---

8. Persons and Institutions to Whom Personal Data May Be Transferred and Purposes of Transfer

In order to fulfill our legal obligations arising from the Law No. 3359 on Basic Health Services, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliates, the Regulation on Private Hospitals, the Regulation on Processing and Protecting the Privacy of Personal Health Data, the Regulation on Deletion, Destruction, or Anonymization of Personal Data, and other relevant legislation;

Your personal data may be transferred, ensuring the necessary technical and administrative measures are taken to maintain an appropriate level of security, for the purposes of:

• Enabling the relevant departments to carry out necessary work for the provision of products and services,
• Managing administrative and financial operations of our clinic,
• Ensuring and supervising physical security in clinic buildings,
• Managing legal, financial, and administrative compliance processes.

Accordingly, personal data may be transferred to institutions and organizations authorized under the applicable legislation (e.g., Turkish Medical Association, Istanbul Provincial Health Directorate, Turkish Dental Association, Social Security Institution, relevant Ministries, judicial authorities), private insurance companies, subsidiaries and affiliates, auditors, consultants, business partners, domestic and/or international organizations, and other third parties in accordance with Articles 8 and 9 of the PDPL.

---

9. Method and Legal Basis for Collecting Personal Data

Your personal data are collected for the purposes described above, to enable the provision of our services, and to allow our Clinic to properly and accurately fulfill its contractual and legal obligations.
Collected data are processed and transferred in accordance with Articles 5 and 6 of the PDPL and for the purposes stated in Articles 2 and 4 of this Clarification Text.

Your data may be collected through verbal (e.g., statements), written (e.g., tests, application forms, consent forms), or electronic means such as call center conversations, identification documents, website, social media channels, mobile applications, and existing camera recording systems.

---

10. Your Rights Regarding Your Personal Data

Under Article 11 of the PDPL, you have the following rights by applying to the data controller:

• To learn whether your personal data are processed,
• To request information if your personal data have been processed,
• To learn the purpose of processing your personal data and whether they are used appropriately,
• To learn the third parties to whom your personal data are transferred domestically or abroad,
• To request correction if your personal data are incomplete or incorrectly processed, and to request that such corrections be notified to third parties to whom your data have been transferred,
• To request deletion or destruction of your personal data if the reasons requiring their processing no longer exist, and to request notification of such action to third parties,
• To object to the occurrence of a result against you by analyzing processed data exclusively through automated systems,
• To request compensation for damages if you suffer harm due to unlawful processing of your personal data.

Pursuant to Article 13(1) of the PDPL, you may submit your requests regarding the above rights, including your identity verification information and your explanation of the right you wish to exercise, to the address:

Suadiye Mh. Bağdat Cd. Küçükağa Sk. Naim Bey Apt. No: 2/6 Kadıköy / ISTANBUL
by delivering them in person with identification documents,
via notary public,
or by sending the relevant form signed with a secure electronic signature to info@fatihsoylemez.com.tr.

Depending on the nature of your request, your applications will be finalized free of charge within no later than thirty (30) days. However, if the process incurs an additional cost, our Clinic reserves the right to charge a fee according to the tariff determined by the Personal Data Protection Board.

---

I HAVE READ AND BEEN VERBALLY INFORMED ABOUT THIS CLARIFICATION TEXT.