Protection of Personal Data

As Büyük Anadolu Hospitals Group, we attach great importance to the security of your personal data. The titles of the legal entities operating each of our hospitals are given below:

• Hospital / Operator Legal Entity
• Büyük Anadolu Hospitals Central Hospital-Samsun / Hospitalpark Sağlık Hizmetleri A.Ş.
• Büyük Anadolu Hospitals Meydan Hospital-Samsun/Hospitalpark Sağlık Hizmetleri A.Ş.
• Private Hospitalpark Darıca Hospital-Kocaeli/ Akasya Health Services and Devices İnş.San.Tic.Ltd.Şti

We keep all kinds of personal data shared by our patients, taking care of patient privacy and taking all necessary technical and administrative measures to ensure the appropriate level of security for your personal data. This Information on Protection of Personal Data explains processing policy and how we collect, transfer, use and protect your personal data during the services performed by the Group.

PERSONAL DATA COLLECTED BY THE GROUP

We collect various information from our patients within the framework of the health services we provide. The said information is collected in accordance with the data processing principles and conditions in the Law on the Protection of Personal Data No. 6698 ("KVKK") under all circumstances. The information we collect from you for the purposes described in Section 2 below may include:

• Your name and your surname,
• T.C. your identity information, your passport number,
• your place and date of birth,
• your gender,- your address,
• Your telephone number,
• E-Mail Address,
• Your patient protocol number assigned to you by the group,
• Your financial data such as payment and billing information,
• Your private health insurance or Social Security Institution data,
• Your biometric data within the scope of services financed by the Social Security Institution,
• Your health data, including but not limited to your laboratory results, test results, examination data, check-up information, prescription information,
• If you communicate with us, your voice recording,
• Your closed-circuit camera system video recording during your visit to our hospitals,
• If you use the car park/valet service, give your license plate,
• Your health data and identity information that you share when you use the online services on our buyukanadolu.com.tr website,
• Your other data that you share when you contact us via e-mail, call center or other channels.

PURPOSES OF PROCESSING YOUR PERSONAL DATA

The personal data we collect as part of the services you receive from us are processed for various purposes, including:

a. To fulfill our legal obligations in the Health Services Basic Law No. 3359, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliates, Regulation on Private Hospitals, Regulation on the Processing and Privacy of Personal Health Data and other relevant regulations;

b. protection of public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and financing;

c. providing you with information about your appointment if you have made an appointment;

D. Planning and managing the internal workings of the Group,

to. analyze to improve our services;

f. billing;

g. verifying your identity;

h. verification of your relationship with contracted institutions;

I. responding to the requests of the Ministry of Health and other public institutions and organizations in accordance with the applicable legislation;

j. responding to your questions or complaints about our services;

k. analyze your use of healthcare services to improve the services we offer;

l. Complying with the Group's internal policies and principles;

m. measuring patient satisfaction and increasing patient satisfaction after receiving health services;

n. contacting you for information purposes regarding our services;

He. supply of drugs or medical devices. However, your personal data will not be used for commercial purposes in any way, except for the activities listed above and as required by the relevant legislation.

Persons and Organizations To Which Your Personal Data Can Be Transferred

By ensuring that all necessary technical and administrative measures are taken to ensure the appropriate level of security in accordance with the KVKK and the relevant health legislation, in line with the purposes set out in Section 2 above; Institutions or organizations permitted by the Health Services Basic Law No. 3359, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliates, Regulation on Private Hospitals, Regulation on the Processing and Privacy of Personal Health Data and other relevant legislation; private insurance companies; our direct/indirect domestic/foreign shareholders, subsidiaries and/or affiliates; our group companies; auditors; consultants; work partners; We may transfer it to domestic/foreign organizations and other third parties from which we contractually receive services, cooperate, to carry out our activities.

Method and Legal Reason for Personal Data Collection

Your personal data is collected in all kinds of verbal, written or electronic media within the scope of the above-mentioned purposes and in order for the Group to fulfill its contractual and legal obligations.

Your Rights Regarding Your Personal Data

To the extent that your personal data is processed by the Group in the capacity of data controller, in accordance with Article 11 of the KVKK, by filling in the "KVKK Access / Information Request Form" below and delivering it by hand to the hospital address you received service or sending it through a notary public, your personal data;

a) learning whether any of your personal data has been processed;

b) requesting information regarding the processing activities of your personal data;

c) learning the purposes of processing your personal data;

d) learning about third parties in case personal data has been transferred to third parties in the country or abroad;

e) request correction of personal data if it is incomplete or incorrectly processed;

f) to request the deletion or destruction of personal data in case the reasons requiring the processing of personal data disappear or the Group does not have a legal basis or legitimate interest to process the said data;

g) objecting to adverse results that may arise as a result of processing personal data through automated systems, and;

h) You have the right to demand compensation for any damage caused by the unlawful processing of your personal data.

The Group will conclude the request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires a separate cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by the Group.