Privacy Notice within the Scope of the Law on the Protection of Personal Data No. 6698 for Patients/Service Recipients

Purpose and Scope of the Privacy Notice

As AKCEYLAN CEYLAN ORAL AND DENTAL HEALTH SERVICES CO. LTD., we take necessary precautions to protect your personal data under the Law on the Protection of Personal Data No. 6698 (“KVKK” or “Law”). We process your personal data in accordance with KVKK and related legislation, acting as a “data controller” for the reasons and methods explained below.

This Privacy Notice regarding the Processing of Personal Data by AKCEYLAN CEYLAN ORAL AND DENTAL HEALTH SERVICES CO. LTD. has been prepared to inform you in the most transparent way possible about the identity of the data controller, the method and legal basis of collecting personal data, the purposes for processing these data, to whom and for what purposes they may be transferred, the data processing period, and your rights as listed in Article 11 of KVKK. The statements regarding your “Personal Data” in this Privacy Notice also cover your “Special Category Personal Data.”

Data Controller

Company Name: AKCEYLAN CEYLAN ORAL AND DENTAL HEALTH SERVICES CO. LTD.
Address: ATALAR MAH. USKUDAR CAD NO:73/J KARTAL/ISTANBUL
(Referred to as the “Company” in this Privacy Notice.)

Method and Legal Basis of Collecting Your Personal Data

Your personal data may be collected through automatic or non-automatic methods, via company branches, the website, social media platforms, call centers, mobile applications, software used to carry out activities within the company, and through verbal, written, or electronic methods. Your personal data may be processed and updated during the course of your relationship with the Company and may be stored both digitally and physically.

Your personal data will be processed for the purposes specified under the heading “Purposes for Processing Your Personal Data” in accordance with Article 5(1) of the Law, upon obtaining your explicit consent, or in the cases specified under Article 5(2), which include:

• a) Explicit stipulation by laws,
• b) Being necessary to protect the life or physical integrity of the person or another person when the person concerned is unable to express consent due to physical impossibility,
• c) Necessity for the processing of personal data for the execution or performance of a contract,
• ç) Necessity to fulfill the legal obligations of the data controller,
• e) Necessity for the establishment, use, or protection of a right,
• f) Necessity for data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the individual.

Special Conditions for Processing Sensitive Personal Data

Special category personal data such as “union membership, association membership” outside of health and sexual life will only be processed to benefit from specific discounts through company agreements with unions and associations, based on your explicit consent or in legally required cases under Article 6(2) and 6(3) of the Law.

Sensitive personal data regarding “religion” will be processed to determine your preferences related to blood transfusion or to manage the medical process considering your sensitivities, based on explicit consent or in legally required cases under Article 6(3).

Your health-related sensitive personal data will be processed under the purposes specified in the “Purposes for Processing Your Personal Data” section, based on your explicit consent or only by authorized individuals bound by confidentiality obligations, for purposes such as public health protection, medical diagnosis, treatment, and management of healthcare services.

Processed Personal Data

Your personal data will be processed securely, in compliance with the Personal Data Protection Law, for legal obligations or to provide better services.

Personal data may include:

• Identity: Information about a person’s identity (e.g., Name, Surname, Date/Place of Birth, National ID Number, Gender, Social Security Number, Nationality, Marital Status).
• Contact: Data used to contact the person (e.g., Phone Number, Residential Address, Email Address).
• Physical Security: Data such as camera recordings (e.g., Security camera footage).
• Transaction Security: Data such as IP addresses, website login details, and security keys.
• Finance: Financial information (e.g., Bank Account Number, IBAN).
• Visual and Audio Data: Photos, audio recordings, or camera footage.
• Health Information: Medical history, treatment methods, test results, medications used, and more.
• Biometric/Genetic Data: Biometric data like fingerprints or genetic information.

When your religious information is processed due to preferences related to blood transfusion, it may also include:

• Religion: Information about a person’s religion.

In case of discounts through company agreements with unions or associations, additional data may include:

• Union Information: Details about union membership.
• Association Information: Details about association membership.

Purposes for Processing Personal Data

Your personal data will be processed for purposes such as:

• Carrying out necessary work by relevant business units to allow individuals to benefit from the products and services offered by the Company,
• Ensuring the safety and legal security of real and legal persons connected to the Company,
• Storing camera footage for security purposes,
• Conducting appointment activities through the website,
• Ensuring patient safety, treatment, and care services,
• Managing daily operations and ensuring legal compliance.

Transfer of Processed Personal Data

Your personal data may be shared with:

• Authorized public institutions and organizations for legal purposes,
• Insurance companies and banks for financial services,
• Lawyers for legal matters,
• Domestic and international organizations with whom we have a contractual relationship.

Data Retention Period

Your personal data will be processed in accordance with legal time limits and business needs, after which they will be securely deleted, destroyed, or anonymized when no longer necessary.

Rights of the Data Subject

You can exercise your rights under Article 11 of the KVKK by submitting a written application to “ATALAR MAH. USKUDAR CAD NO:73/J KARTAL/ISTANBUL” or sending an email to info@ovadis.com.tr if your email is registered with the Company, or to akceylan.ads@hs01.kep.tr via registered electronic mail.