INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

Pursuant to the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Regulation on the Processing of Personal Health Data and Ensuring Privacy, Rebirthian hereby provides this Information Notice in order to inform patients and service recipients regarding the processing of their personal data in compliance with the relevant legal provisions.

Except for cases where the processing and transfer of personal data are required to the extent necessary for the protection of public health, medical diagnosis, examination, treatment and healthcare services, we hereby request your explicit consent for the matters specified below.

1. Collection and Processing of Personal Data

I have been duly informed, by reviewing the Patient / Service Recipient Information Notice on the Protection of Personal Data provided to me, that my personal data may be collected verbally, in writing, visually or electronically, depending on the nature of the healthcare services provided, in order to deliver high-quality medical services.

Within this scope, primarily my personal health data required for the execution of all medical diagnosis, examination, treatment and care services, as well as the general and special categories of personal data obtained, include but are not limited to the following:

• Identity Information: Name, surname, Turkish Republic ID number, driver’s license copy, passport number or temporary Turkish ID number, place and date of birth, marital status, gender, insurance or patient protocol number, and other identifying information.
• Contact Information: Residential address, telephone number, e-mail address and other contact details; call center voice recordings kept in accordance with customer service standards; personal data obtained through communication via e-mail, letters or other communication channels.
• Financial Information: Bank account number, IBAN, credit card details, invoicing information and other financial data.
• Physical Space Security Data: Camera and photographic records maintained for security purposes during clinic visits; vehicle license plate data and related image records obtained when using parking or valet services.
• Closed-Circuit Camera System (CCTV) Records: Visual recordings captured within clinic premises.
• Health Information: Personal health data obtained during all medical diagnosis, examination, treatment and care services, including but not limited to appointment and examination records, laboratory and test results, check-up reports, prescriptions, and consent form data related to medical interventions.
• Additional Data: Survey, suggestion, satisfaction, appreciation and complaint records; browsing data obtained through website contact forms, website and mobile application usage; IP address, Wi-Fi data, browser information; medical documents voluntarily submitted by me; insurance and private healthcare financing data.

2. Purposes of Processing Personal Data

I have been informed that my personal data and special category personal data may be processed for the following purposes:

Fulfillment of legal obligations arising from:

• Law No. 3359 on Fundamental Health Services
• Decree Law No. 663 on the Organization and Duties of the Ministry of Health and Its Affiliates
• Law No. 1593 on Public Health
• Patient Rights Regulation
• Regulation on Private Hospitals
• Regulation on Personal Health Data
• Other applicable legislation

Additional processing purposes include:

• Protection of public health; preventive medicine; medical diagnosis, treatment and care services; planning and management of healthcare services and financing
• Procurement of medicines, consumables and specialized medical materials
• Providing appointment-related notifications; identity verification; invoicing processes; planning, monitoring and management of healthcare operations
• Financial reconciliation with contracted institutions related to healthcare services
• Responding to lawful requests from public authorities
• Measuring and improving patient satisfaction following healthcare services
• Responding to all inquiries and complaints; providing information regarding received services
• Development and implementation of quality management processes
• Analysis and improvement of healthcare service utilization
• Informing patients about campaigns and promotional activities through various communication channels

The above-listed purposes are not exhaustive, and personal data may be processed, recorded, stored, preserved, classified and transferred where necessary in accordance with applicable legislation, particularly in matters related to public security and potential legal disputes, including disclosure upon lawful request to public prosecutors, courts, judicial authorities, the General Directorate of Civil Registration, Turkish Medical Association, Turkish Pharmacists’ Association and other competent authorities.

3. Methods and Legal Grounds for Collecting Personal Data

I acknowledge that the legal basis for the collection of my personal data is derived from:

• Turkish Personal Data Protection Law No. 6698
• Law No. 3359 on Fundamental Health Services
• Decree Law No. 663
• Regulation on Private Hospitals
• Regulation on the Processing and Protection of Personal Health Data
• Ministry of Health regulations and other applicable legislation

My personal data are processed within the scope of Articles 5 and 6 of Law No. 6698 on the following legal grounds:

• Explicitly stipulated by law
• Necessity for the establishment or performance of a contract
• Protection of life or physical integrity where consent cannot be obtained
• Fulfillment of legal obligations of the data controller
• Legitimate interests of the data controller, provided fundamental rights are not harmed
• Protection of public health and execution of medical diagnosis, treatment and care services

Data processing is carried out in accordance with the principles of:

• Lawfulness and fairness
• Accuracy and being kept up to date where necessary
• Specific, explicit and legitimate purposes
• Relevance, limitation and proportionality
• Retention for the period required by legislation or processing purpose

Personal data may be processed automatically (e.g. camera recordings) or non-automatically as part of a data recording system (e.g. completed forms). I am aware that, pursuant to Article 6/3 of KVKK, personal health and sexual life data may be processed without explicit consent by authorized persons or institutions under confidentiality obligations, solely for the purposes of protecting public health and providing healthcare services.

4. Transfer of Personal Data

Within the scope of applicable legislation and for the purposes stated above, my personal data may be transferred to:

• Ministry of Health and affiliated units
• Turkish Medical Association
• Turkish Pharmacists’ Association
• General Directorate of Civil Registration
• General Directorate of Security and law enforcement authorities
• Social Security Institution
• Public prosecutors, courts and judicial authorities
• Authorized public institutions and officials
• Domestic and international laboratories, medical centers, ambulances, healthcare providers, referral institutions
• Regulatory and supervisory authorities
• My employer, where invoicing is made to the employer
• Suppliers, support service providers, archive service providers and business partners
• Auditors, online healthcare consultation platforms, private insurance companies, law firms, financial advisors, solution partners and consultants

I acknowledge and approve such transfers.

5. Delivery of Financial Personal Data

I acknowledge and consent that invoices related to online consultations, examinations or follow-up services shall be issued within one month following the service date and transmitted to me via my declared contact details based on the financial information I have provided.

6. Your Rights Regarding the Protection of Personal Data

By approving this Information Notice, I acknowledge that I have the right to:

• Learn whether my personal data are processed
• Request information regarding processed personal data
• Access and request my personal health data
• Learn the purpose of data processing and whether it is used in accordance with such purpose
• Know the third parties to whom my data are transferred domestically or abroad
• Request correction of incomplete or inaccurate data
• Request deletion, destruction or anonymization of personal data
• Request notification of such actions to third parties to whom data have been transferred
• Object to results arising solely from automated data processing systems
• Claim compensation for damages arising from unlawful data processing

I confirm that I have been duly informed of these rights by Rebirthian.

7. Communication and Application

I am aware that I may submit my requests under KVKK by completing the “Application Form Under the Personal Data Protection Law” available at rebirthian.com, and by:

• In Person: Delivering the form to İstanbul, Türkiye
• Via Notary: Sending it via notary public
• Electronically: Submitting it using a secure electronic signature, mobile signature, registered e-mail (KEP), or my e-mail address registered in your systems

I also acknowledge that I will share my personal data through the communication channels I have provided (address, phone number, e-mail and other means) and that feedback may be provided to me through the same channels. I undertake to notify the Data Controller in the event of any changes to my contact information.