Patient Information Text in accordance with the Law on the Protection of Personal Data

White Vibes Uluslararası Sağlık Turizmi İthalat İhracat ve Ticaret Limited Şirketi respects your privacy and attaches importance to your data security. In this context, this information text has been prepared by us for the purpose of informing you within the framework of the Law on the Protection of Personal Data No. 6698 (“Law” or “LPPD”) and other relevant legislation.

White Vibes Uluslararası Sağlık Turizmi İthalat İhracat ve Ticaret Limited Şirketi, which has the capacity of Data Controller, can record, store, update your personal data as explained in this Information Text, and share such information with, communicate the same to, third parties (relatives of the person receiving the service and/or public and/or private law legal entities of which the service recipient is an employee / or insured, other public and/or private law legal entities, and third parties from which our company receives services or with which it cooperates in order to carry out its activities subject to the purposes specified in the legislation to which it is subject) in cases permitted and/or required by legislation or agreements and classify such information and process the same in such ways as are listed in LPPD and relevant legislation.

Out of the sensitive personal data, the health data of the persons concerned may, without seeking the explicit consent of the relevant person, be processed by persons under the obligation of confidentiality or authorized institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, carrying out the treatment and care services, planning health services and financing and management purposes, without seeking the explicit consent of the related person. Otherwise, your explicit consent will be obtained for the relevant data.

Besides, regardless of the type, all sensitive personal data of specific character can only be processed in accordance with the law, if adequate measures determined by LPPD are taken. Your Private Personal Data is processed by us in accordance with the legislation.

Identity of Data Controller

As White Vibes Uluslararası Sağlık Turizmi İthalat İhracat ve Ticaret Limited Şirketi, we present the following subjects to your information within the scope of our obligation to inform you in relation to your personal data obtained by us as data controller in accordance with the Article 10 of the Law on the Protection of Personal Data No. 6698 and the Communiqué on the Procedures and Principles to be followed in the Fulfillment of the Obligation to Inform.

Processed Personal Data and Purpose of Processing Personal Data

We, as White Vibes Uluslararası Sağlık Turizmi İthalat İhracat ve Ticaret Limited Şirketi, may need to learn your personal information and health data, record and store them within the limits required by the service to be provided in order to carry out the services we will provide to you.

In this context, the main general and personal data of specific nature, especially the personal health data required for the execution of all medical diagnosis, examination, treatment, care and accommodation services and obtained for this purpose, are listed below:

Due to the service you receive from us, the following personal data are processed:

• Your identity data: Your personal data such as your Name, Family Name, Republic of Türkiye Identity Number, passport number or temporary Republic of Türkiye Identity Number if you are not a Turkish citizen, place and date of birth, marital status, gender information and the copy of your Republic of Türkiye Identity Card or Driver’s License, your signature and other identification data that identifies you;
• Your Contact Information: Address, Telephone number, E-mail address and other contact data belonging to you;
• Your Health Information: Your information including, but not limited to, the laboratory and imaging results, test results, examination data, prescription information, all health data that you have conveyed to our company officials and employees via message, e-mail or other communication channels, and during the conduct of medical diagnosis, treatment and care services, as well as your health and sexual life data obtained;
• Genetic Data: Your genetic data that can be obtained as a result of biopsy and similar applications performed in our center;
• Your Financial and Insurance-Related Data: Your bank account number, IBAN number, credit card information, financial data required for issuing invoices, SSK or private insurance data;
• Your personal data obtained during the website visit: log information, cookies, etc. records; and
• Visual and audio recordings: Your visual and audio data obtained with the cameras in our company during your visit to our company and clinic.

Such personal data of yours is processed for the following purposes:

• Being able to benefit from the services offered to you by our company;
• Identification and verification;
• Protection of public health, preventive medicine, medical diagnosis, treatment and care services;
• Planning and management of health services and financing;
• Fulfillment of legal obligations within the framework of the Basic Law on Health Services No. 3359, the Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Organizations, the Regulation on Private Hospitals, the Law on the Protection of Personal Data No. 6698, the Regulation on the Processing of Personal Health Data and the Provision of Privacy and other relevant legislation;
• Planning and managing the internal functioning of our company and clinic and daily operations;
• Supply of medicines and/or medical supplies and/or devices specific to patients;
• Informing the patients about the appointment in case of making an appointment, providing information and/or reminding the appointment;
• Carrying out risk management and quality improvement activities;
• Conducting analysis for the purpose of improving health services;
• Financing your health services, meeting your examination, diagnosis and treatment expenses and sharing the requested information with private insurance companies within the scope of financing health services;
• Analyzing the use of health services and storing your health data, responding to your questions or complaints about our services in order to develop and improve the health services offered by us;
• Execution of patient relationship management processes;
• Realization of finance, accounting and invoice processes;
• Execution of the process with private insurance companies in order to finance the services;
• Follow-up of request/complaint processes;
• Execution of contract processes;
• Execution of your accommodation and transfer transactions;
• Taking any and all necessary technical and administrative measures within the scope of data security of our clinic’s systems and applications, developing and improving the health services we provide;
• Providing information on developments in the health institution, newly applied treatment methods, service areas and services to be provided, opening information and similar issues;
• Giving information to authorized persons and institutions;
• Creation and follow-up of visitor records; and
• Ensuring physical space security of our Company and carrying out audit activities.

Transfer of Personal Data and Purpose of Transfer

Such personal data may, limited to and to the extent of the LPPD and relevant health legislation, be transferred with the purposes explained in the second article of this Information Text to private insurance companies, Ministry of Health and its subordinate units, Social Security Institution, General Directorate of Security and other law enforcement forces, General Directorate of Civil Registry, Pharmacists Association of Türkiye, Courts and any and all kinds of judicial authorities, central and other third parties, your authorized representatives, attorneys to whom you give power of attorney on the subject, our business partners with whom we provide transfer and accommodation services, tax and financial advisors and third parties we receive consultancy from, including auditors, regulatory and supervisory institutions, our business partners with whom we cooperate in order to develop or carry out health services for the above-mentioned purposes, including official authorities, health institutions and physicians under the obligation of confidentiality who receive support during diagnosis/treatment services, and third parties in the country and abroad as specified in Articles 8 and 9 of the Law within the framework of the personal data transfer conditions and purposes.

Personal Data Collection Method and Legal Reason thereof

Your personal data may be collected by automatic or non-automatic methods, by telephone, WhatsApp, our corporate e-mail account, our website, by communication of personal data by business partners, laboratory, third parties such as other physicians under the obligation of confidentiality (within the scope of your consent you have previously provided), by filling in printed texts in our workplace and similar verbal, written or electronic methods. Your personal data may be updated and processed as long as your relationship with the company continues and may be kept under protection in both digital and physical environments.

Such personal data will be processed based on the legal reasons of explicit consent in case it is clearly stipulated in the laws as referred to in article five of the Law, it is obligatory for the performance of the contract, the legal obligation of the data controller, protection of the life or physical integrity of the person himself/herself or another person, who is unable to express his or her consent due to actual impossibility, exercise or protection of a right, and in case of legal benefit of the data controller and you giving your explicit consent.

Your personal data of specific nature related to your health information will be collected only by authorized persons under the obligation of confidentiality in accordance paragraph 3 of Article 6 of the Law No. 6698 for the purpose of protecting public health, conducting preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing, and if necessary, and be processed based on the legal reason of explicit consent.

Data Processing and Retention Period

In the event that the reasons for processing your personal data disappear, it will be subject to one of the processes of deletion, destruction or anonymization in accordance with the LPPD and relevant legislation and in accordance with our Company’s storage and destruction policy.

Your personal data will be processed in compliance with the data processing and prescription periods in all relevant laws and other legal regulations to which our Company is subject, limited to the purposes specified in this Information Text. In case of changes in the laws regarding data processing periods, the new determined periods will be taken as basis.

As a requirement of the purpose-limitation principle, your personal data is processed for a limited period of time that requires the fulfillment of the purposes described in this Information Text and in any case in accordance with the practices of our Center and the practices of its commercial life, and after the expiry of the deadlines, is deleted, destroyed or anonymized.

Your Rights Regarding the Protection of Personal Data

The “relevant persons” whose personal data are processed have the following rights:

a. Learning whether personal data has been processed or not;

b. If personal data has been processed, requesting information about it;

c. Learning the purpose of processing personal data and whether they are used in accordance with the purpose;

d. Knowing the third parties to whom personal data is transferred at home or abroad;

e. Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the procedure made within this scope to the third parties to whom the personal data has been transferred;

f. Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist despite the fact that it has been processed in accordance with the provisions of the LPPD and other relevant laws, and requesting the notification of the procedure made within this scope to the third parties to whom the personal data has been transferred;

g. Objecting to this result if a result against the person arises by analyzing the processed data exclusively through automated systems; and

h. Claiming compensation of the damage in case of loss due to unlawful processing of personal data.

Exercising the Rights of the Relevant Person:

The persons whose personal data are processed may submit their requests regarding their rights specified in the information text, with the information and documents that will indicate their identity, and with the methods specified below or other methods determined by the Personal Data Protection Board, to White Vibes Uluslararası Sağlık Turizmi İthalat İhracat ve Ticaret Limited Şirketi free of charge.

Your requests within the scope of the eleventh article of the Law, which regulates the rights of the person concerned, can be sent by you to our Company at the address Gençlik Mahallesi Tevfik Işık Caddesi Cumhuriyet Apt. No:15/2 Muratpaşa/ANTALYA in person or via registered letter with return receipt through a notary public, or by using secure electronic signature, mobile signature or the e-mail address previously notified by you and registered in our system, by e-mail toinfo@whitevibesdental.com.

In order for the above-mentioned application to be considered a valid application, the applicant is required to specify the following in his/her application in accordance with the Communiqué on Application Procedures to the Data Controller:

a) Name, family name and signature if the application is written;

b) For citizens of the Republic of Türkiye, Republic of Türkiye identity number, nationality for foreigners, passport number or identification number, if any;

c) Domicile or workplace address for notification purposes;

ç) If available, the e-mail address, telephone and fax number for notification,

d) The subject of the request,

Otherwise, the application will not be considered a valid application.

Our company always reserves the right to make changes in the information text for reasons arising from the Law, secondary regulations and Board decisions. Changes to be made to the information text and the updated text will become effective immediately as of the date they are notified to you.

I acknowledge hereby that I have read and understood the Information Text consisting of 6 headings in 5 pages prepared by White Vibes Uluslararası Sağlık Turizmi İthalat İhracat ve Ticaret Limited Şirketi on the Processing of Personal Data, and been informed of the purpose of processing my personal data in detail in the Information Text on the Processing of Personal Data, the institution, organization, company and healthcare professionals to which/whom it is transferred, the methods of collection and legal reasons thereof, my rights to protect my personal data, data security as well as my right to file application.

PATIENT/PARENT/LEGAL REPRESENTATIVE/GUARDIAN

(SIGNATURE)