Patient and Representative Clarification Text

This text has been prepared to inform you about which personal data is processed by the data controller, for what purpose, how, and for what reason, with whom it is shared, and how long it is stored. The information is provided within the scope of Article 10 of the Law on the Protection of Personal Data No. 6698 ('PDPL').

PRIVATE LOTUS HOSPITAL ('Workplace'); as prepared in accordance with Article 10 of the PDPL, we present this clarification text containing information regarding the personal data processing processes specific to the creation of patient records and the provision of health services to the public and relevant persons.

ARTICLE 1: DATA CONTROLLER

Your personal data may be processed by PRIVATE LOTUS HOSPITAL in the capacity of data controller within the scope explained below. The data controller is the real or legal person who determines the purposes and visual aspects of processing personal data and is responsible for the establishment and management of the data recording system.

• Address: Şenevler Mah. Şanlıurfa-Diyarbakır Yolu No:142, 63320 Karaköprü / Şanlıurfa
• Phone: 444 1 587
• Email: bilgi@lotushastanesi.com
• Website: www.lotushastanesi.com
• Contact Person: Baran Kahyaoğlu

ARTICLE 2: PROCESSED PERSONAL DATA AND PROCESSING PURPOSES

The person referred to as the 'patient' in this text is the person who receives the product or service in a technical sense; the term patient used throughout the text should be considered in this context.

The categories of personal data belonging to patients and patient representatives processed by us and the processing purposes are below:

• a) Contact Information (phone, address, email, etc.):
  Follow-up and execution of legal affairs, carrying out activities in accordance with legislation, performance of service, execution of patient communication and information processes, marketing activities (only if explicit consent is given), execution of after-sales support services.
• b) Identity Information (name, surname, ID number, birth date, etc.):
  Fulfillment of legal obligations, execution of activities in accordance with legislation, performance of service, making official institution notifications.
• c) Professional Experience Information (if any):
  Execution of marketing processes.
• d) Health Information (Sensitive Personal Data):
  Execution of medical diagnosis, treatment, and care services, planning and management of health services, providing information to authorized persons, institutions, and organizations per legislation, offering services securely and fully.

ARTICLE 3: PARTIES TO WHOM PERSONAL DATA MAY BE TRANSFERRED

Personal data subject to this clarification text; to fulfill legal obligations and provide health services, in accordance with Articles 8 and 9 of the PDPL, may be transferred to the following parties:

• Social Security Institution (SGK)
• Private insurance companies
• Authorized public institutions and organizations
• Suppliers and service providers (laboratory, imaging, etc.)

Note: Professional experience data is not transferred to third parties.

Transfer of Personal Data Abroad

The following services are provided through service providers whose servers are located abroad. Such transfers are made in accordance with Article 9 of the KVKK, on the condition that you have given explicit consent for the relevant service or that appropriate safeguards provided for in the Law (e.g. standard contractual clauses) are in place.

• Web analytics (Google Analytics, Google LLC): only if you consent to analytics cookies in the cookie notice; visit statistics, device/browser information and truncated IP address.
• Corporate e-mail and office infrastructure (Google Workspace): applications and correspondence you send by e-mail.
• Website live support assistant: if you additionally give explicit consent when starting a chat, your messages are transferred to an artificial intelligence service provider abroad to generate replies. If you do not consent, your messages are answered only by our staff and are not transferred to the AI service.
• WhatsApp (Meta Platforms): only if you choose this channel yourself to contact us; the message you send and your phone number.
• Hosting, infrastructure and information security service providers: technical data required for the website and services to operate.

You may withdraw your explicit consent at any time; withdrawal takes effect for processing after the date of withdrawal.

ARTICLE 4: PERSONAL DATA COLLECTION METHODS AND LEGAL REASONS

Personal data of patients is collected through the following channels:

• Filling out patient registration forms physically
• Verbal declaration
• Online appointment and application forms
• Call center and digital communication channels

Legal reasons:

• PDPL Art.5/2-f: Legitimate interests of the data controller
• PDPL Art.5: Explicit consent (for marketing activities)
• PDPL Art.6/3: Processing of health data by persons or authorized institutions under confidentiality obligation for medical diagnosis, treatment, and care services

ARTICLE 5: RETENTION PERIOD OF PERSONAL DATA

The personal data in this text is stored for the periods stipulated in the legislation and destroyed properly when the period expires.

• Contact Information: 10 Years
• Identity Information: 10 Years
• Professional Experience Information: 10 Years
• Health Information: 20 Years

ARTICLE 6: RIGHTS OF THE DATA SUBJECT

In accordance with Article 11 of the PDPL, subjects have the following rights:

• Learning whether personal data is processed,
• Requesting information if it has been processed,
• Learning the purpose of processing and whether it's used properly,
• Knowing third parties to whom it's transferred,
• Requesting correction if incomplete or incorrect,
• Requesting deletion or destruction,
• Objecting to unfavorable outcomes via automated systems,
• Requesting compensation for damages effectively.

Requests can be sent to Private Lotus Hospital via the communication channels specified.