UNDER THE LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA KASHKALOGLU EYE HOSPITAL EMPLOYEE CLARIFICATION TEXT

Purpose and Scope of the Clarification Text

As LASER MYOPIA PRIVATE TREATMENT CENTER LIMITED COMPANY (“Kaşkaloğlu Eye Hospital”), we take measures to protect your personal data within the scope of the Personal Data Protection Law No. 6698 (hereinafter referred to as “KVKK” or “Law”). We process your Personal Data within the scope of KVKK and relevant legislation and in our capacity as “data controller” for the reasons and methods described below.

LASER MYOPIA SPECIAL TREATMENT CENTER LIMITED COMPANY Clarification Text on the Processing of Personal Data has been prepared in accordance with the article titled “Data Controller’s Obligation to Inform” in Article 10 of the KVKK: the identity of the data controller, the method and legal reason for collecting your personal data, the purpose for which this data will be processed, to whom and for what purpose it can be transferred, the data processing period and what your rights are listed in Article 11 of the KVKK. The explanations made for your “Personal Data” in the clarification text also cover your “Sensitive Personal Data”.

Method and Legal Reason for Collecting Your Personal Data

Your personal data may be collected verbally, in writing or electronically by automatic or non-automatic methods, through the company’s affiliated units, website, social media channels, call center, mobile applications, software used to carry out activities within the company, camera shooting and verbally, in writing or electronically. Your personal data may be processed by creating and updating as long as your relationship with the Company continues and may be kept in both digital and physical environment.

Your personal data may be processed in line with the purposes set out under the heading “Your Personal Data Processed and the Purposes of Processing” and in accordance with Article 5, paragraph 1 of Article 5 of Law No. 6698, or in accordance with Article 5. specified pursuant to paragraph 2 of this Article;

1. a) Explicitly stipulated in the law,
2. c) Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract,

ç) It is mandatory for the data controller to fulfill its legal obligation,

1. e) Data processing is mandatory for the establishment, exercise or protection of a right,
2. f) Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,

processed within the scope of personal data processing conditions.

Your personal data of special nature processed as “criminal record” other than health and sexual life will be processed in line with the purposes set out in the heading “Your Personal Data Processed and Processing Purposes” and in accordance with Article 6, paragraph 2 of Law No. 6698 and in cases stipulated by law in accordance with paragraph 3 of Article 6.

Your personal data of special nature relating to your health information will be collected for the purposes set out under the heading “Your Personal Data Processed and Purposes of Processing” and for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing by authorized persons who are under the obligation of confidentiality only in accordance with paragraph 2 of Article 6 of Law No. 6698 or in accordance with paragraph 3 of Article 6.

Your Processed Personal Data

Your Personal Data is processed securely in accordance with the Law on the Protection of Personal Data in accordance with legal obligations or in order to provide a more appropriate service in company business and transactions.

In this context, the data in the table are collected as personal data;

Identity: This is the data group containing information about the identity of the person (e.g. Name, Surname, Date of Birth / Place of Birth, Turkish ID Number, Gender, SSI Registration Number, Signature)

Contact: A group of data that can be used to reach the person (e.g. phone number, residential address, e-mail address)

Personnel This data category refers to the data types in the personnel file. (e.g. SSI Employment/Exit Information, Payroll Information, Scorecard Records)

Physical Space Security: This data category refers to data types such as employee entry and exit registration information, camera recordings. (Ex. Camera image records)

Transaction Security: This category of data refers to data types such as IP address information, website login and exit information, password and password information. (e.g. Security keys, Username, User ID, Password, Log records, IP Addresses)

Legal Transaction: This data category includes legal proceedings information of the person. (e.g. Wage Garnishment Information, Enforcement Files and Judicial Case Information)

Finance: It is the data group containing the financial information of the person (e.g. Bank Account Number, IBAN Information).

Professional Experience: It is the data group containing information about the person’s profession (e.g. Course – Certification Information, On-the-Job Training Information, Diploma Information, Foreign Language Information, Professional Title, Education Status).

Visual and Auditory Records: It is the data group containing visual and auditory data of the person (e.g. photograph).

Other It is the data group that contains other data defining the person that is not counted as an example of the person (e.g. Military Service Information, Clothing Body Measurements Information, etc.).

Purposes of Processing Your Personal Data;

• To be able to carry out the necessary work by our relevant business units so that real and / or legal third parties, institutions and organizations (employees, visitors, patients, suppliers, business partners, etc.) who have a relationship with the company can benefit from the products and services of our company and / or the Centers and units affiliated to our company,
• Ensuring the security of life and property, legal, commercial and occupational health and safety of real and/or legal third party institutions and organizations in the centers and units where the company’s business is carried out or affiliated to the company,
• Storage of camera images, ensuring discipline, security and inspections in case you are physically present in the centers and units where the company’s business is carried out or affiliated to the company,
• Labor Law No. 4857, Turkish Code of Obligations No. 6098, Vocational Education Law No. 3308, Occupational Health and Safety Law No. 6331, Personal Data Protection Law No. 6698, Tax Procedure Law No. 213, Social Security and General Health Insurance Law No. 5510, Basic Law on Health Services No. 3359, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Organizations, Regulation No. 29399 on the Improvement and Evaluation of Quality in Health, Regulation on Private Hospitals, Regulation on the Processing of Personal Health Data and Protection of Privacy, Regulation on Archival Services and fulfillment of legal and regulatory requirements arising / may arise from all relevant laws and secondary regulations and taking necessary measures in this context,
• Carrying out auditing and/or regulatory duties to be carried out by the authorized and authorized public institutions and organizations and professional organizations in the nature of public institutions,
• Fulfillment of information and document requests by judicial bodies and/or administrative authorities,
• Execution of all Human Resources processes and policies of our company,
• Planning and management of the financing and invoicing of all services provided,
• Training and development of all employees,
• Fulfillment of requests for participation in organizations such as training, seminars, etc,
• Keeping personnel information accurate and up-to-date in order to protect the rights of our employees and to provide services arising from their rights, so that personnel activities can be carried out more effectively,
• Ensuring occupational health and safety,
• Fulfillment of risk management and quality improvement activities,

for the purposes for which they were intended.

Your Personal Data of Special Nature Processed

Health Information: This is the data group containing the health information of the person (e.g. Blood Type, Medical Background Information, Current Health Information, Health Reports, Disability Information)

Criminal Convictions and Security Measures: It is the data group containing information about the criminal conviction and security measures of the person (e.g. Criminal Record).

Purposes of Processing Your Special Categories of Personal Data;

• Carrying out auditing and/or regulatory duties to be carried out by the authorized and authorized public institutions and organizations and professional organizations in the nature of public institutions,
• Fulfillment of information and document requests by judicial bodies and/or administrative authorities,
• Execution of all Human Resources processes and policies of our company,
• Ensuring occupational health and safety,
• Execution of assignment processes,
• Protection of public health,
• Taking the necessary measures for occupational health and safety within the scope of our obligations arising from the legislation, planning and execution of training processes, early intervention in health-related issues,

for their purposes, will be processed.

To Whom and For What Purpose Your Processed Personal Data Can Be Transferred

By ensuring that all necessary technical and administrative measures are taken to ensure the appropriate level of security in accordance with the KVKK and the relevant health legislation, in line with the above-mentioned purposes;

• To legally authorized public institutions and organizations in line with the requests of the relevant public institutions and organizations and limited to the purposes of the request,
• Insurance companies and banks to ensure the fulfillment and continuity of financial services,
• Lawyers or law partnerships for the follow-up of legal affairs,
• Organizations from which we contractually receive and/or provide services to carry out our activities and with which we cooperate,

It is transferred within the framework of the personal data processing conditions specified in Articles 8 and 9 of the KVK Law.

Data Processing Period and Storage Period

Your personal data, limited to the purposes specified in this Clarification Text; It will be processed by complying with the data processing and statute of limitations periods in all relevant laws and other legal legislation to which our company and our company’s affiliated centers and units are subject. In case of changes in the laws regarding data processing periods, the new periods determined will be taken as basis.

As a requirement of the principle of purpose limitation, your personal data is processed limited to the time required for the fulfillment of the purposes described in this Clarification Text and in any case in accordance with the practices of the company and the customs of its commercial life, and after the expiration of the periods, it is deleted, destroyed or anonymized.

Exercise of the Relevant Person’s Rights

As a data subject, you may use your rights under Article 11 of the Law regulating the rights of the data subject by submitting your requests in writing to the address “Mimar Sinan Mahallesi 1400 Sokak No: 10/Z1 Konak İzmir” according to the “Communiqué on the Procedures and Principles of Application to the Data Controller” or electronically to the e-mail address info@kaskaloglu.com provided that your e-mail is registered in the company systems or by applying to our company’s lasermiyopiozel@hs03.kep.tr kep address by registered e-mail. More comprehensive regulation on this subject, more detailed information on data groups is provided in Kaşkaloğlu Eye Hospital Personal Data Application and Response Procedure and Kaşkaloğlu Eye Hospital Personal Data Protection and Processing Policy . You can access the relevant procedure from our corporate website or in line with the request you will make to the relevant personnel.

Data Controller

Title LASER MYOPIA SPECIAL TREATMENT CENTER LIMITED COMPANY

Address : MİMAR SİNAN MAHALLESI 1400 SOKAK NO: 10/Z1 KONAK İZMİR