Privacy Notice (KVKK – Turkish Personal Data Protection Law No. 6698)

This is an English translation provided for information only. The Turkish version of this notice is the legally binding text.

As the practice of Dr. Leyla Ertenü, we take the utmost care to process and store your personal data in accordance with the Constitution of the Republic of Türkiye and Personal Data Protection Law No. 6698 (the "Law" and/or "KVKK"), and we apply the highest level of security measures to keep your personal data safe.

In its capacity as Data Controller under Law No. 6698 and related legislation, the practice of Dr. Leyla Ertenü will record and archive your personal data, share it where necessary with the third parties/institutions listed below, and process it in the ways set out in the Law, in accordance with the Regulation on the Processing of Personal Health Data and the Protection of Privacy, Ministry of Health regulations and other applicable legislation, within the framework described below. We would therefore like to inform you of our mutual rights and obligations.

1. Personal Data We Process

As Data Controller, we process and retain the following personal data in order to establish the service relationship, ensure continuity of service, deliver our services and fulfil our obligations under other laws as a medical practice:

• Identity information: first name, last name, Turkish ID number and/or passport number, signature, place and/or date of birth and/or patient ID number, and other identity data that can identify you.
• Contact information: address, telephone number, e-mail address and other contact data.
• Payment and billing information: your invoicing details.
• Health information: all health information obtained during and/or as a result of medical diagnosis, treatment and care, including diagnoses, hereditary disease/medical history, medications used, smoking status, procedure/care/treatment details, check-up and test results, the doctor's analyses and comments, and prescription details.
• Visual records: photographs, videos and other visual records taken before and during treatment.
• Other information: customer transaction information such as appointment/registration details, requests and complaints, promotions, surveys, thank-you and complaint letters, satisfaction results and consent to commercial communications; voice recordings if you contact our call centre; closed-circuit security camera (CCTV) recordings made during physical visits; and IP addresses, cookies and other personal data obtained when you use our website and mobile applications.

2. Purposes and Legal Grounds for Processing

We process your personal data for the following purposes:

• receiving patient requests and applications,
• carrying out and tracking registration and appointment processes,
• informing you about, and reminding you of, appointments you have made,
• creating a patient record file,
• carrying out examination, preventive medicine, medical diagnosis, treatment and care,
• performing and tracking necessary follow-up checks after procedures and managing any complications,
• sending appointment and procedure reminders during ongoing treatment,
• issuing invoices for the services provided,
• conducting patient-satisfaction work to develop and improve the healthcare services we provide,
• responding to your questions or complaints about our services,
• sharing information with, and responding to, the Ministry of Health and other public institutions as required by law,
• providing necessary information to regulatory and supervisory authorities and official bodies in line with their requests and inspections,
• retaining health information that must be kept under the relevant legislation.

Your health data is processed under Article 6/3 of the Law on the legal ground that it is processed by persons under a duty of confidentiality for the purposes of medical diagnosis, treatment and care, and the planning and management of healthcare services. Your other personal data is processed under Article 5 of the Law on the legal grounds that processing is necessary for compliance with the data controller's legal obligations, for the establishment or performance of a contract, for the data controller's legitimate interests, and for the establishment, exercise or protection of a right.

We process the contact data we use to inform you about our services and special promotional activities, and your personal data in any other case that requires your explicit consent, on the basis of your explicit consent.

3. How We Collect Your Personal Data

Your personal data is collected directly from you when you contact us by telephone, e-mail, our website's online appointment portal, social media or call centre, and by automated and non-automated means through systems such as treatment-tracking systems and security cameras.

4. Transfer of Your Personal Data

For the purposes listed above, and where required by obligations arising from Basic Law on Health Services No. 3359, the Regulation on the Processing of Personal Health Data and the Protection of Privacy and similar legislation, your personal data may be shared with authorised persons, institutions and/or organisations; the Ministry of Health of the Republic of Türkiye and Provincial Health Directorates; other units affiliated with the Ministry of Health; our business partners to the extent necessary; the lawyers, consultants and auditors we work with, where applicable; domestic and foreign organisations from which we receive or to which we provide services, or with which we cooperate, in order to carry out our activities; other third parties; legal representatives; and persons you have authorised.

5. Your Rights as a Data Subject

Under Article 11 of the Law, as a data subject you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties in Türkiye or abroad to whom your data is transferred; request correction of incomplete or inaccurate data; request erasure or destruction of your data; request that third parties to whom your data has been transferred be notified of any correction, erasure or destruction; object to a result against you arising from analysis of your data exclusively by automated systems; and claim compensation for damage suffered as a result of unlawful processing of your personal data.

To exercise these rights, you can send your request — including the information needed to identify you and an explanation of which right under Article 11 of KVKK No. 6698 you wish to exercise — by completing the application form at "drleylaertenu.com" and sending it to our address at "Feneryolu Mah. Fahrettin Kerim Gökay Cad. Kuyubaşı Sk. Aktaş Apt. No: 1A Kadıköy/İstanbul"; by delivering it to our address in person together with documents and information that identify you; or by e-mailing it from your previously registered e-mail address, and/or with a secure electronic signature, to "info@drleylaertenu.com".