TDS DIAGNOSTIC MEDICAL DEVICES LTD. CO. CUSTOMER DISCLOSURE STATEMENT ON THE PROTECTION OF PERSONAL DATA (KVKK)

Dear Customer / Patient,

As TDS Diagnostik Tıbbi Cihazlar Ltd. Şti., we attach the highest value to the privacy and security of your personal data. This disclosure statement has been prepared to inform you in detail, as the data controller, within the framework of Article 10 of the Law on Protection of Personal Data (KVKK) No. 6698 and relevant health legislation.

1. Purposes of Processing Personal Data

Your personal data collected within TDS Diagnostik is processed in accordance with legal principles for the following primary purposes:

• Protection of public health, execution of medical diagnosis, treatment, and preventive healthcare services.
• Fulfillment of mandatory legal notifications to the Ministry of Health, SSI, and other official institutions as required by legislation.
• Management of appointment processes, improvement of our service quality, and establishment of patient satisfaction.
• Establishment of service contracts, invoicing, and completion of financial operations.
• Ensuring uninterrupted internal physical security through closed-circuit camera systems.

2. Categories of Personal Data Processed

Within the scope of our activities, only the following necessary data types are recorded:

• Identity Information: Basic identifiers such as Turkish ID number, name, surname, date of birth, marital status, and patient protocol number.
• Contact Information: Telephone numbers, address, and email data.
• Health and Special Category Data: Medical history records regarding test and imaging results, examination findings, prescription information, sexual life, and genetic data.
• Financial Information: Payment details and private health insurance policy information.
• Visual/Audio and Physical Space Data: CCTV camera recordings, call center audio recordings, and photograph information in official documents.

3. Data Transfer and Sharing

Your personal data is shared with third parties only to the extent permitted by legislation and within the framework of strict confidentiality rules:

• Transferred to the Ministry of Health, SSI, law enforcement units, and relevant judicial authorities within the scope of legal obligations.
• May be shared with laboratories, medical centers, and hospitals collaborated with as part of diagnosis and treatment processes.
• Transferred to banks and financial institutions for financial reconciliation processes.
• Data transfer abroad may occur due to the technological infrastructures used, provided that the legal security conditions specified in Article 9 of the KVKK are met.

4. Data Collection Methods and Legal Grounds

Your personal data is collected through our website, call center, printed forms, and physical or electronic interactions during the provision of healthcare services. These data processing activities are based on legal grounds such as explicit provision in laws, impossibility in practice, establishment or performance of a contract, fulfillment of our legal obligations, and our legitimate interests.

5. Data Retention Periods

Your personal data is generally stored in secure environments for 10 years, taking into account the statutory limitation periods we are subject to. Camera footage recorded to ensure the physical security of our company’s premises is retained for 6 months. Upon the expiration of the relevant periods, your data is deleted, destroyed, or anonymized by lawful methods.

6. Your Rights as a Data Subject

Pursuant to Article 11 of the KVKK, as data subjects, you have the following rights:

• To learn whether your personal data is processed and to whom it is transferred domestically/abroad.
• To request the correction of your incomplete or incorrectly processed data.
• To request the permanent deletion or destruction of your data when legal conditions are met.
• To demand compensation for damages that may arise due to unlawful processing through legal means.

You can submit your requests, along with official documents verifying your identity, to our company’s registered address in writing or via our registered email address using a secure electronic signature. Your applications will be concluded as soon as possible and within a maximum of 30 days, depending on the nature of the request.