POLICY ON THE PROTECTION AND PROCESSING OF SPECIAL CATEGORY PERSONAL DATA

TANSAN PRIVATE HEALTH SERVICES AND TRADE LTD.

 (TANSAN PRIVATE POLYCLINIC)

POLICY ON THE PROTECTION AND PROCESSING OF SPECIAL CATEGORY PERSONAL DATA

1. Aim

This Policy on the Processing and Protection of Special Categories of Personal Data (“Policy”"), numbered 6698

Personal Data Protection Law (“Personal Data Protection Law (KVKK)”"Tansan Private Health Services and Trade Ltd. Co., which holds the title of data controller pursuant to the relevant law...". (Company) This document has been created to determine the procedures and principles for the protection and processing of special categories of personal data held by the institution, within the scope of data security.

In accordance with the fundamental principles determined by the company, the processing of personal data of employees, patients, patient relatives/companions/guardians/parents/representatives, shareholders/partners, service providers, supplier officials/supplier employees, visitors, and all other third parties whose personal data is held within the company's polyclinic for any reason, is carried out in accordance with the Turkish Constitution, international conventions, Law No. 6698 on the Protection of Personal Data, and relevant legislation, within the framework of this Special Categories of Personal Data Protection and Processing Policy.

The protection and processing of special categories of personal data are carried out by the Company in accordance with the Policy prepared for this purpose.

2. Special Categories of Personal Data within the Scope of the Personal Data Protection Law (KVKK)

Within the scope of the Personal Data Protection Law (KVKK), data relating to an individual's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are considered special categories of personal data; the Company acts in accordance with the principles specified in the KVKK and Article 13 of the Constitution in processing the special categories of personal data of individuals, and takes all adequate and necessary measures additionally determined by the Personal Data Protection Board.

3. Processing of Special Categories of Personal Data

Special categories of personal data may be processed with the explicit consent of the data subject or in the limited circumstances specified in the Personal Data Protection Law (KVKK). The law makes a distinction between special categories of personal data. Accordingly, the law regulates differently the circumstances under which personal data relating to health and sexual life, and other special categories of personal data, may be processed without explicit consent.

4. Conditions for Processing Special Categories of Personal Data

According to the KVKK (Law on Protection of Personal Data), special categories of personal data can be processed with explicit consent. Also according to the KVKK, processing of special categories of personal data is possible without the explicit consent of the data subject in the following cases:

a- Special categories of personal data, excluding health and sexual life data, may only be disclosed as stipulated by law.

in these cases,

b-Personal data relating to health and sexual life will only be collected for the protection of public health and preventive purposes.

Medical practice, medical diagnosis, treatment and care services, health services.

for the purpose of planning and managing its financing, and subject to confidentiality obligations.

It may be processed by individuals or authorized institutions and organizations.

Processing Conditions	Scope	Example
Explicit Consent of the Relevant Person	The explicit consent of the relevant person must have been obtained.	Obtaining the consent of volunteers within the scope of clinical trials.
Legal Provision	Personal data other than health and sexual life data may be processed without the explicit consent of the data subject. Tax laws, labor laws, Turkish Commercial Code, etc., impose stricter requirements for processing sensitive data.	According to legislation, an employee's union membership information must be kept in their personnel file.
Protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services.	For the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services, data processing may be carried out by persons or authorized institutions and organizations bound by an obligation of confidentiality.	Health data that the doctor processes about the patient.

5. Measures Regarding the Processing of Special Categories of Personal Data

The company, in its capacity as data controller, takes the following measures in the processing of Special Categories of Personal Data:

a- This Policy establishes a systematic, clearly defined, manageable, and sustainable system for the security of sensitive personal data.

b- For employees involved in the processing of special categories of personal data;

aa- Regular training is provided on the law, related regulations, and the security of special categories of personal data.

bb- Privacy policies are enforced, and confidentiality agreements are signed with employees.

cc-Users authorized to access the data have their access rights and duration clearly defined.

dd- Authorization checks are carried out periodically.

ee- The authorizations of employees who change roles or leave the company are immediately revoked, and in this case, the inventory allocated to them is returned by the Data Controller.

c- If the environments where Special Categories of Personal Data are processed, stored and/or accessed are electronic environments;

aa- Personal data is protected using cryptographic methods.,

bb- Cryptographic keys are stored securely in different environments.,

cc- Transaction records of all actions performed on personal data are securely kept.

It is being logged.,

dd- Security updates for environments containing personal data are continuously monitored, necessary security tests are regularly conducted/commissioned, and test results are recorded.,

ee- Technical controls (e.g., penetration tests) are carried out to prevent the unlawful processing of personal data, risks, threats, vulnerabilities, and gaps are identified, and appropriate technical measures are taken to address these risks and implement necessary precautions.

ff- If personal data is accessed through software, user authorizations for that software are configured, security tests of these software programs are regularly performed/commissioned, and the test results are recorded.,

gg- If remote access to personal data is required, this access is provided through at least a two-factor authentication system.

d- If the environments where Special Categories of Personal Data are processed, stored and/or accessed are physical environments;

aa- Depending on the nature of the environment where Special Categories of Personal Data are stored, adequate security measures are taken (such as fire extinguishing systems, air conditioning, etc., against electrical leaks, fire, flooding, theft, etc.).,

bb- Unauthorized entry and exit are prevented by ensuring the physical security of these areas.

e- If the transfer of Special Categories of Personal Data is necessary;

aa- If personal data needs to be transmitted via email, it is transmitted in encrypted form using a corporate email address or a Registered Electronic Mail (KEP) account.

bb-If the data needs to be transferred via portable memory devices such as CDs or DVDs, it must be cryptographic.

The encryption is done using various methods, and the cryptographic key is stored in a different environment.

cc- When data transfer is performed between servers in different physical locations, data transfer is carried out by establishing a VPN between the servers or using the sFTP method.,

dd- If personal data needs to be transmitted in paper format, necessary precautions are taken against risks such as theft, loss, or unauthorized access to the documents, and the documents are sent in a "Confidential" format.

6. Transfer of Special Categories of Personal Data

The company may transfer the Special Categories of Personal Data it has lawfully obtained to third parties in accordance with data processing purposes and by taking the necessary security measures. Accordingly, the company may transfer Special Categories of Personal Data to third parties if one of the processing conditions specified in the section above and one of the conditions specified below are met.

a- If the Data Subject has given explicit consent,

b- If there is an explicit provision in the laws regarding the transfer of Special Categories of Personal Data,

c- If it is necessary for the protection of the life or physical integrity of the Data Subject or another person, and the Data Subject is unable to express their consent due to factual impossibility or if their consent is not legally valid;

d- If the transfer of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract,

to- If the transfer of personal data is necessary for the company to fulfill its legal obligations,

f- If Special Categories of Personal Data have been made public by the Data Subject,

g- If the transfer of Special Categories of Personal Data is necessary for the establishment, exercise or protection of a right,

h- Personal data transfer is permissible only if it is necessary and does not prejudice the fundamental rights and freedoms of the Data Subject.

7. Transfer of Special Categories of Personal Data Abroad

The company may transfer the Data Subject's Special Categories of Personal Data to foreign countries where the data controller has adequate protection or undertakes to provide adequate protection, in line with legitimate and lawful Personal Data processing purposes, by exercising due diligence, taking the necessary security measures and adequate precautions foreseen by the Board, in the following cases.

a- If the personal data owner has given their explicit consent, or

b- Unless the personal data owner has given explicit consent;

aa- Special categories of personal data of the Data Subject, excluding health and sexual life (race, ethnicity, etc.)

origin, political views, philosophical beliefs, religion, sect or other beliefs, appearance and clothing,

data relating to membership in associations, foundations or trade unions, criminal convictions and security measures

(including biometric and genetic data), in cases stipulated by law,

bb- Special categories of personal data relating to the health and sexual life of the Data Subject may only be processed by persons or authorized institutions and organizations bound by an obligation of confidentiality, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing.

8. Update

This policy is in accordance with the decisions of the Personal Data Protection Board and legislative changes.

It will be updated.