Privacy Notice - Rovena Health

CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA

(KVKK / PDPL Information Notice)

1. Scope of the Personal Data Protection Law

Within the scope of this Clarification Text, information is provided by ROVENA TURİZM OTELCİLİK SANAYİ VE TİCARET ANONİM ŞİRKETİ (“Company”) in order to collect and process your personal data, including sensitive personal data, in accordance with the Personal Data Protection Law No. 6698 (“PDPL”), Health Services Fundamental Law No. 3359, the Decree Law on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, regulations of the Ministry of Health, and other relevant legislation, within the scope of the health tourism and related services you receive from the Company.

As the Data Controller, the Company may save, store, update, share with third parties where permitted and/or required by legislation or agreements (including relatives of the service recipient, public and/or private legal entities, insurance holders, business partners, service providers, and other authorized institutions), transfer, classify, and process personal data in accordance with the PDPL and relevant legislation.

Sensitive personal data, particularly health data, may be processed only by authorized persons or institutions under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and financing, without seeking the explicit consent of the data subject, as permitted by law. In all cases, adequate administrative and technical measures determined under the PDPL are taken.

Personal data may be obtained verbally, in writing, visually, or electronically through call centers, websites, mobile applications, electronic correspondence, and similar channels for the purposes stated above.

2. Collection, Processing and Purposes of Processing Personal Data

Your personal data is processed within the conditions and purposes specified in Articles 5 and 6 of the PDPL in order to:

Ensure legal and commercial security,
Carry out human resources policies,
Determine and implement the Company’s commercial and business strategies,
Fulfill legal obligations,
Provide services to authorized public institutions, judicial authorities, and domestic or international service providers.

Categories of processed personal data include:

Identity Information:
Name, surname, Turkish Republic ID number, passport number, temporary ID number, place and date of birth, gender, marital status, insurance or patient protocol number.

Contact Information:
Address, telephone number, e-mail address, call center voice records, and correspondence records.

Financial Information:
Bank account details, IBAN, credit card and billing information, private insurance data, Social Security Institution data, camera recordings for security purposes.

Health Information:
Medical records, laboratory and test results, examination data, appointment and prescription information, diagnosis and treatment records.

Employment Information (if applicable):
CVs, employment contracts, and related personal data for job applicants or employees.

These data may be processed for purposes including but not limited to identity verification, service provision, appointment management, risk management, quality improvement, legal compliance, billing, insurance coordination, responding to inquiries and complaints, data security, service development, regulatory audits, employee training, patient satisfaction measurement, and research.

3. Transfer of Personal Data

Personal data may be transferred domestically and, in incidental cases, abroad in accordance with Articles 8 and 9 of the PDPL to:

Ministry of Health and affiliated institutions,
Social Security Institution,
Private insurance companies,
Judicial and law enforcement authorities,
Laboratories, medical institutions, and healthcare providers,
Legal, financial, and audit consultants,
Business partners, suppliers, and service providers,

in accordance with relevant legislation including PDPL No. 6698, Health Services Fundamental Law No. 3359, Decree Law No. 663, Labor Law No. 4857, Social Insurance and General Health Insurance Law No. 5510, and other applicable regulations.

4. Situations Where Explicit Consent Is Not Required

In accordance with Article 28 of the PDPL, personal data may be processed without explicit consent where legally permitted, including but not limited to:

Crime prevention and criminal investigations,
Protection of public safety and national security,
Fulfillment of legal obligations,
Establishment or performance of contracts,
Protection of life or bodily integrity,
Legitimate interests of the Company,
Data made public by the data subject,
Establishment, use, or protection of a legal right.

Health and sexual life data may be processed without explicit consent solely for purposes permitted by law and under confidentiality obligations.

5. Method and Legal Grounds for Collection and Processing

Personal data is collected and processed verbally, in writing, visually, or electronically to fulfill the Company’s contractual and legal obligations in accordance with PDPL No. 6698 and other relevant legislation.

6. Rights of Data Subjects

Pursuant to Article 11 of the PDPL, data subjects have the right to:

Learn whether personal data is processed,
Request information regarding processing,
Learn the purpose of processing,
Know third parties to whom data is transferred,
Request correction, deletion, or destruction,
Object to automated decision-making,
Claim compensation for damages arising from unlawful processing.

Applications can be submitted in accordance with the “Communiqué on the Procedures and Principles of Application to the Data Controller”.

EXPRESS CONSENT TEXT

I hereby declare that I have read and understood the Clarification Text regarding the Processing of Personal Data prepared by ROVENA TURİZM OTELCİLİK SANAYİ VE TİCARET ANONİM ŞİRKETİ, and I give my explicit consent for the processing, storage, and transfer of my personal and sensitive personal data in accordance with the purposes stated therein.

I also consent to the use of photographs and videos taken before or after services, and to receiving commercial electronic messages (call, SMS, WhatsApp, e-mail, etc.) for informational and promotional purposes.