KVKK Disclosure

Personal Data Protection

1. Identity of the Data Controller

As ŞAH GRUP MEDİKAL İTHALAT İNŞAAT TURİZM SANAYİ VE TİC. LTD. ŞTİ. ("Maysen Health" or "Company"), we attach great importance to the security of your personal data. With this awareness, we process and preserve all personal data belonging to all persons associated with our Company, including our patients and visitors, in accordance with the Personal Data Protection Law No. 6698 ("KVKK").

2. Purpose of Processing Personal Data

Your personal data (such as identity information, contact information, health data, financial data, and visual/audio records) may be processed by our Company for the following purposes in accordance with the conditions specified in Articles 5 and 6 of the KVKK:

• To provide medical consultancy and health tourism services securely.
• To manage your appointment, travel, transfer, and accommodation organizations.
• To fulfill the obligations arising from the contracts established between you and our Company.
• To communicate with you regarding your treatment plan and post-operative care.
• To fulfill legal and regulatory requirements from the Ministry of Health and other relevant public institutions.
• To ensure financial reconciliation, invoicing, and accounting processes.

3. To Whom and For What Purpose Data Can Be Transferred

Your collected personal data may be transferred to the following parties, strictly limited to achieving the purposes mentioned above and in compliance with Articles 8 and 9 of the KVKK:

• Partner hospitals, clinics, doctors, and healthcare professionals to plan and execute your treatment.
• Accommodation facilities (hotels) and VIP transfer companies to organize your travel logistics.
• Legally authorized public institutions (e.g., Ministry of Health, courts) and private individuals upon legal request.
• Financial institutions and contracted third-party service providers (IT support, legal advisors) for operational purposes.

4. Method and Legal Reason for Collecting Personal Data

Your personal data is collected through various channels such as our website forms, WhatsApp communication line, e-mails, phone calls, social media accounts, and physical documents submitted directly by you.

This data is processed based on the following legal grounds outlined in Article 5 of the KVKK:

• It is explicitly stipulated in the laws.
• It is necessary for the establishment or performance of a contract (e.g., health tourism service agreement).
• It is necessary for compliance with a legal obligation to which the data controller is subject.
• It is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.
• Explicit consent (especially for processing special categories of personal data like health records and photographs).

5. Rights of the Personal Data Owner (Article 11)

Pursuant to Article 11 of the KVKK, as a personal data owner, you have the right to:

• Learn whether your personal data is processed or not.
• Request information if your personal data has been processed.
• Learn the purpose of processing your data and whether they are used appropriately.
• Know the third parties to whom your data is transferred domestically or abroad.
• Request correction of your data if it is incomplete or inaccurately processed.
• Request the deletion or destruction of your personal data under the conditions stipulated in the Law.
• Object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems.
• Claim compensation for the damage arising from the unlawful processing of your personal data.

To exercise your rights mentioned above, you can submit your written request to our official address at Kızıltoprak Mah, Aspendos Blv No:15.B, İç kapı No: 303, Muratpaşa/Antalya or send an e-mail to [email protected] from your registered e-mail address. Your requests will be concluded free of charge as soon as possible and within thirty days at the latest.