REGARDING THE PROCESSING OF PERSONAL DATA

DISCLOSURE STATEMENT

This Clarification Statement Regarding the Processing of Personal Data Law No. 6698 on the Protection of Personal Data published in the Official Gazette dated 07.04.2016 and numbered 29677 (“KVKK“), the Regulation on Personal Health Data published in the Official Gazette dated 21.06.2019 and numbered 30808, the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation published in the Official Gazette dated 10.03.2018 and numbered 30356 and other legislation, “Data Responsible for“, our company One Dose Sağlık Teknolojileri Anonim Şirketi (“Company” or “One Dose“), prepared by KVKK 10 as One Dose. article, we would like to inform and enlighten you about our personal data processing activities within the scope of remote health services we provide through our website and application One Dose – Health.


1. Data Controller

Pursuant to the LPPD, One Dose, as the data controller, will be able to process, record, store, classify, update your personal data in an accurate and up-to-date manner in connection with the purposes described below, in a limited and measured manner, in accordance with the law and good faith, and where permitted by the legislation and / or limited to the purpose for which they are processed. we will be able to explain/transfer to people.

The term “Personal Data” means any information relating to an identified or identifiable natural person.

The term “Sensitive Personal Data” refers to data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

ProcessingThe term “personal data” refers to all kinds of operations performed on personal data, including but not limited to those regulated in the KVKK, such as obtaining, recording, storing, storing, preserving, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system. Authorized personnel within the Company will be able to process your personal data.

2.Processed Personal Data

We will be processing your personal data in the following categories of personal data, including the data you share with us during registration for the One-Dose application and subsequently during remote service provision.

  • Identity Name, surname, Turkish ID number, gender, date of birth
  • Contact: Email address, phone number, contact address
  • Customer Transaction: Appointment information, information on service history
  • Transaction Security: Device operating system and version, type, model, IP address, user transaction logs, passwords (encrypted)
  • Health: Health history, anamnesis, examination findings, laboratory test results, radiology images and reports and other examination reports, prescriptions, information on the referred branch, reports of interviews with clinical psychologists and dieticians, diet prescriptions, audio and visual records of interviews with physicians, and other health information recorded by you in our system, including height, weight, current diseases, regularly used medications and habits, and previous surgeries
  • Insurance: Social Security Institution data, [data on private health insurance]
  • Finance: Bank account number, IBAN number, credit card number, invoice information
  1. Purpose of Processing Your Personal Data

Your personal data is collected by our Company through electronic communication channels and on the basis of the above-mentioned purposes in order to carry out the above-mentioned purposes.

Categories of Personal Data Processed

Purpose of Processing

Legal Grounds

Identity Data

Contact Data

Customer Transaction Data

  • Realization of user registrations through the application,
  • Realization of users’ appointment registrations through the application
  • Fulfillment of the necessary obligations in terms of the Regulation on the Provision of Remote Health Services and other legislation
  • Carrying out the processes related to the sale, provision and performance of the products and services offered by the Company, and in this context, the provision of medical diagnosis, treatment and care services by physicians and health institutions registered in our system
  • Carrying out storage and archiving activities
  • Article 5/2 (ç) of KVKK

“It is mandatory for the data controller to fulfill its legal obligation

  • Article 5/2 (c) of KVKK

“Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process the personal data of the parties to the contract”

Health Data

  • Realization of user registrations through the application
  • Realization of users’ appointment registrations through the application
  • Evaluation of the patient, carrying out the processes related to the necessary tests and examinations, carrying out activities within the scope of diagnosis and treatment studies related to the patient, carrying out the processes related to the sale, presentation and performance of the products and services offered by the Company, in this context, medical diagnosis, treatment and care services are provided by physicians and health institutions registered in our system,
  • Transfer of health data to physicians and healthcare organizations for the performance of services
  • Planning and execution of patient relationship management processes,
  • Carrying out storage and archiving activities within the organization
  • Financing and planning of health services
  • Sharing requested information with private insurance companies

Open Consent

Identity Data

Contact Data

Insurance and Finance Data

  • Financing and planning of health services
  • Confirming your relationship with the institutions contracted with our hospital
  • Sharing requested information with private insurance companies

  • Article 5/2 (f) of KVKK

“Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”

Identity Data

Contact Data

Customer Transaction Data

Transaction Security Data Insurance and Finance Data

  • Ensuring the security of data controller operations
  • Execution of service operation and organization processes
  • Realization of mediation activities within the scope of distance health services
  • Execution of finance and accounting transactions
  • Article 5/2 (f) of KVKK

“Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”

  • Article 5/2 (c) of KVKK

“Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process the personal data of the parties to the contract”

Identity Data,

Contact Data

Customer transaction data

Finance data

  • Execution of finance and accounting transactions
  • Article 5/2 (c) of KVKK

“Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process the personal data of the parties to the contract”

Identity Data

Contact Data

Customer Transaction Data

  • Responding to all your questions and complaints regarding our health services
  • Evaluating our services, conducting marketing processes regarding the services offered by the Company
  • Article 5/2 (f) of KVKK

“Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”

  • Article 5/2 (e) of KVKK

Data processing is mandatory for the establishment, exercise or protection of a right

Identity Data

Contact Data

Customer Transaction Data

Health Data

  • Planning and execution of the activities required to recommend the products and services offered by the Company to the relevant persons by customizing them according to their tastes, usage habits and needs
  • Conducting marketing activities
  • Carrying out advertising/campaign/promotion processes, contacting you with commercial electronic messages when necessary

  • Explicit consent
4. Transfer of Your Personal Data

Your personal data processed within the scope of the purposes described above; In accordance with the basic principles stipulated in the KVKK and in accordance with Article 8 of the KVKK. Within the scope of the personal data processing conditions and purposes specified in the articles, personal data may be transferred to, shared with and/or given access to your personal data to the following persons:

  • Identity, contact, customer transaction dataIn order to carry out the processes related to the sale, presentation and performance of the products and services offered by the Company, to provide medical diagnosis, treatment and care services by physicians and health institutions registered in our system, and to carry out storage and archiving activities, Since our Company is obliged to record the transactions related to remote health services in the central health system in accordance with the relevant legislation, with the Ministry of Health based on the legal reason “It is stipulated in the laws” in accordance with Article 5/2(a) of the KVKK, and based on the legal reason “It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract” in accordance with Article 5/2(c) of the KVKK,

  • Your Health Data for the purpose of evaluating the patient, carrying out processes related to necessary tests and examinations, carrying out activities within the scope of diagnosis and treatment studies regarding the patient, transferring health data to physicians and health institutions for the performance of services, planning and execution of patient relationship management processes, and providing medical diagnosis, treatment and care services physicians and health institutions subject to the confidentiality obligation registered in our system based on your explicit consent;

  • Your Health Data may be shared with insurance companies contracted by the insured patient based on your explicit consent for the purpose of financing and planning of health services and sharing information requested by private insurance companies;

  • Your identity, contact, insurance and financial data, for the purpose of financing and planning of health services, confirming your relationship with the institutions contracted with our hospital, sharing the information requested with private insurance companies within the scope of the eligibility query, in accordance with Article 5/2 (e) of the KVKK “With the insurance company and support and consultancy service providers contracted by the insured patient based on the legal reason that “data processing is mandatory for the establishment, exercise or protection of a right“,

  • Your identity, contact, customer transaction, transaction security data In order to carry out the processes related to the sale, presentation and performance of the products and services offered by the Company, in accordance with Articles 5/2(c) and 5/2(ç) of the KVKK, with our cloud service provider and with the identity verification sharing service of the Ministry of Interior based on the legal reason that “it is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” and “it is mandatory for the data controller to fulfill its legal obligations for the purpose of identity verification verification”;

  • Your identity, contact, customer transaction, and financial data are shared with our contracted accountants for the purpose of carrying out financial and accounting transactions, based on the legal grounds that “it is mandatory for the data controller to fulfill its legal obligations” in accordance with Article 5/2(ç) of the KVKK;

  • Your identity, contact, and customer transaction data In accordance with Article 5/2 (f) of the KVKK, in order to carry out the processes related to the provision and performance of the products and services offered by the Company, to plan and execute the activities necessary for the recommendation of the products and services offered by the Company to the relevant persons by customizing them according to the tastes, usage habits and needs of the relevant persons, to respond to all kinds of questions and complaints regarding our health services, to evaluate our services, to carry out marketing processes regarding the services offered by the Company and to carry out advertising / campaign / promotion processes “With our contracted service providers that provide support, maintenance and repair services to the CRM system based on the legal reason that “data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject“;

  • Your health data To carry out the processes related to the provision and performance of the products and services offered by the Company, to plan and execute the activities necessary to recommend the products and services offered by the Company to the relevant persons by customizing them according to the tastes, usage habits and needs of the relevant persons, to respond to all kinds of questions and complaints regarding our health services, to evaluate our services, to carry out marketing processes regarding the services offered by the Company and to carry out advertising / campaign / promotion processes Based on your explicit consent, the CRM system can be accessed by our contracted service providers that provide support, maintenance and repair services, and the contracted service provider and ;

  • Your contact data As the Company is obliged to register your contact address in a national Commercial Electronic Message Management System (IYS) established by the Republic of Turkey Ministry of Commerce in accordance with the provisions of the relevant legislation, in order to fulfill our obligation arising from the law, without the requirement of explicit consent, in order to fulfill our obligation arising from the law, without the requirement of explicit consent, in Article 5/2 (ç) of the KVKK, “It is mandatory for the data controller to fulfill its legal obligation” based on the legal reason that it is registered in the Commercial Electronic Message Management System (IYS) with the Ministry of Commerce of the Republic of Turkey and the Union of Chambers and Commodity Exchanges of Turkey

  • Since your identity and contact data are provided through the relevant software/portal for the purpose of tracking your electronic commercial message permissions and your explicit consents for personal data processing, sharing, transferring, and tracking your permissions within the scope of IYS integration, without seeking your explicit consent, you are subject to the provisions of Article 5/2 (f) of the KVKK “Provided that it does not harm the fundamental rights and freedoms of the data subject, it is mandatory to process data for the legitimate interests of the data controller” with the contracted company based on the legal reason

It will be shared.

Our Company undertakes to keep personal information strictly private and confidential, to take all necessary measures and to exercise due diligence to prevent unauthorized use or disclosure of personal information to a third party.

5. 11. Your Rights as a Relevant Person Pursuant to Art.

You may submit your requests regarding your rights in writing as personal data owners and together with the documents identifying your identity, together with your written petition containing your explanations regarding the right you wish to exercise. 3028th Street. No: 8D Interior Door No: 27 Çankaya/ANKARA in person or by registered letter with return receipt or info@onedose.io e-mail address, your request will be evaluated by our Company and finalized within 30 (thirty) days at the latest as stipulated within the scope of KVKK. Although it is essential not to charge any fee for the requests, our Company reserves the right to charge a fee based on the fee tariff determined by the Personal Data Protection Board.

Article 28 of the LPPD titled “Exceptions” Without prejudice to the cases stipulated in the article, by applying to our Company, your personal data; to learn whether it has been processed; if processed, to request information about it; to learn the purpose of processing and whether it is used in accordance with its purpose; to know the third parties to whom it is transferred domestically or abroad; to request notification of the transactions made by the third parties to whom it is transferred; to request correction in case of incomplete or incorrect processing; to request deletion or destruction in case the reasons requiring its processing disappear; to request notification of the transactions made to third parties to whom your personal data is transferred; to object to the occurrence of a result against you by analyzing it exclusively through automated systems and to demand the compensation of the damage in case you suffer damage due to processing in violation of the KVKK.

One Dose Health Technologies Inc.

Center : Konutkent Mah. 3028th Street. No: 8D Interior Door No: 27 Çankaya/ANKARA

Tel : 0 850 450 06 06

Mersis No : 0544128049300001