Our Policies

We use cookies to ensure that you can benefit from our website in the most efficient way and to improve your user experience. If you do not prefer cookies, you can delete or block cookies from your browser settings. However, we would like to remind you that this may affect your use of our website. Unless you change your cookie settings from your browser, we will assume that you accept the use of cookies on this site. You can access the regulations regarding the data collected from the Privacy Policy on our website.

Cookies Used on the Website

What is a Cookie and Why is it Used?Cookies are small text files stored on your device or on a network server by the websites you visit through your browser.The main purposes of using cookies on our Website are listed below:

• – To improve the services offered to you by increasing the functionality and performance of the website,
• – To improve the Website and offer new features on the Website and to personalize the features offered according to your preferences;
• – To ensure the legal and commercial security of the Website, you and our Company.

Main Types of Cookies Used on Our Website

Session Cookies

Session cookies are temporary cookies used during our visitors' visit to the Website and are deleted after the browser is closed.The main purpose of using such cookies is to ensure the proper functioning of the Website during your visit.For example, you can fill out online forms consisting of multiple pages.

Persistent Cookies

Persistent cookies are types of cookies used to increase the functionality of the Website and to provide a faster and better service to our visitors.These types of cookies are used to remember your preferences and are stored on your device through browsers.Some types of persistent cookies can be used to offer you special offers, taking into account things like your purpose of using the Website.Thanks to persistent cookies, if you re-visit our Website with the same device, it will be checked whether there is a cookie created by our Website on your device, and if there is, it will be understood that you have visited the site before and the content to be delivered to you will be determined accordingly, thus providing you with a better service.

Main Cookies Used on Our Website

Technical Cookies	Technical cookies ensure the operation of the website and identify non-functioning pages and areas of the website.
Authentication Cookies	When visitors log in to the website using their passwords, these types of cookies identify the visitor as a site user on each page they visit on the website, preventing the user from re-entering their password on each page.
Flash Cookies	These are types of cookies used to enable visual or audio content on the website.
Customization Cookies	These are cookies used to remember users' preferences when visiting different pages of different websites. For example, remembering your chosen language preference.
Analytical Cookies	Analytical cookies are cookies that enable the production of analytical results such as the number of visitors to the website, the identification of the pages viewed on the website, the hours of visiting the website, and the scrolling movements of the website pages.

Can Data Owners Prevent the Use of Cookies?You have the opportunity to personalize your preferences regarding cookies by changing the settings of your browser.

Google Analytics	https://tools.google.com/dlpage/gaoptout
Google Adwords	https://support.google.com/ads/answer/2662922?hl=en
Google Chrome	http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95647
Hotjar	https://www.hotjar.com/legal/compliance/opt-out
Live chat	https://www.livechatinc.com/legal/privacy-policy/
Facebook	https://www.facebook.com/policies/cookies/
Internet Explorer	https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies
Edge	https://support.microsoft.com/en-us/help/4027947/windows-delete-cookies
Firefox	http://support.mozilla.com/en-US/kb/Cookies
Opera	http://www.opera.com/browser/tutorials/security/privacy/
Safari	https://support.apple.com/kb/ph19214?locale=tr_TR

As Bahçeci Sağlık Hizmetleri A.Ş. (“Bahçeci”), our fundamental principles include protecting fundamental rights and freedoms, safeguarding privacy, ensuring and maintaining information security, and respecting ethical values. Accordingly, we process and protect the personal data of all individuals associated with the Company, including those who benefit from our products and services, in compliance with Personal Data Protection Law No. 6698 (“LPPD”).

Purposes of Processing and Transferring Personal Data

The personal data processed may vary depending on our Company’s commercial activities. Your personal data may be collected verbally, in writing, or electronically, through automatic or non-automatic means, including via our Company’s offices, email, and similar channels. In addition, when you visit this website owned by our Company, Bahçeci may collect personal information about you in areas where you are directly or indirectly requested to provide information.Bahçeci uses such personal data solely for the purposes for which it is required and ensures that the personal data collected is protected in accordance with applicable legislation.Your personal data is recorded and processed verbally, in writing, through camera systems, or electronically via call centres, websites, online services, and similar channels, in connection with and limited to purposes including, but not limited to: carrying out the work necessary for you to benefit from the services provided by our Company; ensuring the legal and commercial security of persons who have a business relationship with our Company; conducting administrative operations relating to communications carried out by our Company; informing you about the Company’s services and activities; creating and maintaining patient records and medical treatment plans; arranging information and appointments; conducting private health insurance procedures for the financing and planning of healthcare services; processing the health and identity information you submit through our websites and contacting you; initiating and conducting treatment processes; corporate communications; invoicing for our services; fulfilling legal obligations arising from applicable legislation; sharing medical data and health reports concerning patient history with relevant parties upon request; maintaining communications; carrying out the processes necessary for the proper delivery of treatment; measuring your satisfaction with the services received and improving our services accordingly; risk management; sharing information about services, innovations, and other news concerning our centres; conducting administrative and after-sales operations; ensuring security in business processes and performing audits deemed necessary, including scheduled internal audits; ensuring the physical security of Company premises; fulfilling contractual commitments; ensuring the continuity of Company operations; managing occupational health and safety processes; managing procedures before public institutions and organisations such as the Ministry of Health; protecting public health; conducting preventive medicine, medical diagnosis, treatment, and care services; planning and managing healthcare services and their financing; planning and managing the internal operation of our medical centre; conducting analyses to improve healthcare services; training and developing our employees; monitoring and preventing misuse and unauthorised transactions; conducting research; improving medical diagnosis, treatment, and care services; increasing patient satisfaction; ensuring the physical security and supervision of Company premises; managing evaluation and complaint processes; managing legal compliance, audit, financial affairs, and similar processes; determining and implementing our Company’s commercial and business strategies; implementing our Company’s human resources policies; providing the service you have requested; and sending communications concerning changes, information, use, maintenance, marketing, statistical services, and contract renewals.In addition, the personal data specified above may be processed within the framework of Basic Law on Health Services No. 3359, Decree-Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliated Institutions, the Regulation on Private Hospitals, the Regulation on the Processing and Protection of the Privacy of Personal Health Data, regulations issued by the Ministry of Health, and other applicable legislation. Such data may be transferred to physical archives and information systems belonging to Bahçeci and/or our suppliers and retained in both digital and physical environments.To the extent necessary to achieve the purposes stated above and fulfil legal obligations, and provided that any disclosure remains limited to those purposes, your personal data may be shared with: our suppliers and business partners with whom we cooperate or from whom we receive services for the provision of services by our medical centre, including software companies providing technical support and companies from which we receive medical diagnostic services, such as software providers for ultrasound equipment; the Ministry of Health, its affiliated units, and family health centres; private insurance companies, including health, pension, and life insurance providers; the Social Security Institution; the General Directorate of Security and other law-enforcement authorities; the General Directorate of Population and Citizenship Affairs; other relevant public institutions and organisations; the Turkish Pharmacists’ Association; courts; laboratories, medical centres, and third-party healthcare providers located in Türkiye or abroad with which we cooperate for medical diagnosis; the healthcare institution to which the patient is referred or applies directly; representatives authorised by you; the institution with which you are affiliated and/or for which you work; third parties from whom we receive consultancy services, including lawyers, tax advisers, and auditors; regulatory and supervisory bodies and public authorities; systems located in Türkiye or abroad; and/or companies within the group of companies to which our medical centre belongs. You may apply to our Hospital in writing for more detailed information.

Method and Legal Grounds for Collecting Personal Data

Your personal data is collected, used, recorded, stored, and processed by our Company after personal data subjects have been provided with clear and comprehensible written information and, where required, their explicit consent has been obtained. These activities are carried out lawfully and fairly, in connection with and limited to the legitimate purposes expressly stated above, and in accordance with the principle of proportionality.Your personal data is processed and shared with the persons and institutions listed above on the following legal grounds set out in Article 5(2) of the LPPD:

• It is expressly provided for by law.
• It is necessary to protect the life or physical integrity of the person concerned or of another person where the person concerned is physically or legally incapable of giving consent.
• Processing the personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract.
• It is necessary for the data controller to fulfil its legal obligations.
• The data has been made public by the data subject.
• Data processing is necessary for the establishment, exercise, or protection of a right.
• Data processing is necessary for the legitimate interests of the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject.

Security of Personal Data

Your personal data is processed and stored in a manner that permits access only by authorised persons. Other necessary information-security measures are also implemented to prevent unauthorised access, loss, or damage in the environments where the data is processed and stored, provided that the data is not used outside the stated purpose and scope and is encrypted where necessary. Bahçeci also uses the software prescribed by the Ministry of Health for healthcare institutions, and this software is updated periodically.

Retention Period for Personal Data

Your personal data will be retained for the periods specified in applicable legislation or for as long as required for the processing purposes described above. It will subsequently be deleted, destroyed, or anonymised in full compliance with the LPPD.

Rights of the Data Subject Under Article 11 of the LPPD

Pursuant to Article 11 of the LPPD, you have the following rights as a data subject:

• To learn whether your personal data is being processed.
• To request information if your personal data has been processed.
• To learn the purpose for which your personal data is processed and whether it is being used in accordance with that purpose.
• To learn the identity of third parties to whom your personal data has been transferred in Türkiye or abroad.
• To request the correction of incomplete or inaccurate personal data and to request that the action taken in this regard be communicated to third parties to whom the personal data has been transferred.
• To request the deletion or destruction of your personal data where the reasons requiring its processing no longer exist, even though the data was processed in accordance with the LPPD and other applicable laws, and to request that the action taken in this regard be communicated to third parties to whom the personal data has been transferred.
• To object to any outcome that is detrimental to you and results from the analysis of your processed data exclusively through automated systems.
• To claim compensation if you suffer damage as a result of the unlawful processing of your personal data.

Detailed information on how you may exercise your rights concerning personal data processed by our Company is available in the Personal Data Protection and Privacy Policy at www.bahceci.com.Our Company reserves the right to amend this Privacy Policy without prior notice in order to keep its privacy and data-protection principles up to date and compliant with applicable legislation. If we decide to amend the Privacy Policy, the revised policy will be published on our website.

Data Controller

Bahçeci Sağlık Hizmetleri A.Ş. Mahir İz Street No. 31, Floors 2–3, Altunizade, Istanbul Tel: 444 39 49 Fax: +90 216 340 80 00 Istanbul Trade Registry Office — Registration No. 370646 https://bahceci.com

1. Purpose

As Bahçeci Sağlık Hizmetleri A.Ş. (“Bahçeci”), we attach great importance to the protection of personal data. Accordingly, we take care to process and protect lawfully the personal data of Bahçeci and/or its employees, patients, business partners, authorised persons, job applicants, interns, visitors, suppliers, the employees and authorised persons of cooperating institutions/customers/suppliers, third parties, and other persons, including but not limited to those listed hereinafter (collectively, the “Data Subject” or “Data Subjects”).This Bahçeci Personal Data Protection and Privacy Policy (“Policy”) has been prepared to ensure that personal data processed by our Centre in the course of its activities is handled in accordance with Personal Data Protection Law No. 6698 (“LPPD”), other applicable legislation, and the law. The Policy also aims to establish lawful personal-data processing as a corporate standard and ensure transparency by informing Data Subjects about the personal data processed by our Centre. In this context, Bahçeci processes personal data according to the principles and rules explained in detail below:

• In accordance with Article 4 of the LPPD, personal data is processed lawfully and fairly for specified, explicit, and legitimate purposes; kept accurate and up to date in physical and electronic environments; processed in a manner relevant, limited, and proportionate to its purpose; and retained for the period prescribed by applicable legislation or required for the processing purpose.
• The necessary administrative and technical safeguards specified in Article 12 of the LPPD are implemented.
• During the collection of personal data, in accordance with Article 20 of the Constitution and Article 10 of the LPPD, Data Subjects are informed about the purposes of processing, the persons to whom and purposes for which data may be transferred, the method and legal grounds for collection, and their rights under Article 11 of the LPPD.
• Where required, the explicit consent of Data Subjects is obtained pursuant to Article 20 of the Constitution and Article 5 of the LPPD.
• Our Centre exercises the necessary care in processing and protecting special categories of personal data pursuant to Article 6 of the LPPD.
• The necessary mechanisms are established to allow Data Subjects to exercise their rights under Article 11 of the LPPD.
• When transferring personal data to third parties in Türkiye or abroad as required by the processing purpose, our Centre acts in accordance with Articles 8 and 9 of the LPPD, applicable legislation, and regulations of the Personal Data Protection Board.

In accordance with Article 7 of the LPPD and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, when the grounds requiring processing cease to exist, our Centre deletes, destroys, or anonymises personal data on its own initiative or at the Data Subject’s request. A Personal Data Retention and Destruction Policy has been prepared for this purpose.

2. Scope

This Policy covers all personal data relating to Data Subjects that is processed by automatic means or, provided that it forms part of a data filing system, by non-automatic means.

3. Implementation and Effective Date

The processing and protection of personal data is governed primarily by the LPPD and other applicable legislation. As legislation may change over time, our Centre may periodically amend and update this Policy.If any inconsistency arises between applicable legislation and this Policy, the applicable legislation shall prevail. Our Centre carries out the necessary work to comply with current legal requirements.The Policy prepared by Bahçeci entered into force on 15 October 2018. It is published on our Centre’s website at www.bahceci.com and is also provided to Data Subjects upon request. The Personal Data Protection Committee is responsible for implementing the Policy throughout the Centre. If the Policy is amended, its effective date and relevant provisions will be updated accordingly. The revision table appears in Annex 2.

4. Our Principles

Our Centre processes personal data according to the principles set out in Article 4 of the LPPD.

a. Lawful and Fair Processing

Our Centre acts in accordance with the principle of fairness, the LPPD, and other applicable legislation when processing personal data. Personal data is never collected or processed without the Data Subject’s knowledge. It is not used in a manner that would be unfair to the Data Subject or exceed the purpose for which it was collected. Processing is proportionate to the collection purpose.

b. Ensuring Accuracy and, Where Necessary, Keeping Data Up to Date

Taking account of the Data Subjects’ fundamental rights and its own legitimate interests, our Centre ensures that the personal data it processes is accurate and current and takes the necessary measures for this purpose. It has established systems enabling Data Subjects’ information to be maintained accurately and kept up to date.

c. Processing for Specified, Explicit, and Legitimate Purposes

Our Centre processes personal data for legitimate purposes consistent with the principle of fairness. It observes the principles of specificity and clarity in legal documents concerning data processing, including privacy notices and explicit-consent forms. Rather than relying solely on legal and technical terminology understandable only to specialists, it uses clear language that Data Subjects can understand. Data Subjects can therefore readily understand why their data is processed. Our Centre informs Data Subjects of the relevant processing purposes when their personal data is collected.

d. Processing That Is Relevant, Limited, and Proportionate to Its Purpose

Our Centre processes personal data only for specified and valid purposes. It does not process data for hypothetical future purposes that do not exist at the time of collection. For example, data collected for sales is not subsequently used for marketing without a separate notice; if data will be processed for a different purpose, Data Subjects receive separate information. Data irrelevant to the stated purpose is not processed—for example, information about patients’ family members is not collected for marketing purposes.

e. Retention for the Period Prescribed by Legislation or Required for the Processing Purpose

Our Centre retains personal data only for the period prescribed by applicable legislation or necessary for the processing purpose. It first determines whether legislation stipulates a retention period. Where such a period exists, it is observed; otherwise, data is kept only for as long as required for the purpose. Upon expiry of that period or when the grounds for processing cease to exist, data is deleted, destroyed, or anonymised. Personal data is not retained merely because it might be useful in the future.

5. Data Security

In accordance with Article 12 of the LPPD, our Centre implements the technical and administrative measures necessary to provide an appropriate level of security, prevent unlawful processing of or access to personal data, and ensure its lawful retention.Our Centre conducts or commissions the necessary internal audits pursuant to Article 12 of the LPPD. Non-compliance identified through these audits is reported to the relevant department, and appropriate action is taken to improve existing safeguards.Our Centre has established and activated a system to notify the affected Data Subject and the Personal Data Protection Board as soon as possible if personal data is unlawfully obtained by others. If deemed necessary by the Board, the incident may be announced on the Board’s website or by another method.The principal technical and administrative measures include:

• Planning technology investments required for personal-data security after assessing their costs.
• Employing personnel with appropriate technical expertise.
• Periodically reporting technical controls through the internal-audit mechanism, reassessing identified risks, and implementing necessary technological solutions.
• Installing software and hardware incorporating antivirus systems and firewalls.
• Using suitable backup programs to ensure secure data retention.
• Informing and training employees about personal-data protection law, lawful processing, and measures to prevent unlawful access. Training covers, among other matters, the prohibition on disclosing or using personal data contrary to the LPPD or outside its purpose, and the continuation of this obligation after employment ends.
• Reviewing personal data accessible to business units with assistance from an international consultancy and initiating corrective action where access appears unnecessary.
• Analysing all Centre activities by business unit and reflecting the results in a detailed, process-based personal-data inventory.
• Reviewing Centre documents for LPPD compliance, making necessary amendments, and preparing missing documentation.
• Preparing internal policies to supervise these measures and maintain continuity of implementation.
• Designing and implementing access and authorisation processes according to the legal requirements identified in the process-based inventory.
• Adding provisions to contracts with persons to whom personal data is lawfully transferred—such as service providers—requiring them to implement necessary security safeguards and ensure compliance within their organisations.
• Ensuring that patients receive an appropriate privacy notice and, where required, provide explicit consent before their personal data is processed.

6. Method of Processing Personal Data

Your personal data may be collected through our IVF centres, website, mobile or digital applications, social media, call centre, patient interviews, SMS, written or digital submissions to our website and other websites, support-service organisations, and other channels through which our Centre or authorised representatives contact or may contact you. In some cases, data may be obtained by accessing databases of institutions and organisations, within the limits permitted by applicable legislation and agreements and, where legally required, with your consent. Personal data may be processed through our social-media accounts and you may be contacted for communication, providing information about our services, answering questions, and marketing activities.Data collected by these methods may be processed and transferred within the conditions and purposes specified in Articles 5 and 6 of Law No. 6698. Personal data may also be processed through cookies used on Bahçeci’s website, bahceci.com.In accordance with Article 10 of the LPPD and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, our Centre provides Data Subjects with a privacy notice when obtaining their personal data. This notice identifies Bahçeci and, where applicable, its representative; explains the purposes of processing, recipients and transfer purposes, collection method and legal grounds; and sets out Data Subjects’ rights under Article 11. It also identifies the Data Subject groups whose data is processed, processing purposes, and retention periods.Explicit consent is another possible condition for processing. Where consent is required, our Centre enables the Data Subject to give consent freely, on an informed basis, and for a specified matter. As a rule, explicit consent is obtained in writing. Consent is not required where any condition in Articles 5(2) or 6(3) of the LPPD applies, including the following:

a. Express Provision by Law

Personal data may be processed without explicit consent where the relevant processing activity is expressly prescribed by law.Example: Documents requested from an employee to create a personnel file under Labour Law No. 4857.

b. Inability to Obtain Consent Due to Physical Impossibility

Personal data may be processed without explicit consent where processing is necessary to protect the life or physical integrity of the Data Subject or another person and the Data Subject cannot express consent because of physical impossibility or because consent would not be legally valid.Example: Sharing an injured employee’s blood-group information with the occupational physician.

c. Direct Relation to the Establishment or Performance of a Contract

The personal data of parties to a contract may be processed without explicit consent where processing is directly related and necessary to establish or perform that contract.Example: Recording an individual’s address to make a delivery.

d. Fulfilment of the Centre’s Legal Obligations

Personal data may be processed without explicit consent where necessary for our Centre, as data controller, to fulfil a legal obligation.Example: Processing employee data to prepare payroll records.

e. Data Made Public by the Data Subject

Personal data made public by the Data Subject may be processed without explicit consent, provided that processing remains limited to the purpose for which it was made public.Example: A person publicly sharing contact details for use in emergencies.

f. Establishment, Exercise, or Protection of a Right

Personal data may be processed without explicit consent where necessary for the establishment, exercise, or protection of a right.Example: Retaining evidentiary personal data—such as contracts and invoices—throughout the statutory limitation period and using it where necessary.

g. Legitimate Interests of Our Centre

Personal data may be processed where necessary for our Centre’s legitimate interests, provided that the Data Subject’s fundamental rights and freedoms are not prejudiced.Example: Processing employee-performance data to implement rewards and bonuses intended to increase employee engagement.

7. Processing Special Categories of Personal Data

Article 6 of the LPPD defines data concerning race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data as special categories of personal data subject to enhanced protection.In accordance with Article 10, our Centre informs Data Subjects when collecting special categories of personal data. The notice identifies Bahçeci and, where applicable, its representative; explains the processing purposes, recipients and transfer purposes, collection method and legal grounds; and sets out rights under Article 11. It also informs Data Subjects which groups’ special-category data is processed, for what purposes, and for how long.Special categories of personal data are processed with LPPD-compliant safeguards and appropriate audits. As a rule, explicit consent is obtained freely, specifically, and on an informed basis and is generally recorded in writing.However, pursuant to Article 6(3), consent is not required where a condition in Article 5(2) exists. Moreover, health and sexual-life data may be processed without explicit consent by persons under a duty of confidentiality or authorised institutions and organisations for protecting public health, preventive medicine, medical diagnosis, treatment and care, or planning and managing healthcare services and their financing. Because our Centre is a medical-treatment institution, it does not obtain separate explicit consent each time it processes health data necessary for a patient’s treatment during the treatment period.

8. Our Purposes for Processing Personal Data

Our Centre processes personal data for purposes including carrying out the work and related business processes necessary for its activities; ensuring the legal, technical, and commercial/occupational security of the Centre and persons with whom it has business relationships; planning and implementing commercial and business strategies; enabling Data Subjects to benefit from the Centre’s services; and planning and implementing human-resources policies and processes. These purposes include, without limitation:

• Planning and carrying out employee recruitment and termination processes and managing human-resources and personnel procedures.
• Planning and conducting subcontractor-personnel and call-centre processes and establishing the necessary organisation.
• Planning and managing communications.
• Conducting occupational health and safety processes.
• Providing service proposals, administering campaigns, and conducting market research.
• Managing patient-satisfaction processes.
• Planning and conducting personalised sales and marketing activities.
• Ensuring that activities comply with Centre procedures and applicable legislation.
• Conducting financial processes, financial research, and risk management relating to services received from our Centre, and planning and implementing those processes.
• Planning, auditing, and implementing corporate sustainability, governance, strategic planning, and information-security processes; ensuring business continuity; and conducting administrative operations.
• Performing work and managing relationships with business partners in sectors that vary according to need.
• Maintaining internal systems and application-management operations.
• Managing supplier and business-partner processes.
• Planning and conducting communications with patients and prospective patients.
• Creating and maintaining patient records and medical-treatment plans and arranging information and appointments.
• Conducting private health-insurance procedures to finance and plan healthcare services.
• Initiating and conducting treatment processes.
• Fulfilling legal obligations.
• Sharing medical data and health reports concerning patient history with relevant parties upon request.
• Managing procedures before public bodies such as the Ministry of Health, population directorates, and the Social Security Institution.
• Protecting public health and conducting preventive medicine, medical diagnosis, treatment, and care services.
• Communicating with Bahçeci centres abroad and conducting necessary activities.
• Analysing healthcare services for improvement.
• Monitoring and preventing misuse and unauthorised transactions.

Most activities and processes conducted for these purposes fall within Articles 5(2) and 6(3) of the LPPD and therefore do not require explicit consent. Where an activity or process does not fall within those provisions, the Data Subject’s explicit consent is obtained.

9. Transfer of Personal Data

To the extent necessary to achieve the purposes stated above and fulfil legal obligations, and provided that any disclosure remains limited to those purposes, your personal data may be shared with our suppliers and business partners from whom we receive services for our medical centre—including technical-support software companies and providers of medical diagnostic services such as ultrasound-equipment software—as well as the Ministry of Health and its affiliated units, family health centres, private insurers, the Social Security Institution, the General Directorate of Security and other law-enforcement bodies, the General Directorate of Population and Citizenship Affairs, other relevant public institutions, the Turkish Pharmacists’ Association, courts, laboratories and medical centres in Türkiye or abroad with which we cooperate for diagnosis, third-party healthcare providers, the healthcare institution to which a patient is referred or applies, your authorised representatives, the institution with which you are affiliated or for which you work, consultants including lawyers, tax advisers and auditors, regulatory and supervisory bodies, public authorities, systems in Türkiye or abroad, and companies within the group to which our medical centre belongs.Because Bahçeci uses cloud technology as part of the data economy and due to technical aspects of its operations, personal data may be transferred abroad.Your personal data may be stored and retained; classified for medical research, financial and operational processes, and marketing; updated periodically; and, to the extent permitted by law and subject to confidentiality principles, transferred to third parties, suppliers, service providers, and domestic or foreign shareholders as required for service delivery. Information may be transferred for reasons prescribed by applicable policies and authorities; stored and processed through reporting; and recorded or documented electronically or on paper. Transfers are made within the processing conditions and purposes specified in Article 8 of the LPPD for domestic transfers and Article 9 for transfers abroad.Where the conditions in Articles 5(2) and 6(3) are met, our Centre may transfer personal data and special categories of personal data without explicit consent after implementing the adequate safeguards prescribed by the Personal Data Protection Board.

10. Recipients of Personal Data and Transfer Purposes

In accordance with Article 10 of the LPPD, our Centre informs Data Subjects of recipient groups. The relevant recipients, scope, and purposes are as follows:

Recipient	Definition	Purpose of Transfer
Business Partner	Parties with whom our Centre establishes business partnerships for purposes such as selling, promoting, and marketing its services and providing after-sales support.	Limited to achieving the purposes for which the partnership was established.
Patient	Individuals to whom our Centre provides medical services.	Limited to providing treatment services to our patients.
Supplier	Parties that provide contractual services to our Centre in accordance with its instructions while it conducts commercial activities.	Limited to ensuring delivery of outsourced services necessary for our medical diagnosis and treatment activities.
Legally Authorised Public Institutions and Organisations	Public bodies authorised under applicable legislation to obtain information and documents from our Centre.	Limited to the purpose requested within the relevant body’s legal authority.
Legally Authorised Private-Law Persons	Private-law persons authorised under applicable legislation to obtain information and documents from our Centre.	Limited to the purpose requested within their legal authority, such as an occupational health and safety centre.

11. Retention Periods for Personal Data

Our Centre retains personal data and special categories of personal data only for the periods prescribed by the LPPD and other applicable legislation.If legislation does not specify a retention period, data is retained for a period determined according to the following criteria and is destroyed afterward:

• The period generally accepted as standard practice in the data controller’s sector for the relevant processing purpose.
• The duration of the legal relationship with the Data Subject that necessitates processing.
• The period during which the data controller’s legitimate interest remains valid lawfully and fairly in relation to the processing purpose.
• The period during which legal risks, costs, and liabilities arising from retention continue.
• Whether the maximum period is suitable for keeping the relevant data accurate and, where necessary, current.
• The period for which the data controller must retain the data to meet legal obligations.
• The statutory limitation period for asserting a right connected with the personal data.

If the processing purpose and applicable retention periods have ended, personal data may be retained solely as evidence in a potential legal dispute or to assert or defend a related right. Retention periods are determined by reference to applicable limitation periods and examples of previous requests made to our Centre on the same subjects after those periods had expired. Such retained data is not accessed for any other purpose and is accessed only when required for the relevant dispute. When this additional period ends, the data is deleted, destroyed, or anonymised.

12. Categories of Personal Data

Our Centre processes personal data under the following categories:

Personal Data Category	Description
Identity Information	All information in documents such as driving licences, identity cards, residence documents, passports, lawyer identity cards, and marriage certificates.
Contact Information	Telephone number, address, email address, social-media account, and similar information.
Patient Information	Health information obtained or generated about a Data Subject through operations conducted by our business units in connection with treatment services.
Family Members and Relatives	Information about a Data Subject’s family members and relatives processed to protect employees’ legal interests.
Transaction Security Information	Personal data processed to ensure technical, administrative, legal, and commercial security while conducting our activities.
Risk Management Information	Personal data processed using lawful, commercially customary, and fair methods generally accepted for managing technical and administrative risks.
Personnel Information	Personal data processed to obtain information forming the basis of employment-related rights of employees or other individuals working with our Centre.
Job Applicant Information	Personal data concerning individuals who apply to work at our Centre, are considered as candidates based on human-resources needs and commercial custom and fairness, or have a working relationship with the Centre.
Fringe Benefits and Entitlements	Personal data processed to plan benefits offered to employees and other persons working with the Centre, define objective eligibility criteria, and track entitlements.
Legal Transactions and Compliance	Personal data processed to establish and pursue legal claims and rights, perform obligations, meet statutory duties, and comply with Centre policies.
Audit and Inspection Information	Personal data processed in connection with statutory obligations and compliance with Centre policies.
Special Categories of Personal Data	Data specified in Article 6 of the LPPD.
Request and Complaint Management	Personal data relating to receipt and evaluation of requests or complaints submitted to our Centre.
Incident Management Information	Information and assessments concerning events that may affect our Centre, employees, or shareholders.
Visual and Audio Data	Photographs, CCTV footage, audio recordings, and data contained in copies of documents containing personal data.

13. Categories of Data Subjects

The Policy applies to the Data Subjects whose categories are described below. Persons outside these categories may also submit requests under the LPPD, and such requests will be evaluated under this Policy.

Data Subject Category	Description
Patient	Individuals receiving treatment services from our Centre.
Prospective Patient	Individuals who have requested or expressed interest in our services or are fairly and reasonably considered likely to have such an interest.
Visitor	Individuals who enter physical premises owned or used by our Centre for various purposes or visit our websites.
Third Party	Individuals associated with the parties described above to ensure transaction security or protect their rights and interests—such as guarantors, accompanying persons, family members, and relatives—or any other individual whose data our Centre must process for a specified purpose.
Job Applicant	Individuals who apply for work by any means or make their résumé and related information available for our Centre’s review.
Group Centre Employee	Representatives and employees of our group centres abroad.
Centre Official	Board members and other individuals authorised by our Centre, such as authorised signatories.
Employees, Shareholders, and Officials of Cooperating Institutions	Individuals working for, owning shares in, or authorised by institutions with which our Centre has a business relationship, including business partners and suppliers.

14. Personal-Data Processing at Bahçeci Offices

Security cameras are used to protect our Centre. Personal data is processed through CCTV monitoring and the recording of visitor entries and exits.The purposes of CCTV monitoring include improving service quality and reliability, protecting the life and property of our Centre, Data Subjects, and others, preventing misuse, and safeguarding the legitimate interests of those concerned. CCTV processing is conducted in accordance with the Constitution, the LPPD, and other applicable legislation.Under Article 4 of the LPPD, monitoring is relevant, limited, and proportionate to its purpose. Areas where surveillance could intrude on privacy beyond security needs, such as toilets, are not monitored. Data Subjects are informed of these activities. Explicit consent is not obtained because the Centre has a legitimate interest in the monitoring.In accordance with Article 12 of the LPPD, our Centre implements necessary technical and administrative safeguards for personal data obtained through CCTV monitoring.

15. Retention of Records Concerning Internet Access Provided to Visitors at Bahçeci Offices

For security and the purposes stated in this Policy, internet access may be provided on request to visitors while they are within our buildings and centres. Internet-access logs are recorded under Law No. 5651 and mandatory secondary legislation. They are processed only when requested by authorised public institutions or to fulfil legal obligations during internal audits.Only a limited number of Bahçeci employees may access these logs. They do so solely in connection with an authorised public-body request or an audit and share them only with legally authorised persons.

16. Deletion, Destruction, and Anonymisation of Personal Data

a. Bahçeci’s Obligation to Delete, Destroy, or Anonymise Personal Data

Under Article 138 of the Turkish Penal Code, Article 7 of the LPPD, and Article 7 of the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, personal data is deleted, destroyed, or anonymised on our Centre’s initiative or at the Data Subject’s request when the grounds requiring processing cease to exist, even if it was processed lawfully. These terms have the meanings assigned in that Regulation. A Personal Data Retention and Destruction Policy has been prepared accordingly.Where our Centre has a right and/or obligation to retain personal data under Article 5(2) of the LPPD, it reserves the right not to comply with a destruction request.

b. Deletion, Destruction, and Anonymisation Techniques

Deletion and destruction techniques

• Physical destruction: Personal data processed by non-automatic means as part of a filing system is physically destroyed so that it cannot subsequently be used.
• Secure deletion from software: Data processed wholly or partly by automatic means and stored digitally is deleted from the relevant software so that it cannot be recovered.
• Secure deletion by a specialist: In some cases, a specialist may be engaged to delete personal data securely and irrecoverably.
• Redaction: Personal data is rendered physically unreadable.

When applying these methods, Bahçeci complies fully with the LPPD, secondary legislation, and other applicable law and implements all administrative and technical measures necessary for data security.Anonymisation techniquesAnonymisation means rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even when matched with other data. Our Centre may anonymise lawfully processed data when the grounds requiring processing cease to exist.Under Article 28 of the LPPD, anonymised data may be processed for research, planning, statistics, and similar purposes. Such processing falls outside the LPPD and does not require the Data Subject’s explicit consent.Techniques commonly used by our Centre include:

• Masking: Deleting or replacing selected fields with asterisks so the person cannot be identified. Example: Replacing part of a credit-card number with asterisks.
• Aggregation: Converting data into cumulative totals. Example: Reporting that a workforce is 40% female and 60% male.
• Data derivation: Replacing detailed data with more general equivalents. Example: Replacing a full date of birth with the person’s age.
• Data swapping: Rearranging values within a dataset to remove identifiability without reducing overall utility. Example: Swapping employee-age values when calculating the average age of a workforce.

17. Rights of Data Subjects

Our Centre informs Data Subjects of their rights under Article 10 of the LPPD and explains how to exercise them. In accordance with Article 13, it maintains the necessary channels, internal processes, and administrative and technical arrangements to evaluate requests and provide information.

a. Data Subjects’ Rights

Data Subjects have the right to:

• Learn whether their personal data is processed.
• Request information if their personal data has been processed (click here for the information request form).
• Learn the processing purpose and whether the data is used in accordance with that purpose.
• Learn the identity of third parties to whom personal data has been transferred in Türkiye or abroad.
• Request correction of incomplete or inaccurate data and notification of that correction to recipients.
• Request deletion or destruction where the grounds for processing cease to exist and notification of that action to recipients.
• Object to an adverse result arising from analysis exclusively through automated systems.
• Claim compensation for damage caused by unlawful processing.

Requests concerning Article 11 rights may be submitted to our Centre free of charge by one of the following methods:

1. Complete the form at bahceci.com, sign it with a wet signature, and deliver it personally to Bahçeci Sağlık Hizmetleri A.Ş., Mahir İz Cad. No. 31, Floors 2–3, Altunizade, Istanbul.
2. Complete and wet-sign the form and send it through a notary to the same address.
3. Complete the application form, sign it with a secure electronic signature under Electronic Signature Law No. 5070, and send it by registered electronic mail to [email protected].

Third parties may not exercise Article 11 information rights on behalf of Data Subjects unless they present the original, wet-signed, notarised special power of attorney issued by the Data Subject for the relevant request.If a requested action entails an additional cost, our Centre will charge the fee specified in the tariff established by the Personal Data Protection Board. The payment method will be stated in the Application Form. Applications will not be considered if the fee is not paid by the prescribed method.

b. Right to Complain to the Personal Data Protection Board

Under Article 14 of the LPPD, if an application is rejected, the response is considered inadequate, or no response is provided in time, the Data Subject may lodge a complaint with the Board within thirty days of learning of our Centre’s response and, in any event, within sixty days of the application date.

18. Bahçeci’s Response to Applications

When a Data Subject submits a request, our Centre will conclude it as soon as possible and no later than thirty days, depending on its nature. Our Centre may request information or documents to verify that the applicant is the Data Subject and may ask questions to clarify the application.An application may be rejected with reasons in the following circumstances:

• Processing personal data for research, planning, or statistical purposes after anonymisation through official statistics.
• Processing for artistic, historical, literary, or scientific purposes or within freedom of expression, provided that it does not violate national defence, national security, public security, public order, economic security, privacy, or personality rights and does not constitute a criminal offence.
• Processing within preventive, protective, or intelligence activities conducted by legally authorised public bodies for national defence, national security, public security, public order, or economic security.
• Processing by judicial or enforcement authorities in connection with investigations, prosecutions, trials, or execution proceedings.
• Processing necessary to prevent a criminal offence or conduct a criminal investigation.
• Processing personal data made public by the Data Subject.
• Processing necessary for authorised public institutions or professional organisations with public-institution status to perform supervisory or regulatory duties or conduct disciplinary investigations or proceedings.
• Processing necessary to protect the State’s economic and financial interests concerning budgetary, tax, or financial matters.
• The request is likely to impede the rights and freedoms of others.
• The request requires disproportionate effort.
• The requested information is publicly available.

19. Relationship Between This Policy and Other Company Documents

This Policy is the principal regulation governing the processing of personal data by our Centre. It is intended to operate consistently with other policies, procedures, and processes prepared for similar purposes. If a conflict arises between such documents, this Policy will govern matters concerning personal-data processing.Bahçeci Sağlık Hizmetleri A.Ş. Mahir İz Cad. No. 31, Floors 2–3, Altunizade, Istanbul Trade Registry No. 370646-0 https://bahceci.com

Annex 1 — Abbreviations

Term	Meaning
Communiqué on the Obligation to Inform	Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, published in Official Gazette No. 30356 dated 10 March 2018.
Constitution	Constitution of the Republic of Türkiye No. 2709 dated 7 November 1982, published in Official Gazette No. 17863 dated 9 November 1982.
Data Subject(s)	Natural persons whose personal data is processed, including Bahçeci’s and/or its affiliated centres’ or subsidiaries’ patients, employees with whom it has commercial relations, business partners, shareholders, authorised persons, job applicants, interns, visitors, suppliers, employees of cooperating institutions, third parties, and other persons not limited to those listed.
Regulation on the Deletion, Destruction or Anonymisation of Personal Data	Regulation published in Official Gazette No. 30224 dated 28 October 2017 and effective from 1 January 2018.
LPPD	Personal Data Protection Law No. 6698, published in Official Gazette No. 29677 dated 7 April 2016.
Personal Data Protection Board	The Personal Data Protection Board.
Personal Data Protection Authority	The Personal Data Protection Authority.
Art.	Article.
e.g.	For example.
Policy	Bahçeci Sağlık Hizmetleri A.Ş. Personal Data Protection and Privacy Policy.
Centre/Bahçeci	Bahçeci Sağlık Hizmetleri A.Ş.
Turkish Penal Code	Turkish Penal Code No. 5237 dated 26 September 2004, published in Official Gazette No. 25611 dated 12 October 2004.

Annex 2 — Revision Table

The Policy is published as its first revision. The revision was made due to the Regulation on the Processing of Personal Health Data and Ensuring Privacy, the enforcement of which was suspended.

• We take into consideration all needs, expectations and rights of our patients at every step of the service we provide.
• Our basic principle in our Patient Satisfaction Policy is to provide superior patient experience and patient satisfaction by meeting the needs and expectations of our patients in a continuous and timely manner in accordance with health, safety and confidentiality of information.
• Our business processes and activities are based on our values ​​of honesty, moral integrity, professional ethics and respect for people, which are included in our general business principles and essence.
• Patient suggestions and complaints are managed within the framework of these values ​​​​and are evaluated fairly, impartially and in accordance with legal requirements, with a patient satisfaction-oriented perspective.
• We provide our patients with clear and concise information about their medical processes.
• We transform the feedback and complaints we receive into value-creating opportunities for self-improvement.
• We aim to continuously increase patient satisfaction by continuously improving our medical and administrative systems.

Best regards, BAHÇECİ HEALTH GROUP INC.October 2016

As Bahçeci Health Group, all our colleagues working in 13 centers in 7 countries where we operate have equal rights regardless of language, race, color, gender, political opinion, belief, religion, sect, age, physical disability or any other reason.All our employees are members of the Bahçeci family and have the right to work in a safe environment in working conditions that are in line with human dignity, which is the highest value we have. We believe in the indisputable necessity of human rights and are committed to treating our employees fairly and honestly.We take precautions to prevent the waste generated as a result of our work from threatening the health of patients and employees, and ensure that appropriate waste is recycled. We deliver non-recyclable waste to the relevant institutions for disposal in accordance with laws and regulations.We are aware of our responsibilities towards society. Therefore, in accordance with our social responsibility policy, which we have determined by focusing on what is best for society and the environment, we take initiatives to improve society and environmental conditions.  

The basic principles we have determined within the scope of our social responsibility policy are as follows:

• We fulfill our responsibilities to the state, such as taxes, etc., on time, accurately and in accordance with the principle of transparency.
• We consider our social responsibility activities as a priority and sustainable duty.
• We consider it one of our most important tasks to obtain all international standards and quality certificates that will enable us to protect the present and investors in the future of our employees, society and the environment.
• We act in accordance with the principles of integrity and reliability in our relations with society in all geographies where we operate.
• We continue to conduct scientific studies to improve reproductive health without interruption, and we continuously develop our scientific infrastructure and knowledge. We present the information that emerges as a result of our contributions to science, and whose validity and usefulness have been proven, to the service of society.
• We encourage our employees to take part in social responsibility projects and take their suggestions into consideration when choosing the projects we will support.
• We prioritize health and education issues in our social responsibility activities.
• We act together with the Reproductive Health Protection Association (ÜRSAK) in our social responsibility projects regarding reproductive health.