Personal Data Destruction Policy

Este Medical Group Health and Consultancy Services Inc. (data controller) stores and destroys personal data in compliance with the Personal Data Protection Law No. 6698, the Regulation on the Deletion, Destruction, or Anonymization of Personal Data, and other relevant legislation. Personal data is managed and destroyed following the general principles and regulations specified in this Personal Data Retention and Destruction Policy.

This Policy aims to define general principles regarding the storage and destruction of personal data processed under the Personal Data Protection Law (KVKK) and to fulfill legal obligations.

Explicit Consent: Consent based on information and freely given for a specific subject.

Recipient Group: The category of real or legal persons to whom personal data is transferred by the data controller.

Anonymization: Making personal data unidentifiable, even when matched with other data, ensuring it cannot be associated with any identifiable person.

Relevant User: Persons processing personal data within the data controller organization, except for individuals or units responsible for the technical storage, protection, and backup of the data.

Destruction: The deletion, destruction, or anonymization of personal data.

Personal Data: Any information relating to an identifiable or identified individual (e.g., name-surname, National ID, email, address, date of birth, credit card number, bank account number).

Data Subject: The individual whose personal data is processed.

Processing of Personal Data: Any operation performed on personal data, including obtaining, recording, storing, maintaining, modifying, rearranging, disclosing, transferring, or preventing the use of data, partially or fully by automated or manual means as part of a data recording system.

Sensitive Personal Data: Data on race, ethnicity, political opinion, philosophical belief, religion, sect, attire, association or union membership, health, sexual life, criminal convictions, security measures, and biometric and genetic data.

Periodic Destruction: Deletion, destruction, or anonymization of personal data at regular intervals as outlined in this Policy, upon the expiration of the conditions for processing personal data.

Data storage media covered by the policy

This policy applies to all personal data processed under the KVKK, including both physical and digital copies. Personal data processed under the KVKK is stored in the following media:

• Company computers, email accounts, desktop computers, employee devices (e.g., mobile phones), backup areas, paper files, folders, visitor logs, CDs, DVDs, USBs, hard drives, printers, photocopiers, etc.

‍Reasons for retention and destruction of personal data

The following principles are fundamental in personal data processing activities:

• Compliance with the law and the principle of honesty,
• Ensuring personal data is accurate and, if necessary, kept up to date,
• Processing for specified, explicit, and legitimate purposes,
• Limiting data processing to relevant and necessary purposes,
• Retention only for the period required by relevant legislation or for the purpose for which it is processed.

Our company retains and uses personal data based on the purposes and conditions specified in Articles 5 and 6 of the KVKK. When the conditions for data processing cease to exist, personal data will be destroyed at the data subject’s request or automatically.

‍Conditions for destruction of personal data‍

Personal data will be deleted, destroyed, or anonymized by the company under the following conditions:

• When the legal basis for processing is amended or repealed,
• When the purpose of processing or storing data is no longer applicable,
• When the data subject withdraws their explicit consent, if data processing is based solely on consent,
• When the maximum retention period has expired, and there are no other conditions justifying longer retention.

In cases where the Personal Data Protection Board does not make a contrary decision, our company selects the appropriate method of destruction (deletion, destruction, or anonymization) based on technological capabilities and application costs. If requested by the data subject, the rationale for the chosen destruction method is explained. All necessary technical and administrative measures are taken for each type of destruction process.

Technical and administrative measures

In accordance with Article 12 of the KVKK, the Regulation, the general principles, and this Policy, our company takes the necessary technical and administrative measures based on available technology and costs, including:

• Identifying necessary software and hardware, using strong passwords on computers and email accounts.
• Training personnel on data protection, formalizing responsibilities in employment contracts, and confidentiality obligations continue post-employment.
• Establishing an infrastructure for data backups.
• Designating authorized employees to access data.
• Providing customer files and information only to relevant persons, authorized public institutions, and judicial authorities within the legal framework.
• Fulfilling the obligation to inform individuals before processing personal data.
• Preparing a personal data processing inventory.

‍Retention and destruction periods‍

Our company retains and destroys personal data only for the period required by the relevant legislation or the purpose for which it is processed. If a data subject requests the destruction of their personal data, the following applies:

• If all conditions for processing personal data no longer exist: The request will be fulfilled within thirty days, and the data subject will be informed. If the data has been transferred to third parties, they will be notified to take necessary actions.
• If not all conditions for processing personal data have expired: The request may be rejected under Article 13, paragraph 3 of the KVKK, and the data subject will be informed in writing or electronically within thirty days.

‍Periodic destruction times

The periodic destruction of personal data is performed at six-month intervals, with the first periodic destruction occurring after the date the obligation to destroy data arises.

—

| Process | Retention Period | Destruction Time |

| --- | --- | --- |

| Contract Preparation | 10 years from the end of the contract | First periodic destruction following the retention period |

| Human Resources Processes | 10 years from the end of the activity | First periodic destruction following the retention period |

| Access to Hardware and Software | 5 years | First periodic destruction following the retention period |

| Visitor and Meeting Participant Records | 5 years | First periodic destruction following the retention period |

| Personal Health Data | As specified by legislation | First periodic destruction following the retention period |

| Identity Data | As specified by legislation | First periodic destruction following the retention period |

| Camera Footage | At least 2 months as required by the Private Hospitals Regulation | First periodic destruction following the retention period |

This Policy is deemed effective upon publication on the website.