Protection and Processing of Personal Data

Privacy Notice and Explicit Consent Form

1.Identity of the Data Controller

Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"/the "Law"), your personal data is processed by Op. Dr. Merve Selimbabaoğulları (the "Clinic" or "Data Controller"), acting as data controller, in accordance with the purposes and scope described in this Privacy Notice, and in compliance with the law and the principle of good faith.

2.Purposes of Processing Personal Data

The personal data collected by the Clinic is processed primarily for the purpose of carrying out aesthetic/plastic surgery and health tourism services provided to patients coming from within Türkiye and abroad (including the United Kingdom, the United States and other countries), and specifically for the following purposes:

• Receiving your appointment request and planning and carrying out the preliminary consultation process,
• Planning, performing and following up medical diagnosis, treatment and care services (including pre- and post-operative process management),
• Coordinating travel, accommodation and companion arrangements for patients coming from abroad within the scope of health tourism,
• Ensuring communication between the patient and the Clinic (including telephone, WhatsApp, e-mail and video calls),
• Storing before/after photographs and images for medical record purposes; where patient consent has been obtained, using such images as reference/marketing material,
• Measuring patient satisfaction and evaluating complaints and suggestions,
• Carrying out invoicing, collection and financial processes,
• Keeping the records required by applicable legislation (Ministry of Health regulations, health tourism legislation, accounting and tax legislation, etc.) and responding to requests from competent authorities,
• Where your explicit consent has been obtained, sending promotional, campaign, newsletter and digital marketing communications (e-mail, SMS, WhatsApp),
• Improving user experience and analysing website performance through data collected via the contact form, live support and cookies on the website (merveselim.com),
• Ensuring occupational health and safety and the security of the Clinic (including CCTV footage, if any).

3.Categories of Personal Data Processed

Within the scope of our services, your personal data may be processed under the following categories:

• Identity Information: Full name, date of birth, nationality, passport/ID number (for patients from abroad).
• Contact Information: Phone number, e-mail address, address, country/city information.
• Health Information (Special Category Personal Data): Medical history, current health status, allergy and medication information, surgery/operation notes, before-and-after photographs and images, laboratory/test results.
• Visual and Audio Records: Photographs taken during consultation, video call recordings (if any), clinic CCTV footage.
• Financial Information: Invoice information, payment/collection records (card details are not stored by the Clinic; they are processed through payment institutions).
• Transaction Security and Marketing Information: Website cookie data, IP address, device/browser information, contact form records, marketing consent/preferences.
• Travel and Accommodation Information: Flight details, accommodation preferences, companion information (within the scope of health tourism coordination).

4.Method of Collection and Legal Basis

Your personal data is collected through contact/appointment forms on our website (merveselim.com), our WhatsApp Business line, phone calls, e-mail correspondence, social media messaging tools, in-clinic registration forms and face-to-face meetings, by partly or fully automated means, or by non-automated means provided that they form part of a data recording system.

Your personal data is processed based on the following legal grounds set out in Article 5 of the KVKK:

• Being directly related to the establishment or performance of a contract (the treatment/service agreement),
• Being mandatory for the data controller to fulfil its legal obligations (health legislation, accounting/tax legislation),
• Being mandatory for the legitimate interests of the data controller, provided that this does not harm your fundamental rights and freedoms,
• Being mandatory for the establishment, exercise or protection of a right,
• Your explicit consent (in particular with respect to health data, marketing communications and the use of images for reference purposes).

5.Processing of Special Category Personal Data (Health Data)

Under Article 6 of the KVKK, health data is considered special category personal data, and may be processed without the explicit consent of the data subject only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and financing of healthcare services, by persons under an obligation of confidentiality or competent public institutions and organisations.

The Clinic processes your health data directly related to the treatment process under this exception; processing activities falling outside this exception (for example, the use of images for promotional/reference purposes, or sharing information with third parties within the scope of health tourism coordination) are carried out on the basis of your separately obtained explicit consent. The Explicit Consent Form is set out at the bottom of this page.

6.Transfer of Personal Data

Your personal data may be transferred to the following recipient groups, limited to the purposes set out above and subject to the necessary technical and administrative measures:

• Other healthcare professionals, anaesthesiologists, hospitals and laboratories involved in the treatment process,
• Travel agencies, accommodation facilities and transfer/companion service providers engaged within the scope of health tourism,
• Service providers managing the Clinic's digital marketing, website and CRM infrastructure (acting as data processors, under contractual and confidentiality obligations),
• Payment institutions and financial/accounting service providers,
• Competent public authorities (Ministry of Health, courts, law enforcement, etc.), for the fulfilment of legal obligations.

Because the Clinic accepts patients from abroad and its digital infrastructure services (website hosting, e-mail, CRM, cloud storage, etc.) are, in part, operated through servers located outside Türkiye, your personal data may be transferred abroad in accordance with Article 9 of the KVKK, the list of countries with adequate protection determined by the Turkish Personal Data Protection Board, and appropriate safeguard mechanisms (such as standard contractual clauses or undertakings). Where required, your explicit consent will be additionally requested for such transfers.

7.Use of Cookies on the Website

The website merveselim.com uses essential cookies required for the site to function properly, as well as, where your consent has been obtained, analytical and marketing cookies used to improve user experience, analyse site traffic and carry out promotional/retargeting activities.

• Essential Cookies: Required for the core functions of the website (form submission, language preference, etc.) to work; do not require consent.
• Analytical Cookies: Used to analyse visitor behaviour on an anonymous/statistical basis (e.g. Google Analytics).
• Marketing/Advertising Cookies: Used to display advertisements tailored to your interests and for retargeting purposes (e.g. Meta/Google Ads pixels); activated only with your consent.

You may change your cookie preferences at any time via the cookie consent banner/management panel on the site or through your browser settings.

8.Retention Period

Your personal data is retained for the periods stipulated by applicable legislation (for example, a minimum of 20 years for patient records under the Regulation on Personal Health Data, and 10 years for financial records under accounting and tax legislation) and for as long as required by the purpose of processing. Upon expiry of these periods, your personal data is deleted, destroyed or anonymised in accordance with the Clinic's personal data retention and destruction policy.

9.Rights of the Data Subject (Article 11 of the KVKK)

Under Article 11 of the KVKK, you may apply to the Clinic to exercise the following rights:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing and whether your data is used in accordance with that purpose,
• To know the third parties, in Türkiye or abroad, to whom your personal data has been transferred,
• To request the correction of your personal data if it has been processed incompletely or incorrectly,
• To request the deletion or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK,
• To request that the correction, deletion or destruction carried out pursuant to the above be notified to third parties to whom your personal data has been transferred,
• To object to a result that is to your detriment arising from the analysis of processed data exclusively through automated systems,
• To request compensation for damages you suffer due to the unlawful processing of your personal data.

10.Method of Application

You may submit your requests regarding the rights set out above, in accordance with Article 13 of the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller:

• In writing, to Caddebostan, Bağdat Cad. No:264, 34728 Kadıköy/Istanbul, Türkiye, in person, through a notary public, or by registered mail with acknowledgement of receipt,
• By e-mail, from the e-mail address registered in our system, to info@merveselim.com,
• In writing, via our WhatsApp line at +90 532 385 64 32.

Your application will be concluded free of charge within thirty (30) days at the latest, depending on the nature of the request; however, where the transaction requires an additional cost, a fee may be charged in accordance with the tariff determined by the Turkish Personal Data Protection Board.

---

Explicit Consent Form

I confirm that I have read the Privacy Notice set out above and that I have been informed of the personal data processing activities to be carried out by Op. Dr. Merve Selimbabaoğulları as data controller. In this context, I consent to:

• My before/after photographs and images being used as reference/example material on the Clinic's website, social media accounts and promotional materials, in a manner that does not disclose my identity and/or in accordance with the preference I have explicitly indicated,
• My health data (including medical history, treatment notes and test results) being processed for the purpose of planning the treatment process, coordinating health tourism, and being shared with relevant third parties (such as travel/accommodation providers, interpreters and companion service providers),
• My personal data being transferred abroad due to the fact that the digital infrastructure services are hosted on servers located outside Türkiye,
• Being sent commercial electronic communications by e-mail, SMS and/or WhatsApp for appointment reminders, campaigns, newsletters and promotional purposes,

The above declaration of explicit consent has been given freely, on an informed basis and in an unambiguous manner by the data subject, and may be withdrawn at any time through the same methods. Withdrawal of explicit consent does not affect the lawfulness of processing activities carried out lawfully prior to the date of withdrawal.