DATA BREACH INCIDENT RESPONSE PLAN

1. PURPOSE, SCOPE AND LEGAL BASIS

Pursuant to Article 12(5) of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), where personal data processed are obtained by others through unlawful means, the data controller must notify the data subject and the Personal Data Protection Board ("Board") as soon as possible; where necessary, the Board may announce the breach on its website. This Data Breach Incident Response Plan ("Plan") sets out the steps, roles, timelines and record-keeping arrangements for the detection, assessment, containment, notification and remediation of a personal data breach at TREATX Medikal Turizm Sanayi ve Ticaret A.Ş. ("TreatX" or the "Company").

The Plan covers all personal data processed by the Company both as data controller (Platform membership, booking and transaction records, payment flows, marketing and employee data) and as data processor (hosting and transmission of health files on behalf of Service Providers); all electronic and physical recording environments; and all employees, managers, interns, subcontractor personnel and suppliers processing personal data on behalf of the Company under contract.

Legal basis: Article 12 of the KVKK; the Board's Decision No. 2019/10 dated 24 January 2019 on the Procedures and Principles for Personal Data Breach Notification (72-hour rule, notification obligations of data processors, overseas data controllers, and the requirement to prepare and periodically review a data breach response plan); the Board's Decision No. 2019/271 dated 18 September 2019 (minimum elements of notification to data subjects); the Board's Decision No. 2018/10 (special categories of personal data); and the Personal Data Security Guide. This Plan shall be applied together with the Security Policy, the Policy on the Protection and Processing of Special Categories of Personal Data, and the Personal Data Retention and Destruction Policy.

2. DEFINITIONS

3. EVENTS CONSIDERED BREACHES AND EXAMPLES

The following and similar events are treated as personal data breaches and are subject to this Plan:

• Unauthorised access to the Platform database, administration panel or cloud accounts; compromise of passwords, API keys, sessions or access tokens;
• A request file or content containing health data being sent to the wrong Service Provider; one Service Provider being able to access another Service Provider's request or patient data (data isolation failure);
• Before/After (B/A) images becoming visible on a channel or to persons outside the scope of the relevant consent (authorisation or publication error);
• A software error causing one user to see another user's account, booking or message data;
• An email, message or file containing personal data being sent to the wrong recipient; oral or written disclosure of personal data to unauthorised persons;
• Theft or loss of a Company device, portable storage device or paper file containing personal data;
• Ransomware, malware, denial-of-service or similar cyberattacks; loss of data for which no backup exists;
• Breaches at hosting, email, payment infrastructure or similar suppliers affecting Company data;
• A breach at a Service Provider affecting patients originating through the Platform;
• An employee accessing personal data beyond their duties and authorisation, copying it or taking it outside the Company (insider threat).

4. ROLES AND INCIDENT RESPONSE TEAM

Every employee, supplier and Service Provider who becomes aware of an actual or suspected breach must report it immediately and without delay through the channel specified in Section 5.1. No sanction shall be imposed for a report made in good faith; delaying or concealing a report is subject to disciplinary provisions.

The 24/7 contact details of Team members and alternates are maintained in the contact list annexed to this Plan and updated at least every [6] months (ANNEX 4: Contact List).

5. INCIDENT RESPONSE PROCESS

5.1 Detection and internal reporting

Any person who becomes aware of an incident shall immediately report it to the Data Protection Officer via support@treatx.health / emergency line: +90 531 6388295; outside business hours, the alternate contact listed in the contact list shall be contacted. The internal report shall contain the minimum information in ANNEX 2; missing information shall not delay reporting and may be completed later. The 72-hour period foreseen for notification to the Board starts when the Company becomes aware of the breach; delays in internal reporting do not extend this period. A breach notification received from a supplier or Service Provider is routed through the same channel and the time of receipt is recorded as the time of awareness.support@treatx.health

5.2 Preliminary assessment and classification

Within no more than [4] hours after receiving the internal report, the Data Protection Officer performs a preliminary assessment: whether an actual breach has occurred, affected systems, categories of data (distinguishing special categories), estimated number of persons and records affected, and whether the incident is ongoing. An incident number is assigned and entered in the Breach Register. If suspicion of a breach remains, the Team convenes. Senior Management is informed at the same stage for incidents involving health data, financial data or a large number of persons.

5.3 Containment and preservation of evidence

Under the Team's supervision, measures to stop and mitigate the effects of the breach are taken immediately: terminating unauthorised access and resetting affected accounts, keys and passwords; isolating affected systems; recalling incorrectly transmitted content and obtaining confirmation of destruction from the recipient; immediately removing content from the Platform in publication or authorisation failures; and restoring from backups where necessary. Logs, system images and other evidence are preserved unchanged and time-stamped for potential judicial proceedings and Board inspection; containment measures must not be implemented in a way that destroys evidence.

5.4 Risk assessment

The Team evaluates the nature and cause of the breach, the type and sensitivity of affected data, the number of persons and records affected, categories of data subjects, the extent to which measures taken reduce the impact (for example, encryption), and potential consequences for data subjects (identity theft, fraud, discrimination, reputational damage, physical safety), and classifies the breach as follows:

Company rule: every breach involving health data is handled as high risk regardless of scope (Policy on the Protection and Processing of Special Categories of Personal Data, Section 10). Where there is doubt as to whether notification to the Board is required, the decision shall favour notification.

5.5 Notifications

(a) Notification to the Board. The breach shall be notified without delay and no later than 72 hours after awareness, using the Personal Data Breach Notification Form in the Breach Notification Portal. The notification shall include when the breach occurred and was detected, how it occurred, affected data categories and estimated numbers of persons/records, likely consequences, measures taken and planned, and contact-person details. If all information cannot be provided at once, notification shall be made in phases; if notification cannot be made within 72 hours, reasons for the delay shall accompany the notification. Public communications shall be prepared in accordance with Section 8, taking into account that the Board may announce the breach on its website.

(b) Notification to data subjects. As soon as affected data subjects are identified, they shall be notified within the shortest reasonable time, directly through the email address or telephone number registered in the system or by Platform notification; where direct contact is not possible, by an appropriate method such as a notice published on the Platform. The notification shall be sent with the approval of the Data Protection Officer, in clear and plain language, in the data subject's account language (Turkish/English), and shall contain the minimum elements in ANNEX 3. The support channel shall be prepared for breach-related questions before notification.

(c) Notification as data processor (to Service Providers). If the breach affects health files hosted or transmitted by the Company on behalf of a Service Provider, the Company shall notify the affected Service Provider without delay and no later than [24] hours, in accordance with Board Decision No. 2019/10, using the content in ANNEX 2 and a verified channel. For such data, notification to the Board and patients is the responsibility of the Service Provider (data controller), and the Company shall provide the information and support required for those notifications. If the same incident also affects records for which the Company is the data controller (account, booking, consent records, message metadata), the Company shall make its own Board and data-subject notifications separately and in parallel; the two notifications shall cross-reference each other and remain consistent.

(d) Notifications received from suppliers and Service Providers. Under data processing agreements and the Service Provider membership agreement, breaches at suppliers and breaches at Service Providers affecting patients originating through the Platform must be notified to the Company without delay and no later than [24] hours. The Company routes the notification through the channel in Section 5.1; where data for which the Company is responsible are affected, the 72-hour period begins when the notification is received. Where a breach at a Service Provider established abroad affects data subjects resident in Türkiye, the membership agreement shall remind that Service Provider of its notification obligations to the Board and the Company shall confirm that notification has been made.

(e) Other notifications. Depending on the nature of the incident, the Team assesses whether the following notifications are required and records its decision in the Breach Register:

5.6 Review and remediation

Within no more than [15] days after containment of the incident, the Team prepares a closure report covering the incident timeline, root-cause analysis, affected data and persons, measures taken and their effectiveness, notifications made, additional technical and administrative actions required, need for policy/procedure updates, training needs, and resource/infrastructure investment needs. The report is submitted to Senior Management, added to the Breach Register, and lessons identified are reflected in the next exercise scenario.

6. BREACH REGISTER AND DOCUMENTATION

All security incidents and breaches, whether or not notified to the Board, are entered in the Breach Register and kept ready for Board inspection. Each record shall contain at least: incident number; dates and times of occurrence, detection, awareness and internal reporting; description and cause of the incident; affected systems, data categories and numbers of persons/records; risk level and rationale; measures taken; notifications made and not made (recipient, date, rationale); and closure report. The Breach Register and incident files are retained for 10 years from closure of the incident in accordance with the Personal Data Retention and Destruction Policy; access is restricted to the Data Protection Officer and Legal.

7. PREVENTIVE MEASURES, TRAINING AND EXERCISES

In addition to the technical and administrative measures in the Security Policy, the following practices are carried out to reduce breach risk:

• Central collection of access and transaction logs, alert thresholds for anomalous access, and regular log reviews;
• Testing of data isolation between Service Providers and B/A publication permissions with every release and additionally at least once per year;
• Controls preventing incorrect recipients in health-file transmission (recipient confirmation, pre-transmission verification) and wrong-recipient warnings in corporate email;
• Backup and restore testing; encryption on portable devices and storage media; remote wipe capability;
• A breach notification period of [24] hours, cooperation and information obligations in supplier data processing agreements and the Service Provider membership agreement;
• Annual awareness training for all employees (including phishing simulations) and Plan training at onboarding; retention of training records;
• At least one annual tabletop exercise using a realistic scenario (e.g. health file sent to the wrong Service Provider, ransomware, supplier breach); recording results and remediation decisions in the Breach Register.

8. CONFIDENTIALITY, COMMUNICATION DISCIPLINE AND SANCTIONS

Incident information is shared only with the Team and assigned persons on a "need-to-know" basis. Only the single spokesperson designated by Senior Management is authorised to make external statements concerning the incident, and such statements are subject to Legal review. Employee conduct contrary to this Plan (failure to report, delay, destruction of evidence, unauthorised disclosure) is subject to disciplinary procedures; breaches by suppliers and Service Providers are subject to contractual sanctions and, where necessary, legal remedies. Confidentiality undertakings under the Special Categories of Personal Data Policy also apply to incident-response processes.

9. EFFECTIVE DATE AND REVIEW

This Plan entered into force on 5 October 2026 by decision of the competent corporate body. The Plan shall be reviewed at least annually, and also after every significant incident and exercise, following material product/infrastructure changes and upon changes in legislation (including the general KVKK reform agenda); the contact list shall be updated at least every [6] months. Changes in legislation apply directly even if this Plan has not yet been updated.

ANNEX 1: RESPONSE FLOW AND TIMELINE

ANNEX 2: INTERNAL BREACH REPORT FORM — MINIMUM CONTENT

ANNEX 3: NOTIFICATION TO DATA SUBJECT — MINIMUM ELEMENTS AND TEMPLATE

Pursuant to Board Decision No. 2019/271, notification to the data subject shall be made in clear and plain language and shall contain at least the following elements:

ANNEX 4: CONTACT LIST