PERSONAL DATA RETENTION AND DESTRUCTION POLICY

1. PURPOSE, SCOPE AND LEGAL BASIS

This Personal Data Retention and Destruction Policy ("Policy") sets out the procedures and principles governing the deletion, destruction or anonymisation, at the end of the periods prescribed by applicable legislation or required by the purpose of processing, of personal data processed within the TreatX Health platform ("Platform") operated by TREATX Medikal Turizm Sanayi ve Ticaret A.Ş. ("TreatX" or the "Company" — MERSİS: 0859154003100001; Adalet Mah. Manas Blv. No: 47B, İç Kapı No: 2809, Bayraklı/İzmir), and establishes the minimum Company-wide standard applicable to all personal data held in data recording media.

The Policy covers Service Recipients, Service Provider representatives and employees, Company employees and job applicants, visitors, and all other groups of data subjects whose personal data are processed by the Company; it is binding on all Company personnel, suppliers and subcontractors processing personal data on behalf of the Company.

Legal basis: Article 7 of Law No. 6698 on the Protection of Personal Data ("KVKK"); the Regulation on the Deletion, Destruction or Anonymisation of Personal Data (Official Gazette No. 30224 dated 28.10.2017 — the "Regulation"); and the anonymisation and data security guidance of the Personal Data Protection Board (the "Board").

Pursuant to Article 5 of the Regulation, data controllers subject to the obligation to register with the Data Controllers Registry ("VERBİS") are required to prepare and publish this Policy; under the 2026 thresholds, the registration obligation varies depending on whether the Company's principal field of activity is classified as "processing special categories of personal data" [VERBİS registration status and threshold determination: ....]. Until the scope of the registration obligation is clarified, the Company has put this Policy into effect as a precautionary measure in accordance with the principles of transparency and good practice.

2. DEFINITIONS

3. DATA RECORDING MEDIA

Personal data are retained with the level of care required by the Regulation in the following media:

• Electronic media: Platform databases and application servers; backup systems and cloud storage infrastructure; corporate e-mail and Registered Electronic Mail (KEP) accounts; customer relationship, support and messaging software; payment and invoicing systems; access and transaction logs; and, in exceptional and recorded cases, portable memory/external disks;
• Physical media: employee personnel files; wet-ink signed copies of agreements and offers; incoming/outgoing correspondence and archive records [office/archive address: Adalet Mah. Manas Blv. No: 47B, İç Kapı No: 2809, Bayraklı / İzmir].

Technical and administrative measures concerning the security of data recording media are separately regulated in the Security Policy and, in respect of special categories of personal data, in the Policy on the Protection and Processing of Special Categories of Personal Data; without repeating those measures, this Policy focuses on retention and destruction principles.

4. LEGAL AND PROCESSING GROUNDS REQUIRING RETENTION

Personal data are retained for the period required by the relevant ground where one or more of the following grounds exist:

• Contractual ground: where necessary for the establishment and performance of the Distance Service Agreement with the Service Recipient and for monitoring liabilities arising from defects;
• Legal obligation: compliance with minimum retention periods prescribed by tax, commercial, e-commerce (Law No. 6563), labour and social security, and electronic communications (Law No. 5651) legislation;
• Explicit consent: continuation, within the scope of the consent and until it is withdrawn, of processing based on the data subject's explicit consent (e.g. Before/After images, candidate pool, marketing communications);
• Establishment, exercise or protection of a right: retention with restricted access for evidentiary and defence purposes during the general limitation period (10 years pursuant to Article 146 of the Turkish Code of Obligations);
• Legitimate interest: ensuring service quality and Platform security and preventing fraud and misuse (KVKK Article 5/2(f)), subject to the principle of proportionality.

5. GROUNDS REQUIRING DESTRUCTION

Pursuant to Article 7 of the Regulation, where any of the following circumstances occurs, personal data are deleted, destroyed or anonymised by the Company ex officio or upon the request of the data subject:

• amendment or repeal of the legislative provisions constituting the basis for processing;
• the purpose requiring processing or retention ceases to exist;
• withdrawal by the data subject of the explicit consent on which the processing of personal data is based;
• the Company finds the data subject's request justified, decides to delete, destroy or anonymise the data, and notifies the data subject of that decision;
• following rejection of the data subject's request, an inadequate response, or failure to respond within the period prescribed by the Regulation, the matter is referred to the Board, the Board finds the request justified and decides accordingly, and that decision is served on the Company;
• the maximum period requiring retention of the personal data has expired and there is no other ground justifying longer retention.

6. ROLES AND RESPONSIBILITIES

The [data protection contact person/committee] is responsible for implementing the Policy and operating the periodic destruction process; the Information Systems/IT unit carries out technical destruction, the HR unit handles employee and candidate data, the Legal unit handles data subject requests, and the team responsible for Service Provider relations manages destruction confirmations from suppliers/Service Providers.

7. RETENTION PERIODS TABLE

Category-based retention periods are set out below so as to correspond exactly with the relevant Privacy Notices:

The periods above correspond exactly with those stated in the relevant Privacy Notices; when one document set is updated, the other is revised simultaneously. At the end of these periods, if no other ground justifying retention remains, the data are deleted, destroyed or anonymised in the periodic destruction cycle described in Section 8.

8. PERIODIC DESTRUCTION PERIOD AND PROCEDURE

Pursuant to Article 11 of the Regulation, the periodic destruction interval may not exceed six months; the Company carries out periodic destruction under this Policy ex officio twice each year, in [June and December]. During each periodic destruction cycle, all personal data (including backups) for which the periods in Section 7 have expired and for which no other ground justifying retention remains are reviewed, the appropriate destruction method is determined, and the operation is recorded.

Deletion, destruction or anonymisation carried out upon the request of a data subject is completed, without waiting for the periodic destruction cycle, as soon as possible and no later than 30 days depending on the nature of the request pursuant to KVKK Article 13, and the data subject is informed; where the request is rejected, the grounds are notified in writing or electronically.

Each destruction operation is retained in the destruction register for at least [3] years, including the category of data destroyed, the date and method of destruction, and the unit/person performing the operation; these records do not themselves contain personal data.

9. DESTRUCTION METHODS

9.1. Deletion

Deletion means rendering personal data inaccessible and unusable in any way by the relevant users. In practice, this includes permanently removing the relevant database rows or revoking access rights from all users, deleting the relevant files and directories at operating-system level on file servers, and using redaction/cutting methods for paper records. Deleted data may remain in backups for a period due to system requirements; in such cases, the backups must also be included in the periodic destruction cycle.

9.2. Destruction

Destruction means rendering personal data inaccessible, irretrievable and unusable by anyone in any manner. Documents in physical media are irreversibly shredded using paper shredding/destruction machines; magnetic and optical media (disk, CD/DVD) are physically destroyed or overwritten using secure, industry-standard software so that they cannot be recovered; where hardware must be scrapped, the process is documented in a written record.

9.3. Anonymisation

Anonymisation means rendering personal data incapable of being associated in any manner with an identified or identifiable natural person, even when matched with other data. For secondary uses for statistical and reporting purposes, the Company applies methods described in the Board's Anonymisation Guide, such as masking, aggregation, data derivation and data swapping, in a manner that ensures irreversibility; following anonymisation, the data fall outside the scope of the KVKK and may be used without a time limit.

9.4. Backups and Scope of Application

A destruction decision covers all primary systems in which the data are processed and all backup/archive copies. Through data processing agreements, deletion, destruction and anonymisation are also ensured for copies held by Service Providers processing personal data and by technical infrastructure suppliers (hosting, backup, e-mail); if a supplier fails to comply with this obligation, the Company is informed immediately.

10. DATA SECURITY MEASURES

Technical and administrative measures for protecting personal data against unlawful access, loss or disclosure throughout the retention period and until destruction are regulated in the Security Policy; additional measures for special categories of personal data under the Board's Decision No. 2018/10 are regulated in the Policy on the Protection and Processing of Special Categories of Personal Data. The number of personnel authorised to perform destruction is kept to a minimum, destruction operations are restricted through an authorisation matrix and are logged.

11. DELETION, DESTRUCTION OR ANONYMISATION UPON THE DATA SUBJECT'S REQUEST

Pursuant to KVKK Article 11, where the conditions for processing personal data cease to exist, the data subject may request deletion, destruction or anonymisation of their personal data and notification of that operation to third parties to whom the data have been transferred. The request may be submitted to the Company by any of the methods listed in the Data Controller Application Form published on the Platform (in-Platform application screen, written application, Registered Electronic Mail (KEP), secure electronic or mobile signature, or the e-mail address registered in the system), together with the information required under the Communiqué on the Procedures and Principles of Application to the Data Controller; use of the form is not mandatory.

The Company concludes the request free of charge as soon as possible and no later than 30 days, depending on its nature; where the operation requires an additional cost, the fee specified in the tariff determined by the Board may be charged. If the request is accepted, the necessary action is taken without delay and third parties to whom the data have been transferred are also notified; if the request is rejected, the grounds are notified to the data subject in writing or electronically, without prejudice to the data subject's right to lodge a complaint with the Board (KVKK Article 14).

12. PUBLICATION, RETENTION AND UPDATING OF THE POLICY

This Policy is published publicly on the Platform; if an obligation to register with VERBİS arises, it is also made available to the Personal Data Protection Authority in the manner required by the Regulation. The Company updates the Policy in response to changes in legislation, Board decisions or changes in the scope of its activities; the current version enters into force on its publication date and previous versions are archived for evidentiary purposes.

13. EFFECTIVE DATE

This Policy entered into force on 03.10.2026 and is published on the Platform.