PRIVACY POLICY

1. PURPOSE AND SCOPE

This Privacy Policy ("Policy") has been prepared in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the relevant legislation in order to explain, in general terms, the principles governing the processing of personal data, the parties to whom such data may be transferred, the periods for which such data are retained, and the rights of data subjects through the website at www.treatx.health (including its subdomains) and, once launched, the Mobile Applications (the "Platform"), operated under the "TreatX Health" brand by TREATX Medikal Turizm Sanayi ve Ticaret A.Ş. (the "Company" or "TreatX"), whose registered address is "Adalet Mah. Manas Blv. No: 47B, İç Kapı No: 2809, Bayraklı / İzmir".www.treatx.health

The Platform is an online marketplace that brings together service providers registered on the Platform ("Service Providers"), including healthcare institutions such as clinics, outpatient clinics, private practices, medical centres and hospitals, as well as physicians, dentists and other healthcare professionals who satisfy the requirements under the applicable legislation, with users ("Service Recipients") seeking examination, treatment, dental health, aesthetic and beauty procedures, and consultancy services from them. The Company acts as an intermediary service provider within the meaning of Law No. 6563; healthcare, aesthetic/beauty and consultancy services offered through the Platform are provided by the relevant Service Provider under its own professional responsibility.

This Policy applies to all natural persons who visit the Platform, register with the Platform, receive services through the Platform or provide services through the Platform. The information obligation required under Article 10 of the KVKK is fulfilled through separate Privacy Notices published for Service Recipients, Service Providers, prospective Service Providers and visitors. Privacy Notices and explicit consent texts are prepared and presented separately in accordance with the Personal Data Protection Board's Principle Decision dated 18 February 2026 and numbered 2026/347; publication or acceptance of this Policy does not constitute fulfilment of the information obligation or the obtaining of explicit consent.

This Policy governs the processing activities carried out by the Company in its capacity as data controller. Activities carried out by the Company as a data processor on behalf of Service Providers are subject to the obligations of the relevant Service Provider in its capacity as data controller (see Section 3).

2. DEFINITIONS

3. DATA CONTROLLER AND ALLOCATION OF ROLES

The Company is the data controller for processes relating to the operation of the Platform (membership, account management, intermediation in appointments and package sales, payment records, marketing and transaction security).

Service Providers are independently data controllers in respect of professional records they create in connection with examination, diagnosis, treatment, aesthetic and beauty procedures, and consultancy activities (e.g. patient files, session notes and procedure notes); healthcare professionals also act in accordance with the healthcare legislation applicable to them and their professional duties of confidentiality. The data protection relationship between the Company and Service Providers (independent data controllers / data controller-data processor arrangement) is governed by the agreement between them.

In certain processes, the Company acts not as data controller but as data processor on behalf of the relevant Service Provider (e.g. hosting and technical processing of professional records such as patient files, session notes and procedure notes maintained by the Service Provider within the Platform infrastructure). In these processes, processing is carried out in accordance with the Service Provider's instructions and the agreement between the parties; the obligation to provide information and to respond to data-subject requests rests with the relevant Service Provider in its capacity as data controller. Where authorised by the Service Provider, the Service Provider's Privacy Notices may be presented to data subjects through the Platform interface during the appointment flow. The Company also applies the security measures required under Article 12 of the KVKK in processes where it acts as data processor.

The Company's role in relation to written messaging within the Platform has a dual structure: (i) insofar as message content between the Service Recipient and the Service Provider is hosted and transmitted through the Platform infrastructure as part of communications relating to healthcare services, the Company acts as a data processor on behalf of the relevant Service Provider; and (ii) written messages are also stored within the Company's infrastructure, and because the Company itself determines the purposes and means of the limited processing activities required for the secure and lawful operation of the Platform, handling support requests, preventing misuse and conducting moderation, resolving disputes, and complying with legal obligations, the Company acts as data controller solely in respect of those activities. Access to message content for these purposes is exceptional, role-based, limited to the minimum number of authorised personnel and logged (see Section 7 and the Security Policy).

Card payment transactions are carried out through authorised Payment Institutions integrated by the Company; the current Payment Institution in Türkiye is iyzico. The relevant Payment Institution is independently a data controller in respect of the data it processes within the scope of the payment services it provides; for detailed information concerning payment processes, the privacy policy of the relevant Payment Institution (currently iyzico) should be reviewed. Card details are not processed or stored by the Company (see the Security Policy).

The allocation of roles for the principal processes is as follows:

The above capacities are determined according to who actually decides the purposes of processing, mandatory data fields, retention periods, access permissions and recipients. This section will be updated if the data flows change.

4. CATEGORIES OF PERSONAL DATA PROCESSED

Depending on the user's role, the following principal categories of data are processed through the Platform:

As the Company does not operate an infrastructure that records audio or video calls, audio-visual records such as call-centre recordings, voice-call recordings and video-call recordings are not processed. If this changes, this Policy and the relevant Privacy Notices will be updated before such processing begins.

Processing activities relating to employees and job applicants are governed by separate Privacy Notices.

5. METHODS AND CHANNELS FOR COLLECTING PERSONAL DATA

Personal data are collected through the following channels, electronically by wholly or partly automated means, or by non-automated means provided that the processing forms part of a data filing system:

• Membership, appointment, purchase, form and review fields on the Platform,
• Once the mobile applications are launched, the mobile applications and in-app permissions (notifications, location, camera/gallery access, etc.),
• Email, in-Platform messaging and support channels,
• Referrals made through social media accounts and online advertising channels,
• Information transmitted by Service Providers in connection with performance of the service (e.g. appointment confirmation, session completion information),
• Transaction-result information returned by the relevant Payment Institution during payment processes, excluding card numbers,
• Cookies and similar technologies (see Section 11).

6. PURPOSES OF PROCESSING AND LEGAL BASES

Personal data are processed for the following purposes on the basis of the processing conditions set out in Articles 5 and 6 of the KVKK:

7. PROCESSING OF HEALTH DATA AND EXPLICIT CONSENT

Health data processed due to the nature of the Platform constitute special categories of personal data. As the Company is not a healthcare service provider subject to a duty of professional secrecy, as a rule it processes health data for its own purposes (such as operation of the Platform, appointment referral and form flows, and the support and moderation processes described in Section 3) on the basis of your explicit consent. In respect of records that are merely hosted by the Company as a data processor on behalf of a Service Provider, determining the legal basis and providing the required information are the responsibility of the Service Provider as data controller (see Section 3). Your explicit consent is obtained during the membership and/or appointment flow separately from other approvals and on an informed basis.

Service Providers who are healthcare professionals may process health data within the scope of examination, diagnosis, treatment, aesthetic procedures and consultancy activities under their own responsibility, within the framework of healthcare services carried out by persons subject to a duty of confidentiality pursuant to Article 6/3-e of the KVKK.

You may withdraw your explicit consent at any time through your account on the Platform or via the communication channels specified in Section 17. Withdrawal of consent has prospective effect; following withdrawal, it may no longer be possible to provide through the Platform services that by their nature require the processing of health data. Even in such circumstances, records subject to statutory retention obligations will be retained for the applicable periods.

The Company does not operate an infrastructure that records audio or video calls; even if the Platform enables audio/video calls, such calls will not be recorded by the Company. Written messages within the Platform are, however, stored in the Platform infrastructure. As a rule, access to message content is limited to the parties to the conversation; authorised Company personnel may access such content only in the exceptional, role-based circumstances described in Section 3 concerning Platform operation, support, moderation and legal obligations, with such access being logged (see the Security Policy). Health data may be used for statistical purposes only after being anonymised.

Before-and-after photographs and images relating to aesthetic and beauty procedures are processed and stored as health data. Use of such images for promotional, reference or similar purposes is subject to separate, specific and freely revocable explicit consent for each purpose. Publication for promotional purposes is carried out solely on the relevant Service Provider's profile and case pages on the Platform, on behalf of that Service Provider and on the basis of explicit consent specific to that purpose and medium. The Company does not use before-and-after images, photographs or videos of actual Service Recipients in its own corporate promotion; if such use is contemplated in the future, it will be subject to separate explicit consent. Consent for one purpose or medium does not confer a right of use for any other purpose or medium.

The existence of explicit consent is not, by itself, sufficient to make promotional use lawful; such use must also comply with the Regulation on Promotional and Informational Activities in Healthcare Services published in the Official Gazette dated 12 November 2025 (the "Promotion Regulation") and other applicable legislation. Advertising or promotional activity that is not legally permitted does not become lawful merely because explicit consent has been obtained. Under the Promotion Regulation, use of patient images is subject to the separate obtaining of the specific consent form annexed to the Regulation; before-and-after images may be used only where they have been captured in the same environment and under the same technical conditions, have not subsequently been technologically altered or retouched, and the date of the procedure and the dates on which the images were taken are stated; content depicting the course of surgery or compromising patient privacy may not be shared; a warning that results may vary from person to person must be included; and no payment, discount or gift may be offered to a patient in return for use of images. Statements of thanks or satisfaction by patients or their relatives may not be shared as advertising content. Promotion directed at the domestic market and promotional activities within the scope of international health tourism are conducted through separate channels in accordance with the rules set out in the Promotion Regulation.

A Service Recipient who has given consent may withdraw that consent at any time without being subject to any condition; upon withdrawal, all promotional use of the relevant images will cease immediately. The Company reserves the right at any time to restrict or completely disable the display of images for promotional purposes across the Platform or in respect of specific Service Providers.

8. PROFILING AND AUTOMATED DECISION-MAKING

Automated analysis and profiling methods may be used on the Platform to personalise Service Provider search and ranking results, provide service recommendations and prevent fraud. Profiling and segmentation for marketing purposes are carried out only on the basis of your explicit consent (see Section 6). Decisions producing legal effects concerning you or similarly significantly affecting you are not taken solely by automated systems; you retain the right to object to an adverse outcome arising from analysis carried out exclusively through automated systems (see Section 13).

9. TRANSFER OF PERSONAL DATA

9.1. Domestic Transfers

Personal data may, to the extent limited to the purposes of processing and in accordance with Article 8 of the KVKK, principally be transferred to the following categories of recipients: the relevant Service Provider for appointments and performance of services; the relevant Payment Institution (currently iyzico) for card payment processes; suppliers providing infrastructure, hosting and SMS/email delivery services; legal and financial advisers; and, upon request and to the extent permitted by law, authorised public institutions and authorities.

9.2. International Transfers

Where hosting, analytics or communications infrastructure providers are established outside Türkiye, personal data are transferred in accordance with the procedures set out in Article 9 of the KVKK: transfer to countries covered by an adequacy decision announced by the Board, or provision of appropriate safeguards such as standard contracts (notified to the Authority within five business days of signature), binding corporate rules or written undertakings; where these are not possible, the occasional-transfer circumstances specified in Article 9 may be relied upon. The current list of service providers to which transfers are made is included in the Privacy Notices.

10. RETENTION PERIODS AND DESTRUCTION

Personal data are retained for the period required by the purpose of processing and for the retention periods prescribed by applicable legislation. Principal illustrative periods are set out below.

At the end of the applicable periods, personal data are deleted, destroyed or anonymised in periodic destruction cycles not exceeding six months, in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data and the Company's Personal Data Retention and Destruction Policy. Withdrawal of explicit consent does not result in the immediate and wholesale deletion of all records relating to the relevant data; the minimum records necessary for compliance with legal obligations and for the establishment, exercise or protection of rights may continue to be retained subject to restricted and segregated access. If you terminate your membership, your data will likewise be destroyed within this framework, except for records that must be retained by law or are necessary as evidence in potential disputes. Deletion, destruction, anonymisation and removal from backups are monitored and documented through auditable records. Service Providers remain responsible for retention obligations arising from their own professional legislation (e.g. patient records).

11. COOKIES

The Platform uses strictly necessary, functional, performance and marketing cookies, together with related third-party tools (SDKs). Non-essential cookies and SDKs are disabled by default and are activated only on the basis of your explicit consent and after you make an active selection through the cookie management tool. Accept and reject options are presented with equal prominence in the cookie management tool, and you may change your preferences at any time. Merely displaying the cookie banner or presenting the Privacy Policy does not in itself constitute explicit consent. All cookies and SDKs used, including third-party analytics, session-recording and A/B testing tools, are individually listed in the Cookie Policy together with their name, provider, purpose, type, retention period and, where applicable, information on international transfers. For further information, please review the Cookie Policy at https://treatx.health/#/cookie-policy.https://treatx.health/#/cookie-policy

12. YOUR PREFERENCES AND NOTIFICATION MANAGEMENT

Certain fields in the membership and appointment processes are mandatory in order for the relevant service to be provided; if mandatory fields are not completed, the relevant service may not be available. Optional fields are identified separately and completion is at your discretion.

You may opt out of or withdraw your approval for electronic marketing communications at any time through the communication preferences on the Platform, the opt-out link included in communications, and the İYS (Commercial Electronic Message Management System). Service communications concerning performance of the service, such as appointment confirmations and reminders and payment and refund notifications, do not constitute commercial electronic messages to the extent their content is limited solely to performance of the relevant service and may therefore be sent independently of your marketing preferences. If campaign, recommendation or cross-selling content is added to such notifications, the relevant message becomes subject to the commercial electronic communications regime and requires separate approval. Your marketing approval, İYS record and explicit consent under the KVKK are recorded separately as distinct processes and are not conflated.

You may view and update basic information relating to your account through the account settings on the Platform.

13. RIGHTS OF THE DATA SUBJECT AND APPLICATIONS

Pursuant to Article 11 of the KVKK, you have the right to apply to the Company to:

• learn whether your personal data are being processed and, if so, request information concerning such processing;
• learn the purpose of processing and whether your personal data are used in accordance with that purpose;
• know the third parties to whom your personal data have been transferred in Türkiye or abroad;
• request rectification of personal data that have been processed incompletely or inaccurately;
• request deletion or destruction of your personal data under the conditions set out in Article 7 of the KVKK;
• request notification of rectification, deletion and destruction operations to third parties to whom the personal data have been transferred;
• object to an adverse result arising from analysis of your personal data exclusively by automated systems;
• request compensation for damage suffered as a result of unlawful processing.

You may submit applications in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, using identity verification appropriate to the method of application and proportionate to your request: in writing to our registered office address specified in Section 17; to our registered electronic mail (KEP) address at treatxmedikal@hs03.kep.tr; using a secure electronic signature/mobile signature; from an email address previously notified to the Company and registered in our systems to admin@treatx.health; or, where made available on the Platform, through an in-account application channel. Documents or information evidencing your identity will be requested only to the extent necessary to verify your identity in view of the nature of your application and the method you have selected, and provided that such necessity is clearly communicated to you; no additional copy of an identity document will be requested for applications submitted from a registered email address or through an in-account channel. Applications will be concluded free of charge as soon as possible according to their nature and in any event within 30 days; where processing the application entails an additional cost, fees may be charged in accordance with the tariff determined by the Board. If your application is rejected, the response is found insufficient, or no response is provided within the prescribed period, your right to lodge a complaint with the Board is reserved.

For the part of your application relating to records for which the Service Provider is the data controller (e.g. examination, session and procedure records), the relevant Service Provider is the appropriate addressee; the Company will continue to respond directly to the parts of your application concerning membership, appointment and security records for which it is the data controller. Only the part of your application for which the Service Provider is genuinely the data controller will be forwarded without delay to the relevant Service Provider on an appropriate legal basis and through a secure channel; you will be clearly informed which part of your application has been forwarded to which Service Provider.

14. DATA SECURITY

Pursuant to Article 12 of the KVKK, the Company takes technical and administrative measures designed to ensure an appropriate level of security in order to prevent unlawful processing of and unlawful access to personal data and to safeguard such data. The adequate measures determined by the Board are additionally applied in respect of special categories of personal data. Details of the measures taken are set out in the Security Policy published on the Platform. In the event of a personal data breach, notifications are made in accordance with Article 12/5 of the KVKK and Board decisions. Breaches identified in processes where the Company acts as data processor are notified without delay to the relevant Service Provider as data controller, which bears the applicable notification obligation.

15. AGE LIMIT — USERS UNDER 18

The Platform is available only to persons who are at least 18 years of age. Persons under the age of 18 may not register with the Platform, make appointments or purchase services through the Platform; services for persons under 18 are not offered through the Platform. Date of birth is collected during registration, and use by persons under 18 is technically blocked on the server side.

If, notwithstanding the above, the Company determines that personal data relating to a person under 18 have been processed, it will close the relevant account and, subject to statutory retention obligations and rights of legal defence, destroy the relevant personal data without delay. The account of a user found to have made a false declaration regarding age will be suspended or closed.

16. POLICY CHANGES AND EFFECTIVE DATE

The Company may update this Policy in response to changes in legislation, Board decisions or changes in the services. The current text enters into force on the date it is published on the Platform. Material changes will be announced to members by email or by notification through the Platform. Previous versions of the Policy are archived for evidentiary purposes; a subsequent amendment does not retrospectively render a previous processing activity lawful.

17. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER