SECURITY POLICY

1. PURPOSE AND SCOPE

This Security Policy ("Policy") has been prepared by TREATX Medikal Turizm Sanayi ve Ticaret A.Ş. (the "Company"), established at "Adalet Mah. Manas Blv. No: 47B, İç Kapı No: 2809, Bayraklı / İzmir", in order to explain the measures taken by the Company regarding the security of information of all users who visit, register with, receive services through or provide services through the website at www.treatx.health (including its subdomains) (the "Platform"), operated by the Company under the "TreatX Health" brand, as well as the security rules with which users are required to comply.www.treatx.health

The Platform is an online marketplace that brings together service providers registered with the Platform, including healthcare institutions such as clinics, outpatient clinics, private practices, medical centres and hospitals, as well as physicians, dentists and other healthcare professionals who satisfy the requirements prescribed by applicable legislation ("Service Provider"), with users seeking examination, treatment, dental health, aesthetic and beauty procedures, and consultancy services from such providers ("Service Recipient"). The Company acts as an intermediary service provider within the scope of Law No. 6563 on the Regulation of Electronic Commerce and is not itself the provider of the healthcare, aesthetic/beauty or consultancy services offered through the Platform; such services are provided by the relevant Service Provider under its own professional responsibility.

This Policy shall be read together with the Privacy Policy, Consents for the Processing of Personal Data, Privacy Notices on the Processing of Personal Data, Cookie Policy, Commercial Electronic Communication Consents and membership agreements published on the Platform; where the fulfilment of the information obligation, explicit consent and consent for commercial electronic communications must be obtained separately, this Policy does not replace any of them and does not provide a basis for combining them under a single consent.

2. DEFINITIONS

3. OUR INFORMATION SECURITY PRINCIPLES

The Company manages information security within the framework of three fundamental principles:

• Confidentiality: Ensuring that information is accessible only to authorised persons,
• Integrity: Preserving the accuracy and completeness of information,
• Availability: Ensuring that information is accessible to authorised persons when required.

With respect to personal data, the principles of data minimisation (processing only the minimum data necessary for the relevant purpose) and least privilege (granting only the minimum access required for the relevant duty) are also applied. The Company operates management systems compliant with ISO 9001, ISO/IEC 27001 and ISO 22301 standards in the fields of quality, information security and business continuity management, respectively, and is certified under these standards. Security measures are reviewed regularly and updated in line with technological developments.

4. INFORMATION SECURITY MANAGEMENT SYSTEM AND MANAGEMENT COMMITMENT

Information security is managed within the Company as a corporate process owned by senior management. Senior management declares its commitment to setting information security objectives, allocating the necessary resources, approving this Policy and reviewing it at least annually.

The Company operates an information security management system ("ISMS") established on the basis of ISO/IEC 27001 and certified under that standard; business continuity management is carried out within the framework of ISO 22301. This Policy is supported by subordinate policies and procedures concerning matters such as access management, passwords, backups, incident response and supplier security. Within this framework:

• An inventory of information assets is maintained; assets are classified according to criticality and an owner is assigned to each asset.
• Information security risks are regularly identified, assessed and treated so as to reduce them to an acceptable level.
• The uninterrupted provision of services; protection of the trust of Users and business partners (including Payment Institutions), compliance with legislation and contracts, and protection of the Company's reputation are fundamental information security objectives.
• Disciplinary processes and contractual sanctions are applied in respect of conduct contrary to policies and procedures.
• The ISMS is continuously improved through internal audits and management reviews.

5. PAYMENT SECURITY

5.1. Payment Infrastructure

Card payment transactions carried out through the Platform are processed through authorised Payment Institutions integrated by the Company, which are licensed under Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions and are subject to supervision by the relevant authorities. Our current Payment Institution in Türkiye is iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. ("iyzico"), an electronic money and payment services institution supervised by the Central Bank of the Republic of Türkiye and certified under the international Payment Card Industry Data Security Standard (PCI-DSS). The Company's payment architecture is designed so as not to be permanently dependent on any single provider; if additional or different authorised Payment Institutions are used over time, this Policy and the relevant texts will be updated.

The relevant Payment Institution (currently iyzico) acts as an independent data controller in respect of the data it processes within the scope of the payment services it provides (see Privacy Policy, Section 3).

5.2. Protection of Your Card Information

Your credit card and debit card information (card number/PAN, expiry date, security code/CVV) is not stored or recorded in the Company's systems and cannot be viewed by Company personnel. During the payment flow, card information is transmitted over an encrypted connection to the secure infrastructure of the relevant Payment Institution and the payment transaction is processed on that infrastructure. The Company may access only information indicating whether the transaction was approved or declined, transaction data that does not contain the card number, such as amount and date, and masked/limited transaction reference information transmitted by the relevant Payment Institution.

Card storage ("save my card") and similar features, if offered, operate not with the Company but with the relevant Payment Institution, using a PCI-DSS-compliant card storage (tokenisation) method. Details regarding the provision of any such feature will be announced separately in this Policy.

5.3. 3D Secure Authentication

For card payments, 3D Secure (three-domain secure) authentication is mandatorily applied within the framework supported by the relevant Payment Institution and the card-issuing bank. Under 3D Secure, the transaction is approved using a one-time authentication code sent by your card-issuing bank; this contributes to reducing the risk of unauthorised use. No authentication method can provide absolute security on its own.

5.4. Marketplace Payment Flow

As the Platform operates as a marketplace, payments made by Service Recipients are not held in bank accounts freely available for the Company's use; payment amounts are safeguarded in accounts held with the relevant Payment Institution. Amounts due to the Service Provider — after deduction of the Company's intermediary commission, if any — are transferred to the Service Provider through the relevant Payment Institution in accordance with the service performance and entitlement conditions specified in the relevant reservation/agreement. For services consisting of multiple sessions or stages, the release of payments likewise follows the performance and entitlement conditions specified in the relevant reservation and agreement. Refunds are handled in accordance with the Cancellation and Refund Terms published on the Platform.

5.5. Warning Regarding Off-Platform Payments

For your security, please make payments only through the payment steps available on the Platform. Payments made outside the Platform in cash, by bank transfer/EFT, or through links sent by third parties are outside the Company's knowledge and safeguards; the Company cannot be held liable for losses arising from such payments. The Company's liability arising from the fault or misleading directions of its employees or authorised persons, or from a deficiency in Platform security, and mandatory provisions of applicable law are reserved. Please immediately report any person or organisation directing you to make payment outside the Platform to the Company via support@treatx.health.support@treatx.health

6. DATA TRANSMISSION AND STORAGE SECURITY

To protect data communications between the Platform and user devices, TLS (SSL) encryption based on certificates issued by trusted certificate authorities is used in accordance with current security standards. You can verify a secure connection through the padlock icon and the "https" indication in your browser's address bar.

Personal data is stored in secure data centres/cloud infrastructure located in the Frankfurt region of Germany (AWS eu-central-1); infrastructure-level encryption and access controls are applied in storage environments. Where hosting or cloud services located abroad are used, transfers of data abroad are carried out in accordance with Article 9 of the KVKK and other applicable legislation.

Data is backed up regularly. Incident response, business continuity and disaster recovery processes are operated and reviewed within the scope of the business continuity management system maintained in accordance with ISO 22301.

7. SECURITY OF HEALTH DATA AND COMMUNICATIONS

Health data processed due to the nature of the Platform constitutes special categories of personal data pursuant to Article 6 of the KVKK. In processing special categories of personal data, the Company acts in accordance with the processing conditions prescribed by the KVKK and the adequate measures determined by the Board. The principal measures taken in this respect are as follows:

• Access to health data and in-Platform message content is restricted to the relevant Service Provider on a need-to-know basis for the provision of the service and to a limited number of authorised Company personnel. Company personnel may access message content only exceptionally and on an authorisation basis for the purposes of operating the Platform, responding to support requests, moderation and fulfilling legal obligations, and all such access is logged (see Privacy Policy, Sections 3 and 7).
• Appointment and assessment records and written messaging content on the Platform are transmitted in encrypted form during transfer; infrastructure-level encryption and access controls are applied in the environments in which they are stored.
• The Company does not operate any infrastructure that records audio or video calls; even if audio/video calls are enabled through the Platform, such calls are not recorded by the Company and their content is not stored.
• Service Providers who are healthcare professionals are subject to professional confidentiality obligations under the legislation applicable to them; all Service Providers also undertake confidentiality and data security obligations under their agreements with the Company.
• Where before/after photographs and visual records are taken in connection with aesthetic and beauty procedures, such records are protected as health data; access is restricted to the relevant Service Provider and the minimum number of authorised persons. Any use for promotional purposes is subject to explicit consent specific to the purpose and medium and to the conditions prescribed by the Regulation on Promotion and Information Activities in Healthcare Services (see Privacy Policy, Section 7). The Company may at any time restrict or disable the display of promotional visuals across the Platform or in respect of specific Service Providers.
• The confidentiality of the Service Recipient's identity is fundamental; assessment and review processes are designed so as not to disclose the Service Recipient's health information.

8. TECHNICAL AND ADMINISTRATIVE MEASURES

Pursuant to Article 12 of the KVKK, the Company applies, with a risk-based approach appropriate to its cloud-based architecture, principally the following technical and administrative measures in order to prevent unlawful processing of and unlawful access to personal data and to ensure the safeguarding of personal data:

• The Platform operates on a cloud-based architecture. Network access is restricted through firewall rules and access control lists; internet-facing endpoints are protected through the edge/WAF layer and the cloud provider's security services.
• Regular vulnerability scans are conducted. Comprehensive security and penetration tests have been carried out on the Platform by independent experts, identified findings have been remediated and the scope of testing has also been expanded. Before the final public release, a further comprehensive security/penetration test on the current version is applied as a pre-release condition (launch gate); tests are planned and repeated regularly in line with significant changes and risk assessments.
• Access permissions are managed through a role-based authorisation matrix in accordance with the principle of least privilege; strong passwords and multi-factor authentication (MFA) are applied to privileged administrator accounts; access rights of departing personnel are revoked immediately.
• System and access logs are maintained and regularly monitored.
• Data is encrypted using TLS in transit; infrastructure-level encryption is applied in storage environments and cryptographic keys are managed through the cloud provider's key management services.
• Secure software development practices are applied; code changes are subject to review processes; the use of real personal data in test environments is avoided.
• During recruitment processes, CV and reference checks are carried out to the extent required by the position; segregation of duties is observed for critical privileges.
• Confidentiality agreements are entered into with employees; information security and personal data protection training is provided.
• Data security obligations are stipulated in agreements with suppliers and subprocessors from which services are procured.
• The physical security of data centres from which hosting services are obtained is ensured through the certified physical security controls of the relevant cloud/data centre provider.
• Data is backed up regularly; incident response, business continuity and disaster recovery processes are operated within the framework of the business continuity management system under ISO 22301.
• Compliance with policies and procedures is monitored through internal audits and management reviews within the scope of the ISMS.

9. ACCOUNT AND PASSWORD SECURITY — USER OBLIGATIONS

You are required to comply with the following rules to protect the security of your Platform account:

• Choose a strong password that is difficult to guess, of sufficient length and contains upper- and lower-case letters, numbers and special characters; do not use the same password on other platforms.
• Do not share your password with anyone, including Company employees. The Company will never request your password through any channel.
• Your account is personal to you and may not be transferred to or used by third parties. We remind you that, within the framework of applicable legislation, you are personally responsible for transactions carried out through your account.
• If two-step verification is offered for your account, we recommend that you enable it. The Company's liability arising from system security, defective services, or the acts of its employees and auxiliary persons, and mandatory provisions of applicable law are reserved.
• Do not use the "remember me" option on shared or public devices and log out when you have completed your session.
• If you notice suspicious access to or activity on your account, immediately change your password and report the matter to the Company via support@treatx.health. The Company reserves the right to temporarily suspend accounts in respect of which there is a security concern.support@treatx.health

In addition, Service Providers are required to restrict access to the management panel to authorised personnel only, update access permissions in the event of personnel changes and ensure the security of devices within the Service Provider's organisation.

10. FRAUD AND PHISHING WARNINGS

Company employees will never ask you by telephone, SMS, email or social media for your password, card number, card expiry date, security code (CVV) or SMS authentication codes. Communications purportedly made on behalf of the Payment Institution (currently iyzico) should also be verified through that institution's current official channels. Communications requesting such information are fraudulent attempts.

The Platform's official website is www.treatx.health and the official subdomains operated by the Company; the official communication channels are treatxmedikal@hs03.kep.tr and support@treatx.health. Transactions carried out through any other domains, applications or accounts are not covered by the Company's safeguards.www.treatx.healthtreatxmedikal@hs03.kep.trsupport@treatx.health

Do not click links in suspicious emails or SMS messages that appear to have been sent on behalf of the Company; report suspicious circumstances to support@treatx.health.support@treatx.health

Please pay particular attention to the following in relation to common fraud methods:

• Do not trust callers who request card information, passwords or SMS authentication codes in connection with an appointment cancellation or refund. Refund processes are carried out only through the Platform and in accordance with the Cancellation and Refund Terms; as a rule, refunds are made to the payment method used for the original payment, and you will not be asked for card information, passwords or authentication codes during this process.
• Do not trust callers who ask you to install remote access or screen-sharing software on your device in order to carry out a transaction; the Company does not request remote access for any transaction.
• Be cautious of campaign, discount or prize draw announcements made through fake social media accounts opened in the Company's name; campaigns are announced only through official channels.
• If you receive a suspicious call or message, end the communication and verify the matter through our official communication channel at support@treatx.health.support@treatx.health

11. SECURITY VULNERABILITY REPORTING (RESPONSIBLE DISCLOSURE)

If you identify a security vulnerability on the Platform, we ask that you report it to the Company via support@treatx.health. For good-faith reports, we expect you to provide the minimum information necessary to verify the vulnerability, not to disclose the vulnerability to third parties before it has been remediated, and to immediately delete any data that may have been accessed during the reporting process. Reports are assessed promptly and the reporting party is responded to within a reasonable period.support@treatx.health

12. THIRD-PARTY SERVICES AND LINKS

The Company works with third-party service providers that are contractually bound by data security obligations in areas such as payment services (currently iyzico), SMS and email delivery services, and cloud hosting and data storage services. Processing activities carried out by these service providers within their own systems are subject to the relevant provider's policies and agreements. Where a third party acts as a data processor on behalf of the Company, the Company's obligations to select, instruct, contractually bind and appropriately oversee the supplier remain reserved.

The Platform may contain links to websites belonging to third parties. The operators of the relevant websites are responsible for the content and security practices of linked sites; we recommend that you review their own privacy and security policies before using such sites.

13. COOKIES

Cookies are used on the Platform for session management, security, performance analysis and remembering preferences. Detailed information on cookie types, purposes of use and management of cookie preferences is available in the Cookie Policy published at https://treatx.health/#/cookie-policy.https://treatx.health/#/cookie-policy

14. PROTECTION OF PERSONAL DATA

Your personal data is processed in accordance with the KVKK and applicable legislation. Detailed information regarding the categories of data processed, purposes of processing, legal grounds, transfers and your rights under Article 11 of the KVKK is provided in the Privacy Notices prepared for Service Recipients, Service Providers and visitors, as well as in the Privacy Policy. You may submit your applications under the KVKK via admin@treatx.health or through the other channels specified in Section 17 of the Privacy Policy.admin@treatx.health

15. DATA BREACH AND SECURITY INCIDENT NOTIFICATION

Information security incidents and vulnerability reports are recorded; their impact is assessed and they are addressed within the framework of the incident response procedure. The following notification process is also applied in respect of breaches affecting personal data:

The Company notifies the Board without delay and no later than 72 hours from the date on which it becomes aware of the breach. Following identification of the persons affected by the breach, the relevant data subjects are also notified by an appropriate method as soon as reasonably practicable. In processes where the Company acts as a data processor, any identified breach is notified without delay to the relevant data controller.

16. POLICY CHANGES AND EFFECTIVE DATE

The Company may update this Policy in line with changes in legislation, technical developments or changes to the services. The current text enters into force on the date it is published on the Platform and is kept accessible through the Platform at all times. Material changes are communicated to members by email or notification through the Platform. Previous versions of the Policy are archived for evidentiary purposes; a subsequent amendment does not retroactively render a previous processing activity lawful.

17. CONTACT

You may submit your questions and requests regarding this Policy, as well as security notifications, through the following channels: