Data Privacy Notice for Patients

Last updated: 27.08.2025

Intermed (“we” or “us” or “our”) is a medical service provider with high ethical standards. Intermed is a member of the Affidea corporate group, along with the companies listed below. While this Information Disclosure Text has been provided to you by the health center you have visited, it remains applicable during your visit to any medical center owned by Affidea. Your point of contact for all requests regarding your personal data within Intermed is our Data Protection Officer. The contact information is provided in Article 8.

1. Legal basis for processing your personal data

We are committed and legally obliged to protect all of your personal data that we process. Our medical professionals are subject to both professional and contractual confidentiality obligations. Intermed processes your data in accordance with the legal conditions set forth in the Personal Data Protection Law (“PDPL”) No. 6698. You can find detailed information on how we process your data below.

1.1. We need your personal and health data in order to provide you with the requested medical service.

Your personal data (identity, contact information, health data, insurance information) will be processed within legal parameters, namely, that “there is a necessity to process personal data belonging to the parties of a contract, provided that it is directly related to the conclusion or performance of the contract” and “data processing is mandatory for the data controller’s fulfillment of its legal obligation” for the purpose of your registration to our clinic, scheduling your appointments, providing you with health services, keeping all your health records acquired through the delivery of health services, and reporting them to you through our patient portal. Therefore, the medical service contract you enter, and Intermed's obligation to fulfill its legal obligations in this context, constitute the legal basis for the processing of your personal data. If you receive a medical diagnosis and/or medical treatment service from Intermed, your health data (e.g. information about the requested diagnosis/treatment and our health assessment) will be considered a “special category of personal data” within the scope of the PDPL, and due to the nature of this service, your health information is processed by our healthcare personnel and physicians during provision of this service, who are subject to confidentiality obligations within the legal parameter of "conducting medical diagnosis, treatment and care services” (see Article 3 and Annex 1 for more information).

If you are in a serious or life-threatening condition while you are at one of our clinics, we will use your health data to maintain your health and wellbeing, and on the basis of protecting your vital interests.

1.2. We implement continuous improvement.

At Intermed, we always seek ways to provide better service.

A) Statistical analysis of aggregate data

We would like to analyze some of your personal data in aggregated form for our legitimate interest to obtain valuable statistical information for our sales and marketing teams, e.g. to understand which services are most in demand in certain regions.

B) Quality assurance

We believe it is very important to learn from any untoward incidents that may occur at our clinics. In line with our legitimate interests and legal obligations, we record and analyze events that may endanger health and safety, or which may result in damage of any kind. We limit the processing of your data for these purposes in line with the principle of proportionality, and, in this context, we do not use the personal data that is normally used for identification purposes.

C) Call center

We record your calls in line with our legitimate interests, which include training our employees, following up on complaints and conducting quality monitoring. After examining your call records, we train our employees based on their performance. If there are any connection problems during your call, or you have a complaint regarding communication, we will listen to your call again and give you the most appropriate feedback on the subject. See Article 6.6 for your right of objection regarding the above activities.

Please refer to section 6.6 regarding your right to object to the above activities.

1.3. You may also accept the following additional processing activities of Intermed.

By ticking the relevant box in the "Your data protection statement" section, you can accept the following at no extra cost. If you do not give your consent, this will not affect the medical services to be provided to you.

A) Informing you about opportunities to participate in clinical studies

Affidea is committed to healthcare and the advancement of medical science. We have trustworthy partners, who help pharmaceutical companies or medical device manufacturers to conduct clinical studies in strict compliance with the applicable laws. If you might be interested in participating in such clinical studies, we are happy to inform you about those which potentially fit you (based on the health data we retain about you). We might use all available communication channels to reach out to you. Your consent means no authorization to disclose your data to any third-party, nor any authorization to use your data in a specific clinical study – these require separate informed consent from you, if you express interest further to our initial information about the opportunity

B) Anonymizing and/or disidentifying a copy of your data

Regardless of whether Intermed and/or third parties (including but not limited to hospitals, universities and health insurers) take the lead, we are committed to continually improving medical science, and contributing to research and development. Research and development refers to efforts aimed at innovation, development of new products and tests, improvement of existing ones, and delivery of low-cost health care services. It includes a series of research activities to improve existing products and tests, and to develop new products and tests.

We ask for your support by allowing us to anonymize and/or disidentify a copy of your personal data during the storage period established by law (see Article 3). The data set subject to anonymization and/or disidentification also includes the health data that we collect while providing you with medical services. The data set includes both your personal data that we have already collected and that which we will collect during your future use of our medical services. As specified in Article 7.1, you have the right to access your personal data.

Anonymization and/or disidentification is a process applied to personal data (or a personal data set) that makes it impossible for the person using the anonymized data to identify its owner. In this way, your identity will be unknown when your anonymized and/or disidentified data is used.

We would like to use your anonymized and/or disidentified data for research and development, educational, statistical, and commercial purposes, to use it ourselves or to share it with others, with or without charge. We carefully select our partners and the method of anonymization and/or disidentification to minimize any risks that may arise from the use of your anonymized and/or disidentified data.

C) Contacting you to promote our services

We believe that feedback about your experience as a patient is essential for us to understand how we can best serve our patients. Therefore, we invite you to take part in our satisfaction survey, and thank you in advance for your participation. Your participation in the survey will be subject to your explicit consent, which will be taken with a separate document, and will in no way affect the service we provide to you. If you do not consent, we will not contact you.

D) Patient Survey

We believe that feedback about your patient experience is essential to understanding how we can best serve our patients. Therefore, we invite you to participate in our satisfaction survey and thank you in advance for your participation. Your participation in the survey will be based on your explicit consent, which will be requested in a separate document, and will not affect the service we provide to you in any way. We will not contact you if you do not consent.

E) Storing your data on the cloud

With your knowledge and consent, your personal data may be processed on a cloud environment of the global data processing systems that Intermed uses to reduce paperwork and improve the user experience while conducting data processing activities safely and effectively, in line with international information security standards. It may also be transferred abroad and stored for this purpose. By approving the storage of your data on the cloud and transferring it abroad, you can help reduce paperwork and expedite the bureaucratic processes that might otherwise affect your experience negatively.

If you change your mind, you can withdraw your consent(s) at any time without charge. This will have no effect on the medical services we provide to you. You can withdraw your consent by contacting our Data Protection Officer (contact information is provided in Article 8). Your explicit consent in this regard also includes your consent to be contacted for electronic commercial messages within the scope of Law No. 6563 on the Regulation of Electronic Commerce.
Withdrawing your consent will not affect the legality of the processing activities that were previously carried out on the basis of your earlier consent.

2. The data we process

During your involvement with Intermed, we obtain your personal data from three sources: (1) from you, (2) from others, and (3) from our medical procedures.

(1) In order to provide you with medical services, we require you to provide us with your personal data (especially your identity information), payment data (data required for payment for our services, especially billing information), insurance data (private health insurance), and health data (especially information about your health condition). If you decide to share your previous diagnostic imaging results and medical reports for our use, we will store and process them in our systems for medical diagnosis and/or medical treatment purposes. If you voluntarily provide us with information about your emergency contacts, this data will only be used when we are unable to contact you, or in an emergency. In addition, to provide medical services along with services such as sending appointment information and promotions, limited electronic messages (calls, SMSs, emails) will be sent to your contacts, information on which we will obtain from you.

(2) We collect your personal data from others in the following cases:

a)If you have been referred to our clinic by a medical provider (physician or hospital), and if necessary, we will consult that person about your health condition and/or treatment to determine the optimal medical treatment for you.

b)If the health care we provide you is paid by a health insurer (public or private), we require information about your insurance coverage from said insurer in order to provide you with health care.

(3) We generate health data about you when providing you with medical services. Intermed is legally required to carefully document these services as a medical service provider.
For more inquiries about the data we process, please see the Annex of this notification or refer to our receptionists.

• If you have been referred to our clinic by a medical provider (referring physician or hospital), we will consult with that person about your health condition and/or treatment as needed to determine the most appropriate medical care for you.
• If the healthcare service we provide to you is paid for by a health insurer (public or private), we need to obtain information about your insurance coverage from this insurer in order to provide you with healthcare services.

3. How long do we store your data

Intermed stores your personal data as long as is necessary to provide medical services and comply with applicable medical, tax, accounting and other regulatory requirements. We will delete or anonymize your data when our legal obligation to store it expires. Intermed will not delete your stored data if there is another reason to process it, e.g., if a lawsuit is brought against Intermed or if it is necessary for our legal defense. In this case, we will store the data for as long as is needed for this reason. If there are compensation claims, the data will be stored until legal proceedings are concluded.

For more inquiries regarding how long we store your data, please see the Annex of this notification or refer to our receptionists.

4. With whom do we share your personal data?

During your involvement with Intermed, we share your personal data with three types of recipients: (1) service providers we appoint, (2) providers unaffiliated with us, and (3) people you request us to share your data with.

(1) We use service providers (data processors) to assist us in the processing of personal information we receive and generate (e.g., medical and financial software/hardware companies). Data processors act on behalf of Intermed in line with our written instructions.
We only share your data to the extent that it is absolutely necessary.

(2) We will share your personal data with third parties (i.e., recipients unaffiliated with us) in the following cases:

a) If we are legally required to do so.

b) If required by a contract you are a party to (e.g., your health insurance contract).

c) We will share your health data with other medical professionals with a view to protecting your vital interests (e.g., an emergency).

d) Contracted medical professionals

We only share your data to the extent that it is absolutely necessary

(3) You can request us to send your health data to the referring physician or your primary care physician. The processing activities of third-party recipients are beyond our responsibility and control. Therefore, we recommend that you first contact these third parties as to how they will process your personal data. If you would like us to share your health data with other medical professionals, we ask you to fill out a special consent form which you can obtain from our receptionist.

For more inquiries about the recipients of your personal data, please see the Annex of this notification or refer to our receptionists.

5. Keeping your data safe

Keeping your data safe is our priority. Your personal data is securely stored by us or by carefully selected service providers. If our service providers process your health data on our behalf, we require a high level of data protection, which is stipulated in our written agreements with said providers. We ensure that strict measures are in place to protect your personal data from loss, misuse, or unauthorized access or transfer.

6. Your Rights

Pursuant to Article 11 of the PDPL, you have the following rights:

• 6.1. The right to learn whether or not your personal data is processed. In other words, you have the right to contact us to learn whether or not we are processing your personal data.
• 6.2. If your personal data has been processed, you have the right to request information about it. In other words, if you learn that we have processed your personal data, you can request detailed information about our processing procedures.
• 6.3. The right to obtain information about the purpose for which your personal data has been processed and learn whether or not your personal data have been used in line with their intended purpose. In other words, in line with the above specified right, you can request information about the purposes for which we processed your personal data, and whether we have complied with these guidelines when processing it.
• 6.4. The right to obtain information about third parties to whom your personal data have been transferred domestically or abroad. You can request information about the persons we have shared your personal data with in Turkey or abroad.
• 6.5. The right to request correction of your personal data in the case of incomplete or incorrect processing. If you think we have processed your personal data in an incomplete or incorrect way, you can request that we correct it.
• 6.6. The right to request the deletion or destruction of personal data within the framework of the conditions set forth under Article 7 of the PDPL. You may request that we delete, destroy or anonymize your personal data at any time.
• 6.7. The right to request that the third parties to whom personal data is transferred are informed of the procedures carried out pursuant to sub-paragraphs 7.5. and 7.6. In other words, if you have requested the correction, deletion, destruction or anonymization of your personal data, you can request that we inform the persons to whom we have transferred your data about this procedure.
• 6.8. The right to object to the occurrence of a result that is detrimental to the data subject as a result of analyzing processed data exclusively through automatic systems. If we have caused a result which is detrimental to you by analyzing your processed personal data exclusively through automatic systems, you can object to this by contacting us.
• 6.9. The right to request compensation for any loss suffered in the event that your personal data is processed in breach of the law. If we cause any loss by unlawfully processing your personal data, you can contact us at any time for indemnification.

To exercise your rights, or for more information about the rights specified above, please refer to our receptionists or contact our Data Protection Officer (whose contact information is provided in Article 8).

7. Automatic individual decision making and profiling

Intermed does not process your personal data to make automatic individual decisions. We only conduct data profiling in two cases (profiling is the automatic processing of personal data to evaluate certain personal characteristics relating to a natural person):

(i) To send you personalized promotions if you have given us your explicit consent (see Article 1.3/B). If you have given your consent, you will receive reminders from us about personalized information, service offers and medical examinations. Intermed will not use this marketing profile to make decisions about you or your medical condition.

(ii) If the evaluation of a diagnostic image by a radiologist is assisted by an algorithm (e.g., the post-processing of MRI images). Your medical condition is always diagnosed with the input of a radiologist, not merely by the automatic processing of diagnostic images.

8. If you have any questions

If you have any questions, or wish to learn more about this subject, please feel free to contact our Data Protection Officer in line with the provisions of Article 11 of the PDPL and the Communiqué on Procedures and Principles for Application to the Data Controller (e-mail: kvk@affidea.com; mailing address: Flatofis Kağıthane İş Merkezi Çağlayan Mah. Kent Cad. No:2, Kat:3 Kapı No:30 Kağıthane/ İstanbul)) or refer to our receptionists for more information.

Annex 1 to Data Privacy Notice for Diagnostic Imaging, Outpatient Services and Laboratory Services

You can find detailed information on who we share your data with below. We only share your data if it is absolutely necessary.

You can find detailed information below about the data types we process for various purposes (as set out in sections 1.1 to 1.3 of the notification) and how long we store your data.