KVKK Privacy Notice

Effective Date: 28.12.2025

Omega-Pro Proje Araştırma Geliştirme Limited Şirketi, Omega-Pro Genetik Değerlendirme Merkezi ("Omega-Genetik") attaches great importance to the confidentiality and security of your personal data. Through the studies started long before the entry into force of Law No. 6698 on the Protection of Personal Data (the "KVKK Law") and still ongoing, Omega-Genetik aims to duly fulfil the requirements for compliance with the KVKK Law and to establish a data protection and processing policy in line with international standards.

With the Omega-Genetik Personal Data Protection Policy (the "Policy"), the principles adopted and taken into account in practice by Omega-Genetik for the protection and processing of personal data are set out. The Policy also provides information on the purposes for which Omega-Genetik processes personal data, the method of collecting personal data, its legal purpose, to whom and for what purposes the data may be transferred, and the rights of the data subjects.

Within the scope of the KVKK Law, with respect to its own business and activities, it is the "data controller" in person, and the information and principles in the Policy apply to the entire Omega-Genetik. Omega-Genetik has approved and accepted this Policy, which has been in force since 1 October 2016.

SECTION. GENERAL INFORMATION

Omega-Genetik processes your personal data as follows, within the limits prescribed by the legislation.

1.1. Methods of Collecting Personal Data:

The personal data processed may vary depending on the type and nature of our products and services. We may collect your personal data verbally, in writing or electronically, by automated or non-automated means, through our offices, call centres, website, social media channels, branches and dealers with whom we have business relationships, and similar means.

As long as you benefit from our products and services, your personal data may be processed and, where necessary, updated to ensure their accuracy and currency. In addition, your personal data may also be processed when you physically visit the office buildings and centres of Omega-Genetik or use its call centres, visit its web pages and/or other social and digital channels, or participate in activities such as events, seminars, organizations and training organized by Omega-Genetik.

1.2. Purposes and Procedure of Processing Personal Data:

Your personal data:

Personal data may be processed by Omega Research Companies for the following purposes:

fulfilling our legal obligations set out in Law No. 3359 on the Basic Principles of Health Services, Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, the Regulation on Medical Laboratories, Law No. 6698 on the Protection of Personal Personal Data, the Regulation on the Processing and Ensuring the Privacy of Personal Health Data, and other relevant legislation;

identity verification and authentication to prevent your Personal Data/Personal Data from being seized by others,

protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing,

providing medicines and/or medical supplies and/or devices specific to you,

informing you about your appointment, providing information and/or appointment reminders if you make an appointment,

carrying out risk management and quality improvement activities,

meeting legal and regulatory requirements,

sharing information obtained with the Ministry of Health and other public institutions and organizations and responding to them in accordance with the legislation,

querying your entitlement with institutions/organizations contracted with the laboratory or carrying out financial reconciliation with these institutions regarding the health services provided to you,

sharing information requested by contracted institutions/organizations, including private insurance companies in particular, within the scope of financing of health services and performing identity verification,

issuing invoices in return for the services we provide,

taking all necessary technical and administrative measures within the scope of data security for laboratory systems and applications,

analyzing your use of health services and storing your health data for the purpose of improving and enhancing the health services we provide to you, and responding to your questions or complaints about our services,

obtaining the necessary information in line with the requests and audits of regulatory and supervisory institutions and official authorities,

preserving information regarding your health data that must be stored as required by the relevant legislation,

complying with internal policies and principles,

measuring patient satisfaction following the health services you receive and increasing patient satisfaction,

carrying out promotional and informational activities specific to you and enabling you to benefit from them, and contacting you to inform you about our services,

and without being limited to these, the provision of medical care services, increasing and researching patient satisfaction and related reasons.

Your Personal Data/Personal Data obtained and processed in accordance with the relevant legislation may be transferred to the physical archives and/or information systems belonging to Omega-Genetik and kept under custody both digitally and physically.

The basis for personal data processing activities may be only one of the conditions listed below, or more than one of these conditions may constitute the basis for the same personal data processing activity.

-Existence of the Data Subject's Explicit Consent

One of the conditions for processing personal data is the explicit consent of the data subject. The explicit consent of the personal data subject must be given in relation to a specific subject, based on information and with free will. Data is processed within the scope of the data subject's explicit consent and for the purposes stated in the explicit consent. As a rule, there is no need to obtain the separate explicit consent of the data subject if the other conditions below exist.

-Being Clearly Provided for in Laws

Where explicitly provided for by law, the personal data of the data subject may be processed lawfully. In cases where laws permit data processing, data is processed limited to the reasons and data categories stipulated in the relevant law.

-Inability to Obtain the Explicit Consent of the Person Due to Actual Impossibility

Where the person cannot express their consent due to actual impossibility or their consent cannot be considered valid, their personal data may be processed if processing is mandatory to protect the life or physical integrity of that person or another person.

-Being Directly Related to the Establishment or Performance of a Contract

Provided that it is directly related to the establishment or performance of a contract, personal data may be processed if processing the personal data of the parties to the contract is necessary (on the condition that the person whose data will be processed based on the establishment or performance of the contract is one of the parties to the contract).

-Fulfilling a Legal Obligation

Where data processing is mandatory for Omega-Genetik to fulfil its legal obligations, the personal data of the data subject may be processed.

-The Data Subject Making Their Personal Data Public

Where the data subject has made their personal data public, the relevant personal data may be processed limited to the purpose of publicization.

-Data Processing Being Mandatory for the Establishment or Protection of a Right

Where data processing is mandatory for the establishment, exercise or protection of a right, the personal data of the data subject may be processed.

-Data Processing Being Mandatory Due to Legitimate Interests

Provided that it does not harm the fundamental rights and freedoms of the personal data subject, the personal data of the data subject may be processed where data processing is mandatory for the legitimate interests of Omega-Genetik.

If the processed data are special categories of personal data as defined in the KVKK Law; and if the explicit consent of the personal data subject is also absent, personal data may only be processed in the following circumstances on the condition that the adequate measures to be determined by the KVKK Board are taken:

(i) Special categories of personal data other than the personal data subject's health and sexual life, in cases prescribed by law,

(ii) Special categories of personal data relating to the personal data subject's health and sexual life may only be processed by persons under an obligation of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.

1.3. Security of Personal Data

In accordance with Article 12 of the KVKK Law, Omega-Genetik takes appropriate and necessary measures to prevent the unlawful processing of personal data, to prevent unlawful access to such data and to ensure their preservation, and prevents the unlawful processing of personal data by third parties.

1.4. Transfer of Personal Data

Your personal data may be transferred, for the fulfilment of the purposes set out in this Policy, to other Omega-Genetik entities, our shareholders, public institutions and organizations authorized by law, our suppliers and business partners, persons from whom services are received or other third parties and/or abroad, within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the KVKK Law.

1.5. Rights of the Personal Data Subject Listed in Article 11 of the KVKK Law

Pursuant to Article 11 of the KVKK Law, you have the right to:

a) learn whether your personal data are processed,

b) request information if your personal data have been processed,

c) learn the purpose of processing your personal data and whether they are used in accordance with their purpose,

ç) know the third parties to whom your personal data are transferred domestically or abroad,

d) request correction of your personal data if they have been processed incompletely or incorrectly,

e) request correction of your personal data if they have been processed incompletely or incorrectly and request that the transaction carried out within this scope be notified to the third parties to whom the personal data have been transferred,

f) request the deletion or destruction of your personal data if the reasons requiring their processing cease to exist despite having been processed in accordance with the provisions of the KVKK Law and other relevant laws, and request that the transaction carried out within this scope be notified to the third parties to whom the personal data have been transferred,

g) object to the emergence of a result against the person by means of analysis carried out exclusively through automated systems,

ğ) request compensation for damages in case of suffering damage due to the unlawful processing of personal data.

It is important that the information/data you share is accurate and kept up to date in order to exercise the rights held over data within the meaning of the KVKK Law and for other relevant legislation; all liability arising from the provision of incorrect information belongs entirely to you.

2. SECTION. BASIC PRINCIPLES

Omega-Genetik complies with the general principles and conditions set out in the legislation regarding the protection and processing of personal data and acts in accordance with the principles listed below in order to ensure that personal data are processed in accordance with the Constitution and the KVKK Law.

2.1. Personal Data Processing Activities Being in Compliance with Law and the Rule of Good Faith

Omega-Genetik processes personal data in accordance with the law and the rule of good faith pursuant to Article 4 of the KVKK Law, adopts the principle of "transparency" towards data subjects and informs personal data subjects. Openness and good faith are taken as the basis in the information provided; clear information is given about the purpose of use of the collected personal data and the data are processed within this framework. Avoidance of the use of personal data in a manner that adversely affects the data subject without any legal justification is essential.

2.2. Ensuring Personal Data Are Accurate and, Where Necessary, Up to Date

Omega-Genetik ensures that the personal data it processes are accurate and up to date.

2.3. Processing Personal Data for Specific, Explicit and Legitimate Purposes

Omega-Genetik collects and processes personal data for legitimate and lawful reasons. Omega-Genetik processes personal data in connection with the activities it carries out, within a reasonable framework and to the extent necessary.

2.4. Being Relevant, Limited and Proportionate to the Purpose for Which They Are Processed

Omega-Genetik avoids processing personal data that are not relevant to the processing purpose or not needed. In this framework, minimizing data processing activities is essential.

2.5. Retention for the Period Prescribed in the Relevant Legislation or Necessary for the Purpose for Which They Are Processed

Omega-Genetik retains the personal data it processes only for the period prescribed in the relevant legislation and laws or required by the personal data processing purpose, in accordance with Article 138 of the Turkish Penal Code and Articles 4 and 7 of the KVKK Law. In this context, it is first determined whether a specific period is prescribed in the relevant legislation for the storage of the personal data subject to processing. If a legal period has been determined, conduct is in accordance with that period. If no legal period has been determined, the period necessary for the fulfilment of the processing purpose is determined and personal data are stored limited to this period. When the period expires, unless there is a legal reason requiring the data to be stored for longer, personal data are deleted, destroyed or anonymized.

III. SECTION. ENTRY INTO FORCE AND IMPLEMENTATION

This Policy entered into force on 1 October 2016. If the whole or certain provisions of the Policy are updated, the updates enter into force on the date they are published. The Policy is published in its most current form at www.likitbiyopsi.com.tr.