1.1 General Information on Personal Data Protection Law The General Data Protection Regulation (GDPR) and relevant international laws have been adopted to protect the fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing of personal data. As the Data Controller, Medicatur Anonim Şirketi (Medica Tours) informs you about the following scope.

1.2 Data Controller Information

• Company Name: Medicatur Anonim Şirketi

• Address: Piripaşa Mah. Kumbarhane Cad. No:46, Beyoğlu, Istanbul, Turkey.

• Email: info@medicatur.com.tr

• Phone: +90 216 807 07 70

1.3 Purposes of Processing Your Personal Data Your personal data, including your name, surname, email address, phone number, and health data (dental X-rays, photos, medical history) provided by you, will be processed for the following purposes:

• Creating personalized dental treatment plans and cost estimates.

• Organizing medical tourism services, including VIP transfers, flight coordination, and hotel accommodation.

• Establishing communication via WhatsApp, phone, or email to provide consultation services.

• Fulfilling legal obligations arising from healthcare and tourism regulations.

• Carrying out analysis and evaluation for statistical information without disclosing your identity.

1.4 Methods of Data Collection and Legal Basis Your personal data is collected through digital lead forms (Google Ads), our website, and direct communication channels. The legal basis for processing is your explicit consent provided when submitting our contact forms to receive medical services.

1.5 Transfer of Personal Data Your personal data may be shared with our certified dental surgeons, clinical staff, partner hotels, and transport companies only to the extent necessary to perform your treatment and travel organization. Data may also be shared with authorized public institutions (Ministry of Health, Ministry of Tourism) to fulfill legal requirements.

1.6 Your Rights Under GDPR As a data subject, you have the right to:

• Learn whether your personal data is processed.

• Request information if your personal data has been processed.

• Learn the purpose of processing and whether they are used for that purpose.

• Know the third parties to whom personal data is transferred.

• Request correction, deletion, or destruction of personal data.