This Privacy Notice is prepared by Vivora Therapy, the data controller pursuant to the Personal Data Protection Law No. 6698 (“KVKK”), regarding the use of personal data obtained from Personal Data Subjects and/or third parties in relation to the website www.vivoratherapy.com (hereinafter referred to as the “Site”). The purpose of this notice is to transparently inform and enlighten you about how Vivora Therapy collects your personal data, the purposes and legal grounds for personal data processing activities, the principles regarding personal data transfers (if any), and your rights as a data subject.

As a personal data subject under KVKK, the Personal Data you share will be collected and processed by the Company designated as the Data Controller within the scope specified below.

1. DEFINITIONS and ABBREVIATIONS

In this Privacy Notice:

Company: Vivora Therapy

Personal Data: Any information relating to an identified or identifiable natural person.

Processing of Personal Data: Any operation performed on personal data, whether or not by automated means, including but not limited to collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, making accessible, classification, or preventing the use of data.

Data Subject: The natural person to whom the personal data pertains.

GDPR: The Personal Data Protection Law No. 6698, which came into force upon its publication in the Official Gazette on April 7, 2016.

Data Processor: A natural or legal person who processes personal data on behalf of the Data Controller based on the authority granted by the Data Controller.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data, and is responsible for establishing and managing the data registration system.

Website/Site: Refers to www.vivoratherapy.com.

2. PERSONAL DATA BEING PROCESSED

Depending on the relationship between you and the Company, the types and quantities of personal data processed will vary according to the reasons for processing. The Personal Data you share with the Company or that the Company obtains from third parties consists of the following:

Your personal data is processed in accordance with the general principles set forth in Article 4 of the KVKK, in a manner that is lawful and in compliance with the rules of good faith, accurate and, when necessary, up-to-date, for specific, explicit, and legitimate purposes, connected, limited, and proportionate to the purposes for which they are processed, and stored for the period stipulated by the relevant legislation or necessary for the purposes for which they are processed.

Pursuant to Article 5 of the KVKK, personal data cannot be processed without the explicit consent of the Data Subject. However, according to the same article, if one of the following conditions exists, the personal data of the Data Subject may be processed without explicit consent:

• It is explicitly stipulated by laws,
• It is obligatory for the protection of the life or physical integrity of the person who is unable to declare their consent due to actual impossibility or whose consent is not legally valid, or of another person,
• Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract,
• It is obligatory for the Data Controller to fulfill its legal obligation,
• The personal data have been made public by the Data Subject himself/herself,
• Data processing is obligatory for the establishment, exercise, or protection of a right,
• Provided that it does not harm the fundamental rights and freedoms of the Data Subject, it is obligatory for the legitimate interests of the Data Controller to carry out data processing.

3. GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA, CONDITIONS FOR PERSONAL DATA PROCESSING, AND PURPOSES

Your personal data is processed in accordance with the general principles set forth in Article 4 of the KVKK, in a manner that is lawful and in compliance with the rules of good faith, accurate and, when necessary, up-to-date, for specific, explicit, and legitimate purposes, connected, limited, and proportionate to the purposes for which they are processed, and stored for the period stipulated by the relevant legislation or necessary for the purposes for which they are processed.

Pursuant to Article 5 of the KVKK, personal data cannot be processed without the explicit consent of the Data Subject. However, according to the same article, if one of the following conditions exists, the personal data of the Data Subject may be processed without explicit consent:

• It is explicitly stipulated by laws,
• It is obligatory for the protection of the life or physical integrity of the person who is unable to declare their consent due to actual impossibility or whose consent is not legally valid, or of another person,
• Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract,
• It is obligatory for the Data Controller to fulfill its legal obligation,
• The personal data have been made public by the Data Subject himself/herself,
• Data processing is obligatory for the establishment, exercise, or protection of a right,
• Provided that it does not harm the fundamental rights and freedoms of the Data Subject, it is obligatory for the legitimate interests of the Data Controller to carry out data processing.

Within the scope of this Disclosure Text, the Company processes your personal data in order to fulfill obligations arising from legislation; to carry out the necessary work by the relevant business units to enable the relevant persons to benefit from the products and services offered by our website and to conduct the related business processes; to perform service activities carried out by our website through the necessary work by the relevant business units and the execution of related business processes; to plan and implement the commercial and/or business strategies of our website; to ensure the legal, technical, and commercial/operational security of the relevant persons who have a business relationship with our website; to plan and execute the activities necessary for customizing and promoting the products and services we offer according to the preferences, usage habits, and needs of the relevant persons; to establish possible rights and receivables of the concerned parties; to provide information to authorized institutions based on legislation; to create and track visitor records; and, within the scope of the Law on the Protection of the Consumer and other legal regulations, to ensure the fulfillment of obligations via our Company, our call center, our websites, or our social media pages and, without limitation, through all channels. It also processes your personal data in order to provide better service to customers; offer various advantages; carry out sales, marketing, information, and promotions; provide information about campaigns and their conditions; conduct surveys and customer satisfaction research; carry out and expedite your purchasing transactions; receive and deliver your orders; create campaigns for customers; determine target audiences; monitor customer activities to enhance user experience; develop the operation of our e-commerce site and mobile application and customize them according to customer needs; conduct direct and indirect marketing, personalized marketing, and remarketing activities; carry out personalized segmentation, targeting, analysis, and in-house reporting activities; conduct market research; plan and implement customer satisfaction activities; plan and execute customer relationship management processes; including but not limited to the planning and execution of the sales and marketing processes of the products and/or services of our site, and the planning and execution of processes for creating and/or increasing loyalty to the products and/or services offered by our site.

6. SECURITY OF YOUR PERSONAL DATA

In order to protect your personal data, the Company takes appropriate measures consistent with relevant privacy and data security laws and regulations, and, depending on the state of technology, the costs of implementation, and the nature of the data to be protected, implements technical and organizational measures to prevent risks such as destruction, loss, alteration, unauthorized disclosure, or unauthorized access to your data.

The personal data covered by this Disclosure Text are kept within the Company with access only granted to limited individuals. At the end of the processing period, these personal data will be deleted, destroyed, or rendered anonymous as indicated in the Company’s Personal Data Protection and Destruction Policy.

7. RIGHTS AND OBLIGATIONS OF THE PERSONAL DATA SUBJECT

7.1. Personal data subjects are responsible for ensuring that the personal data they have shared with the Company are accurate, complete, and up-to-date, and that if personal data of other individuals are shared, such data are collected in a valid and lawful manner. The personal data subject is obliged to inform the other individuals whose personal data he/she provides to the Company about the content of this Notice and to obtain their consent for the use of their personal data by the Company in the manner described in this Notice (including transfer and disclosure).

7.2. Within the scope of the KVKK and the relevant legislation, Personal Data Subjects have the following rights:

• To learn whether their personal data are processed or not,
• If their personal data have been processed, to request information regarding this,
• To learn the purpose of processing their personal data and whether they are used in accordance with that purpose,
• To know the third parties, at home or abroad, to whom their personal data are transferred,
• If their personal data are incompletely or incorrectly processed, to request their correction and to request that the transaction carried out in this context be notified to the third parties to whom the personal data have been transferred,
• Even though it has been processed in accordance with Law No. 6698 and the relevant other laws, if the reasons requiring its processing cease to exist, to request the deletion or destruction of personal data and to request that the transaction carried out in this context be notified to the third parties to whom the personal data have been transferred,
• To object to any unfavorable outcome resulting from the analysis of the processed data exclusively by automated systems,
• To demand compensation in the event that they suffer damage due to the unlawful processing of personal data.

As Personal Data Subjects, you may submit your request regarding your rights in a clear and comprehensible manner, along with documents identifying your identity and address, in writing with a wet signature by hand, by mail, or via notary public, to the address of the Company acting as Data Controller.

The Company has the right to verify your identity before responding, and your application must include:

• Your name, surname, and, if the application is in writing, your signature,
• For citizens of the Republic of Turkey, your T.R. identity number; if you are a foreigner, your nationality, passport number, or if available, your identity number,
• Your residential or workplace address for notification,
• If available, your email address, telephone number, and fax number for notification,
• The subject of your request,
• If relevant, information and documents related to the subject must also be attached to the application.

If you submit your requests to the Company in the manner specified above, the Company will process the request as soon as possible, and at the latest within thirty days, depending on the nature of the request.

Vivora Therapy