KVKK - Personal Data Protection Law Disclosure

Disclosure Text Under the Personal Data Protection Law (KVKK)

Pursuant to the Law on the Protection of Personal Data No. 6698 ("KVKK"), RealWorks Teknoloji A.Ş. ("HaloScape" or the "Company"), acting as the data controller, processes your personal data within the framework of the purposes and legal grounds described below.

Data Controller

RealWorks Teknoloji A.Ş.

Yildiz Mahallesi, Asariye Cami Cikmazi Sk. No:5 Besiktas, Istanbul, Turkiye, 34349

Tax Number: 7341829298

Categories of Personal Data Processed

In connection with your use of HaloScape services, the following categories of personal data are processed:

• Identity Data: Name, surname, date of birth, gender
• Contact Data: Email address, phone number
• Health Data: Health information shared through the application, Apple Health / Google Health Connect data, health score (HaloScore) calculation data
• Financial Data: Data related to subscription and payment transactions
• Technical Data: IP address, device information, application usage data, cookie data
• User Content: Photographs and images uploaded to the application

Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Provision of digital health services (real-time consultations, AI-supported health insights, symptom assessments)
• Creating and managing user accounts
• Processing subscription and payment transactions
• Fulfillment of legal obligations
• Ensuring platform security
• Conducting analysis to improve service quality
• If you have given consent: marketing and promotional communications, research and development activities

Legal Grounds for Processing Personal Data

Your personal data is processed pursuant to Articles 5 and 6 of the KVKK on the following legal grounds:

• Explicit Consent: Particularly for your health data and marketing communications.
• Establishment or Performance of a Contract: Mandatory processing to provide the service under the Terms of Use.
• Fulfillment of Legal Obligations: Tax, accounting, and legal retention obligations.
• Legitimate Interest: Platform security and service development activities.

Parties to Whom Personal Data is Transferred

Your personal data may be transferred to the following parties:

• Domestic Transfer: Business partners and subcontractors supporting service processes
• International Transfer: Service providers based abroad such as Google Cloud (infrastructure), Stripe (payment), OpenAI/Anthropic (AI support), Google Analytics/Meta (analytics) — with necessary safeguards in accordance with Article 9 of KVKK and relevant legislation

Your Rights Under KVKK

Pursuant to Article 11 of KVKK, you have the following rights:

a) To learn whether your personal data is being processed, b) To request information about the processing if your data has been processed, c) To learn the purpose of processing your personal data and whether it is being used in accordance with its purpose, d) To know the third parties to whom your personal data has been transferred domestically or internationally, e) To request correction if your personal data is incomplete or incorrectly processed, f) To request deletion or destruction of your personal data, g) To request that the transactions made be notified to the third parties to whom personal data has been transferred, h) To object to a result arising against you by means of analysis solely through automated systems, i) To demand compensation if you suffer damages due to unlawful processing of your personal data.

How to Exercise Your Rights

You may submit your requests regarding your rights to our Company through the following means:

• Email: privacy@haloscape.health
• Postal Address: Yildiz Mahallesi, Asariye Cami Cikmazi Sk. No:5, Besiktas, Istanbul, Turkiye, 34349

Your request will be finalized free of charge in the shortest possible time and in any case within 30 days.

Contact

For your KVKK-related questions:

• Email: privacy@haloscape.health or dpo@haloscape.health