Information on the Protection of Your Personal Data

As Atmosphere Yazılım ve Bilişim Hizmetleri Anonim Şirketi (“Atmosphere”), having the title of Data Controller within the scope of the Law on the Protection of Personal Data No. 6698 (“Law”), which entered into force on April 7, 2016, we present this Information Text regarding the UzmanFikir Application (“Application”) to your information to fulfill our obligation to inform arising from Article 10 of the Law.

We respect the privacy of your Personal Data and take all necessary administrative and technical measures to protect your data.

Update history

Version	Date	Description
v1.3	May 31, 2025	How and for what purpose the personal data we obtain during the use of cash points will be used; removal of the conditions regarding sensitive personal data that we have never collected, recorded and used.
v1.2	August 14, 2024	Change of our company's address.
v1.1	May 14, 2021	Use of survey responses for user segmentation.
v1.0	April 8, 2021	First version.

Definitions

• Adverse Event Reporting Form: The form containing the adverse event notifications you want to make in relation to undesirable events that occur during the use of certain Medical Products.
• Survey: A set of questions created by various pharmaceutical or research companies or by us, aiming to learn and analyze your opinions on some issues related to the pharmaceutical and health services sectors.
• Contracted Organization: The organizations we have a contract with, where you can use the Reward Points that will be defined in your Application account as a result of your participation in various survey studies through the Application.
• Charity Point: The cash values to be transferred directly by Atmosphere to the selected NGO if the Members choose to use the RewardGift Points they earn as a result of the surveys they participate in UzmanFikir in the form of a donation transfer to one of the NGOs listed in UzmanFikir or if participation in a Survey only entitles them to Charity Points.
• Participant: Members who complete various Survey studies through the UzmanFikir Application.
• Personal Data: Any information relating to an identified or identifiable natural person in accordance with the Law on the Protection of Personal Data No. 6698.
• Cash Point(s): Monetary values to be defined in the UzmanFikir Application account of the Members within the limits stipulated in the relevant legislation as a result of their participation in various Survey studies through the UzmanFikir Application and to be transferred to the bank accounts to be notified by the Participants later.
• Reward Coupon(s): Discount coupons that Members will acquire to be used in Contracted Organizations by using the Reward Points they have earned in UzmanFikir.
• Reward Point(s): All rights and values such as discount rights, spending rights and the like that will be defined in your Application account as a result of your participation in various survey studies through the Application and that can be used during the purchase of various goods/services from Contracted Organizations.
• Health Professional (“HCP”): Physician, dentist, pharmacist, nurse, midwife and other professionals defined in Annex 13 of the Law on the Practice of Medicine and Medical Arts No. 1219 dated 11/4/1928.
• Medical Product: A combination of natural or synthetic active substance/substances, enteral nutrition product and medical food applied to humans to treat or prevent a disease, making a diagnosis or correcting, regulating or modifying a physiological function.
• Member/You: Persons who have downloaded the Application and whose membership has been approved by us.
• Regulation: Regulation on the Promotion Activities of Human Medicinal Products. means.

Personal Data of Our Application and Web Visitors

Device and Input Information

When you access the application, we automatically collect some technical information such as internet protocol address, domain name, internet service provider, device brand, model, operating system version, to improve the quality of the service we provide to our users.

IP Address

Your IP address is a number assigned to the mobile device you are using and assigned by your internet provider. This number is automatically identified and stored when you log in or access the internet. The purpose of collecting and storing IP addresses in this way is to increase the service quality by detecting the usage density of the Application, possible access problems and to protect our system against malicious users.

Although IP address information does not have the nature of Personal Data as a rule, we would like to remind you that in some exceptional cases such as the detection of crimes and misdemeanors, or that your IP address can be associated with your other personal information and thus your IP address may also gain the nature of Personal Data.

Personal Data of Members and Participants

This Application is specially prepared for Health Professionals. We request the following information and documents to become a member. We process the data written here from the moment you share it with us:

• Name and surname
• Phone number
• Diploma information
• Professional information (institutional identity, professional title, specialty degree, seniority)

When you apply for membership, we delete this data, which we collect to determine whether you are really an HCP, from the main database of the Application, after examining and approving it, except for your phone number, and move it to a high cryptographic security environment. We continue to store your phone number, which is used for identity verification, in our system during your membership.

After your membership process is completed, we also process your following Personal Data:

• Whether you clicked on the notifications displayed by the application, when you clicked,
• The survey information you participated in (which surveys you looked at and participated in, your answers to the surveys, how long you viewed the questions on the screen)
• The Medical Product promotion content you clicked on and how long you viewed the content on the screen,
• The Reward Points you have earned by participating in surveys and/or other campaigns and when and in which Contracted Organization you converted these Reward points into valid Reward checks,
• Your account access data,
• The Cash Point amounts you are entitled to by participating in surveys and/or other campaigns and the bank account information you request these amounts to be transferred to and the transferred amount information,
• The Charity Point amounts you are entitled to by participating in surveys and/or other campaigns and/or converted from Reward Points and the NGO information you prefer these amounts to be transferred to and the transferred amount information,
• Your sensitive data such as association, foundation or union membership, health-related data may be processed due to the answers you prefer to give to the questions you encounter in the surveys. This data can be processed in accordance with the obligation of confidentiality, to protect public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, as stated in Article 6/3 of the Law.

Our processing period for your Personal Data is limited to the processing periods required for us to perform the service we offer, taking into account the periods required by the legislation. We periodically review the Personal Data we process and delete it irrevocably if the processing purposes/periods have expired.

By Which Method and for What Purpose Do We Process?

We process your Personal Data by automatic or non-automatic methods, verbally or in writing, in physical or electronic media,

• To be able to fulfill our obligations arising from the contract between us (to enable you to use the application),
• To share the survey results as statistical summary data with the relevant persons and organizations,
• To be able to make an Adverse Event Notification,
• To enable you to use your Reward Points and transfer your Cash Points and/or Charity Points,
• To provide you with access to Medical Product promotion content,
• To be able to carry out data analysis activities to increase customer satisfaction,
• To be able to inform you about the services we can provide through verbal or digital media,
• (Only if you have your explicit consent) To be able to inform you about all kinds of general or personalized campaigns, discounts and similar unique advantages or for other situations that require us to contact you,
• To be able to subject the collected data to statistical studies for the improvement of the services we offer, thus to be able to analyze user behavior and trends,
• To be able to group our users who give similar answers to the survey questions or whose interactions with the user interfaces are similar to yours, to analyze the behaviors and trends of these groups and to prepare surveys or Medical Product promotion content for their needs,
• To be able to evaluate your complaints and applications,
• To be able to continuously inform you by notifying you of the changes in our privacy and sales/service policy,
• To be able to back up the data we collect from members to prevent data loss,
• To be able to fulfill our obligations stipulated within the scope of other legislation and to share your data with authorized administrative or judicial institutions within this scope for the purpose.

What are the Legal Reasons for Data Processing?

Your Personal Data is processed within the framework of the following legal reasons, except for cases that require your explicit consent in accordance with Articles 5 and 6 of the Law - in which case no processing activity will be carried out without your explicit consent:

• To be able to comply with the rules clearly stipulated in the legislation,
• If it is related to the personal data you have made public and is in accordance with your will to make it public,
• If it is necessary for the establishment, use or protection of a right,
• Because it is directly related to the performance of the contract we have established to provide you with services through our application,
• If it is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons or authorized institutions and organizations under the obligation of confidentiality (only for sensitive personal data),
• If it is mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance (only for sensitive personal data),
• Provided that it does not harm your fundamental rights and freedoms, in case data processing is mandatory for our legitimate interests (only for non-sensitive personal data).

Who Do We Transfer Your Data To?

As a general principle, we do not transfer your personal data belonging to you as an individual to anyone. We share the summary statistical results/reports that we create by bringing together the data of all Members participating in the campaigns related to Surveys, medical product promotions, Reward Points, Cash Points and Charity Points.

Your Personal Data may be shared with the real or legal persons listed below, within the scope of the purposes stated under the heading "By Which Method and for What Purpose Do We Process?":

Your Shared Data	Shared Persons
Data Related to Surveys: i. Which HCP group you belong to, ii. Your specialty degree, iii. Your seniority, iv. The survey information you participated in (which surveys you participated in and when, your answers to the surveys, how long the questions were displayed on the screen)	Only in summary reports, with the people who prepared the content of the Survey you participated in or the survey questions: i. Persons who are license/permission holders or their contracted companies within the scope of the Regulation on the Promotion Activities of Human Medicinal Products, ii. Research companies, iii. Our solution partners (For example, in case a retail sales company prepares Survey content special for HCPs)
Data Related to Medical Product Promotions: i. Which Medical Product promotion content you clicked on, when and for how long you viewed this content on the screen	Only in summary reports Persons who are license/permission holders or their contracted companies within the scope of the Regulation on the Promotion Activities of Human Medicinal Products
Data Related to Reward Points: i. The types of Reward Points you have earned ii. Usage Information of Reward Points (Contracted Organization where the Reward check was requested, brand, time and Reward code) iii. Only if you request, your information such as your name and surname, e-mail address, phone number that you have specified in order to prepare a Reward Coupon suitable for your request	Only in summary reports i. Contracted Organizations Only if you request, individually i. Contracted Organizations
Data Related to Cash Points The Cash Point amount you have requested and your bank account information to which you have requested the transfer	Individually Contracted Banks
Data Related to Charity Points i. The NGOs you prefer to donate to, ii. The amounts you have donated,	Only in summary reports i. Press and media organizations, ii. Our website and social media accounts publicly,
Data Related to the Adverse Event Reporting Form: i. Name-surname ii. Professional title iii. Reported product name iv. Reported situation v. Contact Information	i. The license holder of the Medical Product for which the form was filled out ii. Turkish Medicines and Medical Devices Agency

IMPORTANT: The patients you have specified in the Adverse Event Reporting Form must be informed about their personal data in accordance with the Law. Please do not share the data of patients you have not informed. You can take the Information Text published by the TURKISH MEDICINES AND MEDICAL DEVICES AGENCY as an example.

IMPORTANT: Your personal data that we process and will transfer to the persons listed above due to your filling out the Adverse Event Reporting Form is used only for pharmacovigilance activities.

We may share your Personal Data with judicial authorities, relevant law enforcement agencies or authorized public institutions in case of legal disputes or upon request in accordance with the relevant legislation.

We may share your personal data with real or legal persons (e.g., call center) or our business partners (affiliated companies or company partners) from whom we receive services, including lawyers and auditors, within the framework of the confidentiality agreements we will make, limited to the purposes listed above.

In some cases where your Personal Data is required to be processed and stored on our behalf for the purposes listed above, we may share your data with third party data processors. The agreements to be made with these third parties will be of a nature to protect your Personal Data at the highest level, and we will keep all their transactions under control.

Where is Your Data Stored?

All personal data you provide is stored on our secure servers located in Turkey.

What Can You Do About Your Personal Data?

By contacting us at any time through the communication channels written below, you have the right to:

• To learn whether your Personal Data is being processed,
• Request any information regarding your processed data,
• Know the third parties to whom your Personal Data is transferred domestically or abroad,
• Learn the purpose of processing your Personal Data and whether they are used in accordance with their purpose,
• Request the correction of your Personal Data if it is incomplete or incorrectly processed,
• Request the deletion/destruction of your data in case the reasons requiring the processing of your personal data disappear,
• Request that the correction, deletion or destruction of your personal data be notified to the third parties to whom your Personal Data has been transferred,
• Object to the emergence of a result against you by analyzing your processed data exclusively through automated systems,
• Demand the compensation of the damage in case you suffer damage due to the unlawful processing of your Personal Data

Responsibility

• Despite all the administrative and technical measures we have taken, Atmosphere and its managers will not have any responsibility in case your data is seized, used, changed, transferred to third parties, disclosed and subjected to similar transactions as a result of any cyberattack or illegal action beyond our control.
• We would like to remind you that you are responsible for the physical security of your login/logout procedures, your device, your SIM card and your phone number. In the event that your device or SIM card is seized by a third party against your will, or if you change or cancel your phone number, we kindly ask you to notify us as soon as possible from the support section within the application or from our contact address below. Upon receipt of your notification, we will make our best effort to protect your account and your Reward Points.

Changes to Our Policy

We reserve the right to change or cancel the terms and conditions stipulated in this Information Text. We will inform you immediately in case of any change or cancellation.

Miscellaneous Provisions

This Information Text is an integral part of the Application Usage and Membership Agreement. The provisions of the Usage and Membership Agreement will apply to matters not included in this text.

Contact Us

1. To exercise your rights mentioned in this Information Text or to express any opinion or question about your Personal Data, you can contact us anonymously by using the support form in the application, or you can reach us by phone, e-mail or mail from the contact information below. We will make our best effort to fulfill your requests promptly.
2. To determine whether the application belongs to you, some additional verifications (such as sending a message to your registered phone, calling you) that do not complicate the application process may be requested. For example, if you apply via your e-mail address, we may reach you using another communication method and ask for confirmation that the application belongs to you.
3. We will conclude the relevant request free of charge within thirty days at the latest, depending on the suitability and nature of your request.

Contact Information

Atmosphere Yazılım ve Bilişim Hizmetleri A.Ş.

MERSIS NO	0103-1286-8530-0001
Address	Huzur Mh. Maslak Ayazağa Cd. No: 4/B 34485 Sarıyer, İstanbul, Türkiye
Email	kisiselveri@uzmanfikir.net
Phone	+90 216 573 5555
E-Notification Address	25878-69864-13153
KEP Address	atmosphereyazilim@hs01.kep.tr