Data Subject Application Form and Procedure

Purpose and Scope

This Procedure governs applications under the Law concerning Personal Data for which the Company acts as data controller. In summary, that Personal Data comprises the following; for details, please review the Privacy Notice and the Privacy Policy pages.

• Limited technical records relating to visits to the bluehams.com website (e.g. IP and access logs kept for security purposes)
• Data submitted through the demo request form (full name, clinic name, e-mail, phone, number of branches and message)
• Platform account and user records (first name, last name, e-mail, phone, username; passwords are stored only as irreversible hash values)
• Subscription and payment notification records (payment records and uploaded bank transfer receipts)
• Security and activity records (login attempts, user activity history and administrator audit logs)

Patient records kept by customer clinics (each a "Clinic") within the Platform are OUTSIDE the scope of this Procedure; for those records, the data controller is the Clinic from which you receive services, and the Company acts solely as a data processor. For details of this distinction, please read the "Important Guidance for Patients" section below.

Requests for the erasure, destruction or anonymization of Personal Data are fulfilled in accordance with the procedures and periods set out in Article 7 of the Law and the relevant legislation, and with the retention periods described on the Retention and Destruction page.

Your Rights Under KVKK Article 11

As a Data Subject, under Article 11 of the Law you may apply to the Data Controller to exercise the following rights.

1. To learn whether your Personal Data is being processed
2. To request information if your Personal Data has been processed
3. To learn the purpose of the processing and whether the data is used in accordance with that purpose
4. To know the third parties to whom your Personal Data is transferred, in Turkey or abroad
5. To request the correction of your Personal Data if it is incomplete or inaccurate
6. To request the erasure or destruction of your Personal Data under the conditions set out in Article 7 of the Law
7. To request that operations carried out under items (5) and (6) above be notified to the third parties to whom your Personal Data has been transferred
8. To object to a result arising to your detriment through the analysis of your data exclusively by automated systems
9. To claim compensation for damage arising from the unlawful processing of your Personal Data

Personal Data is, as a rule, hosted on servers located within the borders of the Republic of Turkey; to the extent any transfer abroad takes place, it is carried out only where the appropriate safeguards required by Article 9 of the Law are provided. Up-to-date information on transfers and recipient groups is provided on the Privacy Notice page; requests for information on this subject are also answered under this Procedure.

Who May Apply

The following Data Subjects may apply to the Company under this Procedure.

• Platform account holders and users: Authorized officials of customer clinics and the staff users defined by those Clinics, with respect to their own account, subscription, payment notification and security records.
• Persons who have submitted a demo request: Anyone who has filled in the demo request form on bluehams.com.
• Website visitors: With respect to the limited technical records relating to visits to bluehams.com.

Each Data Subject may apply only in relation to Personal Data belonging to themselves. Applications on behalf of another person are processed only upon presentation of a notarized special power of attorney or an official document evidencing a custody or guardianship relationship.

Important Guidance for Patients

If you direct your application to the wrong addressee, it is not dismissed; however, because only the Clinic, in its capacity as data controller, can assess the request, the process may take longer. The correct addressee is, in every case, the Clinic from which you receive services. The Company supports the Clinic in technically carrying out operations such as locating, correcting, erasing, anonymizing and reporting records in line with the Clinic's instructions; the details of this division of roles are set out on the Data Processing Agreement page.

Patient applications reaching the Platform in this context cannot be concluded directly, given the Company's data processor role; the applicant is promptly informed of the correct addressee.

Application Channels

You may submit your application through one of the methods provided for in the Application Communiqué, using the channels below. For Data Subject applications, the primary channel is a written application directed to the OYOX LLC (US) postal address.

We do not currently have a registered electronic mail (KEP) address for receiving applications; until a KEP address is announced on this page, please use the channels above for electronic applications.

For general questions about the application procedure you may use the contact form announced on bluehams.com; however, for a message to be treated as a valid application under the Law, it must contain the mandatory elements required by the Application Communiqué and be submitted through one of the channels above.

Mandatory Elements of an Application

Under Article 5, paragraph 2 of the Application Communiqué, your application MUST contain the following elements.

1. Your first name and last name
2. Your signature, if the application is made in writing (by post)
3. Your Turkish ID number if you are a citizen of the Republic of Turkey; if you are a foreign national, your nationality and passport number, or your foreign identity number if you have one
4. Your residential or workplace address for notification purposes
5. Your e-mail address for notification, if available, together with your telephone or fax number
6. The subject of your request (state clearly and comprehensibly which right under Article 11 of the Law you wish to exercise and in relation to which of your Personal Data)

Any information and documents relating to the subject of your request should be attached where available. Applications lacking the mandatory elements cannot be assessed; in that case you will be asked to complete the missing elements, and the request cannot be concluded as long as your identity cannot be established. The form template at the end of this page is designed to cover all of these elements.

Response Time and Fees

Your application is concluded as soon as possible depending on the nature of the request and, in any event, within THIRTY (30) DAYS at the latest from the date it reaches us. The response is communicated to you in writing or electronically, in accordance with the Application Communiqué. Your request is either granted, or refused with an explanation of the reasons; where granted, it is also carried out without delay. If the application turns out to result from our own fault, any fee collected is refunded to the Data Subject.

As a rule, applications are FREE OF CHARGE. However, where the operation forming the subject of the request requires an additional cost, the current tariff set out in the Application Communiqué applies; under the tariff currently in force, a per-page processing fee (1 Turkish lira for each page beyond ten pages) may be charged in written responses, and where the response is provided on a recording medium such as a CD or USB drive, the cost of the medium may be charged.

Right to Lodge a Complaint with the Personal Data Protection Board

Under Article 14 of the Law, if your application is refused, if you find the response insufficient, or if no response is given within the statutory period, you may lodge a complaint with the Personal Data Protection Board (the "Board") within THIRTY (30) DAYS from the date you learn of the response and, in any event, within SIXTY (60) DAYS from the date of the application.

By law, a complaint cannot be lodged with the Board before the application remedy to the Data Controller has been exhausted; you must therefore first apply through the channels set out in this Procedure. Up-to-date information about the Personal Data Protection Authority and the complaint procedure is available at kvkk.gov.tr. The right of persons whose personal rights are violated to claim compensation under general provisions is reserved.

Identity Verification and Prevention of Misuse

To prevent Personal Data from being disclosed to unauthorized or incorrect persons, we must be satisfied that the application genuinely belongs to you. To this end, the Company may request additional information to establish whether the applicant is the Data Subject and may ask questions to clarify the matters stated in the application. For e-mail applications, sending from the e-mail address registered in our system is the primary element of identity verification. E-mail applications sent from an address not registered in our system are not treated as valid e-mail applications under the Application Communiqué unless additional verification sufficient to establish identity is provided; in that case, please use the postal channel or the secure electronic signature / mobile signature channel. For Data Subjects who have no e-mail address registered in our system (for example, mere website visitors), the valid route is likewise the postal channel or the secure electronic signature / mobile signature channel.

• No application may be made in relation to Personal Data belonging to someone else; requests whose identity cannot be verified or which concern third parties' data are refused.
• Applications on behalf of another person are possible only upon presentation of a notarized special power of attorney or a custody/guardianship document.
• Information and documents submitted for identity verification are used solely to conclude the application.
• Legal liability arising from false or misleading information provided in the application rests with the applicant.

Application Form Template

You may copy and fill in the template below and submit it through one of the channels stated above. A signature is mandatory for written (postal) applications.

KVKK Data Subject Application Form

Data Controller: OYOX LLC (BLUEHAMS) — Registered Office: 1209 Mountain Road PL NE, STE N, Albuquerque, NM 87110, United States

Application Address (by post): OYOX LLC, 1209 Mountain Road PL NE, STE N, Albuquerque, NM 87110, United States

• First Name and Last Name: .......
• Turkish ID Number (for citizens of the Republic of Turkey): .......
• Nationality and Passport Number, or Foreign Identity Number (for foreign nationals): .......
• Residential or Workplace Address for Notification: .......
• E-mail Address for Notification (your address registered in our system): .......
• Telephone Number (if available): .......
• Your Relationship with BLUEHAMS (account holder / user / demo requester / website visitor / other): .......
• Subject of the Request (state clearly and comprehensibly which right under Article 11 of the Law you wish to exercise and in relation to which of your data): .......
• Information and Documents Attached to the Application (if any): .......
• Preferred Response Method (by post to my address / to my e-mail address): .......
• Application Date: .......
• Signature (mandatory for written applications): .......

Declaration: I declare and confirm that the information provided in this application is accurate and up to date, that my request concerns only Personal Data belonging to me, and that, if I am applying on behalf of another person, I have attached the document evidencing my authority; I request that my application be assessed and concluded in accordance with Article 13 of Law No. 6698.