Explicit Consent and Consent Information on the Processing of Medical Data

1. The entities to which the consent relates

Cuba Health Assist is a healthcare coordination brand operating within MYDN GROUP.

Depending on the relevant application and service relationship, MYDN GROUP Sağlık Turizm Ticaret Limited Şirketi or MYDN GROUP LLC may act as the data controller.

The data controller for the application is determined according to its role in the relevant personal data processing activity.

Contact: info@cubahealthassist.com

2. What medical information may be processed?

To the extent necessary to assess the application, the following information may be processed:

• The patient's first name, surname, date of birth and relevant identity details.
• Diagnosis and date of diagnosis.
• Medical and treatment history.
• Previous surgery and other procedures.
• Medicines used, allergies and relevant clinical information.
• Pathology and biopsy reports.
• Laboratory and imaging results.
• Molecular and genetic test reports.
• Clinical assessments and physicians' opinions.
• Other necessary medical documents relating to treatment.

Depending on the nature of the application, only the documents necessary for the relevant specialist assessment are requested.

The principle is that unnecessary personal or medical information is not shared.

3. For what purposes may health data be processed?

3.1. Creating the patient file

Bringing together the necessary personal information and medical documents for the relevant application.

3.2. Preliminary check of documents

Checking the legibility of medical documents, the completeness of the file and the types of document needed for the relevant assessment.

3.3. Medical translation and documentation

Preparing the necessary documents in Spanish, translating them or organising them in a form suitable for the relevant specialist assessment.

3.4. Coordinating the specialist physician's assessment

Forwarding the file to the relevant specialist physician or healthcare institution and coordinating the obtaining of a medical opinion.

3.5. Requests for missing documents and additional information

Requesting from the applicant or the patient the up-to-date medical information needed by the relevant healthcare institution.

3.6. Communicating the outcome of the assessment

Communicating the specialist physician's opinion, requests for additional tests or explanations about the next stages to the authorised applicant or the patient.

3.7. Follow-up coordination

Carrying out follow-up, appointment and healthcare institution communication processes that are separately requested by the patient and fall within the scope of the relevant service.

These operations are carried out to the extent that the relevant legal conditions are met.

4. Scope of explicit consent

For a health data processing activity that requires explicit consent, approval is obtained with the relevant purpose of processing clearly stated.

No blanket permission is requested for your health data to be used in general, for an unlimited period or by unspecified third parties.

Explicit consent must relate to specific purposes, and the user must be able to understand which operation they are permitting.

Where another condition for processing data exists under the applicable legislation, the relevant operation may be based on a legal ground other than explicit consent.

5. Sharing medical documents with physicians

For the purpose of assessing the patient file, the necessary medical information may be shared with the relevant specialist physician or authorised healthcare institution.

The scope of this sharing is limited to the information necessary for the physician's assessment.

Where medical documents need to be forwarded to another healthcare institution or to a different assessment process, the legal basis of the new operation and any necessary additional information or consent conditions are assessed separately.

A patient's data is not shared without limit with persons or institutions that have no connection with the file.

6. International transfer of medical data

One of Cuba Health Assist's core coordination activities is sharing the necessary medical documents with specialist physicians in Cuba.

For this reason, your personal health information may be transferred to Cuba in order to deliver the relevant service.

In addition, some of the communication, documentation or technical service providers used may be located in Türkiye, the USA or other countries.

Transfers of data abroad are subject, separately from the legal ground for processing the data, to the conditions laid down in the relevant transfer legislation.

For transfers from Türkiye, Article 9 of KVKK is taken into account; for transfers to which GDPR applies, the relevant international transfer provisions are taken into account.

The relevant data transfer may require an adequacy decision, an appropriate safeguard or one of the exceptional transfer conditions applicable by law.

Giving a general medical data consent does not mean that all the legal requirements for transferring data abroad are automatically met.

Where your explicit consent is additionally required for an exceptional transfer, you will be appropriately informed about the relevant country, the recipient, the purpose of the transfer and the risks that may arise from the absence of adequate protection.

7. AI-supported document operations

Cuba Health Assist may make use of AI-supported systems during the preliminary check of medical documents or the preparation of draft translations.

Because these operations may involve the processing of health data, the relevant legal basis and data security conditions are assessed separately.

Which provider will be used, which data will be transmitted, the conditions under which the provider may process the data and the conditions for transfer abroad are explained in the relevant information.

If the operation needs to be based on separate explicit consent, that consent is obtained separately.

If the user does not consent to an operation, information is provided about possible alternative methods and the effects on the service.

Document or translation drafts produced by artificial intelligence do not constitute an independent medical diagnosis or treatment decision.

Cubi · AI-powered Digital Patient Coordinator is not part of the medical assessment and does not review or interpret medical documents. It only gives general process information, helps with the application and passes messages to the right team. The Cubi notice and your right to refuse AI processing are separate from the medical data consent described in this document and are explained in section 15 below. How your messages are processed is described in detail in the Privacy and Personal Data Protection notice.

8. Information provided by a patient's relative

A person applying on behalf of a patient must have the necessary authority to share the relevant health data and to act on the patient's behalf.

Being the patient's spouse, child, parent or other relative does not, on its own, give authority to give explicit consent for all data processing operations.

If the patient is able to make decisions and has the necessary legal capacity, explicit consent may need to be obtained directly from the patient.

Where a legal representative is authorised, the relevant conditions of representation apply.

Cuba Health Assist may request additional approval or a document of representation in order to verify the validity of the application.

9. Data of child patients

When processing the health data of patients under 18, the parent or legal representative conditions required by the legislation of the relevant country are taken into account.

Where necessary, an additional assessment is made in light of the child's age, capacity for discernment and the applicable patient rights rules.

Persons without legal authority of representation cannot give consent to the processing of health data on behalf of a child solely on the basis of a family relationship.

10. Withdrawing consent

For personal data processing activities based on your explicit consent, you can withdraw your consent at any time.

Withdrawing consent does not invalidate operations lawfully carried out before the date of withdrawal.

After withdrawal, if there is no other valid legal basis for processing the relevant data, operations based on consent are stopped.

Withdrawing consent may mean that the ongoing medical file assessment or coordination service cannot be continued.

Records that must be kept by law may be retained in accordance with the relevant obligations.

11. Retention of medical data

Medical data is kept for as long as necessary to deliver the service and for the applicable legal obligations.

Closing the file or withdrawing explicit consent does not mean that all records will be deleted immediately in every case.

Data for which the purpose of retention or the legal basis has ended is deleted, destroyed or anonymised where the necessary conditions are met.

For detailed information on retention conditions and personal data rights, please see the Privacy and Personal Data Protection notice.

12. Security of your data

Access to medical documents is restricted on the basis of role and authorisation.

Appropriate secure connections, access controls and other technical or administrative protection methods are used when sharing files.

Efforts are made to prevent the unauthorised disclosure of health data to third parties or its use for purposes other than the relevant ones.

Security measures are assessed taking into account the relevant data protection obligations and technical risks.

13. Effects of not giving explicit consent

Where explicit consent is required for the processing of health data, not giving approval means that the relevant processing activity cannot be carried out.

In that case, the file may not be prepared for the physician's assessment, or the relevant medical coordination service may not be provided.

However, general information requests that do not require the processing of health data may continue under appropriate conditions.

Not giving explicit consent does not prevent users from exercising their data protection rights.

14. Recording consent

Explicit consents given electronically may be recorded as part of the necessary proof and security processes.

These records may include the date on which consent was given, the version of the approved text, application or file details and the necessary technical verification records.

Consent records are kept only within the necessary retention and proof conditions.

The record that the Cubi notice was sent and of any objection to AI processing consists only of a pseudonymous identifier, the channel, the date and time, the version of the notice or consent text and, where applicable, the date of the objection; message content is not recorded. This record is kept for 3 years from your last relevant contact with us. If you ask for erasure, the trace linking the record to you is deleted and only a record showing that AI processing was refused remains.

15. Consent statement

The following statement may be presented in the application system as a separate approval field for cases where the processing of health data must be based on explicit consent.

Using this statement does not remove the data controller's other necessary legal and technical obligations.

Separate approval is obtained, where appropriate, for optional AI-supported data processing activities or special transfer operations that legally require separate consent.

The notice is sent separately on each channel and is separate from the explicit consent to the processing of medical data above; the consent checkbox in the application form does not replace the Cubi notice. If you do not want AI processing, write STOP, "I don't want Cubi" or "I don't want AI" on the same channel at any time, even in your first message, or e-mail info@cubahealthassist.com; from then on, your messages on that channel are not sent to the AI service provider and our team answers your questions during working hours. Applying does not depend on using Cubi; your application proceeds in the same way.

16. Your rights and contact

You can contact us to exercise your rights of access, rectification, erasure and withdrawal of explicit consent in relation to your personal data, and the other rights provided for in the applicable legislation.