Privacy Notice on the Protection of Personal Data

Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by Denta7 Ağız ve Diş Sağlığı Hizmetleri Ltd. Şti. (“Denta7 Oral and Dental Health Polyclinic” or the “Polyclinic”) as the data controller, within the scope described in this notice.

• Company: Denta7 Ağız ve Diş Sağlığı Hizmetleri Ltd. Şti.
• Address: Sütçüler Mah. Sütçüler Cad. No: 28/F, Kepez / Antalya
• Phone: +90 (555) 445 07-07
• Email: [KVKK application email address]
• Registered electronic mail (KEP): [if any]
• VERBİS registration number: [if any]

This notice covers patients receiving examination and treatment at the Polyclinic, parents or guardians of patients under 18, patients’ relatives, people requesting appointments via our website, phone or WhatsApp, and visitors to our website.

Depending on your relationship with us, the following personal data may be processed:

• Identity: name, surname, Turkish ID number or passport number, date of birth, gender.
• Contact: phone number, email address, address.
• Patient transactions: appointment requests and details, requested treatment, appointment and visit history, correspondence.
• Health data (special category personal data): medical history, medicines, allergies, examination findings, diagnosis and treatment information, intraoral photos, panoramic X-ray, CT and digital scan images, consent forms, prescriptions.
• Financial: invoice details, payment records, [if any] private health insurance policy details.
• Parent / guardian details: identity and contact details of the parent or guardian for patients under 18.
• Physical security: [if the polyclinic has security cameras] camera recordings.
• Transaction security: IP address, browser information and access logs generated while using the website.

Your personal data is processed for the following purposes:

• Receiving appointment requests, scheduling appointments, sending reminders and notifying changes,
• Carrying out examination, diagnosis, treatment and follow-up services, preparing the treatment plan and obtaining consent,
• Keeping medical records and patient files in accordance with the legislation,
• Working with dental laboratories and imaging centres as required for treatment,
• Invoicing, payment and [if any] insurance processes,
• Fulfilling notification, record-keeping and retention obligations arising from health and other legislation,
• Responding to requests from authorised institutions and protecting our rights in possible disputes,
• Handling patient requests and complaints and communicating with you,
• Ensuring the information and physical security of the Polyclinic and the website.

Your personal data is collected through the appointment form on our website, phone calls, WhatsApp and email correspondence, forms completed and face-to-face meetings at the polyclinic, records made during examination and treatment and [if any] Ministry of Health systems, by fully or partly automated means or by non-automated means as part of a data filing system.

Your general personal data is processed on the legal grounds set out in Article 5(2) KVKK: it is directly related to the conclusion or performance of a contract, it is necessary for the data controller to comply with a legal obligation, it is necessary for the establishment, exercise or protection of a right, and it is necessary for the legitimate interests of the data controller provided that your fundamental rights and freedoms are not harmed.

Your health data is processed under Article 6(3) KVKK by persons under a duty of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services. Other legal grounds set out in the law are relied on where applicable; your explicit consent is obtained separately for any processing outside these cases.

Your personal data may be transferred to the following recipient groups, limited to and proportionate with the purposes above and in accordance with Articles 8 and 9 KVKK:

• The Ministry of Health, the Provincial Health Directorate and related health information systems, [if any] the Social Security Institution and other public institutions authorised by law to request information,
• Judicial authorities and enforcement offices upon request,
• Dental laboratories and imaging centres we work with for treatment (only the necessary information),
• Private health insurance companies [if any], at your request,
• Our accountant, legal adviser and auditors,
• Providers of patient record software, hosting, backup, email and communication services.

If you correspond with us via WhatsApp, your messages may be processed on servers of the service provider (Meta Platforms) located abroad. [If hosting, email or patient record software providers have servers abroad, they must be listed here.]

Transfers abroad are carried out in accordance with the conditions of Article 9 KVKK (adequacy decision, standard contract or other appropriate safeguards, or the cases provided for incidental transfers). We do not ask for health data via WhatsApp and recommend that you do not share treatment documents or images through this channel.

Your personal data is kept for as long as the purpose of processing requires and for the retention periods set out in the relevant legislation; at the end of the period it is deleted, destroyed or anonymised.

• Medical records and patient files: for the period set out in health legislation [period to be confirmed by a lawyer].
• Invoice and accounting records: for the periods set out in the Turkish Commercial Code and the Tax Procedure Law.
• Request forms that do not lead to an appointment: [e.g. 1 year].
• Website access logs: [period to be determined according to the relevant legislation].

In accordance with Article 12 KVKK, technical and administrative measures are taken to ensure an appropriate level of security to prevent unlawful processing of and access to your personal data and to safeguard it. These include access authorisation, encryption, backups, staff confidentiality undertakings and physical archive security.

Under Article 11 KVKK, by applying to the data controller you have the right to:

• learn whether your personal data is processed,
• request information if your personal data has been processed,
• learn the purpose of processing and whether it is used in line with that purpose,
• know the third parties in Turkey or abroad to whom your personal data is transferred,
• request correction if it is incomplete or inaccurate,
• request deletion or destruction within the framework of Article 7 KVKK,
• request that third parties to whom your data was transferred be notified of the correction, deletion or destruction,
• object to a result against you arising from analysis exclusively by automated systems,
• claim compensation if you suffer damage due to unlawful processing of your personal data.

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit your requests with a signed petition containing information identifying you and your request, in person or via a notary to Sütçüler Mah. Sütçüler Cad. No: 28/F, Kepez / Antalya, by registered electronic mail (KEP) to [KEP address], with a secure electronic signature or mobile signature, or from the email address you have previously notified to us and that is registered in our system to [KVKK application email address].

Your application must include your name, surname, signature (for written applications), Turkish ID number (for foreigners, nationality and passport number), address or email address for notifications and the subject of your request.

Applications are concluded free of charge within 30 days at the latest, depending on the nature of the request; if the procedure requires an additional cost, the fee set by the Personal Data Protection Board may be charged. If your application is rejected, you find the response insufficient or no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 KVKK.

This notice may be updated in line with changes in the legislation or our processing activities. The current version is always published on this page; the date of the last update is shown at the bottom of the page.