Privacy Policy

CONFIDENTIALITY AND PERSONAL DATA PROTECTION AGREEMENT

This Confidentiality and Personal Data Protection Agreement is entered into between Private Altınkum Dental Oral and Dental Health Polyclinic
(Address: Altınkum Dental’s official correspondence address)

and

………………………………………………………………, providing services in the field of
……………………………………………………………… .

Under this Agreement, Private Altınkum Dental Oral and Dental Health Polyclinic shall be referred to as the “SERVICE RECIPIENT”, and
……………………………………………………………… shall be referred to as the “SERVICE PROVIDER”.

1. Subject of the Agreement

The purpose of this Agreement is to determine the rights and obligations of the parties regarding the confidentiality and security of information accessed or otherwise obtained by the SERVICE PROVIDER within the scope of the services provided to the SERVICE RECIPIENT, including:

• personal data,
• special categories of personal data,
• patient and patient-relative information,
• health data,
• trade secrets,
• technical and operational information,
• digital assets,
• information systems,
• website and software infrastructure,
• user accounts and access credentials,
• internal procedures, systems and business processes.

2. Obligations Regarding the Protection of Personal Data

The SERVICE PROVIDER agrees to comply with all applicable legislation while processing personal data transferred by the SERVICE RECIPIENT or accessed during the performance of the services, including in particular:

• Turkish Personal Data Protection Law No. 6698 (“KVKK”),
• applicable international conventions to which the Republic of Türkiye is a party,
• legislation concerning personal health data,
• applicable healthcare legislation,
• relevant ethical and professional regulations.

The SERVICE PROVIDER shall also comply with the technical and administrative security measures communicated by the SERVICE RECIPIENT for the protection of personal data.

3. Confidentiality of Patient and Health Data

The SERVICE PROVIDER agrees that all personal and special categories of personal data accessed within the scope of the service relationship, including:

• identity information,
• contact information,
• health data,
• examination and treatment information,
• radiographic images,
• clinical photographs and videos,
• appointment and patient records,
• payment and invoicing information,
• other personal and special categories of personal data,

shall not be processed, disclosed to third parties, reproduced, published or used for any purpose other than the provision of the agreed services, except where instructed by the SERVICE RECIPIENT and permitted or required under applicable law.

This confidentiality obligation shall continue after termination of the service relationship.

4. Protection of Confidential Information

This Agreement covers not only personal data relating to patients and their relatives, but also all commercial, technical and operational information belonging to the SERVICE RECIPIENT.

Confidential information includes, but is not limited to:

• internal clinical procedures and organisational structures,
• proprietary working methods,
• internal practices relating to treatment processes,
• financial information,
• pricing and commercial strategies,
• patient management systems,
• digital accounts,
• domain names,
• website infrastructure,
• software and application systems,
• social media accounts,
• advertising and marketing accounts,
• visual and video archives,
• user accounts,
• access permissions,
• technical documentation,
• databases,
• reports and analyses.

The SERVICE PROVIDER agrees to use such information solely for the purpose of performing the agreed services.

5. Digital Account and Access Security

Where the SERVICE PROVIDER is granted access to any of the following for the purpose of performing the services:

• usernames,
• passwords,
• administrator accounts,
• server access,
• domain management systems,
• hosting services,
• e-mail accounts,
• social media accounts,
• Google Business Profile,
• advertising accounts,
• website management panels,
• APIs,
• or other digital systems,

the SERVICE PROVIDER agrees to use such access solely to the extent necessary for the performance of the services.

The SERVICE PROVIDER shall not disclose access credentials to unauthorised third parties and shall not create any new user or administrator account without the written or electronic approval of the SERVICE RECIPIENT.

Upon termination of the service relationship or upon request by the SERVICE RECIPIENT, the SERVICE PROVIDER shall immediately cease using all access rights granted to it and shall securely delete any access information in its possession.

6. Transfer of Data to Third Parties

The SERVICE PROVIDER shall not transfer personal data or confidential information obtained from the SERVICE RECIPIENT to third parties without the knowledge of the SERVICE RECIPIENT and without an appropriate legal basis.

Where the use of a subcontractor or third-party service provider is necessary for the performance of the services, the SERVICE PROVIDER shall ensure that appropriate confidentiality and data protection obligations are also imposed on such third parties.

7. Data Security

The SERVICE PROVIDER shall implement reasonable and necessary technical and administrative measures in order to:

• prevent unlawful processing of personal data,
• prevent unauthorised access to personal data,
• ensure secure storage of personal data,
• restrict access rights to individuals who require such access for the performance of the services.

In the event that the SERVICE PROVIDER becomes aware of any data breach, unauthorised access, data loss or other security incident, the SERVICE PROVIDER shall inform the SERVICE RECIPIENT without undue delay.

8. Termination of the Service Relationship

Upon termination of the service relationship for any reason, the SERVICE PROVIDER shall, in accordance with the instructions of the SERVICE RECIPIENT, return, delete or otherwise render inaccessible:

• documents and materials provided to it,
• personal data,
• patient information,
• digital files,
• account and access credentials,
• other confidential information belonging to the SERVICE RECIPIENT.

Data that must be retained pursuant to applicable legislation shall be excluded from this obligation to the extent required by law.

9. Duration of Confidentiality Obligations

The SERVICE PROVIDER’s obligations relating to the confidentiality of personal data and trade secrets shall continue after termination of the service relationship for the periods prescribed by applicable legislation and for as long as the relevant information retains its confidential nature.

10. Liability

The SERVICE PROVIDER shall be responsible, within the scope of its fault and legal liability, for damages arising from any breach of its obligations under this Agreement or applicable legislation.

Where the SERVICE RECIPIENT or relevant data subjects suffer damage as a result of unlawful data processing, unauthorised disclosure, breach of confidentiality or failure by the SERVICE PROVIDER to implement necessary security measures, all civil, administrative and criminal liabilities arising under applicable legislation shall remain reserved.

11. Applicable Law

For matters not specifically regulated under this Agreement, the following legislation shall apply, including but not limited to:

• Turkish Personal Data Protection Law No. 6698,
• Turkish Code of Obligations,
• Turkish Commercial Code,
• legislation concerning healthcare services and personal health data,
• other applicable primary and secondary legislation.

12. Competent Courts and Enforcement Offices

Any dispute arising from or in connection with this Agreement shall be subject to the jurisdiction of the competent courts and enforcement offices determined in accordance with applicable Turkish law.

13. Entry into Force

This Agreement has been read and accepted by the parties and shall enter into force upon signature on ……/……/2026.

The Agreement has been executed in two copies, and each party has received one copy.