Personal Data Protection Clarification Text

As Özel Altınkum Dental Ağız ve Diş Sağlığı Polikliniği (“Altınkum Dental” or the “Polyclinic”), we attach importance to the security and privacy of the personal data of our patients, patients’ relatives, employees, suppliers and website visitors.

For the protection of personal data, we implement technical and administrative measures appropriate to the nature of our data processing activities and process personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and other applicable legislation.

We fulfil our obligations regarding the collection, processing, transfer, storage and protection of personal data in accordance with the KVKK and relevant secondary legislation.

This Privacy Notice has been prepared pursuant to the data controller’s obligation to inform under Article 10 of the KVKK. It explains the identity of the data controller, the methods and legal grounds for collecting personal data, the purposes for which such data is processed, the persons and organisations to whom it may be transferred, the purposes of such transfers and your rights under Article 11 of the KVKK.

References to personal data in this Notice also include, where applicable, special categories of personal data, particularly health data.

1. Collection and Processing of Personal Data and Purposes of Processing

Altınkum Dental processes and stores personal data in accordance with the KVKK, applicable healthcare legislation and other relevant regulations.

Your personal data may be processed for purposes including the lawful provision of healthcare services, conducting examination, diagnosis, treatment, care and follow-up processes, creating patient records and fulfilling obligations arising from legislation or contractual relationships.

Depending on the nature of the service provided, personal data may be collected through automated or non-automated means via:

• patient registration and management systems used within the Polyclinic,
• face-to-face communications,
• telephone conversations,
• the website,
• contact and appointment forms,
• WhatsApp,
• electronic mail,
• social media channels,
• digital systems used in connection with healthcare services,
• physical forms and documents.

Personal data may be collected verbally, in writing, physically or electronically and may be created, updated and stored in digital and/or physical environments for the period required under applicable legislation.

Personal Data That May Be Processed

Identity Information: Name, surname, Turkish Republic identification number, passport or identification information for foreign patients, date and place of birth, gender and other identity information required by applicable legislation.

Contact Information: Telephone number, e-mail address, residential or correspondence address and other contact information.

Patient and Treatment Information: Patient records, appointment information, information concerning healthcare services provided or planned and records relating to treatment processes.

Financial Information: Information required for invoicing, payment and accounting processes.

Visual and Audio Data: Where required for the provision of healthcare services, intraoral and extraoral photographs, radiographic images and other medical images, as well as security camera recordings where CCTV systems are used in common areas of the Polyclinic for security purposes.

Health Data and Other Special Categories of Personal Data: Oral and dental health information obtained during examination, diagnosis, treatment, care and follow-up processes; radiographic images; medical history; medication information; systemic health conditions; allergy information; treatment plans and other health information necessary for the provision of healthcare services.

Purposes for Processing Personal Data

Your personal data may be processed for the following purposes:

• fulfilling obligations arising from the Basic Law on Health Services No. 3359, regulations issued by the Ministry of Health and other applicable legislation,
• providing oral and dental healthcare services,
• carrying out preventive healthcare, medical diagnosis, treatment, care and follow-up processes,
• creating patient files and maintaining healthcare records,
• planning treatment,
• carrying out necessary medical imaging and laboratory processes,
• arranging appointments and communicating appointment information to patients,
• communicating changes to appointments and information concerning treatment processes,
• responding to questions, requests and complaints relating to healthcare services,
• conducting invoicing, payment and accounting processes,
• making notifications to authorised public institutions and organisations where required by law,
• maintaining the security of information systems and patient records,
• preventing unauthorised access and unlawful personal data processing activities,
• carrying out operational and service processes within the Polyclinic,
• evaluating patient satisfaction and improving healthcare services.

2. Persons and Organisations to Whom Personal Data May Be Transferred

Your personal data may be transferred, to the extent required by the purposes of processing and in accordance with the conditions stipulated under Articles 8 and 9 of the KVKK, to:

• the Republic of Türkiye Ministry of Health and its affiliated units,
• Provincial and District Health Directorates,
• the Social Security Institution,
• other legally authorised public institutions and organisations,
• courts, Public Prosecutors’ Offices and other authorised judicial authorities,
• law enforcement authorities and other authorised public bodies,
• private health insurance companies and relevant insurance organisations,
• other healthcare institutions to which the patient is referred or from which healthcare services are received within the scope of cooperation,
• institutions providing medical diagnosis, imaging and laboratory services,
• laboratories and suppliers involved in the production of personalised dental products or devices such as dental prostheses, orthodontic appliances and clear aligners,
• representatives expressly authorised by the patient or legal representatives,
• lawyers, certified public accountants, consultants and auditors providing legal, financial or technical services,
• information technology, hosting, software, infrastructure and security service providers,
• other authorised persons and organisations to whom data must or may lawfully be transferred under applicable legislation.

Where personal data is transferred outside Türkiye, such transfers are carried out in accordance with the conditions stipulated under Article 9 of the KVKK and the applicable legislation governing international data transfers.

3. Methods and Legal Grounds for Collecting Personal Data

Your personal data may be collected verbally, in writing, physically or electronically for the purpose of providing healthcare services and enabling Altınkum Dental to fulfil its legal obligations.

Depending on the type of personal data and the relevant processing activity, personal data may be processed on legal grounds including:

• where processing is expressly provided for by law,
• where processing is necessary for compliance with a legal obligation,
• where processing is necessary for the establishment, exercise or protection of a legal right,
• where processing is directly related to the establishment or performance of a contract,
• where processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not adversely affected,
• the legal conditions applicable to the processing of special categories of personal data for the provision and management of healthcare services.

Where explicit consent is legally required as the applicable condition for processing, your personal data will be processed only after obtaining the necessary explicit consent.

4. Retention Period for Personal Data

Your personal data is retained only for the purposes specified in this Privacy Notice and for the retention and limitation periods prescribed under healthcare legislation, the KVKK, tax and accounting legislation and other legislation applicable to Altınkum Dental.

Where no specific statutory retention period applies, personal data is retained for as long as necessary for the purposes for which it is processed.

When the legal or factual grounds requiring the processing of personal data cease to exist, the relevant personal data is deleted, destroyed or anonymised in accordance with applicable legislation.

5. Protection of Personal Data

Altınkum Dental implements technical and administrative measures appropriate to the nature of the personal data processed in order to:

• prevent unlawful processing of personal data,
• prevent unlawful access to personal data,
• ensure the secure storage of personal data.

Necessary authorisation and security measures are implemented to ensure that patient information, including personal health data, is accessible only by individuals who require access within the scope of their duties and authorisations.

6. Your Rights Under the KVKK

Pursuant to Article 11 of the KVKK, you have the right to:

• learn whether your personal data is being processed,
• request information if your personal data has been processed,
• learn the purpose of processing your personal data and whether it is being used in accordance with that purpose,
• know the third parties in Türkiye or abroad to whom your personal data has been transferred,
• request correction of personal data where it has been processed incompletely or inaccurately,
• request deletion or destruction of personal data where the conditions stipulated under the KVKK are met,
• request notification of correction, deletion or destruction procedures to third parties to whom personal data has been transferred,
• object to an outcome that is detrimental to you where such outcome results solely from the analysis of processed data by automated systems,
• claim compensation for damages suffered as a result of unlawful processing of personal data.

7. Applications to the Data Controller

You may submit requests relating to your rights under the KVKK to Altınkum Dental together with information and documentation sufficient to verify your identity.

Applications may be submitted:

• personally or in writing to the official correspondence address of the Polyclinic,
• through a notary public,
• by electronic communication methods permitted under applicable legislation,
• using a secure electronic signature.

Applications will be processed as soon as reasonably possible according to the nature of the request and, in all cases, within the time limits prescribed by the KVKK.

Applications are generally processed free of charge. However, where processing the request incurs an additional cost, fees may be charged in accordance with the tariff determined by the Turkish Personal Data Protection Board.

Data Controller: Özel Altınkum Dental Ağız ve Diş Sağlığı Polikliniği
Website: https://altinkumdis.com/
Address: Official correspondence address of Altınkum Dental
Contact: Official communication channels of Altınkum Dental