Privacy and Personal Data Protection Notice (Law No. 6698 / KVKK)

1. Data controller

DoctorCAN Clinics Ağız ve Diş Sağlığı Polikliniği Limited Şirketi

• Address: Arnavutköy Mahallesi Bebek Arnavutköy Caddesi No: 55 A/2, 34345 Beşiktaş / İstanbul
• Telephone: +90 542 325 04 04 · +90 212 263 37 65
• E-mail: dental@doctorcanclinics.com
• Trade Registry No: 211678-5 (İstanbul Ticaret Sicil Müdürlüğü)
• Chamber of Commerce No: 1201468-0 (İstanbul Ticaret Odası · NACE: 86.23.01)
• MERSIS No: 0302102554600001
• Tax Office & Tax ID: 3021025546 — Beşiktaş Tax Office
• Ministry of Health SKRS Facility Code: 591371
• Responsible Medical Director: Dr. Dt. Müge Kıyık Tatar

2. Categories of personal data processed

Identity data. Full name, Republic of Türkiye ID number (or passport / foreign national ID number for international residents), place and date of birth, gender, signature, and parent or legal guardian identity details for minor patients.

Contact data. Telephone number, e-mail address, residential address, and emergency contact details.

Health data (special-category personal data). Systemic and dental medical history (anamnesis), regular medications, allergies, clinical examination findings, diagnosis and treatment records, panoramic and periapical radiographs, three-dimensional imaging records obtained from external imaging centers when clinically indicated, intraoral digital optical scans, treatment plans, informed consent forms, prescriptions, and clinical reports.

Financial data. Invoicing details, tax identification information, payment and receipt records, and private health insurance authorization records.

Transaction security and communication records. Appointment scheduling, modification, and reminder records, as well as secretarial coordination history conducted via telephone and official communication channels.

Visual data. Intraoral and clinical photographs taken strictly as part of the patient chart when necessary for diagnosis, treatment planning, and clinical follow-up.

3. Purposes of processing

• Planning, performing, and monitoring oral, dental, and maxillofacial healthcare services in compliance with medical standards and applicable legislation
• Managing clinical diagnosis, surgical and restorative procedures, and post-treatment recall follow-ups
• Receiving appointment requests, coordinating physician schedules, confirming appointments, and sending recall notifications
• Maintaining mandatory patient charts, protocol logs, and electronic health records (e-Nabız / Ministry of Health Information Systems) pursuant to Health Services Fundamental Law No. 3359, the Regulation on Private Oral and Dental Healthcare Facilities, and the Regulation on Personal Health Data
• Carrying out technical impression and digital design workflows required for prosthetic and restorative fabrication
• Issuing invoices for healthcare services rendered, maintaining statutory accounting records, and fulfilling tax obligations
• Responding to mandatory information and document requests from authorized public institutions (Ministry of Health, Provincial Health Directorate, Social Security Institution, courts)
• Evaluating patient rights applications, fulfilling evidentiary obligations in potential legal disputes, and ensuring data security

4. Legal grounds

Health data (special-category personal data) — Processed pursuant to Article 6/3 of Law No. 6698 (KVKK) for the protection of public health, preventive medicine, medical diagnosis, treatment, and care services, and the planning and management of healthcare services by our physicians and authorized healthcare personnel bound by statutory confidentiality; or based on your explicit consent for any processing outside this statutory scope.

Identity, contact, financial, and transaction security data — Processed pursuant to Article 5/2 of Law No. 6698 based on the following legal grounds:

• Explicitly stipulated by law (Art. 5/2-a): Provisions of Health Services Fundamental Law No. 3359, Law No. 1219 on the Practice of Medicine and Allied Arts, the Regulation on Private Oral and Dental Healthcare Facilities, the Regulation on Personal Health Data, Tax Procedure Law No. 213, and Turkish Commercial Code No. 6102
• Establishment or performance of a contract (Art. 5/2-c): Processing directly necessary for scheduling appointments and delivering clinical healthcare services
• Compliance with a legal obligation (Art. 5/2-ç): Fulfilling mandatory Ministry of Health notifications, medical archive retention obligations, and fiscal regulations
• Establishment, exercise, or protection of a right (Art. 5/2-e): Retaining medical records and informed consent documents as legal evidence in potential disputes
• Legitimate interests of the data controller (Art. 5/2-f): Ensuring clinical operations, appointment coordination, and information security without prejudice to fundamental rights and freedoms

5. Methods of collection

• Written or electronic patient registration, medical anamnesis, and informed consent forms completed in person at our clinic
• Verbal medical history interviews and clinical examinations conducted by our physicians
• In-clinic digital panoramic and periapical radiography devices and intraoral three-dimensional optical scanner systems
• Radiological examinations and reports delivered to our clinic by the patient or referred external imaging centers
• Requests submitted via telephone, official WhatsApp line, and e-mail for appointment coordination and information
• Information and appointment routing steps on our corporate website (`doctorcanclinics.com`) — no personal health information (PHI) is stored on our public website

6. Data transfers

Your personal data may be transferred in accordance with Article 8 of KVKK and the Regulation on Personal Health Data, strictly limited to the purposes of processing and under statutory confidentiality obligations, to the following recipient groups:

• Authorized public institutions and authorities — Republic of Türkiye Ministry of Health (e-Nabız / central health data systems), Istanbul Provincial Health Directorate, Social Security Institution, Tax Office Directorates, and legally authorized judicial or administrative authorities
• Referred healthcare institutions and imaging centers — Relevant hospitals, medical centers, or imaging centers with the patient’s knowledge and explicit consent when surgical procedures require general anesthesia, sedation, hospital settings, or external three-dimensional imaging
• Prosthetic fabrication and medical supply partners — Strictly technical impression, digital scan, and shade/design parameters required for the fabrication of fixed, removable, or implant-supported restorations (under confidentiality commitments pursuant to KVKK Art. 12)
• Private health insurance companies and contracted institutions — Strictly the documents required for coverage authorization and reimbursement when requested by the patient
• Certified public accountants and financial advisors — Limited financial and identity data required for invoicing and statutory tax filings
• Information technology, appointment coordination, and patient record infrastructure providers — Domestic data processors providing technical infrastructure, secure hosting, and appointment/secretarial coordination services on behalf of our clinic (under data processing and confidentiality agreements executed pursuant to KVKK Art. 12)
• Legal counsel and advisors — Strictly as necessary for the establishment, exercise, and defense of legal rights

Your health data is not transferred abroad. In exceptional cases where documents must be transmitted to an international healthcare institution or insurance provider at the patient’s own request, such transfer is carried out strictly in accordance with KVKK Article 9 and the patient’s written explicit consent.

7. Statutory retention periods

Your personal data is retained for the periods stipulated in applicable legislation, or for the period required by the processing purpose and statutory limitation periods where no specific period is prescribed:

• Patient charts, medical diagnosis and treatment records, informed consent forms, and radiological images — At least twenty (20) years from the date of the last clinical procedure, pursuant to healthcare archive legislation, Article 49 of the Private Hospitals Regulation, and the Regulation on Personal Health Data
• Invoices, receipts, and accounting records — Five (5) years pursuant to Article 253 of Tax Procedure Law No. 213, and ten (10) years pursuant to Article 82 of Turkish Commercial Code No. 6102
• Contractual relationship and legal dispute limitation records — Ten (10) years, corresponding to the general statutory limitation period under Article 146 of Turkish Code of Obligations No. 6098
• Appointment coordination and communication records not resulting in clinical treatment — Two (2) years following the completion of the communication and scheduling purpose

Upon expiration of the statutory retention period, personal data is deleted, destroyed, or anonymized during periodic destruction cycles in accordance with the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.

8. Your rights under Article 11

Pursuant to Article 11 of Law No. 6698 (KVKK), you have the right to:

• Learn whether your personal data is being processed
• Request information if your personal data has been processed
• Learn the purpose of processing and whether your data is used in accordance with that purpose
• Know the third parties to whom your personal data is transferred domestically or abroad
• Request rectification of incomplete or inaccurate personal data
• Request deletion or destruction of your personal data within the conditions set forth in Article 7 of KVKK
• Request notification of rectification, deletion, or destruction operations to third parties to whom your personal data has been transferred
• Object to the occurrence of a result against you arising from the analysis of processed data exclusively by automated systems
• Demand compensation for damages should you incur losses due to unlawful processing of your personal data

9. Application procedure

To exercise your rights under Article 11, you may submit your application in accordance with the Communiqué on the Principles and Procedures for Applications to the Data Controller via the following channels:

• In writing with wet-ink signature — Delivered in person, via notary public, or by registered mail with return receipt to Arnavutköy Mahallesi Bebek Arnavutköy Caddesi No: 55 A/2, 34345 Beşiktaş / İstanbul, accompanied by identity verification documents
• Via electronic mail — Sent from the e-mail address previously registered in our clinic’s system, or signed with a secure electronic or mobile signature, to dental@doctorcanclinics.com

Your application must clearly state your full name, signature (for written applications), Republic of Türkiye ID number (or nationality and passport/ID number for foreign nationals), residential or business address for service of notices, e-mail address and telephone number if available, and the specific subject of your request.

Properly submitted requests are concluded free of charge as soon as possible and within thirty (30) days at the latest pursuant to KVKK Article 13. Should the transaction require an additional cost, the tariff determined by the Personal Data Protection Board may apply.

If your application is rejected, if you find the response insufficient, or if no response is provided within thirty days, you have the right to lodge a complaint with the Personal Data Protection Board (KVKK Board) within thirty days of learning of our response and, in any event, within sixty days of the application date.

10. Updates and trademark notice

This Privacy and Personal Data Protection Notice is reviewed and updated in accordance with amendments to Law No. 6698 (KVKK), the Regulation on Personal Health Data, and updates to our clinical processes. The updated notice takes effect on the date of publication, indicated at the bottom of this page.

Registered Trademark and Copyright Notice: DoctorCAN Clinics® is a registered trademark (DoctorCAN Clinics Ağız ve Diş Sağlığı Polikliniği Limited Şirketi). All rights to the texts, design, clinical archive visuals, and corporate identity elements on this website are reserved.