The Personal Data Protection Law

Data Controller: Ilke Oral and Dental Health Clinic

Address: Halide Edip Adıvar Street, No:22 Bahçelievler Karabağlar/Izmir

The personal and sensitive data you share is processed in accordance with the Personal Data Protection Law (KVKK) and related medical regulations, and is limited, measured, and connected to the purposes of the services and activities we provide. Please also read the Patient KVKK Information Text prepared for our patients.

Method and Legal Basis for Collecting Your Personal Data

Your personal data may be collected verbally, in writing, via WhatsApp, or electronically. When you fill out the form in the contact us section on our website, data collection activities related to this purpose will also be conducted. Your personal data, including examination information, health data, treatment records, various written and verbal agreements, petitions, conversations, business cards, documents obtained during the monitoring of lawsuits or enforcement proceedings, are processed according to the specific circumstances required by the provided health services. No data is processed by us through the website, and internet access logs (IP address, timestamp, traffic information) may be kept by the domain provider’s IT company in accordance with Law No. 5651. Cookies are used on our website. The website is implemented to provide information about addresses, contact details, and service areas.

Your data can be obtained through automatic methods such as SMS, WhatsApp, email, internet, disk, CD, DVD, memory cards, phones, and similar electronic or internet-based tools. Additionally, non-automatic methods like forms, contracts, notifications, judicial or administrative decisions can also be used to obtain your data.

We collaborate with private hospitals, laboratories, medical supply providers, and patient record database service providers under cooperation protocols within the scope of KVKK, ensuring confidentiality commitments are obtained. Resumes are not processed without being requested for job applications. If a CV bank is to be created, an explicit consent process will be implemented.

The legal bases for processing your personal data;

1. a) Processing your data such as identity and address information is mandatory according to legislation during taxation processes.
2. b) It is mandatory to fulfill our clinic’s legal obligations regarding file keeping, storage, and sharing information with authorized authorities as required by health legislation.
3. c) It is necessary for the performance of the contract.
4. d) It is necessary for the protection, utilization, and establishment of our clinic’s rights and claims.
5. e) Explicit consent when necessary

Purpose of Processing Your Personal Data

Your personal data will be processed within the framework of the principles specified in Article 4/2 of the KVKK and in accordance with health-related legislation, to ensure your access to the provided services, to comply with legal obligations such as file keeping, information storage, reporting, taxation, and other statutory requirements.

Your personal data is retained for a period proportionate to the purpose, in accordance with specified durations in legislation or, in the absence of regulatory provisions, based on legitimate interest and explicit consent practices. After this period, digital data is irreversibly deleted, while paper-based data is destroyed by shredding. Upon receiving a deletion request from the data subject, it will be promptly fulfilled, provided that it does not contradict the legislation.

The storage and destruction policy for personal data specifies detailed retention periods. In general, contract durations are 10 years, employment law records are kept for 10 years, tax records for 10 years, and health records are maintained for 30 years from the termination of service.

Transfer of Your Personal Data

Your personal data is not transferred abroad as a general principle. However, it should be noted that services such as patient record systems, appointment databases, email services like Gmail, and applications like WhatsApp, which are used for appointment management, are provided from abroad. Inadvertently, your data may transit outside the country during these processes. Data of foreign nationals or residents reaching us from abroad may need to be shared with them or with addresses abroad for overseas insurance transactions or health tourism purposes.

Your personal data may be transferred to domestic institutions and organizations in accordance with the purposes mentioned above, as well as to regulatory and supervisory authorities, Social Security Institution (SGK), Provincial Health Directorates, courts, public prosecutors’ offices, administrative authorities, and other official bodies as stipulated by the legislation and regulations, in compliance with KVKK and other applicable laws.

Your Rights as the Data Subject Whose Personal Data is Processed

KVKK 11. In accordance with Article and other applicable legislation currently in force;

• Learning whether your personal data is being processed
• Requesting information if your personal data has been processed
• Learning the purpose of processing your personal data and whether they are used in accordance with that purpose
• Knowing the third parties, both domestically and internationally, to whom your personal data has been transferred
• Requesting correction of your personal data if it is incomplete or inaccurately processed
• Requesting the deletion or destruction of your personal data in accordance with the conditions stipulated in the KVKK legislation
• When requesting correction of incomplete or inaccurate data, as well as deletion or destruction of personal data, you can also request that this be communicated to third parties to whom your personal data has been transferred
• Objecting to any decision that results in adverse consequences for you based solely on automated processing of data
• In the event of suffering damage due to the unlawful processing of personal data, you have the right to request compensation for such damage.

Procedures and Principles for Submitting Your Requests

As the data subject, you can exercise your rights listed above by submitting a written request or using other methods determined by the Personal Data Protection Board. Your request must clearly and understandably specify the right you wish to exercise and include any relevant explanations.

You can send your request with a wet signature by mail to the following address: **Halide Edip Adıvar Caddesi, No:22 Bahçelievler Karabağlar/İzmir**

The issues that constitute the basis of your application must be related to you personally, and your application must include your identity and address information. Identity verification will be limited to the information we have. If you are applying on behalf of someone else; you must apply with a power of attorney containing special authorization. Although there is no special format for the application, you can use the application form on our website, writing your request clearly will ensure a clear answer.