DENTEKİZ CLINIC HEALTH
PERSONAL DATA STORAGE AND DISPOSAL POLICY
I. INTRODUCTION
1.1. Purpose of the Policy
The processing of personal data obtained by Dentekiz Clinic pursuant to Arcle 20 of the Constuon
tled “Privacy of Private Life” and the Law on the Protecon of Personal Data No. 6698 (“Law”) and
applicable regulaons and communiqués, data owners (employees, employee candidates, paents,
paent relaves, suppliers, interns, visitors and other relevant third pares) to protect fundamental
rights and freedoms, especially the privacy of private life, and the data controller processing personal
data to perform data processing in accordance with the law, to protect, store and, when necessary,
personal data obtained. Determinaon of the principles regarding the destrucon of these forms the
purpose of this Policy.
1.2. Scope of the Policy
Any informaon relang to an idened or idenable natural person is obtained, recorded, stored,
stored, changed, reused as personal data by Dentekiz Clinic as a data controller fully or parally
automacally or by non-automac means provided that it is a part of any data recording system.
Considering that all kinds of transacons such as the arrangement, disclosure, transfer, takeover,
making available, classicaon or prevenon of use are considered as data processing acvies,
establishing the procedures and principles of the data processing acvity carried out by Dentekiz
Clinic determines the scope of this Policy.
1.3. Implementaon of the Policy and Related Legislaon
Your personal data and personal health data are for the purposes explained in this policy text and
Health Services Basic Law No. 3359, Decree Law No. 663 on the Organizaon and Dues of the
Ministry of Health and Aliates, Regulaon on Private Hospitals, Regulaon on the Processing of
Personal Health Data and Protecon of Privacy, related regulaons and It has been prepared in
accordance with the rules set forth in the regulaons, communiqués, decisions and guides published
by the Board, especially the Law No. 6698. and the rules will nd applicaon. All nocaons,
decisions and guidelines published by the Board are followed by Dentekiz Clinic, and the rules
spulated by the Policy are kept up to date.
1.4. Enforcement of the Policy
The policy was published on the website of Dentekiz Clinic hps://www.dentekiz.com and entered
into force on the date of its publicaon.
II. ISSUES REGARDING THE PROTECTION OF PERSONAL DATA
2.1. Ensuring the Security of Personal Data
According to Arcle 12 of the Law No. 6698, the data controller;
● To prevent the unlawful processing of personal data,
● To prevent unlawful access to personal data,
● To ensure the protecon of personal data
It is obliged to take all necessary administrave and technical measures to ensure the appropriate
level of security for the purpose.
For the reasons explained, Dentekiz Clinic implements security measures to prevent unlawful
processing of personal data, transfer and disclosure to third pares, unauthorized access and security
deciencies arising from other means. Explanaons on the administrave and technical measures
taken VI. It is included in the ADMINISTRATIVE AND TECHNICAL MEASURES TO PROTECT PERSONAL
DATA.
2.2. Protecon of Private Personal Data
Among the sensive personal data, the health data of the persons concerned, without seeking the
explicit consent of the relevant person, but for the purposes of protecng public health, prevenve
medicine, medical diagnosis, treatment and care services, planning health services and nancing and
management purposes, persons or authorized instuons and can be processed by organizaons. In
addion, regardless of the type, all sensive personal data can only be processed in accordance with
the law if adequate measures determined by KVKK are taken.
Your personal data that you share with us within the scope of our clinical acvies; For the purposes
of protecng public health, prevenve medicine, medical diagnosis, treatment and care services
provided by Dentekiz Clinic, with automac or non-automac methods, planning and management of
health services and nancing; Obtaining, recording, storing, changing through all channels including
social media applicaons such as internet site, survey, social responsibility and verbal, wrien, visual
or electronic media, via hotline/call center, internet site, verbal, wrien and similar channels,
collected and rearranged. Any operaon performed on data within the scope of KVKK is considered as
"processing of personal data".
In addion, your personal data may be processed when you use our hotline or internet page for
informaon, appointment, complaint or other purposes for service provision, visit our clinic or
website and browse this site.
The data that is sensive due to its nature and may cause vicmizaon or discriminaon of the data
owner if it is in the hands of third pares is accepted as "Special "Qualied Personal Data" within the
scope of the Law. Sensive personal data includes data related to the person's race, ethnicity, polical
opinion, philosophical belief, religion, sect or other beliefs, clothing, associaon, foundaon or union
membership, health, sexual life, criminal convicon and security measures, and biometric data. and
genec data. Sensive personal data cannot be processed without the explicit consent of the data
subject. All necessary measures are taken by Dentekiz Clinic to protect sensive personal data, and it
is essenal that such data are not obtained and processed as much as possible.
III. ISSUES REGARDING THE PROCESSING OF PERSONAL DATA
3.1. Processing of Personal Data in Compliance with the Principles Established in the Legislaon
The principles to be applied in the processing of your personal data in accordance with Arcle 4 of
the Law are as follows:
● Compliance with the law and the rule of honesty,
● Being accurate and up-to-date when necessary,
● Processing for specic, explicit and legimate purposes,
● Being connected, limited and restrained for the purpose for which they are processed,
● To be kept for as long as required by the relevant legislaon or for the purpose for which they are
processed.
3.2. Personal Data Processing Condions
Personal data obtained by Dentekiz Clinic cannot be processed without the explicit consent of the
person concerned, with the excepon of the excepons spulated in the Law. Your personal data may
be processed without express consent in the following cases:
● It is clearly spulated in the laws,
● It is compulsory for the protecon of the life or physical integrity of the person or another person,
who is unable to express his consent due to actual impossibility or whose consent is not given legal
validity,
● It is necessary to process the personal data of the pares to the contract, provided that it is directly
related to the establishment or performance of a contract,
● It is mandatory for the data controller to fulll its legal obligaon,
● The person concerned has been made public by himself,
● Data processing is mandatory for the establishment, exercise or protecon of a right,
● It is necessary to process data for the legimate interests of the data controller, provided that it
does not harm the fundamental rights and freedoms of the data subject.
3.3. Excepons to Obligaon to Obtain Explicit Consent
a) It is clearly spulated in the laws
One of the data processing condions is that it is expressly spulated in the law. The provisions in the
laws regarding the processing of personal data may create a data processing condion. In such a case,
the explicit consent of the person concerned is not sought.
b) Actual impossibility
The personal data of the person concerned can be processed without his explicit consent in cases
where it is necessary for the protecon of the life or physical integrity of the person or another
person, who is unable to express his consent due to actual impossibility or whose consent is not
legally valid.
c) Being directly related to the establishment or performance of the contract
In the event that data processing is deemed necessary during the conclusion of a contract to which
the data owner is a party or during the performance of the contract, the processing of personal data
may come to the fore without obtaining explicit consent.
d) Dentekiz Clinic fullls its legal obligaons
As a data controller, Dentekiz Clinic can process personal data without obtaining explicit consent for
the purpose of fullling legal obligaons.
e) It has been made public by the person concerned
Personal data made public by the data subject, in other words, personal data disclosed to the public
in any way, can be processed without obtaining explicit consent. Even in this case, the publicized
personal data cannot be used for purposes other than its intended use.
f) Being compulsory for the establishment, use and protecon of a right
In cases where it is necessary for the establishment, exercise or protecon of a right, it is possible to
process the personal data of the person concerned without his explicit consent.
g) Obligatory for the legimate interests of the data controller, provided that it does not harm the
fundamental rights and freedoms of the data subject.
If the processing of personal data is obligatory for the data controller and the data processing will not
harm the fundamental rights and freedoms of the data subject, personal data may be processed
without obtaining explicit consent.
The legimate interest of the data controller is the interest and benet to be obtained as a result of
the processing to be carried out. Benet of the data controller; It must relate to a legimate,
suciently eecve, specic and already exisng interest to compete with the fundamental rights
and freedoms of the person concerned. It should be a process that is related to the current acvies
of the data controller and will benet him in the near future.
3.4. Processing of Private Personal Data
The processing of sensive personal data is subject to Arcle 6 of the Law and it is prohibited to be
processed without the explicit consent of the person concerned.
Data on race, ethnic origin, polical opinion, philosophical belief, religion, sect or other beliefs,
disguise and dress, membership in associaons, foundaons or unions, health, sexual life, criminal
convicons and security measures, and biometric and genec data are of special nature. is personal
data. The data included in this scope is limited and cannot be expanded through interpretaon.
Due to its nature, special quality personal data is data that, if learned, may cause discriminaon and
vicmizaon of the person concerned. Therefore, they need to be protected much more strictly than
other personal data.
a) Special categories of personal data other than health and sexual life
Special categories of personal data other than personal data related to health and sexual life can be
processed without seeking the explicit consent of the person concerned, in cases spulated by the
laws.
b) Personal data of special nature regarding health and sexual life
Special categories of personal data regarding health and sexual life can only be processed by persons
or authorized instuons and organizaons that are under the obligaon of condenality for the
purpose of protecng public health, conducng prevenve medicine, medical diagnosis, treatment
and care services, planning and managing health services and nancing.
3.3. Excepons to Obligaon to Obtain Explicit Consent
a) It is clearly spulated in the laws
One of the data processing condions is that it is expressly spulated in the law. The provisions in the
laws regarding the processing of personal data may create a data processing condion. In such a case,
the explicit consent of the person concerned is not sought.
b) Actual impossibility
The personal data of the person concerned can be processed without his explicit consent in cases
where it is necessary for the protecon of the life or physical integrity of the person or another
person, who is unable to express his consent due to actual impossibility or whose consent is not
legally valid.
c) Being directly related to the establishment or performance of the contract
In the event that data processing is deemed necessary during the conclusion of a contract to which
the data owner is a party or during the performance of the contract, the processing of personal data
may come to the fore without obtaining explicit consent.
d) Dentekiz Clinic fullls its legal obligaons
As a data controller, Dentekiz Clinic can process personal data without obtaining explicit consent for
the purpose of fullling legal obligaons.
e) It has been made public by the person concerned
Personal data made public by the data subject, in other words, personal data disclosed to the public
in any way, can be processed without obtaining explicit consent. Even in this case, the publicized
personal data cannot be used for purposes other than its intended use.
f) Being compulsory for the establishment, use and protecon of a right
In cases where it is necessary for the establishment, exercise or protecon of a right, it is possible to
process the personal data of the person concerned without his explicit consent.
g) Obligatory for the legimate interests of the data controller, provided that it does not harm the
fundamental rights and freedoms of the data subject.
If the processing of personal data is obligatory for the data controller and the data processing will not
harm the fundamental rights and freedoms of the data subject, personal data may be processed
without obtaining explicit consent.
The legimate interest of the data controller is the interest and benet to be obtained as a result of
the processing to be carried out. Benet of the data controller; It must relate to a legimate,
suciently eecve, specic and already exisng interest to compete with the fundamental rights
and freedoms of the person concerned. It should be a process that is related to the current acvies
of the data controller and will benet him in the near future.
3.4. Processing of Private Personal Data
The processing of sensive personal data is subject to Arcle 6 of the Law and it is prohibited to be
processed without the explicit consent of the person concerned.
Data on race, ethnic origin, polical opinion, philosophical belief, religion, sect or other beliefs,
disguise and dress, membership in associaons, foundaons or unions, health, sexual life, criminal
convicons and security measures, and biometric and genec data are of special nature. is personal
data. The data included in this scope is limited and cannot be expanded through interpretaon.
Due to its nature, special quality personal data is data that, if learned, may cause discriminaon and
vicmizaon of the person concerned. Therefore, they need to be protected much more strictly than
other personal data.
a) Special categories of personal data other than health and sexual life
Special categories of personal data other than personal data related to health and sexual life can be
processed without seeking the explicit consent of the person concerned, in cases spulated by the
laws.
b) Personal data of special nature regarding health and sexual life
Special categories of personal data regarding health and sexual life can only be processed by persons
or authorized instuons and organizaons that are under the obligaon of condenality for the
purpose of protecng public health, conducng prevenve medicine, medical diagnosis, treatment
and care services, planning and managing health services and nancing.
4.2. Internaonal Transfer
Personal data cannot be transferred abroad without the explicit consent of the person concerned. In
so far, the existence of one of the condions specied in the second paragraph of Arcle 5 and the
third paragraph of Arcle 6 of the Law and in the foreign country to which the personal data will be
transferred;
● Availability of adequate protecon,
● In the absence of adequate protecon, data controllers in Turkey and in the relevant foreign
country undertake in wring to provide adequate protecon and the Board has permission,
may be transferred abroad without seeking the explicit consent of the person concerned, provided
that the
V. CATEGORIZATION OF PERSONAL DATA PROCESSED BY DENTEKİZ CLINIC AND PURPOSE OF
PROCESSING
Data subject data subjects The data categorizaon obtained by Dentekiz Clinic and the purposes
pursued in the processing of personal data are shown in the relevant secons of the claricaon texts
on our website for each category of data subject.
VI. ADMINISTRATIVE AND TECHNICAL MEASURES TO PROTECT PERSONAL DATA
Administrave and technical measures are taken by Dentekiz Clinic to securely store personal data, to
prevent unlawful processing and access to personal data.
In order to ensure personal data security, it is determined what all personal data is processed by
Dentekiz Clinic and the probability of the risks that may arise regarding the protecon of this data;
While determining these risks, whether the personal data is sensive personal data (1), what degree
of condenality it requires due to its nature (2), and the nature and quanty of the damage that
may arise in the case of a security breach (3) are taken into account.
Aer dening and priorizing these risks; control and soluon alternaves to reduce or eliminate the
said risks; cost, applicability and usefulness should be evaluated in line with the principles, necessary
technical and administrave measures are planned and put into pracce.
6.1. Administrave Measures
Even if employees have limited informaon about aacks that will harm personal data security and
cyber security, it is of great importance to ensure personal data security. For this reason, awareness
and informaon acvies are carried out in our internal organizaon as a data controller.
Providing necessary training on issues such as not revealing and sharing personal data unlawfully,
conducng awareness acvies for employees and creang an environment where security risks can
be determined; It is ensured that everyone working with the data controller, regardless of their
posion, determines their roles and responsibilies regarding personal data security in their job
descripons and that employees are aware of their roles and responsibilies in this regard.
On the other hand, condenality agreements are signed as part of the recruitment processes of the
employees, and a disciplinary process is carried out if the employees do not comply with the security
policies and procedures.
In case of any change in the policies and procedures regarding personal data security, trainings are
provided to inform and explain the change to the employees, and the informaon about the threats
to data security and security is kept up-to-date.
Personal data should be accurate and up-to-date when necessary in accordance with Arcle 4(b) and
(d) of the Law, and should be kept for as long as required by the relevant legislaon or for the
purpose for which they are processed. In this context, the data processed are processed in
accordance with the principles and rules that must be observed in data processing acvies and are
kept for the period necessary for the purpose for which they are processed. It is shown in the
STORAGE AND DISPOSAL OF PERSONAL DATA.
The table below provides a summary of the administrave measures taken to ensure data security:
Administrative Measures
Preparation of Personal Data Processing Inventory
Corporate Policies (Access, Information Security, Use, Storage and Disposal etc.)
Contracts (Between Data Controller-Data Controller, Data Controller-Data Processor)
Privacy Commitments
In-house Periodic and/or Random Audits
Risk Analysis
Employment Contract, Disciplinary Regulation (Adding Legal Provisions)
Corporate Communication (Crisis Management, Informing the Board and Relevant Person,
Reputation Management, etc.)
Education and Awareness Activities (Information Security and Law)
Notification to Data Controllers Registry Information System (VERBIS)
Personal Data Security Policies and Procedures
Rapid Reporting of Personal Data Security Issues
Monitoring Personal Data Security
Establishing Disciplinary Arrangements Containing Data Security Provisions for Employees
Reducing Personal Data As Much As Possible
Preparation and Implementation of Institutional Policies on Access, Information Security, Use,
Storage and Disposal
Removal of Authorities in this Area of Employees with a Change in Job or Leaving the Job
Including Data Security Provisions in Signed Contracts
Identification of Current Risks and Threats
Conducting In-house Periodic and/or Random Inspections
Protocols and Procedures for Special Quality Personal Data Security have been determined and their
implementation
Raising Awareness of Data Processing Service Providers on Data Security
6.2. Technical Measures
Firewalls and gateways are used among the measures taken to protect my informaon technology
systems containing personal data against unauthorized access and threats by third pares over the
internet. With the rewall used, violaons of the informaon network are stopped, and with the
gateway, employees' access to websites or online plaorms that pose a threat to personal data
security is restricted.
In addion, regular checks are made regarding the proper funconing of the soware and hardware
and whether the security measures taken for the systems are sucient. Access to systems containing
personal data is restricted, and within this scope, employees are granted access to the extent
necessary for their jobs and dues, and their authories and responsibilies, and access to the
relevant systems is provided by using a user name and password. While creang the aforemenoned
passwords, numbers or leer sequences associated with personal informaon that can be easily
guessed are avoided as much as possible.
Access authorizaon and control matrices are created within the data controller organizaon, and
products such as anvirus and anspam, which regularly scan the informaon system network and
detect dangers, are used to protect against malicious soware.
In order to ensure data security, necessary measures are taken to ensure that documents in paper
media containing personal data and servers, backup devices, CD, DVD, USB and other similar storage
devices are only accessible to authorized personnel and to increase physical security in this regard.
In the table below, the administrave measures taken to ensure data security
summary given:
Technical Measures
Authority Matrix
Authority Control
Access Logs
User Account Management
Network Security
Applicaon Security
Encrypon
Intrusion Detecon and Prevenon Systems
Data Loss Prevenon Soware
Backup
Firewalls
Current An-Virus Systems
Deleon, Destrucon, or Anonymizaon
Key Management
VII. BUILDING, FACILITY ENTRANCES AND PERSONAL DATA PROCESSING IN THE BUILDING AND
FACILITY
7.1. Camera Monitoring Acvity at Building, Facility Entrances and Inside
Within the scope of the Law on Private Security Services, camera monitoring is carried out in order to
ensure security in the Dentekiz Clinic building, working areas, common areas, parking lot and its
surroundings, and to protect the interests of Dentekiz Clinic and other persons. The camera
monitoring acvity is carried out in accordance with the Law and is carried out within the scope of
the data processing condions listed both in the Law and in this Policy.
7.2. Monitoring of Guest Entrance and Exit Carried out at Building, Facility Entrances and Inside
Identy informaon of the guests vising Dentekiz Clinic is subject to personal data processing in
order to control and monitor the entrances and exits to the Dentekiz Clinic building and to ensure
security. The personal data processed within the scope of this acvity are only limited to the guests'
entry and exit, and the relevant personal data is recorded in the data recording system in electronic
or physical environment.
VIII. STORAGE AND DISPOSAL OF PERSONAL DATA
8.1. Retenon Periods of Personal Data
Your personal data kept at Dentekiz Clinic is kept for as long as data processing is necessary; In the
event that the obligaon to delete, destroy or anonymize personal data arises, it is deleted, destroyed
or anonymized within the rst periodic destrucon period following the date of occurrence of this
obligaon.
Dentekiz Clinic acts in accordance with the general principles set forth in arcle 4 of the Law and the
technical and administrave measures set forth in arcle 12 in the deleon, destrucon or
anonymizaon of your personal data.
All transacons regarding the deleon, destrucon or anonymizaon of personal data are recorded
by us and are kept during the processing of personal data for at least 30 years in accordance with the
legal obligaon.
Personal data specialist personnel assigned by Dentekiz Clinic regarding the storage and destrucon
of data is the person responsible for the execuon and supervision of the personal data storage and
destrucon policy.
8.2. Obligaon to Delete, Destroy and Anonymize Personal Data
Personal data processed by Dentekiz Clinic are processed in accordance with the provisions of the
"Regulaon on the Deleon, Destrucon or Anonymizaon of Personal Data" published in the Ocial
Gazee dated 28 October 2017 and numbered 30224 prepared by the Law on Arcle 7 and the
Personal Data Protecon Board. In the event of the disappearance of the reasons requiring it, it is
deleted, destroyed or anonymized ex ocio or upon the request of the relevant data owner.
a) Deleon of personal data
Deleon of personal data is the process of making personal data inaccessible and non-reusable for
relevant users.
All necessary technical and administrave measures are taken to ensure that the deleted personal
data cannot be accessed and reused for the relevant users.
b) Destrucon of personal data
Destrucon of personal data is the process of making personal data inaccessible, unrecoverable and
unusable by anyone in any way. The data controller is obliged to take all necessary technical and
administrave measures regarding the destrucon of personal data.
c) Anonymizaon of personal data
Anonymizaon of personal data means that personal data cannot be associated with an idened or
idenable natural person under any circumstances, even if it is matched with other data.
All kinds of technical and administrave measures are taken by Dentekiz Clinic to anonymize your
personal data, and they are anonymized by applying methods in accordance with our personal data
retenon and destrucon policy.
8.3. Deleon, Destrucon and Anonymizaon Techniques of Personal Data
The techniques for deleng, destroying or anonymizing the personal data processed by Dentekiz
Clinic are shown below, and which of the techniques will be applied may vary depending on the
nature of the personal data processed.
For this, rst of all, determining the personal data that is the subject of deleon, destrucon or
anonymizaon (1), idenfying the relevant users for each personal data using the access
authorizaon and control matrix or a similar system (2), accessing the relevant users, It is necessary
to determine the authorizaons and methods such as retrieval and reuse (3), and to close and
eliminate the access, retrieval, reuse authorizaon and methods of the relevant users within the
scope of personal data (4).
The way to delete personal data is as follows:
● Deleon command in cloud or applicaon type soluons,
● Blackening, cung or making invisible data on paper media,
● Deleon of data on removable media using appropriate soware.
The way to destroy personal data is as follows:
● Physical destrucon of opcal media and magnec media by melng, burning or pulverizing,
● Other destrucon on paper or electronic media.
IX. RIGHTS OF THE PERSONAL DATA OWNER AND THE USE OF THESE RIGHTS
9.1. Rights of Personal Data Owner
In accordance with the Law No. 6698, in the capacity of data owner:
● Learning whether your personal data is processed,
● If your personal data has been processed, requesng informaon about it,
● Learning the purpose of processing your personal data and whether they are used in accordance
with the purpose,
● Knowing the third pares to whom personal data is transferred at home or abroad,
● Requesng correcon of personal data in case of incomplete or incorrect processing,
● Requesng the deleon or destrucon of your personal data within the framework of the
condions spulated in Arcle 7,
● Requesng nocaon of the third pares to whom personal data has been transferred, regarding
the correcon, deleon or destrucon of data in case of incomplete or incorrect processing,
● Objecng to the emergence of a result against you by analyzing your processed data exclusively
through automated systems,
● You have the right to demand the compensaon of the damage in case of any damage due to the
unlawful processing of your personal data.
9.2. Exercise of Personal Data Owner's Rights
Requests by the data subject regarding the implementaon of the Law, contact e-mail
info@dentekiz.com or Ataköy 7-8-9-10. It should be sent to Dentekiz Clinic in wring to the address
of Kısım Mahallesi, Çobançeşme E-5 Yanyol Caddesi, No: 20/1, Block A, Floor: 13, Flat: 167, Ataköy
Towers, Bakırköy-İstanbul. For applicaon requests, the "Data Owner Applicaon Form" published by
Dentekiz Clinic on its website should be used.
9.3. Dentekiz Clinic Responding to Applicaons
According to the nature of the applicaon request, Dentekiz Clinic is nalized as soon as possible. This
period cannot exceed 30 days aer the request is properly served to us. In so far, if the transacon
requires any cost, a fee may be charged according to the tari determined by the Personal Data
Protecon Board.
APPENDIX – 1: Denions
Explicit consent: Consent on a specic subject, based on informaon and expressed with free will,
Anonymizaon: Making personal data incapable of being associated with an idened or idenable
natural person in any way, even by matching with other data,
Recipient group: The natural or legal person category to which personal data is transferred by the
data controller,
Direct ideners: ideners that, by themselves, directly reveal, disclose and disnguish the person
with whom they are in a relaonship,
Indirect ideners: Ideners that come together with other ideners, revealing, disclosing and
making the person they are in a relaonship disnguishable,
Relevant person: The real person whose personal data is processed,
Relevant user: Real or legal persons who process personal data within the organizaon of the data
controller or in line with the authorizaon and instrucon received from the data controller,
excluding the person or unit responsible for the technical storage, protecon and backup of the data,
Destrucon: Deleon, destrucon or anonymizaon of personal data,
Law: Law on Protecon of Personal Data No. 6698, dated 24/3/2016,
Blackening: Processes such as scratching, painng and icing all of the personal data in a way that
cannot be associated with an idened or idenable natural person,
Recording medium: Any medium containing personal data that is fully or parally automated or
processed by non-automac means, provided that it is a part of any data recording system,
Personal data: Any informaon relang to an idened or idenable natural person,
Processing of personal data: Obtaining, recording, storing, preserving, changing, rearranging,
disclosing, transferring, taking over, making available personal data by fully or parally automac or
non-automac means provided that it is a part of any data recording system, all kinds of operaons
carried out on the data, such as the classicaon or prevenon of its use,
Board: Personal Data Protecon Board,
Instuon: Personal Data Protecon Authority,
Data processor: The natural or legal person who processes personal data on behalf of the data
controller, based on the authority given by the data controller,
Data registraon system: The registraon system in which personal data is processed and structured
according to certain criteria,
Data controller: The natural or legal person who determines the purposes and means of processing
personal data and is responsible for the establishment and management of the data recording
system.
Identy Informaon: Your name, surname, T.C. your identy number, passport number or temporary
T.C. your idencaon number, place and date of birth, marital status, gender, insurance or paent
protocol number and other idencaon data by which we can idenfy you;
Contact Informaon: Your address, telephone number, e-mail address and other communicaon
data, your voice call records kept by customer representaves or paent services in accordance with
call center standards, and your personal data obtained when you contact us via e-mail, leer or other
means;
Accounng Informaon: Your nancial data such as your bank account number, IBAN number, credit
card informaon, billing informaon; your data on private health insurance and your Social Security
Instuon data for the purpose of nancing and planning health services; If you visit our clinic, your
footage of camera recordings kept for security and inspecon purposes,
Health Informaon: Your personal data regarding all kinds of health and sexual life obtained during or
as a result of medical diagnosis, treatment and care services, including but not limited to your
laboratory results, test results, examinaon data, appointment informaon, prescripon informaon.
your other personal data, including the CV provided in this regard, in case you apply, and all kinds of
personal data related to your service contract if you are a Dentekiz Clinic employee or a related
employee.
APPENDIX – 2: Personal Data Owners (Relevant Persons)
Data Subject Categories
Explanation
Worker
It refers to the people working in the clinic.
Employee Candidate
It refers to real persons who apply for a job by sending a CV to the Clinic
or by other methods.
Intern
It refers to the people who use the profession they are trained in the clinic
practically to increase their professional knowledge.
Patient
It refers to the real persons who benefit from the services offered by the
Clinic.
The relatives of the patient
It refers to the companions or relatives of the patients who use the
services offered by the Clinic.
supplier
It refers to natural persons and legal entity employees from whom
services are provided.
Visitor
It refers to the 3rd persons who visit the clinic.
It refers to the 3rd persons
who visit the clinic.
Refers to the people who apply to the clinic, other than those who
communicate.
APPENDIX – 3: Third Pares to whom Personal Data is Transferred
Transferred Person/Unit
Purpose of Transfer
Ministry of Health
Transfer of informaon that needs to be transferred in accordance
with public health and legislaon.
Social Security Instuon
Transferring informaon for the purpose of carrying out the
procedures of the Employees, Employee Candidates and Paents
within the scope of Social Security.
Authorized Public Instuons
and Organizaons
Limited sharing/transfer of informaon and documents requested
by the Clinic by relevant public instuons and organizaons.
suppliers
Transfer of personal data limited to the provision of services
received from suppliers.
Any personal data obtained by Dentekiz Clinic can be processed for the purposes listed; conrming
your identy, protecon of public health, prevenve medicine, medical diagnosis, execuon of
treatment and care services, planning and management of health services and nancing, planning
and management of the operaon of our clinic and daily operaons, supply of medicines, informing
you about the appointment if you make an appointment, risk management and quality improvement
acvies, making evaluaons for the development of health services, conducng research, fullling
legal and regulatory requirements, conrming your relaonship with the instuons contracted with
the clinic, invoicing in return for our health services, informaon requested with private insurance
companies within the scope of nancing health services. sharing the informaon requested with the
Ministry of Health and relevant public instuons and organizaons in accordance with the relevant
legislaon, answering all your quesons and complaints about our health services, taking all
necessary technical and administrave measures within the scope of data security of our clinic's
systems and applicaons, improving the health services we provide and Analyzing your use of health
services and storing your health data in order to improve your health, obtaining necessary
informaon in line with the requests and inspecons of regulatory and supervisory instuons and
ocial authories, training and development of our employees, monitoring, prevenng and reversing
abuse and unauthorized transacons, Preserving informaon about your health data, providing
nancial agreement regarding the health services oered to you with our contracted instuons,
measuring paent sasfacon and carrying out, developing, planning and managing health services
and nancing, increasing paent sasfacon, research and similar purposes.
ANNEX-5: Periods
Personal Data Category
Storage Time
Health Data (Biometric and genec
and examinaon data, laboratory,
test, analysis and examinaon
results, check-up and prescripon
informaon, paent records and
health data including but not limited
to, and paent close informaon
when necessary)
30 Years from the end
of the personal data
processing activity
All Records Related to Accounng
and Financial Transacons
10 years
Cookies and Logs
6 Months –
Maximum 2 Years
Trac Informaon on Online Visitors
2 years
Personal Data Regarding Suppliers
10 Years after the
legal relationship
ends
Personal Data Protecon Board
Transacons
10 years
Contracts
10 Years From The
Termination Of The
Agreement
Human Resources Processes
10 Years From End of
Activity
Visitor Registraon
2 Years From Event
Ending
Data on Personal Files Stored under the
Labor Law
10 Years from the end
of the Business
Relationship
Data on Personal Files Stored under the
Labor Law
15 Years from the end
of the Business
Relationship
Data Collected under OHS Legislaon
(Health reports, OHS Trainings,
Occupaonal Health and Safety records,
etc.)
10 Years from the end
of the Business
Relationship
Data kept within the scope of SGK
Legislaon (Recruitment declaraons,
bonus/service documents, etc.)
1 year
Job Applicaon If Applicaon Is Not
Accepted, Data Regarding Candidate
Applicaons (CV, Curriculum Vitae,
Cover Leer, Applicaon Form etc.)
10 Years After
Contract Termination
Personal Data Regarding Tax Records
5 Year
Personal Data Processed for Security
Purposes in Accordance with CCTV
Cameras (Camera Records)
90 day
Traffic Information Processed during
Use of the Office Internet Network,
Internet Login and Remote
Connection (IP address, start and end
time of the service provided, type of
service used, amount of data
transferred and subscriber identity
information, if any, etc.)
2 Year
Personal Data of a Dead Person
At least 20 Years