Privacy Notice (KVKK)

Data Controller

Under the KVKK, your personal data is processed by Koza Dent Clinic as data controller, within the scope described below.

Address: Merkez Mah. Dr. Sadık Ahmet Cd. No:30-34D, Bağcılar / İstanbul Phone: 0212 813 93 93 E-mail: info@kozaclinic.com

Categories of Personal Data

Depending on how you use our website, the following personal data may be processed:

• Identity and contact data: full name, phone number, e-mail address.
• Request data: the content of your contact-form message and your language preference.
• Health data (special category personal data): dental X-rays, panoramic radiographs, CT and MRI images taken at our clinic, together with related dates and notes.
• Authentication data: full name, phone number and the e-mail address matching your clinic record used to verify your identity for the X-ray lookup and patient portal, and records of one-time verification codes.
• Transaction security data: IP address, browser and device information, timestamps, and access logs of sign-in, verification and file download operations.

Please do not share detailed information about your health through the contact form; you can discuss it with your dentist during your consultation.

Purposes of Processing

Your personal data is processed for the following purposes:

• Answering and following up on questions, requests and appointment enquiries sent via the contact form.
• Verifying your identity and providing secure access to your X-ray and imaging files.
• Carrying out medical diagnosis, treatment and care services and keeping patient records.
• Preventing unauthorised access, ensuring information security and detecting misuse.
• Fulfilling legal obligations and responding to requests from competent authorities.

Legal Grounds

Your personal data is processed on the following legal grounds set out in Articles 5 and 6 of the KVKK:

• Processing is necessary for the conclusion or performance of a contract, provided it relates directly to that contract (Art. 5/2-c) — requests relating to appointments and treatment.
• Processing is necessary for the controller to comply with a legal obligation (Art. 5/2-ç) — health legislation and requests from authorities.
• Processing is necessary to establish, exercise or protect a right (Art. 5/2-e) — retention of access logs.
• Processing is necessary for the legitimate interests of the controller, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f) — answering contact requests, information security and preventing misuse.
• Your health data: processing by persons under a duty of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services (Art. 6/3-e).

Transfer of Personal Data

Limited to the purposes above and in line with Articles 8 and 9 of the KVKK, your personal data may be transferred to:

• Competent public authorities such as the Ministry of Health and judicial or administrative bodies, where required by law.
• Server hosting and e-mail delivery providers we use to operate our website; health data is stored encrypted on these providers’ systems.
• Legal and financial advisers bound by professional secrecy.

Where our service providers’ servers are located abroad, transfers are carried out in accordance with Article 9 of the KVKK (an adequacy decision or appropriate safeguards such as standard contractual clauses). The map on our contact page is loaded from Google only if you choose “Load map”; your browser may then share data with Google. No data is sent to Google before the map is loaded.

Method of Collection

Your personal data is collected electronically via the contact, X-ray lookup and patient portal forms on our website, and physically and electronically during patient registration and treatment at our clinic, by automated means or by non-automated means that form part of a filing system.

Retention Periods

Your personal data is kept for as long as the purpose of processing requires and for the periods required by law; it is then deleted, destroyed or anonymised:

• Contact-form messages: 2 years from receipt.
• X-ray and imaging files made available to you via the website: 180 days from upload, after which they are automatically deleted from the system. Your patient file at the clinic is kept separately for the periods required by health legislation.
• One-time verification codes and download links: valid only for a short time (a matter of minutes) and unusable once expired.
• Transaction security and access logs: for the periods required by applicable legislation.

Data Security

We take the necessary technical and organisational measures to prevent unlawful processing of and access to your personal data: all communication with our website is encrypted (TLS); X-ray and imaging files are stored encrypted on our servers and are released only to a patient whose identity has been verified with a one-time code; only authorised clinic staff can access the admin panel, and every access is logged.

Your Rights

Under Article 11 of the KVKK, you have the right to apply to our clinic to:

• learn whether your personal data is processed,
• request information about the processing,
• learn the purpose of processing and whether data is used in line with that purpose,
• know the third parties in Turkey or abroad to whom data is transferred,
• request rectification of incomplete or inaccurate data,
• request erasure or destruction of data under the conditions in Article 7 of the KVKK,
• request that rectification, erasure or destruction be notified to third parties to whom data was transferred,
• object to an outcome against you resulting exclusively from automated analysis,
• claim compensation for damage arising from unlawful processing.

How to Apply

You can submit requests regarding your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller and with information verifying your identity, in writing to Merkez Mah. Dr. Sadık Ahmet Cd. No:30-34D, Bağcılar / İstanbul, via registered e-mail (KEP) or secure electronic signature, or by e-mail to info@kozaclinic.com from the e-mail address registered with our clinic.

Your request will be concluded free of charge within 30 days at the latest, depending on its nature; if the process involves an additional cost, the fee set by the Personal Data Protection Board may be charged. If your request is rejected, you find the answer insufficient, or no answer is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of the KVKK.

Cookie Policy

Our website uses only cookies that are strictly necessary for it to work. We do not use analytics, advertising, marketing or third-party tracking cookies, so no cookie consent is requested. Strictly necessary cookies are processed on the basis of our legitimate interest (Art. 5/2-f) to provide the core functions of the site.

If you choose to load the map on our contact page, Google may set its own cookies, which are subject to Google’s privacy policy. You can delete or block cookies in your browser settings; blocking strictly necessary cookies may prevent some features from working.

Changes

The Clinic reserves the right to amend this notice and cookie policy in line with changes in legislation or updates to its services. The current version is always published on this page.