Patient Privacy Notice
on the Processing of Personal Data

Data Controller

Under Turkish Personal Data Protection Law No. 6698 (the “Law”), your personal data is processed by Dr. Kürşat Yılmaz Dental Practice (“Hamza Kürşat Yılmaz”) as data controller, within the scope explained below.

How We Collect Your Data and on What Legal Grounds

We collect personal data directly from you, from the contractual relationship between us, through our website, our social media accounts, e-mail, post, and official notifications from administrative and judicial authorities — verbally, electronically or in writing. Collection is carried out in line with the conditions set out in the Law and proportionately to the purposes below, on the following legal grounds under Articles 5 and 6:

• Processing is necessary for entering into or performing a contract with you (for example, processing your identity and contact details when treatment begins).
• Processing is mandatory for the establishment, exercise or protection of a right (for example, managing health insurance processes, ensuring information security, retaining data during statutory limitation periods).
• Processing is expressly provided for by law (for example, keeping transaction records under the Law and Law No. 5651).
• Processing is necessary to fulfil our legal obligations (financial and tax obligations, responding to lawful requests from regulatory authorities).
• Processing is necessary for our legitimate interests, provided your fundamental rights and freedoms are not harmed (conducting and auditing business activities, securing operations). Your use of the website may be analysed with cookies in order to measure service quality and advertising performance.
• Your explicit consent, where required (for example, transferring data to the Social Security Institution or Ministry of Health bodies on request; cloud clinic and appointment systems, e-invoice integrators, partner laboratories, practice archive).

Purposes of Processing

Your personal data may be processed for the purposes you disclosed it to us for, principally to establish and manage every stage of our treatment relationship, to ensure information security and the security of legal transactions, and to meet our statutory obligations.

These purposes include: conducting information security processes; carrying out audit and ethics activities; ensuring activities are conducted in line with legislation; conducting finance and accounting affairs; managing communication, requests and complaints; and planning and carrying out diagnosis and treatment services.

Your contact details are processed on the basis of your explicit consent under Article 5/1 of the Law, in order to send you campaign and informational messages.

Transfer of Personal Data

We process personal data in accordance with the “need to know” and “need to use” principles, applying data minimisation and the necessary technical and administrative security measures.

In line with the purposes above and limited to fulfilling them, your data may be shared as follows:

• With business partners and service providers offering call centre services for the delivery of diagnosis and treatment; with insurance companies and agencies within the scope of private health insurance.
• With our e-invoice partner so your invoice can be sent electronically; with cargo and courier firms for physical delivery of contracts or invoices; with authorised public bodies for the fulfilment of tax obligations.
• With business partners and service providers that supply, operate or service our IT infrastructure, for the conduct of contractual processes and legal proceedings.

Your data may also be shared with authorised public institutions and bodies under the Basic Law on Health Services No. 3359, Decree Law No. 663 on the Organisation and Duties of the Ministry of Health and its Affiliates, and other applicable legislation.

Your Rights as a Data Subject

As the person whose data is processed, you may exercise the rights set out in Article 11 of the Law — learning whether your data is processed, requesting information about the processing, learning its purpose and whether it is used accordingly, knowing the third parties to whom it is transferred, requesting correction of incomplete or inaccurate data, requesting erasure or destruction, objecting to a result arising solely from automated analysis, and claiming compensation for damage arising from unlawful processing.