Privacy Policy

This Confidentiality and Personal Data Protection Agreement is entered into between Specialist Dentist Çağrı Şibal (Address: Avcılar Exclusive, Mansuroğlu Mah., 288/4. Sk. No: 9/1, A Blok, Office: 39, 35535 Bayraklı / İzmir) and ........................................................................, from whom services are obtained in the field of .................................................................

In this Agreement, Specialist Dentist Çağrı Şibal shall be referred to as the “SERVICE RECIPIENT”, and ........................................................................ shall be referred to as the “SERVICE PROVIDER”.

The SERVICE PROVIDER agrees that, when using any information and personal data transmitted to it, made accessible to it, or obtained during the performance of services provided to the SERVICE RECIPIENT’s dental practice, it shall comply with all applicable legislation, including in particular the Turkish Personal Data Protection Law No. 6698 (“KVKK”), the “Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention No. 108)”, the “Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine”, professional medical ethics rules, and other applicable legal provisions.

The SERVICE PROVIDER is obliged not to process, reproduce, transfer, disclose, share, or use for purposes other than those authorised any personal data relating to patients, patients’ relatives, employees, or other third parties to which it gains access or of which it becomes aware during the provision of services to the SERVICE RECIPIENT, particularly special categories of personal data, including health data, without the knowledge and lawful authorisation of the SERVICE RECIPIENT.

This obligation shall continue after termination of the service relationship between the parties, in accordance with applicable legislation and confidentiality obligations.

Scope of Confidential Information

This Agreement covers not only personal data and special categories of personal data relating to patients, but also the following information and assets belonging to the SERVICE RECIPIENT or used in the course of its activities:

• Patient records and health data,
• Orthodontic examination and treatment records,
• Radiographic images and clinical photographs,
• Digital intraoral scans,
• Clear aligner and orthodontic treatment plans,
• Clinical procedures and operational information,
• Information relating to specialised medical practices and methods,
• Website and digital infrastructure information,
• Software and administrative panel access credentials,
• User accounts and access information,
• Trade secrets,
• Financial information,
• Business processes,
• Patient and supplier lists,
• Marketing and digital communication strategies,
• Other information declared confidential by the SERVICE RECIPIENT or which, by its nature, should reasonably be considered confidential.

The SERVICE PROVIDER accepts, represents, and undertakes that it shall not disclose to third parties any specialised medical practices, methods, techniques, systems, or commercial information learned within this scope; shall not use such information for its own benefit or for the benefit of third parties; and shall refrain from any conduct that may constitute unfair competition.

Security of Personal Data

The SERVICE PROVIDER is obliged to take the necessary technical and administrative measures to prevent unlawful processing of and unauthorised access to personal data and to ensure that personal data are securely retained.

The SERVICE PROVIDER:

• Shall not share usernames, passwords, or access credentials provided to it with third parties.
• Shall not transfer data to its own devices, personal cloud accounts, or unauthorised systems without the permission of the SERVICE RECIPIENT.
• May use the data solely for the purpose of performing the services assigned to it.
• Shall inform the SERVICE RECIPIENT without delay in the event of suspected unauthorised access, data loss, data leakage, or any other security breach.
• Shall not delegate or transfer access to personal data to any third-party service provider or subcontractor without the prior written consent of the SERVICE RECIPIENT.

Termination of the Service Relationship

Upon termination of the service relationship between the parties, the SERVICE PROVIDER shall, in accordance with the instructions of the SERVICE RECIPIENT, return or delete/destroy in compliance with applicable legislation all information, documents, data, files, digital records, access credentials, and other materials belonging to the SERVICE RECIPIENT that are in its possession.

Following termination of the service relationship, the SERVICE PROVIDER shall not retain any copies of data belonging to the SERVICE RECIPIENT for its own use, except where retention is required by law.

Liability

The SERVICE PROVIDER acknowledges that it shall bear legal, administrative, and criminal liability arising from its own acts and transactions where it breaches the obligations set out in this Agreement during or after the service relationship.

Where the SERVICE RECIPIENT, patients, or third parties suffer damage as a result of the SERVICE PROVIDER’s conduct contrary to this Agreement or applicable legislation, the resulting damages and liabilities shall be assessed in accordance with the general principles of law.

Applicable Legislation

In matters not expressly regulated under this Agreement, the following shall apply:

• Turkish Personal Data Protection Law No. 6698,
• Decisions of the Turkish Personal Data Protection Board and relevant secondary legislation,
• Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data,
• Convention for the Protection of Human Rights and Dignity of the Human Being with regard to the Application of Biology and Medicine,
• Turkish Code of Obligations,
• Turkish Commercial Code,
• Turkish Labour Law, to the extent applicable,
• Healthcare legislation and other relevant legislation.

Competent Courts

Any disputes arising from the implementation or interpretation of this Agreement shall be subject to the jurisdiction of the Courts and Enforcement Offices of İzmir.

This Agreement has been read and accepted by the parties, executed in two counterparts on …… / …… / 2026, and one copy has been delivered to each party.