Personal Data Protection Clarification Text

As Specialist Dentist Çağrı Şibal (legally defined as the “Data Controller: Specialist Dentist Çağrı Şibal”), we attach importance to the security and privacy of the personal data of our patients and website visitors. We aim to implement appropriate technical and administrative security measures in the processing and storage of personal data.

We process your personal data, in our capacity as the data controller, within the scope described below and in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and applicable legislation. We fulfil our obligations regarding the collection, purposes of use, processing, transfer, storage, and protection of personal data in accordance with the KVKK and relevant secondary legislation.

This Privacy Notice has been prepared pursuant to the data controller’s obligation to inform under Article 10 of the KVKK. It is intended to provide information regarding the identity of the data controller; the methods and legal grounds on which your personal data are collected; the purposes for which they are processed; the persons and organisations to whom they may be transferred and the purposes of such transfers; and your rights under Article 11 of the KVKK.

References to “personal data” in this Notice also include, where applicable, special categories of personal data, particularly health data.

1. Collection and Processing of Personal Data and Purposes of Processing

Specialist Dentist Çağrı Şibal processes and retains your personal data in accordance with the KVKK, healthcare legislation, and other applicable regulations.

Your personal data may be processed for the purposes of providing healthcare services in compliance with applicable legislation, carrying out examination, diagnosis, orthodontic assessment, treatment and follow-up processes, creating patient records, and fulfilling legal obligations.

Depending on the nature of the service provided, your personal data may be collected by automated or non-automated means through cagrisibal.com, telephone, social media accounts, WhatsApp, email, online communication and appointment channels, as well as verbally, in writing, electronically, or in physical environments.

Your personal data may be updated for as long as the patient-doctor or user-service relationship continues and may be retained in digital and/or physical environments for the periods required by applicable legislation.

Personal Data That May Be Processed

Identity Information:
Name, surname, Turkish Republic identification number, passport number or temporary identification number, date of birth, gender, and other identification information necessary for creating a patient file.

Contact Information:
Address, telephone number, email address, and other contact details.

Financial Information:
Payment, invoicing, and financial transaction information required under applicable legislation.

Visual and Audio Data:
Intraoral and facial photographs required as part of the treatment process, clinical images, radiographic and digital records, and other visual or audio records obtained in accordance with the law.

Health Data and Other Special Categories of Personal Data:
Health data obtained during orthodontic examination, diagnosis, treatment, and follow-up processes; clinical data relating to dental and jaw structures; radiographs; intraoral scans; photographs; treatment plans; records relating to clear aligner and fixed orthodontic treatments; and other information necessary for the provision of healthcare services.

Purposes for Processing Your Personal Data

Your personal data may be processed for the following purposes:

• Fulfilling legal obligations arising from healthcare legislation,
• Carrying out medical and dental assessments, diagnosis, orthodontic treatment, and follow-up processes,
• Creating and maintaining up-to-date patient records,
• Planning and providing healthcare services,
• Creating and managing appointment processes,
• Providing information regarding appointments and treatment processes through communication channels such as telephone, SMS, email, or WhatsApp,
• Invoicing the services provided and managing financial processes,
• Responding to questions, requests, and complaints concerning healthcare services,
• Ensuring the security of information systems and patient data,
• Preventing unauthorised transactions and personal data security breaches,
• Fulfilling statutory record-keeping and archiving obligations,
• Improving healthcare services in terms of quality and patient experience.

2. Persons and Organisations to Whom Your Personal Data May Be Transferred

Your personal data may be shared, only to the extent necessary and subject to the conditions set out under the KVKK and applicable legislation, with the following persons or organisations:

• The Ministry of Health of the Republic of Türkiye and its affiliated units,
• Provincial Directorates of Health and other authorised healthcare authorities,
• The Social Security Institution,
• Private insurance companies,
• Authorised public institutions and organisations,
• Courts, Chief Public Prosecutor’s Offices, and other authorised judicial authorities,
• Authorised law enforcement authorities,
• Laboratories whose services are used for the provision of healthcare,
• Authorised laboratories and suppliers involved in the production of orthodontic appliances, clear aligners, retainers, or similar customised medical/dental products,
• Other healthcare institutions and healthcare professionals to whom the patient is referred or applies,
• Representatives or legal guardians expressly authorised by the patient,
• Professional advisers providing legal, accounting, auditing, or similar services,
• Service providers providing information technology, software, hosting, data storage, and infrastructure services.

Where personal data are transferred abroad, such transfers will be carried out in accordance with the relevant provisions of the KVKK and the applicable regulations governing international transfers of personal data.

3. Methods and Legal Grounds for the Collection of Personal Data

Your personal data may be collected in physical or electronic environments through verbal, written, or digital methods.

The processing of personal data may be carried out on the legal grounds provided under the KVKK, including in particular:

• Where processing is expressly provided for by law,
• Where processing is necessary for the data controller to fulfil its legal obligations,
• Where processing is necessary for the establishment, exercise, or protection of a right,
• Where processing is necessary for the legitimate interests of the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject,
• Where the relevant conditions prescribed by applicable legislation for the provision of healthcare services are satisfied,
• Where necessary, on the basis of the explicit consent of the data subject.

When processing special categories of personal data, the specific requirements stipulated under the KVKK and other applicable and current legislation are taken into consideration.

4. Retention Period of Personal Data

Your personal data are retained only for the purposes specified in this Privacy Notice and in accordance with the retention and limitation periods prescribed under healthcare legislation, the KVKK, tax and accounting legislation, and other applicable laws.

When the purpose for processing and retaining personal data ceases to exist and there is no other legal basis under applicable legislation requiring continued retention, personal data are deleted, destroyed, or anonymised using methods compliant with applicable legislation.

5. Your Rights Regarding the Protection of Personal Data

Pursuant to Article 11 of the KVKK, you have the following rights in relation to your personal data:

• To learn whether your personal data are being processed,
• To request information if your personal data have been processed,
• To learn the purpose for which your personal data are processed and whether they are being used in accordance with that purpose,
• To know the third parties to whom your personal data have been transferred in Türkiye or abroad,
• To request the correction of your personal data if they have been processed incompletely or inaccurately,
• To request the deletion or destruction of your personal data subject to the conditions prescribed by applicable legislation,
• To request that corrections, deletions, or destruction of personal data be notified to third parties to whom the personal data have been transferred,
• To object to any outcome arising against you as a result of the analysis of processed personal data exclusively through automated systems,
• To request compensation for damages if you suffer loss as a result of the unlawful processing of your personal data.

You may submit your applications under the KVKK, together with information sufficient to verify your identity and request, through the communication channels specified on cagrisibal.com or to the physical contact address stated below.

Your applications will be processed as soon as reasonably possible, depending on the nature of the request, and within the time limits prescribed by applicable legislation.

Data Controller and Contact Information

Data Controller: Specialist Dentist Çağrı Şibal
Title: Orthodontist / Specialist Dentist
Website: https://www.cagrisibal.com/
Telephone: +90 532 505 40 08
Address: Avcılar Exclusive, Mansuroğlu Mah., 288/4. Sk. No: 9/1, A Blok, Office: 39, 35535 Bayraklı / İzmir, Türkiye