Privacy & Personal Data Protection Policy

GDPR & KVKK Compliant

1. Data Controller

This Privacy and Personal Data Protection Policy is issued by Dentlal (KSS Sağlık Hizmetleri), located at Göztepe, Fahrettin Kerim Gökay Cd. 232/B, 34732 Kadıköy/Istanbul, Turkey, acting as the data controller in accordance with the Turkish Personal Data Protection Law (KVKK), the EU General Data Protection Regulation (GDPR), and other applicable legislation.

2. Purpose and Scope

This Policy explains how personal data collected through the Company's website and digital channels is processed, for what purposes, on which legal bases, to whom it may be transferred, and the rights of data subjects.

3. Categories of Personal Data Processed

• Identity data (name, surname)
• Contact data (email address, phone number)
• IP address, device and browser information
• Usage and transaction security data
• Communication and request content

4. Purposes of Processing

• Planning and provision of healthcare services
• Preliminary assessment and treatment planning
• Managing patient communication processes
• Improving service quality
• Compliance with legal obligations
• Ensuring information security
• Marketing and informational communications (subject to consent)

5. Legal Basis for Processing

Personal data is processed under KVKK Articles 5 and 6 and GDPR Articles 6 and 9, including: explicit consent, performance of a contract, legal obligation, legitimate interest, and public health protection.

6. Data Sharing and Transfers

Personal data may be shared with public authorities where required by law, business partners and service providers, IT and infrastructure service providers, and third-party healthcare professionals involved in treatment. All transfers comply with KVKK Articles 8–9 and GDPR requirements.

7. Cookies and Tracking Technologies

The website uses cookies to enhance user experience, analyze usage, improve performance, and ensure security. Users may manage or disable cookies through browser settings.

8. Data Retention

Personal data is retained for the period required by applicable laws or as long as necessary for processing purposes. After expiry, data is deleted, destroyed, or anonymized.

9. Data Security

The Company implements appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction.

10. Rights of Data Subjects

• Learn whether personal data is processed
• Request access to personal data
• Learn the purpose of processing
• Know third-party recipients
• Request correction of inaccurate data
• Request deletion or destruction
• Request restriction of processing
• Object to processing
• Withdraw consent at any time

11. Contact

12. Updates

The Company reserves the right to amend this Policy in line with legal and operational requirements. The latest version is always published on the website.