KVKK Clarification Notice

At Betadent Oral and Dental Health Polyclinic we process your personal data under Turkish Law No. 6698 on the Protection of Personal Data (KVKK). Below you will find which data we collect, why we process it, who we share it with and what your legal rights are.

Last updated: 26 September 2026 · This is an English translation of our KVKK Aydınlatma Metni. If the two texts differ, the Turkish text prevails. How the UK and EU GDPR apply to you is explained in our Privacy Policy.

As Betadent Ağız ve Diş Sağlığı Polikliniği Est.Öz.Sağ.Hizm.Med.Tur.Tic.Ltd.Şti. (hereinafter “Betadent Ltd.Şti.”) and our practice team, we attach great importance to the security of your personal data. We keep all personal data that our patients share with us in a way that respects patient privacy, and we take every technical and administrative measure needed to ensure an appropriate level of security for it. This Clarification Notice on the Protection of Personal Data is required by Article 10 of Law No. 6698 on the Protection of Personal Data. Its purpose is to inform our patients about our personal data protection and processing policy, about how we collect, transfer, use and protect your personal data while our practice provides its services, and about your legal rights in this respect. This notice covers not only patients who come to our clinic but also anyone who contacts us through our website, WhatsApp, e-mail, our social media accounts or social media lead forms.

1. Personal Data Collected by Our Clinic

So that the health services we provide are delivered effectively, soundly, safely, continuously and in line with the law, we ask our patients for various items of personal information. This information is collected in accordance with the “principles and conditions for processing personal data” set out in Articles 5 and 6 of Law No. 6698 on the Protection of Personal Data. The personal data we ask for are listed below. Depending on the patient’s age, state of health, the nature of the condition and of the treatment to be given, and other circumstances, all or some of them will be requested. The personal data requested from our patients are:

• Your name and surname;
• Your Turkish identity details, Turkish ID number, passport number;
• Your place and date of birth;
• Your gender;
• Your address;
• Your telephone number;
• Your e-mail address;
• The patient protocol number assigned to you;
• Financial information such as payment and invoice details;
• Your private health insurance and Turkish Social Security Institution (SGK) details;
• Your laboratory results, X-ray films and other medical imaging outputs;
• Your test and examination results;
• Your examination data;
• Your check-up information;
• Your prescription details and other health data, without being limited to these;
• Security camera recordings, installed for security purposes, showing the entrance and exit of the practice and the common areas inside it;
• Other data you share when you contact us by post, telephone, fax, e-mail or other channels;
• Personal images relating to the treatment you receive (photographs, video, etc.);
• The name, telephone number, e-mail address, treatment of interest and message you send us through the appointment and contact forms on our website, WhatsApp, our social media accounts and social media lead forms (Facebook/Instagram), and the photographs and X-rays you send us for a preliminary assessment;
• For patients travelling from abroad, the arrival and departure dates you share for treatment and travel planning, and the flight details needed for the airport transfer;
• Transaction security and usage data generated when you visit our website (IP address, device and browser information, pages viewed, and the link or advert that brought you to the site). Apart from what is strictly necessary, these are collected only if you allow it in your cookie preferences (see section 8).

2. Purposes of Processing

The personal data we collect in the course of the health services provided by our practice are processed only for the legitimate purposes set out below, and will never be used for any other commercial purpose beyond those purposes and other purposes arising from the law. The personal data we collect in the course of the health services we provide are processed only for the following legitimate purposes:

• a. Fulfilling our legal obligations under Basic Law on Health Services No. 3359, Decree-Law No. 663 on the Organisation and Duties of the Ministry of Health and Its Affiliated Institutions, the Regulation on Private Health Institutions Providing Outpatient Diagnosis and Treatment, the Regulation on the Processing of Personal Health Data and the Protection of Privacy, and other legislation;
• b. Protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing;
• c. Giving you information about your appointment, if you make one;
• d. Planning and managing the internal operation of the practice and ensuring its security;
• e. Carrying out analysis to improve our services;
• f. Invoicing;
• g. Verifying your identity;
• h. Verifying your relationship with contracted institutions;
• i. Responding, as required by the applicable legislation, to requests from the Ministry of Health, other public administrative institutions and judicial authorities;
• j. Responding to your questions or complaints about our services;
• k. Analysing your use of health services in order to improve the services we offer;
• l. Complying with the internal policies and principles of our practice;
• m. Measuring and improving patient satisfaction;
• n. Contacting you to give you information about our services;
• o. Supplying medicines or medical materials;
• p. Ensuring effectiveness and continuity in patients’ treatment;
• r. Ensuring the security of our practice;
• s. Fulfilling obligations arising from private-law contracts entered into by Betadent Ltd.Şti.;
• t. Sharing on social media or other platforms for promotional and informational purposes (only on the basis of separate explicit consent you give for this);
• u. Recording the information, price, preliminary assessment and appointment requests you send us through our website, WhatsApp, e-mail, social media and social media lead forms, following them up under a single record in our customer relationship management (CRM) system, and responding to your request;
• v. For patients travelling from abroad, planning the treatment schedule, appointments and airport transfer;
• y. If you allow it in your cookie preferences, measuring how our website is used and whether our adverts lead to enquiries.

Your health data are not used for advertising. No health data and no patient lists are sent to advertising platforms.

3. Persons and Organisations to Which Personal Data May Be Transferred

In line with Law No. 6698 on the Protection of Personal Data in particular, the health legislation in force and other legal provisions, the personal data of our patients processed by us may be shared with the relevant official administrative authorities and judicial bodies. In addition, provided that this does not conflict with the legislation in force, the relevant personal data may be transferred to private insurance companies, auditors, consultants, business partners, domestic organisations from which we receive services under contract or with which we cooperate in order to carry out our activities, and other third parties.

Personal data are also transferred to the IT and communications service providers below, only to the extent the service requires. Because these providers’ servers are located outside Türkiye, these transfers are transfers abroad, as described in section 7:

4. Method and Legal Grounds of Collection

The personal data of our patients listed above are collected and processed in written or electronic form so that our practice can fulfil its legal and contractual obligations, for the purposes set out above. They are collected and processed through face-to-face meetings with patients or meetings held by telephone, teleconference or video conference, or through notifications the patient makes to us in writing by hand or by post, by e-mail or via social media; through the appointment and contact forms on our website, WhatsApp and social media lead forms (Facebook/Instagram); and, when you visit our website, by automatic or partly automatic means through cookies and similar technologies. We collect and process your personal data within the legal conditions set out in Articles 5 and 6 of Law No. 6698. Our main activities and the legal grounds we rely on are:

• Examination, treatment and medical records: our legal obligation under health legislation (Art. 5(2)(ç)) and performance of the contract with you (Art. 5(2)(c)); for health data, the provision of medical diagnosis, treatment and care by persons under a duty of confidentiality (Art. 6(3)(e)).
• Answering your form, WhatsApp, e-mail and lead-form enquiries and following them up in our CRM system: processing directly related to the establishment of a contract at your request (Art. 5(2)(c)) and our legitimate interest in following up enquiries properly and completely (Art. 5(2)(f)). Photographs, X-rays and health information you choose to send us for a preliminary assessment are processed for review by our dentists under Art. 6(3)(e) and, where required, on the basis of your explicit consent (Art. 6(3)(a)).
• Invoicing, accounting and reports to the authorities: legal obligation (Art. 5(2)(ç)).
• Security camera recordings: our legitimate interest in the safety of our patients, staff and premises (Art. 5(2)(f)).
• Disputes and complaints: establishment, exercise or protection of a right (Art. 5(2)(e); for health data, Art. 6(3)(d)).
• Analytics and advertising cookies: your explicit consent (Art. 5(1)). You can withdraw it at any time through the cookie banner or the “Cookie settings” link at the bottom of the page.
• Sharing your treatment photographs and videos for promotion: only your separate, written, explicit consent (Art. 6(3)(a)). You can withdraw it at any time.
• Promotional commercial electronic messages (SMS, e-mail, etc.): your prior approval under Law No. 6563; every message lets you opt out.
• Transfers abroad: the conditions of Article 9 of the Law, explained in section 7.

The wording of the relevant articles of the Law, setting out the conditions for processing personal data, is as follows (English translation published by the Turkish Personal Data Protection Authority):

ARTICLE 5 – Conditions for processing personal data

(1) Personal data shall not be processed without explicit consent of the data subject. (2) Personal data may be processed without seeking the explicit consent of the data subject only in cases where one of the following conditions is met: a) It is expressly provided for by the laws. b) It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid. c) Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract. ç) It is necessary for compliance with a legal obligation to which the data controller is subject. d) Personal data have been made public by the data subject himself/herself. e) Data processing is necessary for the establishment, exercise or protection of any right. f) Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.

ARTICLE 6 – Conditions for processing special categories of personal data

As amended by Law No. 7499, in force since 1 June 2024.

(1) Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data are deemed to be special categories of personal data. (2) (Repealed) (3) It is prohibited to process special categories of personal data. However, such processing is permitted under the following conditions: a) Data subject has given his/her explicit consent, b) It is explicitly provided by laws, c) It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid, ç) It relates to personal data that have been made public by the data subject, and processing is consistent with the data subject’s intention to make such data public, d) It is necessary for the establishment, exercise or protection of any right, e) It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and for the planning, management and financing of health-care services by persons subject to legal obligation of confidentiality or by competent public institutions and organizations, f) It is necessary for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance, g) It relates to the current or former members and affiliates of foundations, associations, and other non-profit organizations established for political, philosophical, religious, or trade union purposes, or to individuals who are in regular contact with these organizations, provided that such processing complies with the applicable legislation governing these organizations and their objectives, is limited to the organizations’ fields of activity, and does not involve disclosure of data to third parties. (4) Adequate measures, as determined by the Board, shall also be implemented in the processing of special categories of personal data.

5. Storage Method, Retention Period and Destruction of Personal Data

Personal data stored and processed by us within the conditions above will be stored and kept in our custody for 10 years + 6 months, taking into account the 10-year general limitation period set out in Article 146 of Turkish Code of Obligations No. 6098 and possible delays in the service of notices. At the end of this period, patients’ personal data kept physically or in writing will be destroyed by obliteration (tearing, cutting, burning, etc.), and personal data kept electronically will be destroyed by deletion.

Shorter periods, or special periods set by law, apply to the following records:

• Records of form, lead-form, WhatsApp and e-mail enquiries that do not lead to treatment (including CRM records): up to 24 months, then deleted.
• Security camera recordings: kept for a short period, then overwritten; if an incident has to be investigated, footage of that incident may be kept longer.
• Invoices and accounting records: for the periods required by Turkish tax and commercial law.
• Website analytics data (if you consented): up to 14 months in Google Analytics.
• Records of approval for commercial electronic messages: for as long as your approval is valid, plus 3 years as proof.

Some records may be kept longer than these periods where a legal dispute is ongoing or the law requires it.

6. Your Legal Rights Regarding Your Personal Data

Your legal rights regarding the personal data collected and processed by our practice are set out in Article 11 of Law No. 6698 on the Protection of Personal Data. The article, and therefore your legal rights regarding the personal data we collect and process, reads as follows:

ARTICLE 11 – Rights of the data subject

(1) Each person has the right to request to the data controller about him/her: a) to learn whether his/her personal data are processed or not, b) to demand for information as to if his/her personal data have been processed, c) to learn the purpose of the processing of his/her personal data and whether these personal data are used in compliance with the purpose, ç) to know the third parties to whom his/her personal data are transferred in country or abroad, d) to request the rectification of the incomplete or inaccurate data, if any, e) to request the erasure or destruction of his/her personal data under the conditions referred to in Article 7, f) to request reporting of the operations carried out pursuant to sub-paragraphs (d) and (e) to third parties to whom his/her personal data have been transferred, g) to object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems, ğ) to claim compensation for the damage arising from the unlawful processing of his/her personal data.

You can exercise these rights: a) by delivering a written statement of which of the rights in Article 11 of the KVKK you wish to exercise, together with your request and information and documents that identify you, to our practice at Kızıltoprak Mah., 919. Sokak No:23/A, 07300 Muratpaşa / Antalya, Türkiye, by hand, through a notary, by post or by the other methods set out in the KVKK; or b) by e-mail to betadentantalya@gmail.com, sent from your registered electronic mail (KEP) address or from an e-mail address you have previously given to our practice and that is recorded in our system. Our practice will conclude your request free of charge, as quickly as its nature allows and within thirty days at the latest. If the process involves an additional cost, however, the fee in the tariff set by the Personal Data Protection Board will be charged to you.

If your request is refused, you find the answer insufficient or you receive no answer in time, you may complain to the Personal Data Protection Board within thirty days of learning of our answer, and in any case within sixty days of the date of your request (KVKK Art. 14).

7. Transfer of Personal Data Abroad

Your personal data are mainly kept in Türkiye, at our clinic. However, the servers of the providers listed in section 3, which we use for our website, forms, e-mail and messaging services and our customer relationship management (CRM) system, are located outside Türkiye. The data you send us through these channels, and the usage data generated if you accept cookies, are therefore transferred abroad.

These transfers are made under Article 9 of Law No. 6698: one of the processing conditions in Articles 5 and 6 must be met, and one of the appropriate safeguards provided for in the Law, such as the standard contract published by the Personal Data Protection Board, must be in place. Where an appropriate safeguard cannot be provided, a transfer is made only if it is incidental and falls under one of the cases listed in Article 9(6), for example your explicit consent to the transfer after being informed of the possible risks, or the transfer being necessary for pre-contractual measures taken at your request.

Data transferred abroad may not enjoy the same level of protection as in Türkiye. If you would rather not send health information such as X-rays or photographs through these channels, you can bring them to your first appointment at the clinic instead. You can ask us which of your data are held by which provider and in which country, using the methods in section 6.

8. Cookies and Similar Technologies

Regardless of your consent, our website uses only what it needs to work: your language choice (betadentLang) and your cookie choice (betadentConsent) are kept in your browser’s local storage and are not sent to us. Other cookies are used only if you allow them in the cookie banner:

• Analytics: Google Analytics 4, loaded through Google Tag Manager, measures in aggregate how many people visit the site and which pages they read. This data is not used to identify you.
• Advertising: Google Ads and Meta (Facebook/Instagram) tags measure whether an advert led to an enquiry and allow our adverts to be shown to people who visited the site. No health data is sent to these platforms.
• Embedded content: when the Google Maps map on our site loads, Google receives your IP address. Patient videos load from YouTube’s privacy-enhanced mode (youtube-nocookie.com) only when you press play.

We use Google Consent Mode: if you reject analytics and advertising cookies, Google’s tags set no cookies. If you have not saved a choice, we treat a Global Privacy Control (GPC) signal from your browser as a rejection. You can change your choice at any time with the “Cookie settings” link at the bottom of every page. Google Analytics cookies stay in your browser for up to 2 years, and advertising cookies usually for up to 13 months.

We update this notice when our processing changes. Changes that materially affect you, such as a new purpose or a new recipient, are stated clearly on this page. Last updated: 26 September 2026.

Respectfully submitted for your information.

View this notice as a PDF