At Özel Lotus İstanbul Ağız ve Diş Sağlığı Polikliniği, we value the privacy and security of your personal data. This Personal Data Protection Notice explains the purposes, lawful bases and methods of processing your personal data, and your rights under Turkish Personal Data Protection Law No. 6698 (KVKK).
This notice provides general information about processing involving website visitors, patients, prospective patients, patients’ relatives, legal representatives and other individuals who contact our clinic. A separate notice may be provided where a particular activity or service requires more specific information.
1. Data Controller
Under Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by Özel Lotus İstanbul Ağız ve Diş Sağlığı Polikliniği as the data controller.
Our clinic works to implement the technical and organisational measures required by applicable legislation to process personal data lawfully, keep it secure and protect it against unauthorised access.
2. Scope of This Notice
The main groups whose personal data may be processed under this notice are:
- Patients and prospective patients
- Patients’ relatives
- Parents and legal representatives
- Website visitors
- People requesting appointments or information
- People contacting us by phone, email or WhatsApp
- Other individuals who contact our clinic
3. Categories of Personal Data Processed
Depending on the processing activity and service provided, our clinic may process the following categories of personal data.
3.1. Identity Information
- First and last name
- Date of birth
- Age
- Turkish identity number where necessary
- Other information on identity documents necessary for healthcare provision
3.2. Contact Information
- Telephone number
- Email address
- Address
- Preferred communication channel
3.3. Patient and Service Information
- Appointment details
- Application and request information
- Treatment and service history
- Patient communication records
- Operational information relating to healthcare services
3.4. Health Data
The following special categories of personal data may be processed to the extent necessary to provide healthcare:
- Oral and dental health information
- Examination findings and medical history
- Diagnosis and treatment information
- Treatment plans
- Radiographs and other medical images
- Laboratory or test results
- Medication information
- Allergy information
- Information about previous treatments
- Other health information necessary to deliver treatment safely
3.5. Visual and Audio Data
- Intraoral and extraoral photographs necessary for diagnosis, treatment or follow-up
- Other medical visual records created during healthcare provision
3.6. Legal and Financial Information
- Billing and payment information
- Records relating to compliance with legal obligations
- Information relating to applications, requests and disputes
3.7. Digital and Technical Data
- IP address
- Browser and device information
- Operating system information
- Pages visited
- Traffic and referral source
- Website usage and interaction information
- Information obtained through cookies
- System and security logs
4. Purposes of Processing Personal Data
Depending on the type of data and the service you use, your personal data may be processed for the following purposes:
- Creating and managing appointment requests
- Communicating with patients and their relatives
- Providing information about requested treatments and healthcare services
- Registering and admitting patients
- Carrying out diagnosis, treatment and care
- Creating and monitoring treatment plans
- Maintaining patient safety
- Maintaining and improving healthcare quality and standards
- Managing operational activities connected with healthcare
- Managing billing and payments
- Meeting statutory record-keeping and retention obligations
- Complying with legal obligations towards authorised public bodies
- Establishing, exercising or protecting legal rights
- Responding to website messages and enquiries
- Maintaining website security and technical integrity
- Measuring website performance and improving the user experience
- Using analytics or marketing technologies where the user has made the required choices and given permission
5. Lawful Bases for Processing Personal Data
Depending on the nature of the activity, your personal data is processed on an appropriate lawful basis under Articles 5 and 6 of the KVKK, as outlined below.
| Processing Activity | Main Lawful Basis |
|---|---|
| Receiving Appointment Requests, Messages and Enquiries | Processing directly related to entering into or performing a contract and, where applicable, necessary for the data controller’s legitimate interests. |
| Patient Registration, Admission and Healthcare Delivery | Processing expressly provided for by law, compliance with legal obligations and applicable conditions for processing special categories of personal data in healthcare. |
| Medical Diagnosis, Treatment and Care | Processing necessary to carry out diagnosis, treatment and care under the KVKK provisions on special categories of personal data. |
| Financial and Accounting Activities | Processing expressly provided for by law and necessary for the data controller to comply with a legal obligation. |
| Legal Proceedings and Dispute Management | Processing necessary to establish, exercise or protect a right. |
| Website Security and Essential Technical Operation | Compliance with the data controller’s legal obligations and processing necessary for its legitimate interests, provided it does not harm fundamental rights and freedoms. |
| Use of Non-Essential Analytics or Marketing Technologies | The individual’s explicit consent where required for the activity, or another appropriate lawful basis provided by legislation. |
Providing information and obtaining explicit consent are separate processes. Receiving information about the processing of your personal data does not depend on your approval. Where an activity requires explicit consent, your consent is obtained separately and must be freely given.
6. Processing Health Data
Under the KVKK, health data is classified as a special category of personal data .
Patients’ health data may be processed to protect oral health, carry out diagnosis, treatment and care, maintain patient safety and comply with healthcare legislation, subject to the conditions in Article 6 of the KVKK.
Measures are taken to implement the additional technical and organisational safeguards required by legislation when processing special categories of personal data.
General website contact and enquiry forms are not intended to collect your medical history or provide an online medical diagnosis. Unless specifically requested, please avoid adding detailed health information, medical reports or other sensitive personal data to the message field.
7. How Personal Data Is Collected
Your personal data may be collected through the following channels by wholly or partly automated means, or by non-automated means where it forms part of a data filing system:
- Patient registration at the clinic
- Examinations and treatment
- Website contact and enquiry forms
- Appointment requests
- Telephone calls
- WhatsApp communications
- Email correspondence
- Medical imaging and diagnostic systems
- Records and documents created during healthcare provision
- Website cookies and similar technologies
- Server, security and system logs
- Information lawfully obtained from authorised public bodies
8. Sharing Personal Data
Your personal data may be transferred to third parties to the extent necessary to fulfil processing purposes, deliver healthcare and comply with legal obligations, where the transfer conditions under the KVKK are met.
| Recipient Category | Purpose of Transfer |
|---|---|
| Authorised Public Bodies and Institutions | Compliance with healthcare legislation and other legal and regulatory obligations. |
| Judicial and Administrative Authorities | Responding to lawful requests for information or documents and managing legal proceedings. |
| Authorised Healthcare Professionals or Organisations Required for Care | Providing diagnosis, treatment or care, or coordinating healthcare services. |
| Authorised Providers Used for Laboratory, Imaging or Healthcare Services | Carrying out diagnosis and treatment to the extent necessary. |
| Accounting, Legal and Consultancy Service Providers | Meeting financial and legal obligations and protecting rights. |
| IT, Server and Technical Infrastructure Providers | Operating and securing information systems and providing technical support. |
Transfers are limited to, and proportionate to, the relevant processing purpose.
9. International Transfers of Personal Data
Operating the website or using digital communications, security, analytics and similar technologies may involve infrastructure provided by service providers outside Türkiye.
Where personal data is transferred abroad, the transfer is based on an applicable mechanism under Article 9 of the KVKK, including the prescribed conditions, an adequacy decision, appropriate safeguards or another mechanism permitted by legislation.
Where a specific transfer or technology requires explicit consent, the necessary consent may be obtained separately from the individual.
10. The Website and Cookies
Essential cookies may be used to keep our website functioning properly and securely. Non-essential analytics or marketing technologies may be used in accordance with applicable legislation and user preferences.
For detailed information about cookie types, purposes and how to manage your preferences, please read our Cookie Policy .
11. Retention of Personal Data
Your personal data is retained for the period required by the processing purpose and in accordance with statutory retention periods under healthcare, tax, accounting and other applicable legislation.
When the processing purpose no longer applies and no other lawful basis under the applicable legislation requires retention, personal data is deleted, destroyed or anonymised in accordance with the law.
12. Security of Personal Data
We work to implement appropriate technical and organisational measures to prevent unlawful processing or access and to keep personal data secure.
Depending on the nature of the data and systems, these measures may include:
- Restricting access permissions
- Authorisation and authentication mechanisms
- Encrypted data transmission using SSL/TLS
- Firewalls and protection against malicious traffic
- Software and system updates
- Backup and data recovery processes
- Maintaining access and security logs
- Additional safeguards for special categories of personal data
- Restricting access by staff and service providers
13. Children’s Personal Data
Our clinic may provide oral and dental healthcare to children.
Children’s personal and health data may be processed to the extent necessary to deliver healthcare, maintain patient safety, carry out diagnosis and treatment, and comply with applicable legal obligations.
Where necessary, information about a parent or legal representative may also be processed to deliver the relevant healthcare service.
14. Your Rights Under the KVKK
Under Article 11 of the KVKK, as an individual whose personal data is processed, you have the following rights, which you may exercise by applying to the data controller:
- To learn whether your personal data is being processed,
- to request information if your personal data has been processed,
- to learn the purpose of processing and whether your data is used in accordance with that purpose,
- to know the third parties to whom your data is transferred within Türkiye or abroad,
- to request correction of incomplete or inaccurate personal data,
- to request deletion or destruction under the conditions set out in the KVKK,
- to request notification of corrections, deletion or destruction to third parties to whom your data has been transferred,
- to object to an adverse outcome resulting from analysis of your data exclusively through automated systems,
- to seek compensation for damage caused by unlawful processing of your personal data
.
15. How to Submit a Request
You may submit requests concerning your rights under the KVKK to the data controller, Özel Lotus İstanbul Ağız ve Diş Sağlığı Polikliniği.
Your application must clearly state your request and include the information necessary to verify that it has been made by you.
Applications are assessed under the KVKK and the Communiqué on the Procedures and Principles for Applications to the Data Controller, and resolved within the statutory period according to the nature of the request.
Özel Lotus İstanbul Ağız ve Diş Sağlığı Polikliniği
Website: dentlotus.com
Contact: You can contact us through the official channels listed on our clinic’s website.
16. Updates to This Notice
This Personal Data Protection Notice may be updated to reflect changes in processing activities, technologies, services or applicable legislation.
The current version is published on this page, with the updated date shown at the top.