ALP BULGURDental Clinic · Denizli
TR/EN/DE
Appointment
Personal Data Protection · 06

Personal Data Retention and Disposal Policy

1. Purpose and Scope

Dentist Hamdi Alp Bulgur, operating an oral and dental health practice under the trade name "Alp Bulgur Diş Kliniği" (the "Practice"), has prepared this Personal Data Retention and Disposal Policy (the "Policy") as data controller. Its purpose is to fulfil our obligations under the Personal Data Protection Law No. 6698 (the "Law") and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data (the "Regulation"), and to inform data subjects about the principles for determining maximum retention periods necessary for processing purposes and about deletion, destruction and anonymisation procedures.

The Policy covers all personal data of patients, relatives, appointment requesters, website users, visitors, employees, job applicants, employees and representatives of suppliers and business partners, and other natural persons. It applies to wholly or partly automated processing and non-automated processing where the data form part of a data filing system.

Data Controller: Dentist Hamdi Alp Bulgur (an oral and dental health practice operating under the trade name "Alp Bulgur Diş Kliniği")

Address: Sırakapılar Mahallesi, Gazi Bulvarı, 1581 Sokak, No: 1, Daire: 28, Merkezefendi / Denizli

Telephone: +90 532 240 93 19 / +90 258 261 84 36

Email: info@alpbulgur.com

Website: alpbulgur.com

2. Definitions

Explicit Consent: freely given, specific and informed consent. Relevant User: persons processing personal data within the data controller's organisation or under its authority and instructions, excluding the person or unit responsible for technical storage, protection and backup. Disposal: deletion, destruction or anonymisation of personal data. Recording Medium: any medium holding personal data processed wholly or partly automatically, or non-automatically as part of a data filing system. Personal Data: any information relating to an identified or identifiable natural person. Special Categories of Personal Data: data listed in Article 6 of the Law, mainly patients' health data in our Practice. Deletion: making personal data inaccessible and unusable for relevant users. Destruction: making personal data inaccessible, irretrievable and unusable by anyone. Anonymisation: making it impossible to associate personal data with an identified or identifiable natural person, even by matching them with other data. Periodic Disposal: deletion, destruction or anonymisation carried out on the controller's own initiative at recurring intervals specified in the retention and disposal policy when all processing conditions in the Law cease to apply. SBYS: health information management system software registered in the Ministry of Health's registration system. Board: the Personal Data Protection Board. Data Subject: the natural person whose personal data are processed.

3. Principles

Our Practice follows these principles when retaining and disposing of personal data:

  • Deletion, destruction and anonymisation comply fully with the Law, the Regulation, healthcare legislation, Board decisions and this Policy.
  • All deletion, destruction and anonymisation operations are recorded; without prejudice to other legal obligations, those records are retained for at least three years.
  • Unless the Board decides otherwise, our Practice selects an appropriate deletion, destruction or anonymisation method for disposal on its own initiative. For a data subject's request, an appropriate method is selected with reasons given.
  • When all processing conditions in Articles 5 and 6 of the Law cease to apply, personal data are deleted, destroyed or anonymised on our own initiative or at the data subject's request.
  • For health data, statutory duties to keep and retain patient records and both the patient's and dentist's interests in evidence are taken into account. Records subject to mandatory retention cannot be deleted at a data subject's request before the period ends; the data subject is informed of this and the reasons.
  • Requests are answered within thirty days. If the data concerned have been transferred to third parties, those recipients are notified and the necessary action at their end is ensured.

4. Recording Media

Our Practice stores personal data in: SBYS software and databases registered in the Ministry of Health's registration system; digital radiology, intraoral scanning and imaging software; online appointment and website servers; corporate email accounts; computers, backup units and authorised cloud backups; accounting and electronic professional-services receipt systems; telephones and instant messaging applications; camera recording devices, where present; paper patient registration and medical history forms, informed consent forms, X-ray films, contracts, accounting documents and personnel files; and the locked cabinets and archives containing them.

5. Reasons for Retention and Disposal

Within the limits of the Law and related legislation, our Practice retains personal data particularly to (i) provide oral and dental healthcare and keep lawful patient records; (ii) fulfil legal obligations; (iii) provide evidence and defence in disputes; and (iv) plan and fulfil employee entitlements. Reasons for retention include:

  • Express statutory requirements to keep and retain patient records;
  • Necessity of retention directly related to the formation and performance of contracts;
  • Retention for the establishment, exercise or protection of a right, including evidence during limitation periods;
  • Necessity for the Practice's legitimate interests without prejudicing data subjects' fundamental rights and freedoms;
  • Retention to fulfil tax, social security, occupational health and safety and healthcare obligations;
  • The data subject's explicit consent where retention relies on consent.

Under the Regulation, personal data are deleted, destroyed or anonymised on the Practice's own initiative or upon request when:

  • Legislation forming the basis for processing or retention is amended or repealed;
  • The purpose requiring processing or retention ceases to exist;
  • The processing conditions in Articles 5 and 6 of the Law cease to apply;
  • The data subject withdraws consent where processing relies solely on explicit consent;
  • Our Practice accepts a deletion, destruction or anonymisation request under Article 11 of the Law;
  • A complaint is made to the Board following rejection, an inadequate response or failure to respond in time, and the Board approves the request;
  • The maximum retention period has ended and no condition justifies longer retention.

6. Determining Retention and Disposal Periods

The following criteria are applied in order:

  • Where legislation prescribes a retention period, that period is observed.
  • Where no period is prescribed, data are classified as ordinary or special categories using Article 6 of the Law; the Board's adequate measures apply to special categories. Retention is assessed against Article 4 principles and the existence of a legitimate purpose. The applicable processing conditions under Articles 5 and 6 are identified, and reasonable periods are determined, taking account of limitation periods needed for evidence in disputes.
  • For patient records, a twenty-year period has been determined by considering together the record-retention duty under the Regulation on Private Healthcare Institutions Providing Oral and Dental Health Services, the Regulation on Personal Health Data, limitation periods for the dentist's civil and criminal liability, and the patient's interest in future access to treatment history.

7. Retention and Disposal Periods

Personal data are retained for the periods below. On expiry, they are deleted, destroyed or anonymised in the next periodic disposal cycle and in any event within 180 days after expiry.

  • Patient records and medical files (registration and medical history forms, examination findings, diagnosis, treatment plans and procedures, informed consent forms, prescription records, radiological images, intraoral photographs, digital impression and scan data, laboratory and prosthetic records): 20 years after the patient's last examination or treatment. If the patient dies, health data are retained for at least 20 years from the date of death.
  • Appointment records: appointments resulting in treatment are retained with patient records as part of the patient file; online, telephone or message appointment requests not resulting in treatment are retained for 1 year from the request date.
  • Website contact form messages and information requests: 1 year after the request is concluded.
  • Explicit consent and informed consent forms for use of patient images for information, education or scientific purposes: until consent is withdrawn, and for 10 years after withdrawal or the end of use for evidence.
  • Other explicit consent declarations (communication preferences, informing relatives, transfers to insurers, etc.): until withdrawal; thereafter, for the retention period of the relevant data category for evidence.
  • Receipts for professional services, payment, accounting and tax records: 5 years from the calendar year following the year to which the record relates under Tax Procedure Law No. 213; if disputed, until the dispute is concluded by final judgment.
  • Supplier, laboratory, IT and other contracts and data transfer undertakings: 10 years after termination (the general limitation period under the Turkish Code of Obligations No. 6098).
  • Employee personnel files, employment contracts, payroll, leave and attendance records: 10 years after employment ends (obligations and limitation periods under Law No. 5510 and the Labour Law).
  • Employee health records under occupational health and safety legislation (pre-employment and periodic examination reports, vaccination records): 15 years after employment ends.
  • Job applicant CVs and application information: 1 year from application; up to 2 years with explicit consent.
  • CCTV recordings, where cameras are present in communal areas: 30 days from recording; recordings relating to an incident or dispute, until the relevant process is concluded.
  • Website and online appointment access and traffic logs: 2 years on the basis of legitimate interests in Site security, in line with the maximum period for hosting providers under Law No. 5651.
  • Data obtained through cookies: for the periods in the Cookie Privacy Notice and Cookie Policy, and in any event no longer than 24 months.
  • Data subject requests, responses and Board correspondence: 3 years after the request is concluded; if disputed, until the dispute is concluded.
  • Patient requests, complaints and satisfaction records: 3 years from creation.
  • Personal data relating to an offence or legal dispute: for the applicable civil or criminal limitation period.
  • Data collected under other legislation: for the statutory period.

The above periods may not apply if the purpose of use continues, a statutory period is longer, or a limitation period requires longer retention. In such cases, the latest-ending period among the purpose of use, specific legislation and limitation period applies.

8. Periodic Disposal

Under Article 11 of the Regulation, expired data are deleted, destroyed or anonymised in six-monthly disposal cycles, in June and December each year, using this Policy. All operations are documented, and the records are retained for at least three years without prejudice to other legal obligations.

9. Deletion, Destruction and Anonymisation Methods

9.1. Deletion of Personal Data

The data to be deleted are identified and relevant users are determined using the access authorisation and control matrix. Their access, recovery and reuse permissions are removed. In SBYS, appointment systems and other databases, software deletion commands make data inaccessible to relevant users. Server and computer files are deleted using operating-system commands and removing access rights; cloud backup data are deleted using the provider's command. Paper data are irreversibly obscured by crossing out, painting or erasing so that relevant users cannot access them and technological solutions cannot read them.

9.2. Destruction of Personal Data

All copies are identified and a method appropriate to each medium is applied. Paper documents are irreversibly shredded. X-ray films and optical media are physically destroyed. Specialists irretrievably erase hard drives, portable storage and similar magnetic or electronic media by overwriting or degaussing, or physically destroy the media. End-of-life equipment is not disposed of before its data are destroyed.

9.3. Anonymisation of Personal Data

Anonymisation prevents identification by removing or altering all direct and indirect identifiers. Where patient data are needed for scientific studies, statistics or service quality measurement, the Practice anonymises them using methods such as removing variables, generalisation, masking and grouping. Under Article 28 of the Law, anonymised data fall outside its scope and do not require explicit consent for research, planning and statistical processing.

10. Technical and Organisational Measures

The main measures under Article 12 of the Law and Board Decision No. 2018/10 to ensure secure retention, prevent unlawful processing and access, and ensure lawful disposal are:

Organisational measures

  • Access is limited to employees who need the data for their duties, taking account of sensitivity and importance.
  • Employees receive training in data protection, patient privacy and data security and sign the Employee Confidentiality and Personal Data Protection Undertaking.
  • Personal Data Protection Undertakings are agreed with suppliers and processors, or data security provisions are added to existing contracts.
  • A personal data processing inventory and access authorisation matrix are prepared and kept current; retention periods are tracked in the inventory.
  • Physical storage areas are protected against fire, flooding, theft and similar risks. Patient files and documents are kept in locked cabinets; unauthorised access is prevented.
  • If processed personal data are obtained unlawfully by others, the Board is notified as soon as possible and within 72 hours, and data subjects as soon as reasonably possible.
  • The dentist regularly checks compliance with the Policy.

Technical measures

  • SBYS and other systems require a username and strong password. Accounts are personal and are disabled immediately on departure or change of role.
  • Electronic media and backups containing special categories of data are protected cryptographically; all operations are securely logged.
  • Electronic data are backed up regularly using a secure system. Backups receive the same protection, and expired data are also removed from backups.
  • Up-to-date antivirus and firewalls are used; security updates are applied regularly. Remote access to special categories of data uses at least two-step authentication.
  • When transferring special categories of data: encrypted corporate email is used for email transfers; portable storage, CDs and DVDs are encrypted; VPN or sFTP is used between servers in different locations; paper documents are sent in sealed envelopes marked as confidential.
  • Destruction makes data irretrievable and leaves no trace of the data; the destruction operation itself is documented.

11. Responsibilities and Allocation of Duties

The dentist, as data controller, is responsible for implementing and communicating the Policy, monitoring compliance, legislative changes and Board decisions, updating it and conducting periodic disposal. An employee or external provider may be assigned these duties, but responsibility remains with the controller. IT providers are responsible under their undertakings for deleting and destroying data in their systems in accordance with this Policy.

12. Entry into Force, Breaches and Sanctions

  • This Policy enters into force when published on the website and communicated to employees. It is binding on all employees, consultants, external providers and anyone processing personal data on behalf of the Practice.
  • The dentist monitors employee compliance. Any breach must be reported immediately to the dentist.
  • Following assessment, employees who breach the Policy are subject to appropriate action under employment legislation and the Employee Confidentiality and Personal Data Protection Undertaking.
  • The Practice reviews and updates this Policy as necessary following legislative changes and Board decisions. The current version is always the version on our website.