This Privacy Notice has been prepared under the Personal Data Protection Law No. 6698 ("KVKK" or the "Law") by the data controller, Dentist Hamdi Alp Bulgur, who operates an oral and dental health practice under the trade name "Alp Bulgur Diş Kliniği" (the "Practice"). It explains the scope and purposes of processing your personal data, possible recipients, collection methods and legal grounds, and your rights under Article 11 of the Law.
"Alp Bulgur Diş Kliniği" is the trade name used by Dentist Hamdi Alp Bulgur. Our Practice also presents its activities and receives online appointment requests through alpbulgur.com. Detailed information for patients is provided in the Patient Privacy Notice; for people requesting appointments through our website, in the Online Appointment Request Privacy Notice; and for employees and job applicants, in the Employee and Job Applicant Privacy Notice. This notice applies alongside and supplements those specific notices.
1. Data Controller
Under the KVKK, your personal data are processed by the data controller identified below. A self-employed dentist is the data controller for personal data processed in their practice.
Data Controller: Dentist Hamdi Alp Bulgur (an oral and dental health practice operating under the trade name "Alp Bulgur Diş Kliniği")
Address: Sırakapılar Mahallesi, Gazi Bulvarı, 1581 Sokak, No: 1, Daire: 28, Merkezefendi / Denizli
Telephone: +90 532 240 93 19 / +90 258 261 84 36
Email: info@alpbulgur.com
Website: alpbulgur.com
2. Personal Data We Process and Groups of Data Subjects
Our Practice processes personal data of patients and their relatives (parents, guardians or people whom the patient wishes to be informed), prospective patients requesting appointments, website visitors, people visiting the Practice, employees and representatives of suppliers and business partners, our employees and job applicants. The main data categories vary according to the group and the legal relationship:
- Identity data: first name, surname, Turkish identification number or passport number for foreign nationals, date of birth, sex and signature.
- Contact data: telephone number, email address, postal address and communication preferences.
- Health data (special categories of personal data): for patients, medical history, medication and allergies, oral and dental examination findings, radiological images, intraoral photographs and digital impression data, diagnosis, treatment plan, procedures performed, prescriptions and informed consent records; for employees, health information required by occupational health and safety legislation.
- Financial data: service fees, payment and receipt information (our Practice does not retain bank or credit card numbers).
- Legal transaction data: contracts, consent forms, requests and complaints, and correspondence in disputes.
- Transaction security data: records such as IP addresses, dates and times and browser information relating to transactions through our website and online appointment system.
- Visual and audio data: video recordings where security cameras are used in communal areas of the Practice; intraoral photographs and videos taken for treatment documentation.
- Professional experience and personnel data: only for our employees and job applicants.
3. Collection Methods and Legal Grounds
Your personal data are collected verbally and in writing during examination and treatment; through patient registration and medical history forms, informed consent forms, health information management system software registered in the Ministry of Health's registration system, digital imaging and impression devices, online appointment and contact forms, telephone, email, text messages and instant messaging applications, messages sent to our social media accounts, contracts, accounting and receipt records, and camera systems, where present. Collection is wholly or partly automated, or non-automated where the data form part of a data filing system.
Your personal data other than special categories are processed in accordance with the general principles in Article 4 of the KVKK on the following grounds in Article 5:
- Express provision by law (KVKK Article 5/2-a): Law No. 1219, Basic Law on Health Services No. 3359, the Regulation on Private Healthcare Institutions Providing Oral and Dental Health Services, the Regulation on Personal Health Data, Tax Procedure Law No. 213 and related legislation.
- Necessity of processing the personal data of parties to a contract, provided that it is directly related to its formation or performance (KVKK Article 5/2-c): patient–dentist relationships, appointment requests, supply and service contracts.
- Necessity for the data controller to fulfil a legal obligation (KVKK Article 5/2-ç): record-keeping, Ministry of Health notifications, tax and social security obligations and responding to competent authorities.
- Necessity for the establishment, exercise or protection of a right (KVKK Article 5/2-e): handling disputes, evidence and defence.
- Necessity for the legitimate interests of the data controller, without prejudicing the fundamental rights and freedoms of the data subject (KVKK Article 5/2-f): appointment reminders, Practice and information security, and improving service quality.
- Your explicit consent where the above grounds do not apply (KVKK Article 5/1).
Special categories of your personal data, including health data, are processed under Article 6(2)(e) of the KVKK where necessary for medical diagnosis, treatment and care, and the planning, management and financing of healthcare services, by the dentist and Practice staff subject to a duty of confidentiality. Processing may also rely on express provision by law under subparagraph (b), necessity to protect life or physical integrity under subparagraph (c), or necessity for the establishment, exercise or protection of a right under subparagraph (d) of the same paragraph. The adequate measures specified in the Personal Data Protection Board's Decision No. 2018/10 of 31 January 2018 are taken. Processing outside these grounds, such as sharing before-and-after treatment images for information purposes, is carried out only with your separate explicit consent. Employees' health data are processed under subparagraph (f) where necessary to fulfil legal obligations in employment, occupational health and safety and social security.
4. Purposes of Processing Your Personal Data
Your personal data are processed for the following purposes in accordance with Article 4 of the KVKK: lawfulness and fairness; accuracy and keeping data up to date where necessary; specific, explicit and legitimate purposes; relevance, limitation and proportionality to those purposes; and retention for the period prescribed by legislation or necessary for the processing purpose:
- Providing oral and dental healthcare; examination, diagnosis, treatment planning, treatment and review;
- Receiving, assessing, confirming, reminding, changing and cancelling appointment requests;
- Keeping and retaining patient records in accordance with legislation and making the required notifications to the Ministry of Health's central health data system;
- Collecting service fees, issuing receipts for professional services and fulfilling accounting and tax obligations;
- Carrying out laboratory and manufacturing processes required for dentures, crowns, clear aligners and similar treatments;
- Communicating with patients, answering requests, questions and complaints, and monitoring patient satisfaction;
- Ensuring the safety of the Practice, our patients and employees, and information security;
- Fulfilling legal obligations, providing information to competent authorities, handling disputes and protecting our rights;
- Managing employment, personnel, occupational health and safety and social security processes for employees and job applicants;
- Managing procurement, outsourced services and business partnerships;
- Operating our website, ensuring its security and improving the user experience.
5. Transfers of Your Personal Data
Your personal data may be transferred to the following recipient groups under Article 8 of the KVKK, only to the extent necessary for the purposes above:
- Ministry of Health and its units (Provincial Health Directorate): statutory notifications to the central health data system, inspections and notification duties (legal obligation).
- Dental prosthetic laboratories and digital manufacturing centres: only the impression, scan and shade information necessary to produce dentures, crowns, bridges, clear aligners and similar devices (carrying out treatment).
- Radiology and imaging centres, consulting physicians and referral healthcare institutions: where diagnosis and treatment require this and with your knowledge.
- Accountant and Revenue Administration: receipts for professional services, accounting and tax obligations.
- Banks and payment service providers: only for carrying out payment transactions.
- IT service providers: companies supplying health information management systems, online appointment systems, website hosting, email, backup and security services as data processors on behalf of our Practice.
- Private health insurance companies: only at your request and with your explicit consent.
- Legal advisers, lawyers and competent judicial and administrative authorities (courts, public prosecutors, the Turkish Dental Association and its affiliated Chamber, the Personal Data Protection Authority): to fulfil legal obligations and protect rights.
- Patients' relatives, parents, guardians or persons authorised by the patient: to the extent permitted by legislation and in accordance with the patient's preferences.
Data protection undertakings or contractual provisions are agreed with all third-party recipients. Health data transfers are based on sharing only the minimum necessary information and using encrypted transmission.
6. Transfers of Your Personal Data Abroad
As a rule, your personal data are processed and stored in Türkiye. Transfers abroad may nevertheless occur where (i) servers for email, hosting, content delivery or security services are abroad; (ii) you choose to communicate through an overseas instant messaging application such as WhatsApp; or (iii) treatment requires your digital impression and image data to be sent to manufacturers or laboratories abroad. Under Article 9 of the KVKK, as amended by Law No. 7499, and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, these transfers rely first on an adequacy decision by the Personal Data Protection Board. In its absence, an appropriate safeguard is required, such as a standard contract published by the Board, binding corporate rules or a written undertaking authorised by the Board. If neither is available, transfers may take place only occasionally, based on your explicit consent after information about possible risks, or on another condition in Article 9(6) of the Law.
7. Retention Periods
Your personal data are retained for the period prescribed by legislation or necessary for the processing purpose, after which they are deleted, destroyed or anonymised under our Personal Data Retention and Disposal Policy. Taking healthcare legislation and limitation periods into account, patient records are retained for twenty years from the last examination or treatment. Financial records are retained for five years under tax legislation, and online appointment requests that do not result in an appointment for one year. Detailed periods are set out in our Personal Data Retention and Disposal Policy.
8. Your Rights Under Article 11 of the KVKK and How to Submit a Request
Under Article 11 of the KVKK, you may apply to our Practice as data controller to exercise the following rights:
- To learn whether your personal data are being processed;
- To request information if your personal data have been processed;
- To learn the purpose of processing and whether your personal data are used in accordance with that purpose;
- To know the third parties to whom your personal data are transferred in Türkiye or abroad;
- To request rectification of incomplete or inaccurate personal data;
- To request deletion or destruction of your personal data under the conditions in Article 7 of the KVKK;
- To request notification to third-party recipients of the actions taken in response to your rectification, deletion or destruction requests;
- To object to a result against you arising from analysis of your processed data exclusively through automated systems;
- To seek compensation for damage caused by unlawful processing of your personal data.
You may submit requests concerning these rights under the Communiqué on the Procedures and Principles for Requests to the Data Controller by completing the Data Subject Request Form available on our website. You may deliver your handwritten-signed request in person or through a notary to Sırakapılar Mahallesi, Gazi Bulvarı, 1581 Sokak, No: 1, Daire: 28, Merkezefendi / Denizli; send a request signed with a secure electronic signature or mobile signature to info@alpbulgur.com; or email info@alpbulgur.com from an email address previously provided to our Practice and registered in our system.
Your request will be concluded free of charge as soon as possible, according to its nature, and in any event within thirty days. If the procedure entails an additional cost, a fee may be charged under the tariff set by the Personal Data Protection Board. Your request must include your full name, Turkish identification number (for foreign nationals: nationality, passport number or identification number, if any), residential or business address for service, email address for notifications, if any, telephone number and the subject of the request. For requests concerning health data, we may ask for additional identity-verification information and documents to ensure that information reaches only the person entitled to receive it.
If your request is rejected, the response is inadequate or no response is provided in time, you retain the right to complain to the Personal Data Protection Board within thirty days of learning of the response, and in any event within sixty days of your request.
9. Changes
Our Practice may update this Privacy Notice in response to legislative changes, decisions of the Personal Data Protection Board and developments in its practices. The current text is always the version published at alpbulgur.com. All our KVKK policies and notices are available on our website, and printed copies may be requested from our Practice.