This Privacy Notice is provided by data controller Dentist Hamdi Alp Bulgur, operating an oral and dental health practice under the trade name "Alp Bulgur Diş Kliniği" (the "Practice"), under the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It informs patients receiving oral and dental healthcare and their relatives (parents, guardians, accompanying persons and persons the patient wishes to be informed) about processing their personal data.
1. Data Controller
Data Controller: Dentist Hamdi Alp Bulgur (an oral and dental health practice operating under the trade name "Alp Bulgur Diş Kliniği")
Address: Sırakapılar Mahallesi, Gazi Bulvarı, 1581 Sokak, No: 1, Daire: 28, Merkezefendi / Denizli
Telephone: +90 532 240 93 19 / +90 258 261 84 36
Email: info@alpbulgur.com
Website: alpbulgur.com
2. Personal Data We Process
We process the following data to provide healthcare and fulfil legal obligations:
- Identity data: name, surname, Turkish identification number (nationality and passport number for foreign patients), birth date, sex and signature; parent or guardian identity for patients under 18.
- Contact data: telephone number, email and postal address, emergency contact details and communication preferences.
- Health data (special categories of personal data): medical history (systemic diseases, past surgery, medication, allergies, pregnancy and breastfeeding, infectious disease information and other details needed for safe treatment); oral and dental examination findings, dental chart, radiological images (periapical, panoramic and three-dimensional tomography), intraoral and facial photographs and videos, digital impressions and intraoral scans, diagnosis, treatment plan and options, procedures and materials, prescriptions and medication, informed consent forms, laboratory and prosthetic records, review and follow-up notes, appointment reason and complaints and notes you provide.
- Financial data: service fees, payment plans, payment and collection details, professional-services receipts, receivables and payables. Credit and debit card numbers are not recorded or retained by the Practice.
- Legal transaction data: patient registration, informed consent and explicit consent forms, requests and complaints, dispute correspondence and official requests.
- Transaction security data: IP address, date, time and browser records relating to your website and online appointment transactions.
- Visual and audio data: security-camera images where cameras exist in communal areas (no cameras record in examination or treatment rooms).
- Relatives’ data: identity and contact details of parents, guardians and accompanying persons; names and contact details of persons the patient wishes to be informed.
3. Collection Methods
Data are collected through patient registration and medical history forms, information given verbally during examination and treatment, Ministry-registered health information software, digital radiology and imaging devices, intraoral scanners and cameras, informed consent forms, online appointment and contact forms, telephone, text messages, email, instant messaging if you choose, social media messages, payment and receipt records, referral and consultation correspondence, and camera systems where present. Collection is wholly or partly automated or non-automated as part of a filing system. Records from another institution referring you, or previous investigations you send us, are added to your patient file.
4. Purposes of Processing Your Personal Data
- Creating your patient record and verifying identity;
- Oral and dental examination, diagnosis, treatment planning and treatment, review and follow-up;
- Assessing general health, medication and allergies for safe treatment, and managing emergencies;
- Laboratory and digital manufacturing processes for dentures, crowns, bridges, clear aligners, implant superstructures and similar devices;
- Further investigations, consultation and referral where necessary;
- Obtaining and documenting your informed consent before treatment;
- Keeping and retaining records lawfully and making statutory notifications to the Ministry of Health's central health data system;
- Receiving, confirming, reminding, changing and cancelling appointments and communicating about treatment and review;
- Collecting service fees, issuing receipts for professional services and fulfilling accounting and tax obligations;
- Answering requests, questions and complaints, monitoring satisfaction and improving service quality;
- Ensuring the safety of the Practice, patients and employees;
- Fulfilling legal obligations and official requests, protecting rights and providing evidence in disputes;
- With your explicit consent: using treatment images for education, scientific studies or lawful information; sending necessary health data to your private insurer at your request; communicating through your chosen messaging application; and informing the relatives you designate.
5. Legal Grounds for Processing
Health data are processed without requiring explicit consent under Article 6(2)(e) of the KVKK where necessary for medical diagnosis, treatment and care or planning, management and financing of healthcare, by the dentist and staff subject to confidentiality duties. The dentist is bound by confidentiality under Law No. 1219, the Medical Deontology Regulation and the Patient Rights Regulation. Other grounds are express statutory provision for records and Ministry notifications (Article 6/2-b), necessity to protect life or physical integrity in emergencies (6/2-c), and necessity to establish, exercise or protect a right in disputes (6/2-d). Processing outside these grounds relies only on explicit consent (6/2-a); refusal does not affect treatment.
Other personal data rely on Article 5(2) of the KVKK: express legal provision (a: record and notification duties under healthcare and tax law); necessity for forming and performing the patient–dentist contract (c); fulfilling our legal obligations (ç); establishing, exercising or protecting a right (e); and legitimate interests without prejudicing your fundamental rights and freedoms (f: appointment reminders, Practice security and service quality).
Health data are processed under the adequate measures in Board Decision No. 2018/10 of 31 January 2018 and the Regulation on Personal Health Data, only by authorised persons subject to confidentiality, in encrypted environments with access logging.
6. Transfers of Your Personal Data
Under Article 8 of the KVKK and only for the purposes below, your data may be transferred to:
- Ministry of Health and Provincial Health Directorate: mandatory central health data notifications, inspections and reporting under the oral and dental healthcare and personal health data regulations (legal obligation).
- Dental laboratories and digital manufacturing centres: only impression, scan, shade and design data needed to manufacture dentures, crowns, bridges, clear aligners and similar devices, using patient codes instead of identity where possible (treatment).
- Radiology and imaging centres, consulting physicians and referral institutions: further investigations, consultation and referrals required for treatment, with your knowledge (treatment).
- Accountant and Revenue Administration: professional-services receipts, accounting and tax obligations (legal obligation). No health data are shared except the service description legally required on the receipt.
- Banks and payment providers: only to make payments (contract performance).
- IT providers (processors): health information systems, imaging, appointments, hosting, security, email and backup providers acting on the Practice's behalf, under its instructions and confidentiality commitments.
- Private or supplementary health insurers: only at your request, with explicit consent and limited to information needed for insurance procedures.
- Relatives, parents or guardians: for under-18 patients, the parent or guardian; otherwise only persons you designate and wish to be informed, under the Patient Rights Regulation and Regulation on Personal Health Data.
- Lawyers, advisers, mediators, courts, public prosecutors, enforcement offices, law enforcement, the Authority, Turkish Dental Association and affiliated Chamber: only as required for legal obligations and establishing, exercising or protecting rights.
Under the Regulation on Promotion and Information Activities in Health Services and the KVKK, your health data are not shared with any third party for advertising, marketing or commercial purposes.
7. Transfers of Your Personal Data Abroad
Your data are generally processed and stored in Türkiye. Transfers abroad may occur in the following cases:
- Identity, contact and appointment information where the email, hosting, content delivery or security servers we use are abroad;
- Information shared through overseas instant messaging applications such as WhatsApp, if you choose this and explicitly consent;
- Health data where treatments such as clear aligners require digital impressions and images to be sent to manufacturers or laboratories producing abroad.
Under Article 9 of the KVKK as amended by Law No. 7499 and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, transfers rely on a Board adequacy decision or, if none exists, appropriate safeguards such as a Board-published standard contract. If appropriate safeguards are unavailable, they rely on your explicit consent after information about possible risks under Article 9(6)(a). Where a treatment option requires transfer abroad, you are informed separately during planning.
8. Patient Privacy and Persons to Be Informed
Information about your health is given only to you. Under the Patient Rights Regulation and Regulation on Personal Health Data, you may designate who may or may not be informed and change this at any time. Health information of patients under 18 or under legal guardianship is given to their parent or guardian. Examination and treatment rooms protect privacy and have no camera recording. At reception and in waiting areas, health information is handled so third parties cannot overhear.
9. Retention Periods
Patient records and medical files, including radiology, digital impressions and consent forms, are retained for twenty years after the last examination or treatment, considering healthcare retention duties, limitation periods for the dentist's civil and criminal liability and your interest in future access. Financial records are retained for five years under tax law; requests not resulting in treatment for one year; processing based on explicit consent until withdrawal. On expiry, data are deleted, destroyed or anonymised under our retention and disposal policy. Mandatory patient records cannot be deleted on request before expiry; we explain the reasons in our response.
10. Security of Your Personal Data
Under Article 12 of the KVKK and Board Decision No. 2018/10, measures include encrypted records in Ministry-registered software, regular backups, authorised accounts and strong passwords, access logs, employee confidentiality undertakings and training, locked physical files, confidentiality undertakings with recipients and encrypted health-data transfers.
11. Your Rights Under Article 11 of the KVKK
Under Article 11 of the KVKK, you may apply to our Practice to exercise the following rights:
- To learn whether your personal data are being processed;
- To request information if your personal data have been processed;
- To learn the purpose of processing and whether your personal data are used in accordance with that purpose;
- To know the third parties to whom your personal data are transferred in Türkiye or abroad;
- To request rectification of incomplete or inaccurate personal data;
- To request deletion or destruction of your personal data under the conditions in Article 7 of the KVKK;
- To request notification to third-party recipients of the actions taken in response to your rectification, deletion or destruction requests;
- To object to a result against you arising from analysis of your processed data exclusively through automated systems;
- To seek compensation for damage caused by unlawful processing of your personal data.
Under the Patient Rights Regulation, you may also request health information, inspect patient records and seek correction of missing, unclear or inaccurate information.
You may submit requests concerning these rights under the Communiqué on the Procedures and Principles for Requests to the Data Controller by completing the Data Subject Request Form available on our website. You may deliver your handwritten-signed request in person or through a notary to Sırakapılar Mahallesi, Gazi Bulvarı, 1581 Sokak, No: 1, Daire: 28, Merkezefendi / Denizli; send a request signed with a secure electronic signature or mobile signature to info@alpbulgur.com; or email info@alpbulgur.com from an email address previously provided to our Practice and registered in our system.
Your request will be concluded free of charge as soon as possible, according to its nature, and in any event within thirty days. If the procedure entails an additional cost, a fee may be charged under the tariff set by the Personal Data Protection Board. Your request must include your full name, Turkish identification number (for foreign nationals: nationality, passport number or identification number, if any), residential or business address for service, email address for notifications, if any, telephone number and the subject of the request. For requests concerning health data, we may ask for additional identity-verification information and documents to ensure that information reaches only the person entitled to receive it.
If rejected, inadequately answered or not answered in time, you may complain to the Board within thirty days of learning of the response and in any event within sixty days of your request.
12. Updating This Privacy Notice
This notice may be updated following legislative changes and developments in our practices. The current text is published at alpbulgur.com and available in print at the Practice.