ALP BULGURDental Clinic · Denizli
TR/EN/DE
Appointment
Personal Data Protection · 02

Personal Data Protection and Processing Policy

PART 1: INTRODUCTION

1.1. Importance of Personal Data Protection

Personal data protection is a fundamental right guaranteed by Article 20 of the Constitution. As an oral and dental health practice, protecting all personal data we process, particularly the health data entrusted to us, is a priority. Dentist Hamdi Alp Bulgur, the data controller operating under the trade name "Alp Bulgur Diş Kliniği" and through alpbulgur.com (the "Practice"), has prepared this Policy under the Personal Data Protection Law No. 6698 ("KVKK" or the "Law") to fulfil the general duty to inform and establish the basic principles of processing in the Practice.

To implement this Policy, we establish procedures, prepare notices for each data subject group, agree confidentiality undertakings with employees having access and third-party recipients, take necessary technical and organisational measures and monitor compliance.

1.2. Purpose of the Policy

The Policy sets out the principles of lawful processing and protection of personal data in our Practice and promotes transparency by informing patients, relatives, appointment requesters, website users, visitors, employees, job applicants, and employees and representatives of suppliers and partners.

1.3. Scope

This Policy concerns all personal data of the above groups processed by our Practice wholly or partly automatically, or non-automatically as part of a filing system. Specific provisions are also set out in the Employee and Job Applicant Privacy Notice, the Patient Privacy Notice and the Policy on Processing and Security of Special Categories of Personal Data.

1.4. Identity and Contact Details of the Data Controller

Under the KVKK, the data controller is the self-employed dentist whose identity and contact details appear below:

Data Controller: Dentist Hamdi Alp Bulgur (an oral and dental health practice operating under the trade name "Alp Bulgur Diş Kliniği")

Address: Sırakapılar Mahallesi, Gazi Bulvarı, 1581 Sokak, No: 1, Daire: 28, Merkezefendi / Denizli

Telephone: +90 532 240 93 19 / +90 258 261 84 36

Email: info@alpbulgur.com

Website: alpbulgur.com

1.5. Definitions

In this Policy: Explicit Consent means freely given, specific and informed consent. Data Subject means the natural person whose data are processed. Personal Data means any information relating to an identified or identifiable natural person. Special Categories of Personal Data means data concerning race, ethnic origin, political opinions, philosophical beliefs, religion, denomination or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data. Processing means any operation on data, including obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, receiving, making available, classifying or preventing use. Data Controller means the natural or legal person determining processing purposes and means and responsible for establishing and managing the filing system. Data Processor means the natural or legal person processing data on the controller's behalf under its authority. Board means the Personal Data Protection Board; Authority means the Personal Data Protection Authority. SBYS means health information management system software registered in the Ministry of Health's registration system.

1.6. Application of the Policy and Legislation

Applicable legislation takes precedence over this Policy in any conflict. In addition to the KVKK and secondary legislation, our Practice is bound by patient privacy and confidentiality duties under Law No. 1219, Basic Law on Health Services No. 3359, Turkish Dental Association Law No. 3224, the Regulation on Personal Health Data, the Regulation on Private Healthcare Institutions Providing Oral and Dental Health Services, the Patient Rights Regulation, the Regulation on Promotion and Information Activities in Health Services, and the Medical Deontology Regulation.

1.7. Access and Updates

This Policy is published at alpbulgur.com and is also available in print at the Practice on request. It is updated as necessary following legislative changes, Board decisions and developments in our practices. The current version is always the one on our website.

PART 2: PRINCIPLES AND CONDITIONS FOR PROCESSING PERSONAL DATA

2.1. Principles Applied to Processing

Our Practice processes personal data under Article 20 of the Constitution and Article 4 of the KVKK according to these principles:

  • Lawfulness and fairness: we identify the legal basis, observe proportionality, use data only for the stated purpose and do not process data without the persons concerned being informed.
  • Accuracy and keeping data current where necessary: accurate patient records are essential to safe healthcare. Identity, contact and health information are confirmed at each examination and correction requests are assessed promptly.
  • Specific, explicit and legitimate purposes: purposes are determined before processing and explained to data subjects through privacy notices.
  • Relevance, limitation and proportionality: only data needed for healthcare and legal obligations are collected. Data minimisation is applied; online appointment and contact forms request only information needed to respond.
  • Retention for the statutory period or the period necessary for the purpose: data are kept for the periods in our Personal Data Retention and Disposal Policy and then deleted, destroyed or anonymised.

2.2. Conditions for Processing Ordinary Personal Data

Under Article 20(3) of the Constitution, personal data may be processed only where provided by law or with explicit consent. Our Practice processes without explicit consent where a condition in Article 5(2) of the KVKK applies: express provision by law; necessity to protect the life or physical integrity of a person unable to consent due to actual impossibility or whose consent is not legally valid, or of another person; necessity to process a contracting party's data directly related to forming or performing a contract; necessity to fulfil the controller's legal obligation; public disclosure by the data subject; necessity for the establishment, exercise or protection of a right; or necessity for the controller's legitimate interests without prejudicing the data subject's fundamental rights and freedoms.

Where these conditions do not apply, specific, freely given and informed explicit consent is sought. Considering the trust inherent in the patient–dentist relationship, processing data necessary for healthcare relies primarily on grounds other than consent. Explicit consent is requested only for activities outside those grounds that are not essential to healthcare, such as sharing treatment images for information purposes, providing information to private health insurers or communicating through instant messaging applications. Healthcare is never conditional on giving explicit consent.

2.3. Conditions for Processing Special Categories of Personal Data

Article 6 of the KVKK identifies certain data as special categories because unlawful processing risks harm or discrimination. Providing oral and dental healthcare requires processing patients' health data. Under Article 6, as amended by Law No. 7499, processing special categories is prohibited as a rule. Our Practice processes them only after taking the adequate measures determined by the Board and in the following circumstances:

  • Where necessary for protecting public health, preventive medicine, medical diagnosis, treatment and care, or planning, managing and financing healthcare, by persons subject to confidentiality duties (the dentist and Practice staff) (KVKK Article 6/2-e). This is the principal ground for processing patients' health data.
  • Express provision by law (KVKK Article 6/2-b): duties such as keeping patient records and notifying the central health data system of the Ministry of Health.
  • Necessity to protect the life or physical integrity of a person unable to consent due to actual impossibility or whose consent is not legally valid, or of another person (KVKK Article 6/2-c): emergencies.
  • Necessity for the establishment, exercise or protection of a right (KVKK Article 6/2-d): evidence and defence in disputes.
  • Necessity to fulfil legal obligations in employment, occupational health and safety, social security, social services and social assistance (KVKK Article 6/2-f): employees' health data.
  • The data subject's explicit consent (KVKK Article 6/2-a): processing outside the above conditions.

As a rule, our Practice does not process data on race, ethnic origin, political opinions, philosophical beliefs, religion, denomination, appearance and dress, association, foundation or trade-union membership, sexual life, criminal convictions, or biometric and genetic data. In addition to this Policy, the Policy on Processing and Security of Special Categories of Personal Data applies; it is based on Board Decision No. 2018/10 of 31 January 2018 on adequate measures for processing special categories of personal data.

2.4. Informing Data Subjects

Under Article 10 of the KVKK and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, data subjects are informed at collection about the controller's identity, processing purposes, recipients and transfer purposes, collection methods and legal grounds, and Article 11 rights. Layered notices are provided in patient registration forms, website appointment and contact forms, at the Practice and in employment processes. Where explicit consent is needed, informing the data subject and obtaining consent are carried out separately.

2.5. Obtaining Explicit Consent

Explicit consent must be specific, informed and freely given. The Practice obtains it in writing or electronically, separately for each purpose and in a provable manner. Consent is not a prerequisite for healthcare. Data subjects are told they may withdraw consent at any time, and withdrawals are acted on without delay. Consent to use before-and-after treatment images for information purposes is obtained together with the Visual Content Recording and Processing Consent Form required by the Regulation on Promotion and Information Activities in Health Services.

PART 3: DATA SUBJECT GROUPS, DATA CATEGORIES AND PROCESSING PURPOSES

3.1. Data Subject Groups

People whose personal data are processed at our Practice are grouped as follows:

  • Patient: a natural person who receives or has received oral and dental healthcare from the Practice.
  • Patient relative, parent or guardian: a legal representative, accompanying person or person whom the patient wishes to be informed.
  • Prospective patient (appointment requester): a natural person requesting an appointment or information through our website, telephone, email, instant messaging or social media.
  • Website user: a natural person visiting the website or using online forms.
  • Visitor: a natural person visiting the Practice for any purpose.
  • Employee or job applicant: a natural person working at the Practice, applying for employment or submitting a CV for consideration.
  • Supplier or business partner employee/representative: a natural person who is an employee, representative or shareholder of a dental laboratory, digital manufacturing centre, IT provider, accountant or other supplier.
  • Other third party: another natural person connected with the above whose data are processed, such as an emergency contact.

3.2. Personal Data Categories

Personal data processed by our Practice are classified as follows:

  • Identity data: information in identity documents, such as name, surname, Turkish identification number, nationality and passport number for foreign nationals, birth date, sex and signature.
  • Contact data: telephone number, email address, postal address and communication preferences.
  • Health data (special categories): medical history, systemic diseases, medication, allergies, pregnancy status, oral and dental examination findings, radiological images (periapical, panoramic, tomography), intraoral photographs and videos, digital impression and scan data, diagnosis, treatment plan, procedures performed, prescriptions, informed consent forms, laboratory and prosthetic records; for employees, pre-employment and periodic examination reports and health information required by occupational health and safety legislation.
  • Financial data: service fees, payment and professional-services receipt information, receivables and payables (card numbers are not retained).
  • Legal transaction and compliance data: contracts, informed consent and explicit consent forms, data subject requests, requests and complaints, dispute and correspondence records and official requests.
  • Transaction security data: website and online appointment access logs, IP address, date and time, browser and device information, user account and permission details.
  • Physical premises security data: video recordings where cameras are present in communal areas.
  • Visual and audio data: photographs and videos for treatment documentation.
  • Personnel, professional experience and performance data: for employees and job applicants, CVs, diplomas, certificates, work documents, payroll, leave, attendance and training records.
  • Appointment and patient transaction data: appointment date, time and reason, requests, questions and notes sent to the Practice and service history.

3.3. Processing Purposes

Our Practice processes personal data only within the conditions in Articles 5(2) and 6(2) of the KVKK for these purposes:

  • Providing oral and dental healthcare: examination, diagnosis, treatment planning, treatment, reviews and follow-up;
  • Keeping, backing up and retaining electronic patient records under the Regulation on Private Healthcare Institutions Providing Oral and Dental Health Services;
  • Making statutory notifications to the Ministry of Health's central health data and registration/notification systems;
  • Receiving, assessing, confirming, reminding, changing and cancelling appointments, and communicating with patients;
  • Laboratory and digital manufacturing processes for dentures, crowns, bridges, clear aligners, implant superstructures and similar devices;
  • Collecting service fees, issuing receipts for professional services and fulfilling accounting and tax obligations;
  • Measuring patient satisfaction, following up requests and complaints and improving service quality;
  • Ensuring safety of the Practice, patients and employees and securing premises;
  • Information security, access permission management, operation and security of the website and online appointment system;
  • Fulfilling legal obligations, informing competent persons and authorities, handling legal affairs and disputes;
  • Forming, performing and terminating employment contracts; personnel, payroll, leave, occupational health and safety and social security processes; recruitment of job applicants;
  • Managing supplier and business partner contracts and the supply chain;
  • Using treatment images for education, scientific studies and information to the extent permitted by legislation and with the patient's explicit consent;
  • Retention and archiving, and responding to data subject requests.

Considering the prohibition of overt or covert healthcare advertising under the Regulation on Promotion and Information Activities in Health Services, the Practice does not process personal data for advertising or marketing. Patients receive only legally permitted information and reminders, based on explicit consent where necessary. People are not called or sent messages or emails for promotion or marketing. Necessary appointment and treatment notifications rely on contract performance and legitimate interests.

3.4. Specific Provisions on Employee Data

Under Article 419 of the Turkish Code of Obligations No. 6098, without prejudice to the KVKK, employee data are processed only insofar as relevant to suitability for work or necessary for performing the employment contract. Processing fulfils obligations under Labour Law No. 4857, Social Insurance and General Health Insurance Law No. 5510, Occupational Health and Safety Law No. 6331, the Regulation on Private Healthcare Institutions Providing Oral and Dental Health Services (work documentation and Ministry registration), and tax legislation. Health data are processed under Article 6(2)(f) of the KVKK only as necessary for employment and occupational health and safety obligations and by persons subject to confidentiality. Data on race, ethnic origin, political opinions, philosophical beliefs, religion, denomination, appearance and dress, association, foundation or trade-union membership, sexual life, and biometric and genetic data are not processed unless expressly provided by law. Details appear in the Employee and Job Applicant Privacy Notice; employees undertake data protection obligations through the Employee Confidentiality and Personal Data Protection Undertaking.

PART 4: TRANSFERS OF PERSONAL DATA

4.1. Domestic Transfers

For lawful purposes and with necessary security measures, the Practice may transfer data to third parties under Article 8 of the KVKK on a ground in Article 5(2). Personal Data Protection Undertakings and contractual security provisions ensure processors act only on the Practice's instructions and within the stated purpose.

4.2. Recipient Groups

  • Ministry of Health, Provincial Health Directorate and affiliated units: statutory duties such as central health data notifications, inspections, work documentation and registration.
  • Dental prosthetic laboratories and digital manufacturing centres: only impression, scan, shade and design information necessary for manufacturing prostheses and other devices.
  • Radiology and imaging centres, consulting physicians and referral institutions: as required for diagnosis and treatment and with the patient's knowledge.
  • Accountant, Revenue Administration and other tax authorities: professional-services receipts, accounting and tax duties.
  • Social Security Institution, İŞKUR and other employment authorities: employee social security and employment obligations.
  • Banks and payment providers: only collecting payments and paying salaries.
  • IT providers (data processors): health information management systems, imaging software, online appointments, hosting, content delivery, security, email and backup services.
  • Private health insurers: only at the patient's request and with explicit consent.
  • Legal advisers, lawyers, mediators, courts, enforcement offices, public prosecutors, law enforcement, the Personal Data Protection Authority, Turkish Dental Association and affiliated Chamber: legal obligations and establishing, exercising and protecting rights.
  • Occupational health and safety providers and workplace physician: statutory obligations concerning employees.
  • Patient relatives, parents, guardians and authorised persons: to the extent permitted by the Patient Rights Regulation and Regulation on Personal Health Data.

4.3. Transfers of Special Categories of Personal Data

With adequate measures determined by the Board, the Practice transfers health data only where a condition in Article 6(2) applies, limited to the minimum needed for treatment, statutory notifications or protecting rights. Electronic transfers use encryption. Laboratories and manufacturers use patient codes instead of identities where possible. Paper documents are sent in sealed envelopes marked confidential.

4.4. Transfers Abroad

Our Practice generally processes and stores data in Türkiye. Under Article 9 of the KVKK, amended by Law No. 7499, and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, transfers may occur where an Article 5 or 6 processing condition applies and the Board has issued an adequacy decision for the destination country, its sectors or an international organisation. Without an adequacy decision, the data subject must be able to exercise rights and access effective remedies in the destination, and an appropriate safeguard must be provided: a Board-published standard contract, Board-approved binding corporate rules, a non-treaty agreement between foreign and Turkish public bodies authorised by the Board, or a written undertaking authorised by the Board. Standard contracts must be notified to the Authority within five working days of signing.

If neither adequacy nor appropriate safeguards are available, transfers may occur only occasionally where: the data subject explicitly consents after information about possible risks; transfer is necessary to perform a contract with the subject or implement pre-contractual measures at their request; it is necessary to form or perform a contract between the controller and another person in the subject's interests; it is necessary for an overriding public interest; it is necessary to establish, exercise or protect a right; it is necessary to protect the life or physical integrity of someone unable to consent due to actual impossibility; or data are transferred from a register open to the public or people with legitimate interests. In our Practice, transfers abroad are limited to overseas IT services (email, hosting, content delivery and security), communication through overseas instant messaging at the patient's choice, and sending digital impressions and images to overseas manufacturers or laboratories when treatment requires it. The above rules apply to these transfers.

PART 5: RETENTION AND DISPOSAL OF PERSONAL DATA

Under Article 7 of the KVKK, Article 138 of the Turkish Criminal Code and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, the Practice deletes, destroys or anonymises lawfully processed data on its own initiative or on request when the reasons for processing cease. Retention follows statutory periods or, where none are prescribed, the period necessary for the purpose, considering limitation periods needed for evidence. Patient records are retained for twenty years after the last examination or treatment, taking healthcare legislation and limitation periods into account. Our Personal Data Retention and Disposal Policy specifies periods, disposal methods and cycles.

PART 6: RIGHTS OF DATA SUBJECTS

6.1. Data Subject Rights

People whose data are processed by the Practice have the following Article 11 rights:

  • To learn whether their personal data are processed;
  • To request information about processing;
  • To learn the purpose and whether data are used in accordance with it;
  • To know third-party recipients in Türkiye or abroad;
  • To request correction of incomplete or inaccurate data;
  • To request deletion or destruction under Article 7;
  • To request notification of rectification, deletion or destruction actions to third-party recipients;
  • To object to a result against them arising from analysis exclusively by automated systems;
  • To seek compensation for damage caused by unlawful processing.

Patients also have rights under the Patient Rights Regulation to request health information, inspect records and seek correction, and under the Regulation on Personal Health Data to determine to whom their health data may be disclosed.

6.2. Exercising Rights and Submitting Requests

Data subjects may exercise the above rights by completing the Data Subject Request Form on our website and delivering a handwritten-signed request in person or through a notary to Sırakapılar Mahallesi, Gazi Bulvarı, 1581 Sokak, No: 1, Daire: 28, Merkezefendi / Denizli; sending a request signed with a secure electronic or mobile signature to info@alpbulgur.com; or emailing info@alpbulgur.com from an email address previously provided and registered in our system.

Requests are concluded free of charge as soon as possible and within thirty days. Additional costs may be charged under the Board's tariff. Requests must include full name, signature for written requests, Turkish identification number (for foreigners, nationality, passport number or identification number if any), residential or business address for service, email address for notifications if any, telephone number and subject. Relevant information and documents must be attached. Additional identity documents may be requested for health data so that only entitled persons receive information. Requests for another person require a notarised power of attorney or proof of parental authority or guardianship.

If a request is rejected, inadequately answered or not answered in time, a complaint may be made to the Board within thirty days of learning of the response and in any event within sixty days of the request. The request procedure with the Practice must be exhausted before complaining to the Board.

PART 7: ENSURING PERSONAL DATA SECURITY

7.1. Our Data Security Obligations

Under Article 12 of the KVKK, the Practice takes all necessary technical and organisational measures for appropriate security to prevent unlawful processing and access and safeguard personal data. Board Decision No. 2018/10 and the Regulation on Personal Health Data also apply to health data security.

7.2. Technical Measures

  • Patient records are kept in health information management software registered in the Ministry of Health's registration system and regularly backed up securely.
  • Systems require a username and strong password; multi-factor authentication is used for remote access and where supported.
  • Access rights are limited by role and removed immediately on changes of authority or departure.
  • Current antivirus and firewall software is used; operating-system and application security updates are applied regularly.
  • Electronic media and backups with special categories of data are cryptographically protected; access and operations are securely logged.
  • The website and online appointment system use HTTPS/TLS; security services and access logging help prevent unauthorised access and misuse.
  • Electronic health data transfers use encrypted email, secure file transfer or encrypted connections; portable media are encrypted.
  • Unused media and devices are not disposed of until data have been irretrievably erased.

7.3. Organisational Measures

  • Before starting work, employees sign the Employee Confidentiality and Personal Data Protection Undertaking and receive regular training on data protection and patient privacy.
  • Data protection undertakings are agreed with suppliers and processors and data security clauses are added to contracts.
  • A processing inventory and access authorisation matrix are prepared and kept current.
  • Physical documents such as patient files, radiographs and consent forms are kept in locked cabinets. Examination rooms protect privacy; patient information at reception and in waiting areas is handled so third parties cannot hear or see it.
  • Physical locations are secured against fire, flooding, theft and similar risks; unauthorised access is prevented.
  • Data are minimised where possible and expired data are disposed of during periodic cycles.
  • A breach notification and management procedure is in place; employees must immediately report suspected breaches to the dentist.
  • Compliance with this Policy and related procedures is reviewed and audited regularly.

7.4. Monitoring Data Processors

Where necessary, the Practice audits or commissions audits of processor compliance with the KVKK and undertakings, requires deficiencies to be remedied and may terminate contracts if they are not.

7.5. Personal Data Breach Management

If personal data are obtained unlawfully by others, the Practice notifies the Board within 72 hours of learning of the breach under Article 12(5) of the KVKK and Board Decision No. 2019/10 of 24 January 2019. Affected persons are notified as soon as reasonably possible after identification. All details, effects and measures are recorded.

PART 8: DATA CONTROLLERS REGISTRY (VERBİS)

Under Board Decision No. 2025/1572 of 4 September 2025 (Official Gazette No. 33034 of 1 October 2025), controllers whose main activity is processing special categories of data are exempt from registration if their annual employee count is below 10 and annual balance-sheet total below TRY 10 million. The Practice is exempt while meeting these criteria; if exceeded, registration is completed within thirty days after the obligation arises. This does not remove other duties, such as informing data subjects, security, retention and disposal, and responding to requests.

PART 9: ENTRY INTO FORCE AND UPDATES

This Policy enters into force on publication on the website. Amendments take effect when published in the same way. The Practice reviews and updates it as necessary following legislative changes, Board and court decisions and changes to processes, practices and systems. The current version is always the one on our website.

Data Controller: Dentist Hamdi Alp Bulgur (an oral and dental health practice operating under the trade name "Alp Bulgur Diş Kliniği") — Address: Sırakapılar Mahallesi, Gazi Bulvarı, 1581 Sokak, No: 1, Daire: 28, Merkezefendi / Denizli — Telephone: +90 532 240 93 19 / +90 258 261 84 36 — Email: info@alpbulgur.com — Website: alpbulgur.com