Privacy Policy

DENTAKAY ORAL AND DENTAL HEALTH SERVICES LTD. CO.

CLARIFICATION TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

Dentakay Oral and Dental Health Services Limited Company ("Dentakay" or the "Company") attaches the utmost importance to the privacy and security of the personal data of its patients, prospective patients, visitors, and business partners. In our capacity as Data Controller under the Personal Data Protection Law No. 6698 ("KVKK" or the "Law"), we process, record, and store your personal data within the scope explained below in accordance with the Law and the rules of good faith, and transfer it to third parties only in the cases permitted by legislation.

This Privacy Notice applies to all personal-data processing activities carried out across every Dentakay clinic (Nish Istanbul, Şişli, Antalya, Ankara, and others), our websites (www.dentakay.com and subdomains), our call centres, and all other communication channels through which we interact with you. As Dentakay provides services to patients from Turkey and abroad, we also take into account internationally recognised data protection principles, including transparency, data minimisation, purpose limitation, confidentiality, security, accountability, and respect for data subject rights where relevant.

1. Categories of Personal Data We Process

Owing to the nature of the healthcare and health-tourism services we provide, the data you declare to us or that we obtain through automatic and semi-automatic means during the delivery of our services are processed under the following categories:

2. Purposes of Processing Your Personal Data

Your personal data is processed for the specific purposes set out below, in accordance with the fundamental principles established in Articles 4, 5, and 6 of the KVKK and on the basis of the principle of data minimisation.

A. Provision of Medical Diagnosis, Treatment, and Care Services

Your health data and identity information are processed in order to perform oral and dental-health examinations, establish diagnoses, prepare treatment plans, carry out surgical and aesthetic dentistry applications, produce and fit dental prostheses in a laboratory environment, supply medicines and materials, and manage post-treatment follow-up. Final medical diagnosis, treatment decisions, and clinical recommendations are made by authorised healthcare professionals within the appropriate clinical process. This activity is our primary function under the Basic Law on Health Services No. 3359 and Decree-Law No. 663.

B. Pre-Treatment Enquiries and Remote Communication

When you contact us through remote channels, including website forms, WhatsApp, our call centre, e-mail, SMS, and social media, your identity, contact, and any information you choose to share are processed for pre-treatment enquiries, pre-treatment assessment, treatment-option clarification, appointment planning, and clinical-evaluation preparation. Information exchanged through these channels supports and prepares for care; it does not constitute a final diagnosis. Remote communication does not replace an in-person examination where one is required, and any definitive clinical decision is made by an authorised healthcare professional following the appropriate clinical process.

C. Health-Tourism and Operational Logistics

For patients travelling to us from within Türkiye and from abroad, identity, contact, and travel data are processed in order to organise airport-hotel-clinic transfers, arrange accommodation, support visa procedures (including the issuing of invitation letters), and provide translation services.

D. Fulfilment of Legal and Administrative Obligations

Your data is processed to meet notification obligations (E-Nabız, USS, and similar) arising under the legislation of the T.R. Ministry of Health, Provincial Health Directorates, the Social Security Institution (SGK), and other relevant public authorities; to issue invoices, make tax payments, and complete financial reconciliations; and to retain patient files for the periods required by law, in accordance with the Regulation on Private Hospitals and related legislation.

E. Patient-Relations Management and Service Quality

Your data is processed to send appointment reminders (by SMS, telephone, and e-mail), conduct patient-satisfaction surveys, evaluate requests and complaints, and deliver call-centre services in line with our quality standards.

F. Promotion and Marketing Activities (Subject to Explicit Consent)

Subject to your separate explicit consent, your data may be processed to provide personalised treatment suggestions, inform you about new services and campaigns, and share success stories (before/after images) on our website and social-media channels. The use of health data for marketing purposes, the sharing of before/after visuals and patient testimonials, and the sending of commercial communications are each carried out only on the basis of your separate, freely given explicit consent, which you may withdraw at any time.

3. Methods and Legal Grounds for Collecting Your Personal Data

Your personal data is collected in oral, written, visual, or electronic form through our clinics, websites (dentakay.com and its subdomains), mobile applications, call centres, e-mail, SMS, and WhatsApp lines, social-media platforms (including Facebook, Instagram, and LinkedIn), and our authorised business partners (such as health-tourism agencies). Where these channels are used for remote contact, information is gathered for pre-treatment enquiries, appointment planning, and clinical-evaluation preparation, as described in Section 2(B).

• Express Provision in Law: Ministry of Health legislation, the Tax Procedure Law, the Labour Law, and similar regulations.
• Performance of a Contract: Fulfilling the requirements of the treatment and service relationship established between you and Dentakay.
• Actual Impossibility of Obtaining Consent: Protecting the life of a patient who is unconscious or otherwise unable to express consent.
• Compliance with a Legal Obligation: Enabling Dentakay to meet its statutory responsibilities relating to notification, retention, and security.
• Medical Diagnosis and Treatment (KVKK Art. 6/3): The processing of health data by our physicians, who are bound by an obligation of confidentiality, for the purpose of delivering treatment and care.
• Legitimate Interests of the Data Controller: Appointment tracking, ensuring the physical security of our clinics (CCTV recording), and improving our processes, provided this does not harm your fundamental rights and freedoms.
• Explicit Consent: Obtained separately for specific activities such as marketing, the sharing of treatment visuals and testimonials, and the transfer of data abroad.

4. Transfer of Your Personal Data

To achieve the purposes described above, and in accordance with Articles 8 (domestic transfer) and 9 (international transfer) of the KVKK, your personal data may be shared with the following recipient groups, limited in each case to the data necessary for the relevant purpose:

• Official Institutions and Authorities: The T.R. Ministry of Health, Provincial Health Directorates, the General Directorate of Security, courts and enforcement offices, tax offices, and the SGK, within the scope of legal obligations.
• Medical Business Partners: DentakayLabs (for prosthesis production), external laboratories, pathology centres, consulting specialist physicians, and imaging centres.
• Operational Suppliers: Information-technology infrastructure providers, database and server-service providers, financial advisers, law firms, and translation offices.
• Tourism and Logistics Partners: Contracted hotels and transfer companies, limited to the identity and location information strictly required to arrange accommodation and transport.
• International Recipients (Transfer Abroad): The patient's own insurer, Dentakay's overseas liaison offices (such as London and Riyadh, for coordination purposes), and the overseas servers of the global technology providers we use (such as Google, Meta, and WhatsApp). International transfers are carried out in accordance with Article 9 of the Law, on one of the following bases: (i) your explicit consent; (ii) transfer to a country for which the Board has declared that adequate protection exists; or (iii) a written undertaking of adequate protection by the data controllers in Türkiye and the relevant foreign country, together with the authorisation of the Board (through the signing of Standard Contracts).
• Mobile Messaging Privacy: Mobile information and text messaging opt-in data will not be shared with, sold to, or disclosed to any third parties, affiliates, or partners for marketing or promotional purposes. SMS consent is not shared with third parties. We use your mobile number solely to provide the messaging services you have requested or consented to receive.

5. Data Security, Patient Privacy, and Confidentiality

Dentakay is committed to protecting your personal data, and in particular your health data, against loss, theft, unauthorised access, alteration, and disclosure. To this end, we maintain a layered programme of administrative, physical, and technical safeguards and continuously review it in line with legal requirements and internationally recognised healthcare privacy and information-security standards.

Confidentiality and Authorised Access

Access to personal data and medical records is restricted to authorised personnel who require such access to carry out their professional duties. Access rights are granted on the basis of role-based authorisation and are reviewed on a regular basis. All members of our workforce are bound to preserve the confidentiality of patient information, both during and after their engagement with Dentakay.

Accuracy and Integrity of Medical Records

We take reasonable measures to ensure that personal and medical information is accurate, complete, and up to date, and that it is maintained in a manner that supports the continuity, quality, and safety of patient care. Records are protected against unauthorised alteration, deletion, or disclosure.

Access Monitoring and Audit Logs

Electronic access to patient records is protected through unique user authentication. System access and activity may be recorded in audit logs and monitored to verify compliance with applicable law, our internal policies, and our information-security requirements.

Physical, Administrative, and Technical Safeguards

We implement administrative, physical, and technical safeguards designed to protect personal data against unauthorised access, loss, alteration, destruction, and disclosure. Depending on the system and the sensitivity of the data concerned, these safeguards may include controlled physical access to premises and records, secure information systems, secure transmission methods, encryption where appropriate, role-based authorisation, regular backups, antivirus protection, firewall technologies, and periodic security assessments.

Workforce Confidentiality and Training

All employees, consultants, contractors, and third-party personnel who may access personal data are required to comply with confidentiality obligations and to receive appropriate training on privacy, information security, and data-protection requirements. Where we work with suppliers and processors, we apply due diligence and put in place contractual data-protection obligations before entrusting them with personal data.

Protecting Patient Privacy Throughout Care

We are committed to safeguarding your privacy at every stage of your care. Patient information is used, disclosed, or shared only for purposes permitted by applicable legislation, with your consent where required, or to meet a legal obligation. Every effort is made to preserve patient dignity, confidentiality, and privacy throughout registration, examination, diagnosis, treatment, communication, and record-management processes.

Personal Data Breach Management

Dentakay maintains procedures for identifying, assessing, managing, and responding to personal-data breaches. In the event of a breach, we implement the necessary corrective actions promptly and, where required by applicable legislation, notify the relevant authorities and the affected individuals.

Continuous Improvement

We periodically review our privacy and information-security practices to maintain ongoing compliance with legal requirements, international standards, and our own organisational policies. Improvements are introduced as needed on the basis of risk assessments, audits, incident reports, and technological developments.

6. Retention and Destruction of Your Personal Data

Your personal data is retained for the periods required by the relevant legislation, including the following:

• Patient Medical Records: 20 years from the end of treatment.
• Records of Deceased Patients: 30 years, in accordance with the amendment to the Regulation on Personal Health Data.
• Forensic-Case Records: For the applicable statutory limitation period (at least 20 years).
• CCTV Recordings: Approximately 2 months, depending on the recording device's capacity.
• Accounting Records: 10 years.

Data whose retention period has expired is deleted, destroyed, or anonymised periodically in accordance with the Dentakay Data Retention and Destruction Policy.

7. Your Rights as a Data Subject (KVKK Article 11)

As a data subject, you may exercise the following rights by applying to Dentakay:

• To learn whether your personal data is being processed;
• To request information where your data has been processed;
• To learn the purpose of processing and whether your data is used in accordance with that purpose;
• To know the third parties to whom your data is transferred, whether domestically or abroad;
• To request the correction of incomplete or inaccurate data;
• To request the deletion or destruction of your data within the framework of Article 7 of the KVKK;
• To request that any correction, deletion, or destruction be notified to the third parties to whom your data was transferred;
• To object to any outcome arising to your detriment from the analysis of your data solely by automated systems;
• To claim compensation for damage suffered as a result of the unlawful processing of your data.

8. How to Exercise Your Rights

You may submit requests concerning your rights by completing the "Data Controller Application Form" and delivering it through one of the following channels:

• In Writing: In person or via notary public to Çobançeşme Mah. Sanayi Cd. Nish İstanbul No: 44A Kat: 10, 34196 Bahçelievler / İstanbul.
• By Registered Electronic Mail: To dentakay@hs01.kep.tr.
• By E-Mail: To kvkk@dentakay.com, sent from the e-mail address registered in our system.

Your application will be concluded free of charge and as soon as possible, and in any event within thirty (30) days at the latest, depending on the nature of the request.

DENTAKAY COOKIE POLICY

Effective Date: 16 January 2026

1. Introduction and Purpose

As Dentakay Oral and Dental Health Services Ltd. Co. ("Dentakay"), we use cookies, pixels, local storage technologies, and similar tracking tools to improve your experience during your visit to our website (www.dentakay.com), to measure site performance, and to offer personalised content suitable for your interests. This policy has been prepared to inform you transparently about what these technologies are, how they are used, and how you can manage your preferences.

2. What is a Cookie?

Cookies are small data files that are recorded on your device (computer, tablet, mobile phone) through your browser when you visit a website and enable information exchange between the site server and your device. Cookies allow the website to remember you (for example, your language preference or session information) and contribute to the site working more efficiently.

3. Cookie Categories and Purposes of Use

The cookies used on the Dentakay website are collected in four main categories according to their purposes of use:

A. Mandatory (Strictly Necessary) Cookies

These cookies are essential for the technical operation of our website, ensuring security, and providing the basic services you request (page navigation, access to appointment forms, saving privacy preferences). These cookies are not used for marketing purposes and are not subject to your consent. If you block these cookies from your browser settings, some parts of the site may not work.

Examples: Session ID, CSRF security tokens, cookie consent status record.

B. Analytical and Performance Cookies

Help us understand how visitors use our website, measure traffic sources, and identify the most popular pages. Thanks to these cookies, we improve site performance and optimise user experience. The information collected is aggregate and anonymous; it does not directly identify you.

Services Used: Google Analytics 4, Hotjar.

Function: Number of visitors, bounce rate, time spent on the page, click maps (heatmap).

C. Functional Cookies

Enable our website to remember the choices you make (language preference, region, username, etc.) and provide you with more advanced, personalised features.

Example: Live Chat history, preferred currency.

D. Targeting and Advertising (Marketing) Cookies

These cookies are used to show you relevant advertisements on other websites or social media platforms (Facebook, Instagram, Google) based on your interests and browsing habits on our website. They can be placed by Dentakay and its advertising business partners. These cookies are only activated with your explicit consent (by clicking the "Accept" button). If you do not allow them, general content will be shown instead of advertisements specific to you.

Services Used: Meta (Facebook) Pixel, Google Ads Conversion Linker.

4. List of Specific Cookies Used on Our Website

The table below details the main cookies used on dentakay.com, their providers, and their retention periods:

5. Cookie Management and Changing Preferences

You can manage your preferences through the "Cookie Banner" that appears on your first entry to our website.

• Accept All: You allow all cookie categories.
• Settings / Manage Preferences: You can turn Analytical and Marketing cookies on and off separately.
• Decline: Only Mandatory cookies work, others are blocked.

You can change your preferences at any time by clicking the "Cookie Settings" link at the bottom of our website. Additionally, you can delete or block cookies using your internet browser's settings:

• Google Chrome: Settings > Privacy and Security > Cookies
• Mozilla Firefox: Options > Privacy and Security
• Safari: Preferences > Privacy
• Internet Explorer / Edge: Settings > Site Permissions

6. Data Controller Contact

For your questions regarding our cookie policy or your personal data, you can review our Clarification Text page or contact us at kvkk@dentakay.com.