Privacy Policy and KVKK Data Protection Notice

1. Identity of the data controller

Article 10 of the KVKK requires us to tell you plainly which organisation processes your personal data. The data controller for this website and for the enquiry form on it is the organisation identified below.

The registration details below must be completed in full before this notice is published. Every field left blank means that the duty to inform has not been discharged as a matter of law.

• Address for service: Levent Mah. Büyükdere Cad. No:72, 34330 Beşiktaş / İstanbul
• Email: info@implant72.com
• Telephone: the clinic does not publish a telephone number. Written applications are accepted by email and by post.

2. What personal data we process

Every field we ask you to complete on the enquiry form, and the data category each one falls into, are set out below. The form has no hidden fields; nothing is collected from you beyond the fields you can see on screen.

Uploading X-rays and photographs is not compulsory. You can submit the form leaving only your contact details and uploading no files at all. In that case no preliminary assessment can be made and we will simply get in touch with you.

• Identity data: your first name and surname.
• Contact data: your telephone number, your email address and the country you live in.
• Preference data: the language you would like to speak in and the timeframe you have in mind for visiting the clinic (as soon as possible, within 1 month, 1 to 3 months, just researching for now).
• Health data (special category): the option you tick for the current condition of your teeth. These options include 'All of my teeth are missing', 'I am missing several teeth', 'I wear a removable denture', 'I have failed or old implants', 'I need full-arch implant treatment' and 'I am not sure yet'.
• Health data (special category): whether or not you have X-rays or photographs to hand.
• Health data (special category): the free text you choose to write in the message field. Any health information you enter there (medicines you take, systemic conditions, previous treatments) is processed as well.
• Health data (special category), in file form: the X-ray images and intra-oral photographs you upload. The form accepts a maximum of 3 files; JPG, PNG, WEBP and PDF formats are supported, with an upper limit of 8 MB per file. These files are technically uploaded to our server and forwarded to the system in which clinic enquiries are collected.
• Transaction security data: the date and time your enquiry was received and the language version of the site on which you completed the form (for example tr, en, de). In addition, as on every website, the hosting infrastructure keeps server access logs; those logs may contain technical data such as your IP address.
• The form contains a control field that is not visible on screen, used to filter out automated submissions by bots. This field collects no information from you; if it is filled in, the enquiry is not processed.

3. Your health data is special category data and is processed on the basis of your explicit consent

Article 6 of the KVKK classifies health data as a special category of personal data. It is a category recognised as capable of causing harm or discrimination to the individual if it is disclosed without authorisation. Your X-ray, your intra-oral photograph and what you tell us about the condition of your teeth all fall within it.

For the data collected through this website, before any patient relationship has been established between you and the clinic, the legal basis we rely on is your explicit consent. Explicit consent is consent relating to a specific matter, given on an informed basis and expressed by free will. This notice is that information.

You are under no obligation to give explicit consent, and no adverse consequence will follow for you if you do not. If you do not consent, your health data is not processed; you can write directly to info@implant72.com to get in touch with the clinic.

The explicit consent statement you are asked to approve reads as follows: you declare that you consent to your health data, including your X-ray images, your intra-oral photographs and the information about the condition of your teeth, being processed for the purpose of carrying out a preliminary suitability assessment and contacting you, and being transferred to service providers in Turkey and abroad solely for and limited to that purpose.

4. How and on what legal basis we collect your personal data

Your data is collected entirely by automated means, through the electronic form that you complete on the site of your own accord. When you submit the form, the information is first sent to the implant72.com server and from there transferred to the automation system in which clinic enquiries are collected. Beyond that, we do not gather data about you from third parties and we do not buy data.

The legal bases we rely on when processing your data differ according to the type of data:

• First name, surname, telephone, email and country: Article 5(2)(c) of the KVKK, processing being directly related to the conclusion or performance of a contract, and Article 5(2)(f), our legitimate interest in being able to respond to your request.
• Health data, your statement about the current condition of your teeth and the X-rays and photographs you upload: your explicit consent under Article 6 of the KVKK.
• If treatment begins at the clinic, your health data continues to be processed as part of the provision of medical diagnosis, treatment and care services, by healthcare staff bound by a duty of confidentiality and within the framework of the applicable legislation.
• Retention of enquiry and treatment records and the provision of information to competent public authorities: Article 5(2)(a) of the KVKK, where processing is expressly provided for by law, and Article 5(2)(ç), where processing is necessary for compliance with our legal obligation.
• Keeping the site and the form secure and preventing misuse: our legitimate interest under Article 5(2)(f) of the KVKK.

5. The purposes for which we process your personal data

We use the data we collect only for the purposes set out below. Should any use arise outside these purposes, you will be informed separately and, where necessary, your explicit consent will be sought again.

• Carrying out a preliminary suitability assessment for implant treatment on the basis of the X-rays, photographs and information you send.
• Sharing the outcome of that assessment and the possible treatment options with you and answering your questions.
• Preparing information on the treatment plan, its duration and its cost if you are found to be suitable.
• Scheduling your clinic appointment and, if you are travelling from abroad, coordinating the timetable for your visit.
• Enabling us to communicate with you in the language you prefer.
• Keeping records of enquiries and handling your requests and complaints.
• Preventing misuse of the form and automated bot submissions and keeping our systems secure.
• Meeting the retention, notification and reporting obligations imposed by legislation.
• As at the date this notice was prepared, your data is not used for advertising profiling and is not sold to third parties. No decision that directly concerns you is taken solely on the basis of analysis by automated systems; the preliminary assessment is made by a dentist.

6. Who we transfer your personal data to

The technical route by which your enquiry reaches the clinic team is itself a transfer: when you submit the form, the fields you have completed and the files you have uploaded are sent to the automation or customer relationship management (CRM) system in which clinic enquiries are collected. That system acts as a data processor on behalf of the clinic and may not use your data for its own purposes.

The parties to whom your data is transferred, and the reason for each transfer, are set out below. The company names and server locations in this list must be completed before this notice is published; as a data subject, knowing who your data is transferred to is a right you hold under Article 11 of the KVKK.

• Clinic staff and the dentists carrying out the assessment: only those individuals granted access because their duties require it.
• Competent public authorities and judicial bodies: only where they are legally empowered to request information and documents, and limited to the scope of the request.

7. Transfers of your data abroad

Some of the technical infrastructure providers we use may have servers outside Turkey. In that case your personal data is deemed to have been transferred abroad, and the transfer is subject to the conditions in Article 9 of the KVKK.

Under the Law, a transfer abroad may be made to a country in respect of which the Personal Data Protection Board has issued an adequacy decision; where there is no adequacy decision, the transfer may be carried out on the basis of one of the appropriate safeguards, such as a standard contract, binding corporate rules or a written undertaking; and in incidental cases where none of those safeguards is available either, the transfer is based on the data subject's explicit consent to that transfer.

Transfers abroad of the health data collected from you on this site are made within the framework of the legal mechanism we use and within the scope of your explicit consent. The countries to which data is transferred, and the basis for the transfer, are set out below.

8. How long we keep your personal data

Your personal data is kept for as long as is necessary for the purpose for which it is processed and for the minimum retention periods laid down by the applicable legislation. Once the period expires, your data is deleted, destroyed or irreversibly anonymised.

The periods below must be completed in line with the clinic's Personal Data Retention and Destruction Policy. Stating a period in this notice that is not in fact applied would amount to giving the data subject false information.

9. The measures we take to keep your data secure

We are conscious that we collect health data, and the specific technical measures we take are set out below. Even so, no technical measure offers absolute security; we would like you to have that in mind when you decide whether to send us your X-ray.

• Site and form traffic is carried over an encrypted connection (HTTPS).
• The file types and sizes that may be uploaded are checked in the browser and then checked again on the server; only JPG, PNG, WEBP and PDF files are accepted and a limit of 8 MB per file applies. A maximum of 3 files is processed.
• If the system your enquiry is to be delivered to has not been configured, the form does not show you a false success message; it displays a clear error message instead. That way a lost enquiry does not go unnoticed by you.
• Transmission to the clinic enquiry system is protected by an authorisation key.
• In the event of a data breach, the matter is reported to the Personal Data Protection Board and to the data subjects affected as soon as possible, in accordance with Article 12 of the KVKK.

10. Cookies and site usage data

The site separates its language versions by means of the language prefix in the address bar (for example /tr/, /en/, /de/). For that reason no marketing cookie infrastructure is needed in order to remember your language.

As at the date this notice was prepared, the site code contains no advertising, analytics, heat mapping or social media tracking script. The cookies used are limited to the strictly necessary cookies required for the site to work and for language routing.

If a non-essential cookie or an analytics tool is added later, this section will be updated and your consent will be sought before any cookie is placed on your browser. We do not state cookie names and lifetimes on the basis of assumptions; the list below will be completed after an audit carried out in the browser.

• You can delete or block cookies from your browser settings. If you block strictly necessary cookies, some parts of the site may not work as expected.

11. If you send information or images belonging to someone else

You may complete the form on behalf of a relative and upload their X-ray or photograph. If you do, it is you who transfers that person's health data to us.

Before making such a submission, you must inform the person concerned of what this notice contains and obtain their explicit consent to the processing of their health data. By submitting the form you are deemed to declare that you have given that information and obtained the necessary consent.

The person whose data is shared has every right listed in this notice and may apply to us directly to ask for their data to be erased.

12. Children's personal data

This form is intended for people over the age of 18. If an enquiry is to be made on behalf of a person under the age of eighteen, the form must be completed by a parent or legal guardian and the explicit consent must be given by that parent or guardian.

Where we establish that data belonging to a person under the age of eighteen has been submitted without the approval of a parent or guardian, that data is destroyed unless we are legally obliged to keep it.

13. Your rights under Article 11 of the KVKK

By applying to the data controller, you may exercise the following rights in relation to your personal data:

• To learn whether your personal data is being processed.
• To request information about the processing if your personal data has been processed.
• To learn the purpose of the processing of your personal data and whether the data is used in accordance with that purpose.
• To know the third parties in Turkey or abroad to whom your personal data has been transferred.
• To request that your personal data be rectified if it has been processed incompletely or inaccurately.
• To request that your personal data be erased or destroyed under the conditions laid down in Article 7 of the KVKK.
• To request that any action taken in response to your rectification, erasure or destruction requests be notified to the third parties to whom your personal data has been transferred.
• To object to an outcome to your detriment that arises from your processed data being analysed exclusively by automated systems.
• To claim compensation for any loss you suffer because your personal data has been processed unlawfully.

14. How to exercise your rights

You can send us the requests above in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller. You can apply in the following ways: by sending a written application bearing your wet signature to our address; by writing to info@implant72.com from the email address you have previously notified to us and which is registered in our system; by using a secure electronic signature or a mobile signature; or by writing to our registered electronic mail (KEP) address.

Your application must contain the information below. We ask for it in order to verify that the request genuinely comes from you; we cannot disclose health data in response to a request whose originator we are unable to identify.

Your application will be concluded as soon as possible, depending on the nature of your request, and in any event within thirty days at the latest. No fee is charged where the action involves no separate cost; where a cost is involved, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

If your application is refused, if you find our response inadequate or if no response is given within the time limit, you have the right to lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and, in any event, within sixty days of the date of your application. The Board's application channels are set out at kvkk.gov.tr.

• Your first name and surname and, in a written application, your signature.
• For citizens of the Republic of Turkey, your Turkish identity number; for foreign nationals, your nationality, passport number or identity number if you have one.
• Your place of residence or business address for the service of notices.
• Your email address, telephone number and fax number for notification purposes, if you have them.
• A clear statement of the subject of your request, with any relevant information and documents attached to the application.
• Address for electronic applications: info@implant72.com

15. You can withdraw your explicit consent

You may withdraw the explicit consent you have given to the processing of your health data at any time, without giving any reason. It is enough to write to info@implant72.com or to send a written application to the address above.

When you withdraw your consent, the processing based on that data stops, and your health data together with the X-rays and photographs you have uploaded is destroyed, apart from anything we are legally obliged to keep. A withdrawal takes effect for the future; it does not invalidate processing lawfully carried out before you notified us.

If treatment has already begun, healthcare legislation may require the medical records to be kept. In that case the records are held solely within the scope of that statutory retention obligation and are not used for preliminary assessment or for contacting you.

16. Governing law and competent authority

This notice has been prepared within the framework of the Personal Data Protection Law No. 6698 (KVKK) and the related secondary legislation. Turkish law applies to any dispute arising from the processing of your data.

If you are resident in the European Union or the United Kingdom, the GDPR may give you equivalent rights, including the right to lodge a complaint with your local supervisory authority; that does not alter the fact that the processing described here is governed by the KVKK.

17. Changes to this notice

We may update this notice because legislation changes, because the service providers we use change or because our processing activities are updated. The current version is always published on this page.

If a change is made that widens the scope of your explicit consent, your consent will be sought separately for the new processing activity; saying nothing does not count as approval.

18. Clinical disclaimer

Suitability becomes clear only after a clinical examination, an assessment of your X-rays and treatment planning. This site promises neither zero risk nor a guaranteed outcome.

Completing the form does not mean that a diagnosis has been made or that a treatment relationship has been established between us. An assessment based on the images you send is a preliminary review and is no substitute for a clinical examination.