Privacy Policy

1. Who we are (Data Controller)

Özel Key Smile Ağız ve Diş Sağlığı Polikliniği ("Key Smile", "we", "us") is the data controller (veri sorumlusu) responsible for the personal data described in this policy.

• Address: Erzene Mh. 31 Sk. No: 40-42A, Şehrin Evleri, Bornova / İzmir, Türkiye
• Email: info@keysmile.com.tr
• Phone: +90 (501) 539 35 35

Key Smile is a private oral and dental health polyclinic authorised by the Republic of Türkiye Ministry of Health and registered on the official Health Türkiye platform.

2. What data we collect

Depending on how you interact with us, we process the following categories:

• Identity data — name and surname; for patients who attend the clinic, date of birth and identification or passport number where required by health legislation.
• Contact data — phone number, email address, country of residence, and messages you send us by form, WhatsApp, email or social media.
• Health data — the reason for your enquiry, dental and medical history, clinical notes, X-rays and intraoral photographs, treatment plans and records. This is a special category of data and receives extra protection.
• Appointment and treatment data — appointment dates, treatment stages, and travel or accommodation details where we arrange them for you.
• Financial data — invoicing details and payment records. We do not store full card numbers.
• Technical data — IP address, approximate country derived from it, browser and device type, and pages visited. See our Cookie Policy.

You are free to decline to give us personal data, but we may then be unable to provide the treatment, quote or service you have asked for.

3. Why we use it, and our legal basis

Purpose	Legal basis (KVKK)	Legal basis (GDPR)
Answering your enquiry and preparing a treatment quote	Art. 5/2-c — necessary for a contract	Art. 6(1)(b) — pre-contractual steps
Delivering dental treatment and keeping your patient record	Art. 6/3 — protection of public health, preventive medicine, diagnosis and treatment by persons under a duty of confidentiality	Art. 9(2)(h) — health care, together with Art. 6(1)(b)
Appointment reminders and treatment follow-up	Art. 5/2-c — necessary for a contract	Art. 6(1)(b)
Invoicing, accounting and statutory record retention	Art. 5/2-a and 5/2-ç — legal obligation	Art. 6(1)(c) — legal obligation
Marketing messages about offers and new services	Art. 5/1 — your explicit consent	Art. 6(1)(a) — consent
Site security, fraud prevention and improving the website	Art. 5/2-f — legitimate interest	Art. 6(1)(f) — legitimate interest

Marketing is always separate. We only send you promotional messages if you have opted in, and commercial electronic messages to recipients in Türkiye are managed through the İYS (Message Management System). You can withdraw at any time using the unsubscribe link in the message or by emailing us — withdrawing does not affect your treatment.

4. Who we share it with

We never sell your personal data. We share it only where necessary, with:

• Treating clinicians and laboratories — dentists, specialists and dental laboratories involved in your treatment, all bound by professional confidentiality.
• Partner service providers — hotels, transfer and translation services, where you have asked us to arrange them.
• Technology providers — website hosting, email, messaging and IT support suppliers acting as our processors under contract.
• Professional advisers — accountants and lawyers, under a duty of confidentiality.
• Public authorities — the Ministry of Health, tax authorities, courts and other competent bodies where the law requires it.

5. International transfers

We treat patients from many countries, and some of our technology providers are based outside Türkiye. Where we transfer personal data abroad, we do so on one of the bases permitted by KVKK Art. 9 — an adequacy decision, appropriate safeguards such as standard contractual clauses notified to the Turkish Data Protection Authority, or your explicit consent.

For transfers of data from the EEA or the UK, we rely on Standard Contractual Clauses or another transfer mechanism recognised under GDPR Chapter V. You may request a copy of the safeguards in place by contacting us.

6. How long we keep it

• Patient files and health records — a minimum of 20 years after the last treatment, as required by Turkish health legislation.
• Enquiries that do not become treatment — up to 2 years from your last contact with us.
• Invoices and accounting records — 10 years, as required by tax and commercial law.
• Marketing consent records — until you withdraw consent, plus the limitation period for proving the consent was given.
• Website technical logs — up to 12 months.

At the end of these periods, data is deleted, destroyed or anonymised.

7. How we protect it

We apply the administrative and technical measures required by KVKK Art. 12: access controls limiting patient records to authorised clinical staff, encryption in transit, confidentiality undertakings from all staff and suppliers, secure storage of clinical images, regular backups, and staff training on data protection and patient confidentiality.

8. Your rights

Under KVKK Art. 11 you have the right to:

• learn whether we process your personal data, and request information if we do;
• learn the purpose of processing and whether it is used accordingly;
• know the third parties at home or abroad to whom your data is transferred;
• request correction of incomplete or inaccurate data, and ask us to notify third parties of the correction;
• request erasure or destruction of your data where the grounds for processing have disappeared;
• object to a result produced solely by automated analysis;
• claim compensation for damage caused by unlawful processing.

If the GDPR applies to you, you additionally have the rights of access, rectification, erasure, restriction, data portability, objection, and the right to withdraw consent at any time.

How to exercise them: write to us at info@keysmile.com.tr or at the clinic address above, in line with the Turkish Communiqué on Application Procedures to the Data Controller. We respond within 30 days at the latest. If you are not satisfied, you may complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EEA/UK, to your local supervisory authority.

9. Children

We treat patients under 18 only with the consent and involvement of a parent or legal guardian, and we process their data on that basis. This website is not directed at children.

10. External links

Our website links to sites we do not operate, such as social media platforms and the Health Türkiye registry. We are not responsible for their content or privacy practices — please read their own policies.

11. Changes to this policy

We may update this policy as our services or the law change. The current version is always published on this page with its update date. Material changes affecting how we use your data will be notified to you directly where we are required to do so.

12. Contact

Questions about this policy or about how we handle your data: info@keysmile.com.tr · +90 (501) 539 35 35 · Erzene Mh. 31 Sk. No: 40-42A, Şehrin Evleri, Bornova / İzmir, Türkiye.