--- title: Personal Data Protection and Processing Policy description: Kişisel Verilerin Korunması Kanunu (KVKK)’ Başvuru formuna kvkk.gov.tr adresinden ulaşabilirsiniz.  canonical: https://smileizmir.com/en/personal-data-protection-and-processing-policy clinic: SMİLE İZMİR – Estetik Ağız ve Diş Sağlığı Polikliniği contact: +905539355141 language: en published: 2026-07-16T06:04:10.786Z updated: 2026-07-17T06:44:53.793Z --- # Personal Data Protection and Processing Policy Kişisel Verilerin Korunması Kanunu (KVKK)’ Başvuru formuna kvkk.gov.tr adresinden ulaşabilirsiniz.  # Personal Data Protection and Processing Policy "You can access the Personal Data Protection Law (KVKK) application form at kvkk.gov.tr." The protection of personal data is among the most important priorities of “SMILE IZMIR DENTAL MEDICAL INDUSTRY AND TRADE LIMITED COMPANY”. The necessary sensitivity is shown regarding the security of personal data, and great importance is placed on patient privacy and the processing and preservation of all personal data belonging to our patients in the best possible way and with care. In addition to our patients, the protection of personal data of our companions, visitors, all our employees, and employees of the institutions and organizations with which we cooperate, in accordance with the Law No. 6698 on the Protection of Personal Data and the regulations and relevant legislation on the Processing of Personal Health Data and Ensuring Privacy, is adopted as a corporate policy within the framework of the following basic principles. • Processing personal data in accordance with the law and principles of fairness, • Keeping personal data accurate and up-to-date when necessary, • Processing personal data for specific, explicit and legitimate purposes, • Processing personal data in a manner that is relevant to, limited to, and proportionate to the purpose for which it is processed. • Retaining personal data for the period stipulated in the relevant legislation or for the period necessary for the purpose for which they are processed, • Informing and educating personal data owners, • Establishing the necessary system for personal data owners to exercise their rights, • Taking necessary measures for the preservation of personal data, • When transferring personal data to third parties in accordance with the requirements of the processing purpose, to act in compliance with the relevant legislation and the regulations of the Personal Data Protection Board, • Showing the necessary sensitivity in the processing and protection of special categories of personal data, • Deleting and destroying personal data in accordance with the law and within the defined timeframe. **Aim** The main purpose of this Policy is to provide explanations regarding the personal data processing activities and measures taken to protect personal data by “SMILE IZMIR DENTAL MEDICAL INDUSTRY AND TRADE LIMITED COMPANY” in accordance with the law, and to ensure transparency by informing individuals whose personal data is processed by our Clinic, primarily our patients, visitors, employees and institutional officials, employees, shareholders and officials of institutions with which we cooperate, and third parties. Personal data processed by “SMILE IZMIR DENTAL MEDICAL INDUSTRY AND TRADE LIMITED COMPANY” is collected through automated or non-automated methods, although this may vary depending on the healthcare services provided. This includes our patient representatives, physicians, healthcare professionals, other employees, subcontractors and their employees, and companies engaged in any kind of commercial activity; Special categories of personal data and general personal data, primarily health data collected verbally, in writing, or electronically through our call center, website, online services, and similar means, may be processed for the purposes listed below. Our services include: conducting medical diagnosis, treatment, and care services; protecting public health; planning and managing preventive healthcare services and their financing; informing patients about appointments; planning and managing our clinic's internal procedures; conducting analysis to improve healthcare services; training and developing our employees; protecting our employees' personnel processes and legal rights; monitoring and preventing abuse and unauthorized transactions; carrying out risk management and quality improvement activities; conducting research; fulfilling legal and regulatory requirements; billing for our services; verifying your identity; verifying your relationship with institutions contracted by our clinic; sharing any information requested by private insurance companies regarding the financing of healthcare services; responding to all your questions and complaints regarding our healthcare services; taking all necessary technical and administrative measures within the scope of data security for our clinic's systems and applications; analyzing your healthcare usage and storing your health data to improve and enhance the healthcare services we provide; and maintaining information regarding your health data that must be stored according to relevant legislation. We will ensure financial reconciliation regarding the healthcare services provided to you with our partner institutions, banks, and all organizations (public and private) from which healthcare expenses are collected; share the requested information with the Ministry of Health and other public institutions and organizations in accordance with the relevant legislation; measure patient satisfaction and improve patient satisfaction. Personal data is collected and processed in any verbal, written, or electronic medium for the purposes stated above and to ensure that healthcare services are provided within the defined legal framework, and that “INVISMILE ESTETİK DENTAL MEDİKAL SANAYİ VE TİCARET LİMİTED ŞİRKETİ” fulfills its contractual and legal obligations properly and completely. **Scope** This Policy covers the personal data of our patients, companions, visitors, institutional officials, employees, employees, shareholders and officials of individuals, organizations and institutions with whom we have cooperation and all kinds of legal relationships, and third parties, processed automatically or non-automatically, as defined below. Personal data includes: name, surname, Turkish Republic Identity Number, passport number or temporary Turkish Republic Identity Number, place and date of birth, gender, marital status, clinic-specific protocol number, and other identifying data for patients; contact data such as address, telephone number, email address, etc.; financial data such as payment and billing information; audio and digital information that can be obtained through electronic or non-electronic methods; general and special categories of personal data, primarily personal health data obtained during the performance of all medical diagnosis, examination, treatment, and care services; data relating to private health insurance and Social Security Institution data for the purpose of financing and planning health services; health and identity data sent via websites; and all visual (digital and non-digital) records. The scope of application of this policy may vary depending on the data subject groups. This could be the entire policy (e.g., our patients); or it could apply to only certain provisions (e.g., only our employees, suppliers, etc.). Personal data may also be processed when using call centers or websites to access online services, on the internal intranet, during training, participation in hospital-organized events, or when visiting websites. **Definitions** *Explicit Consent:* Consent given freely and based on informed knowledge regarding a specific matter. *Anonymization:*   This is the process of altering personal data in such a way that it loses its personal data status and this alteration is irreversible. For example, using techniques such as masking, aggregation, and data distortion to make personal data impossible to link to a specific individual. Employees, Shareholders, and Officials of Institutions with Which We Collaborate: This includes all individuals working for, as well as shareholders and officials of, institutions with which our clinic has any kind of business relationship (such as business partners and suppliers, but not limited to these). *Processing of Personal Data:* Any operation performed on personal data, such as obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of data, whether wholly or partly automated or non-automated, provided that it is part of a data recording system. *Data Subject:* The natural person whose personal data is being processed. For example, patients and employees. *Personal Data:* Any information relating to an identified or identifiable natural person. Therefore, the processing of information relating to legal entities is not covered by the Law. For example, name, surname, Turkish National Identity Number, e-mail, address, date of birth, credit card number, bank account number, etc. *Patient:* A person who visits our clinic for examination and treatment, and receives outpatient or inpatient treatment. Special Categories of Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are considered special categories of personal data. *Institution Official:* The General Manager of the institution and other authorized individuals. *Third Party:* To ensure the security of commercial transactions between our clinic and the aforementioned parties, or to protect the rights and interests of these individuals, third-party individuals (e.g., employees or authorized representatives of service providers, companions, etc.) are considered third parties related to these individuals. *Data Processor:* A natural or legal person who processes personal data on behalf of the data controller, based on the authorization given by the data controller. For example, the IT company that holds our clinic's data, all employees who enter patient data into the system. *Data Controller:* The person who determines the purposes and means of processing personal data and manages the place where the data is systematically stored (data recording system). *Visitor:* Individuals who have entered the physical premises of our clinic for various purposes or who have visited our websites. **Implementation of Policy and Related Legislation** The processing and protection of personal data are carried out within the framework of the relevant legal regulations in force. “SMILE IZMIR DENTAL MEDİKAL SANAYİ VE TİCARET LİMİTED ŞİRKETİ” Personal Data Protection Policy has been prepared in compliance with current regulations. This policy has been developed in accordance with the rules set forth by the relevant legislation and integrated with the practices of “SMILE IZMIR DENTAL MEDICAL INDUSTRY AND TRADE LIMITED COMPANY”. It is carrying out the necessary preparations in compliance with the effective dates stipulated in the Personal Data Protection Law. The personal data mentioned above may be processed, when necessary, within the framework of the provisions of legislation such as the Basic Law on Health Services No. 3359, the Decree Law No. 663 on the Organization and Duties of the Ministry of Health and its Affiliated Institutions, the Private Hospitals Regulation, the Regulation on the Processing of Personal Health Data and the Protection of Privacy, and Ministry of Health regulations, etc., and will be transferred to physical archives and information systems belonging to our clinic and/or our suppliers. Consequently, personal data will be protected in both digital and physical environments in accordance with the legal periods defined in the institution's procedures. **Ensuring the Security of Personal Data** Our clinic takes the necessary technical and administrative measures to ensure an optimal level of security to prevent the unlawful processing of personal data and to ensure the preservation of this data, and conducts or commissions the necessary audits in this regard. The actions and measures taken by our clinic to ensure "data security" in accordance with Article 12 of the Personal Data Protection Law are listed below. • Our clinic takes technical and administrative measures, considering technological capabilities and implementation costs, to ensure the lawful processing of personal data. Employees are informed that they cannot disclose personal data they learn to others in violation of the KVKK (Personal Data Protection Law) provisions, nor can they use it for purposes other than the processing purpose, and that this obligation continues even after they leave their positions. They are required to make the necessary commitments in this regard. • Our clinic takes technical and administrative measures to prevent the careless or unauthorized disclosure, access, transfer, or any other unlawful access to personal data. • Our clinic is raising awareness among data processing institutions, such as business partners and suppliers to whom we transfer personal data, regarding the prevention of unlawful processing of personal data, the prevention of unlawful access to data, and the lawful preservation of data. • Our clinic's obligations as the data controller when processing personal data, and the legal, administrative, and technical measures it has developed in this regard, are enforced through contracts with data processing institutions with which our clinic has relationships in various capacities such as suppliers and business partners, in a manner consistent with the nature of their data processing activities. • Our clinic conducts or commissions the necessary audits internally. The results of these audits are reported to the relevant department within the institution's internal procedures, and necessary activities are carried out to improve the measures taken. • In accordance with Article 12 of the Personal Data Protection Law, our clinic operates a system that ensures that if personal data processed is obtained by others through unlawful means, this situation is reported to the relevant personal data owner and the Personal Data Protection Board as soon as possible. **Data Subject Rights; Claiming Rights, Communication Channels and Evaluation of Data Subject Requests** Our clinic implements the necessary channels, internal procedures, administrative and technical arrangements in accordance with Article 13 of the Personal Data Protection Law to assess the rights of personal data owners and to provide them with the necessary information. If personal data owners submit their requests regarding the rights listed below to our Clinic in writing, in person, or with a specially authorized power of attorney, our Clinic will process the request free of charge as soon as possible, and at the latest within thirty days, depending on the nature of the request. Personal data owners; • To find out whether your personal data is being processed, • Requesting information regarding the processing of personal data, • To learn the purpose for which personal data is processed and whether it is being used appropriately for that purpose, • Knowing the third parties to whom personal data is transferred, whether domestically or internationally. • Requesting the correction of personal data if it has been processed incompletely or incorrectly. • Requesting the deletion or destruction of personal data, • Requesting that third parties to whom personal data has been transferred be notified of any corrections, deletions, or destructions of personal data. • The right to object to an outcome that is detrimental to oneself, resulting from the analysis of processed data exclusively through automated systems. • Individuals have the right to claim compensation for damages incurred as a result of the unlawful processing of their personal data. In accordance with Article 13, paragraph 1 of the Personal Data Protection Law, requests regarding the exercise of the rights mentioned above must be submitted to our Clinic (data controller) in writing. To exercise your rights under the Personal Data Protection Law (KVK), please submit your request to our clinic including the necessary identifying information and a description of the rights you wish to exercise, specifying which right under Article 11 of the Law you are exercising. This will ensure a faster and more effective response to your request. **Protection of Special Categories of Personal Data** “SMILE IZMIR DENTAL MEDICAL INDUSTRY AND TRADE LIMITED COMPANY” meticulously protects personal data using its technical and administrative capabilities. The security measures taken by our clinic are optimally implemented, considering technological possibilities and potential risks. A certain group of personal data is defined as "special categories of personal data" in the Personal Data Protection Law because of the risk that its unlawful processing could cause harm or discrimination to individuals. This data includes information on race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. The protection of the aforementioned data, which is defined as "special category" under the Personal Data Protection Law and processed lawfully, is handled with utmost care. **Informing and Notifying the Personal Data Subject** In accordance with Article 10 of the Personal Data Protection Law, our clinic informs data subjects during the collection of their personal data. Within this scope, our clinic informs data subjects about our identity, the purpose for which the personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal basis for collecting personal data, and the rights of the data subject under Article 11 of the Personal Data Protection Law. Article 20 of the Constitution stipulates that everyone has the right to be informed about personal data concerning them. Accordingly, Article 11 of the Personal Data Protection Law (KVKK) includes the right to request information among the rights of the data subject. In line with this, our clinic provides the necessary information to the data subject upon their request, in accordance with Article 20 of the Constitution and Article 11 of the KVKK. Our clinic informs data subjects and relevant parties about its institutional policy on the protection of personal data through various publicly available documents, thereby ensuring accountability and transparency in personal data processing activities. Furthermore, our clinic informs individuals about its activities and relevant legal provisions through various methods, particularly when seeking their explicit consent. **Processing of Personal Data** Our clinic processes personal data in accordance with Article 20 of the Constitution and Article 4 of the Personal Data Protection Law; ensuring accuracy and up-to-date information, adhering to the law and principles of fairness; pursuing specific, clear, and legitimate purposes; and conducting personal data processing activities in a manner that is relevant, limited, and proportionate to the purpose. Our clinic retains personal data for the period stipulated by law or required by the purpose of personal data processing. In accordance with Article 20 of the Constitution and Article 5 of the Personal Data Protection Law, our clinic processes personal data based on one or more of the conditions stipulated in Article 5 of the Personal Data Protection Law regarding the processing of personal data. Our clinic complies with the regulations stipulated in Article 6 of the Personal Data Protection Law regarding the processing of special categories of personal data. Our clinic complies with Articles 8 and 9 of the Personal Data Protection Law (KVK Law) and the regulations established by the KVK Board regarding the transfer of personal data. **Processing Personal Data in Accordance with the Principles Stipulated in the Legislation** *Acting in Accordance with the Law and the Principle of Honesty* Our clinic adheres to the principles established by legal regulations regarding the processing of personal data, as well as the general rule of trust and honesty. Our clinic considers the proportionality requirements in the processing of personal data and does not use personal data for purposes other than those intended. *Ensuring that personal data is accurate and up-to-date when necessary.* Our clinic takes the necessary measures to ensure that the personal data it processes is accurate and up-to-date, while respecting the fundamental rights and legitimate interests of data subjects. *Processing for Specific, Explicit and Legitimate Purposes* Our clinic clearly and precisely defines the legitimate and lawful purpose of personal data processing. We process personal data only to the extent necessary and relevant to the services we provide. The purpose for which personal data will be processed is communicated to the client before any personal data processing activity begins. *Being relevant, limited, and proportionate to the purpose for which they are committed.* Our clinic processes personal data in a manner suitable for achieving the stated purposes and avoids processing personal data that is not related to or needed for achieving those purposes. For example, we do not process personal data to meet potential future needs. *Retaining for the period stipulated in the relevant legislation or for the period necessary for the purpose for which they were processed.* Our clinic retains personal data only for the period specified in the relevant legislation or for the period necessary for the purpose for which it was processed. In this context, our clinic first determines whether a retention period for personal data is stipulated in the relevant legislation; if a period is specified, it complies with that period; if no period is specified, it retains personal data for the period necessary for the purpose for which it was processed. Upon the expiration of this period or the cessation of the reasons requiring its processing, personal data is deleted, destroyed, or anonymized by our clinic. **Conditions for Processing Personal Data** The protection of personal data is a constitutional right. According to Article 20, paragraph 3 of the Constitution, personal data may only be processed in cases prescribed by law or with the explicit consent of the individual. In line with this, and in accordance with the Constitution, our clinic processes personal data only in cases prescribed by law or with the explicit consent of the individual. Although the legal grounds for processing personal data by our clinic vary, all personal data processing activities are carried out in accordance with the general principles set forth in Article 4 of Law No. 6698. The explicit consent of the data subject is only one of the legal grounds that allow the lawful processing of personal data. Besides explicit consent, personal data may also be processed if one of the other conditions listed below is met. The basis for personal data processing may be only one of the conditions listed below, or more than one of these conditions may serve as the basis for the same personal data processing activity. If the processed data is special categories of personal data, the following conditions apply. • Obtaining the Explicit Consent of the Personal Data Subject • Explicitly Provided for in the Laws • Inability to Obtain the Explicit Consent of the Person Concerned Due to Practical Impossibility • Directly related to the formation or performance of the contract. • The Institution Fulfilling its Legal Obligations • The Data Subject's Disclosure of Their Personal Data • Data processing is necessary for the establishment or protection of a right. • Data processing is necessary for the legitimate interests of our clinic. **Processing of Special Categories of Personal Data** Our clinic meticulously adheres to the regulations stipulated in the Personal Data Protection Law (KVKK) when processing personal data classified as "special categories" under the KVKK. Article 6 of the Personal Data Protection Law (KVK Law) designates certain personal data as "special categories" because their unlawful processing carries the risk of causing harm or discrimination to individuals. These include data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. In accordance with the Personal Data Protection Law, our Clinic processes special categories of personal data under the following circumstances, provided that adequate measures determined by the Personal Data Protection Board are taken: • If the personal data owner has given their explicit consent, or • If the personal data owner has not given explicit consent; • Special categories of personal data, excluding the data subject's health and sexual life, may be disclosed in cases stipulated by law. • Special categories of personal data relating to the health and sexual life of the personal data subject may only be processed by persons or authorized institutions and organizations under an obligation of confidentiality, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing. **Transfer of Personal Data** Our clinic may transfer the personal data and sensitive personal data of the data subject to third parties (third-party companies, institutions, group companies, third-party individuals) both domestically and internationally, in accordance with the lawful purposes of personal data processing and by taking the necessary security measures. In this regard, our clinic acts in compliance with the regulations stipulated in Article 8 of the Personal Data Protection Law. Your personal data will be processed by “SMILE IZMIR DENTAL MEDİKAL SANAYİ VE TİCARET LİMİTED ŞİRKETİ”, Medical Centers, Group Companies, Universities, Ministry of Health, its affiliated sub-units and family medicine centers, private insurance companies (health, pension and life insurance, etc.), Social Security Institution, General Directorate of Security and other law enforcement agencies, General Directorate of Population, Turkish Pharmacists Association, courts and all public institutions and organizations, including but not limited to, laboratories, medical centers and third parties providing health services located domestically or abroad with whom we cooperate for medical diagnosis, the health institution to which the patient is referred or to which the patient applies, your authorized representatives, the institution you are affiliated with and/or work for, third parties from whom we receive consultancy services, including lawyers, tax consultants and auditors, regulatory and supervisory institutions and official authorities, domestic or foreign systems and/or companies within the group of companies to which our Hospital belongs, our suppliers, support service providers and business partners from whom we benefit from services or with whom we cooperate, within the scope of the Law and other legislation and for the purposes stated above. (For more detailed information, you can contact our clinic in writing). **Transfer of Personal Data Abroad** “SMILE IZMIR DENTAL MEDICAL INDUSTRY AND TRADE LIMITED COMPANY” may transfer patient information, including identity information, contact information, customer information such as requests and orders for products and services to be supplied for treatment, audiovisual recordings taken for treatment purposes such as jaw, mouth and face photographs, and all health information belonging to the patient provided to “SMILE IZMIR DENTAL MEDICAL INDUSTRY AND TRADE LIMITED COMPANY” **ABROAD, in line with the purposes of personal data processing, for the purpose and scope of the patient's treatment.** ** Personal Data Collected for Physical Security Purposes** Personal data processing activities carried out at building and facility entrances, within the building and facilities, and website visitors. Our clinic's camera surveillance for security purposes complies with the regulations contained in the Personal Data Protection Law (KVKK). Our clinic's buildings and facilities are monitored using security cameras, and personal data is processed to track the entry and exit of patients, staff, visitors, and supplier company employees. Our clinic processes personal data through the use of security cameras and the recording of visitor entries and exits. In this context, our clinic acts in accordance with the Constitution, the Personal Data Protection Law, and other relevant legislation. Our clinic uses a camera surveillance system at the building and facility entrances, and within the facility itself, to record video and, where necessary, audio of our visitors. Our clinic's security camera surveillance aims to improve the quality and reliability of services provided, ensure the safety of the institution, patients, employees, and other individuals, and protect the interests of patients regarding the healthcare and other services they receive. The camera surveillance conducted by our clinic is carried out in accordance with the Law on Private Security Services and related legislation. Only authorized institution employees and/or employees of the supplier company have access to the digitally recorded and stored files. Live camera footage can be viewed by externally contracted security personnel. Camera recordings are stored for ____ period of time. In accordance with Article 12 of the Personal Data Protection Law, our clinic takes the necessary technical and administrative measures to ensure the security of personal data obtained as a result of camera surveillance activities. **Conditions for Deletion, Destruction, and Anonymization of Personal Data** As stipulated in Article 138 of the Turkish Penal Code and Article 7 of the Personal Data Protection Law, even if processed in accordance with the relevant legal provisions, personal data will be deleted, destroyed, or anonymized in accordance with our Clinic's relevant procedures or upon the request of the personal data owner, if the reasons requiring its processing cease to exist. In this context, our Clinic is training, assigning tasks to, and raising awareness among the relevant business units to fulfill its obligations. Individuals visiting our clinic buildings have their names and surnames collected, or their personal data owners are informed about this matter through texts posted at the institution or otherwise made accessible to visitors. For security purposes and as stated in this Policy, our Clinic may provide internet access to Visitors upon request while they are within our Buildings and Facilities. In this case, log records related to internet access are kept in accordance with the provisions of Law No. 5651 and the regulations issued pursuant to this Law; these records are processed only upon request by authorized public institutions and organizations or to fulfill our relevant legal obligations during audit processes carried out within the Institution. Only a limited number of Institution employees have access to the log records obtained within this framework. Institution employees with access to these records use them only for requests from authorized public institutions and organizations or for audit processes, and share them only with legally authorized individuals. The limited number of individuals with access to the records declare, through a confidentiality agreement, that they will protect the confidentiality of the data they access. Our clinic records internet activity on its websites using technical means to ensure that visitors' visits are consistent with their purpose, to display personalized content, and to conduct online promotional activities. Detailed explanations regarding the protection and processing of personal data related to the activities carried out by our clinic can be found in the "Website Privacy Policy" texts of the relevant websites. **Entry into force of the policy** The Personal Data Protection and Processing Policy of “SMILE IZMIR DENTAL MEDICAL INDUSTRY AND TRADE LIMITED COMPANY” shall enter into force on March 1, 2021. In the event of renewal of the entire policy or specific clauses, the effective date of the policy shall be the date of revision for that clause. Our policy is published on our clinic's website ( [http://smileizmir.com/](https://smileizmir.com/) ). --- Kaynak: SMİLE İZMİR – Estetik Ağız ve Diş Sağlığı Polikliniği · https://smileizmir.com/en/personal-data-protection-and-processing-policy Randevu: https://smileizmir.com/en/contact Telefon: +905539355141