Privacy Notice (KVKK)

1. Data controller

Pursuant to Law No. 6698 on the Protection of Personal Data ("KVKK"), personal data processed within the scope of the Platform is processed by the Platform Operator in accordance with applicable legislation.

Data processing activities relating to the healthcare services provided through the Platform are the responsibility of the relevant dental clinic or healthcare provider.

2. Categories of data processed

The main categories of personal data that may be processed on the Platform include:

• Identity data (name, surname)
• Contact data (phone, email, address if any)
• Customer transaction / appointment data
• Transaction security data (session, verification, technical logs)
• Marketing preferences and consent records (if any)
• Fields that may constitute special-category health data (for example allergy information) — see dedicated section

3. Purposes of processing

Your personal data may be processed for the following purposes:

• Creating membership, authenticating identity, and managing accounts
• Receiving, transmitting, and tracking appointment requests and supporting related clinic processes
• Ensuring security, preventing abuse, and keeping audit records
• Responding to support requests and communicating with users
• Fulfilling legal obligations and providing information to competent authorities
• Sending commercial electronic messages where you have given explicit consent

4. Legal bases

Your personal data is processed based on the legal grounds set out in Articles 5 and (for special-category data) 6 of the KVKK that are applicable to the relevant processing activity. These may include where processing is expressly provided by law; is necessary for the establishment or performance of a contract; is mandatory for the data controller to fulfill a legal obligation; is mandatory for the legitimate interests of the data controller without harming the data subject’s fundamental rights and freedoms; and cases of explicit consent.

Which legal basis applies depends on the nature of the specific processing activity. The legal basis for special-category health data is addressed separately below; remaining uncertainties are subject to legal review.

5. Collection methods

Your personal data may be collected via web and mobile application forms, membership and profile screens, appointment flows, support channels, cookies and similar technologies, by fully or partially automated means; and, depending on the nature of the service, by transfer from clinic processes.

6. Recipient groups

Your personal data may be transferred, limited to the purposes above, to the following recipient groups:

• Affiliated dental clinics and authorized clinic staff (to the extent necessary for appointment and patient processes)
• Hosting, infrastructure, SMS/email delivery, and similar service providers
• Legal advisors and parties providing audit and security services (to the extent necessary)
• Competent public institutions and organizations (where legally required)

7. International transfers

Depending on the nature of cloud/infrastructure or communication services used, your personal data may be transferred to servers or providers located abroad. In such cases, KVKK provisions on international transfers and Board decisions are observed, and necessary legal safeguards are sought.

[TODO — LEGAL REVIEW REQUIRED: Countries of transfer, safeguard mechanisms, and current Board adequacy status will be clarified after legal review.]

8. Retention periods

Personal data is retained for as long as required by the processing purpose and considering retention / limitation periods under applicable legislation. At the end of the period, data is deleted, destroyed, or anonymized.

[TODO — BUSINESS/LEGAL REVIEW: A detailed retention matrix by data category will be added after legal and operational review.]

9. Rights under KVKK Article 11

As a data subject under Article 11 of the KVKK, you have the following rights:

• To learn whether your personal data is processed
• To request information if it has been processed
• To learn the purpose of processing and whether it is used in line with that purpose
• To know the third parties to whom data is transferred domestically or abroad
• To request correction if data is incomplete or inaccurate
• To request deletion or destruction under the conditions set out in the KVKK
• To request that correction / deletion be notified to third parties to whom data was transferred
• To object to an outcome against you arising from analysis exclusively by automated systems
• To request compensation for damage arising from unlawful processing

10. How to apply

To exercise your rights under the KVKK, you may apply through the contact channels available on the Platform. Applications are concluded in accordance with the KVKK and related communiqués.

11. Special-category health data / allergies field

The allergies field in the Platform profile may, by its nature, be assessed as special-category personal data (health data). Matters relating to processing of this field are set out separately below.

• Why processed: [TODO — CLINIC/PRODUCT REVIEW: Why allergy information is collected and how it is used in clinic processes will be clarified.]
• Roles with access: [TODO — ACCESS REVIEW: Which user, clinic, and support roles may access this field will be determined.]
• Legal basis: [LEGAL REVIEW REQUIRED]
• Retention period: [TODO — RETENTION REVIEW: Retention period / deletion policy specific to the allergies field will be determined.]

12. Version

The document version is "kvkk_tr_2026_01".

Updated text is published on the Platform. Material changes are announced through appropriate channels.