Privacy and Personal Data Clarification Notice

Privacy and Personal Data Clarification Notice

This notice explains how Miradent collects and uses your personal data when you visit our websites or contact us through one of our online forms. It is addressed in particular to international patients who reach us through www.miradentturkey.com, and it is written to be read before you send us any information about yourself or your health.

1. Applicable law

Miradent is established and operates in the Republic of Türkiye. All data we receive through our websites is processed under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the secondary legislation issued under it. Where you write to us from another country, your data is still processed under Turkish law, and the rights described in section 10 below are the rights the KVKK grants you.

Please be aware from the outset that, although Turkish law governs this processing, the server on which our websites run is physically located in the United States. Section 9 explains what that means for anything you type into one of our forms.

Our supervisory authority is the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

2. Who is responsible for your data

The data controller is:

• Legal name: Miradent Özel Sağlık Hizmetleri Sanayi ve Ticaret Anonim Şirketi
• Trading as: Miradent Oral and Dental Health Polyclinic (Miradent Ağız ve Diş Sağlığı Polikliniği)
• Address: Muhittin Mahallesi, Fikir Sokak 27/4, İnan Plaza, 59860 Çorlu / Tekirdağ, Türkiye
• Telephone: +90 282 651 37 43 · +90 282 652 87 76 · +90 549 590 22 00
• E-mail: healthtourism@miradentturkey.com

We operate two domains, www.miradent.com.tr (Turkish only, for visitors in Türkiye) and www.miradentturkey.com (Turkish, English and Bulgarian, for international visitors). Both are served by the same installation, the same database and the same server, and both use the same forms. This notice therefore applies to both of them without distinction.

3. What we collect, and where

We collect your data by electronic means only: what you type into one of the forms on our websites, and what our server records automatically at the moment a form is submitted. We do not collect data about you by any other method, we do not buy data about you, and we do not build profiles from your browsing.

3.1 "Send your X-ray results" form

Pages: /en/about-us/send-your-x-ray-results/ and /tr/hakkimizda/rontgen-sonuclarinizi-gonderin/

• Your name and surname (required)
• Your e-mail address (required)
• Your telephone number (required)
• Your message (optional)
• A file upload, which is required. What you upload here is a radiographic image of your teeth and jaw. Under Article 6 of the KVKK this is health data, which is a special category of personal data and is subject to stricter protection than ordinary data.

The uploaded file is written to a directory on our server that is not reachable from the web, attached to the notification e-mail sent to our clinic, and then deleted from the server. It is not published, indexed or made available to anyone other than our clinic.

3.2 "Which tooth is troubling me" form

Page: /tr/hakkimizda/rahatsizligim-hangi-disimde/

• Your name and surname (required), e-mail address (required), telephone number (required) and message (optional)
• Around fifty checkboxes by which you indicate tooth numbers and the complaints you have. These selections describe your state of health and are therefore also health data under Article 6 of the KVKK.

3.3 Online appointment form

Page: /tr/hakkimizda/online-randevu/

• Your name and surname (required), e-mail address (required), telephone number, and your message (required)
• This form has no health data field. It is a request for an appointment.

3.4 Contact form

Page: /tr/contact/

• Your name and surname, e-mail address, telephone number, subject and message. This form has no health data field.

3.5 Data recorded automatically

When a form is submitted, our server also records your IP address, the date and time of the submission, and your browser information. Your IP address and the time of submission are printed in the notification e-mail that reaches our clinic; your browser information is held in our server records. These details exist so that we can trace misuse of the forms and meet our obligations as the operator of the site.

4. How your submission reaches us

Every form on both domains is delivered to us as an e-mail message sent to healthtourism@miradentturkey.com. The forms are protected against automated abuse by Google reCAPTCHA, and that protection is verified on our own server before a submission is accepted.

5. Why we process your data, and on what legal basis

6. Health data: what your consent means

Two of our forms ask you for information about your health. Because this is a special category of data under Article 6 of the KVKK, we want to be explicit about three things.

• You do not have to use these forms. You can reach us by telephone or e-mail, or come to the clinic, without sending a radiograph or completing a complaint checklist online.
• Your consent is separate and voluntary. Your consent to the processing of health data is asked for apart from your acknowledgement of this notice; the two are not bundled together, and you may decline the consent while still reading and accepting this notice. Declining it does not prevent you from contacting us by other means.
• You can withdraw it. If you withdraw your consent, we stop processing the health data concerned and delete it, unless we are required by law to keep a copy. Withdrawal does not affect what was lawfully done before you withdrew.

Please note that the exemption in Article 6(3) of the KVKK for health personnel under a duty of confidentiality does not apply to a submission made through a public web form. For that reason your explicit consent is the only basis on which we can accept health data through this website.

7. How long we keep your data

We keep your data only for as long as the purpose it was given for requires. We deliberately do not state fixed periods here that we could not keep to; what we can tell you precisely is the following.

• The radiographic image you upload is deleted from our server once it has been attached to the notification e-mail. It is not archived on the website and no copy of it remains in the web directory.
• Your submission itself reaches us as an e-mail and is held in the clinic's mailbox for as long as we need it to answer you and, where a treatment relationship follows, for as long as the legislation on patient records requires us to keep it.
• Server records containing your IP address, the time of your submission and your browser information are kept for the period we need in order to trace misuse of the forms and to meet our obligations as the operator of the site.
• If you withdraw your consent to the processing of your health data, we delete that data unless a legal obligation requires us to retain a copy.

If you want to know whether we still hold data about you, or you want it erased, section 11 explains how to ask.

8. Cookies

The cookies actually set by our websites are the following. You decide in the cookie banner whether cookies in the statistics and external-content categories may be set, and you can change that decision at any time.

You can change or withdraw your cookie choice at any time through the cookie settings link on our websites, and you can delete cookies through your browser.

9. Transfer abroad

Our websites are hosted in the United States. The server that runs both www.miradent.com.tr and www.miradentturkey.com is located in a Leaseweb USA data centre in Manassas, Virginia, United States. Everything you enter into a form on our websites — including a radiograph or a list of dental complaints — is therefore transferred outside Türkiye at the moment you submit it, and is processed on that server. This is a continuous transfer, not an occasional one.

In addition, the following service providers process limited data outside Türkiye:

• Google Analytics 4 (Google Ireland Limited / Google LLC) — usage statistics, only if you consent to statistics cookies. This involves a transfer of data to the United States.
• Google reCAPTCHA — protection of our forms against automated abuse.
• Google Maps — the embedded map on our contact and address pages, loaded only as external content.

Our websites contain links to our social media accounts (Instagram, LinkedIn, Facebook, Viber). These are ordinary links: they do not embed third-party code in our pages and they do not transfer data about you until you click them.

We do not use Yandex Metrica or any Yandex service, and no data from our websites is transferred to the Russian Federation. If you have read an earlier version of our cookie information that said otherwise, that statement was incorrect and has been corrected.

What the law requires of us here. Article 9 of the KVKK, as amended in 2024, does not allow a controller to base a continuous, systematic transfer abroad on the data subject's explicit consent. Such a transfer must rest on an adequacy decision, on standard contractual clauses notified to the Authority, or on binding corporate rules. The requirement is stricter still for special category data such as a radiograph. We are addressing our hosting arrangement in line with this requirement, and we will update this notice when the arrangement changes. Until then, if you prefer that your health information never leave Türkiye through our website, please do not upload it to our forms — contact us by telephone or in person instead, or bring your radiograph with you to the clinic.

10. Your rights

Article 11 of the KVKK gives you the right to:

• learn whether we process personal data concerning you;
• request information about that processing, if we do;
• learn the purpose of the processing and whether your data is being used in a manner consistent with that purpose;
• know the third parties, in Türkiye or abroad, to whom your data has been transferred;
• request that incomplete or inaccurate data be corrected, and that the correction be communicated to those third parties;
• request that your data be erased or destroyed where the conditions of Article 7 are met, and that this be communicated to those third parties;
• object to a decision taken about you solely by automated processing, where it produces an unfavourable result for you;
• claim compensation if you suffer damage because your data was processed unlawfully.

Where you have given explicit consent — for health data or for statistics and external-content cookies — you may also withdraw that consent at any time, without having to give a reason.

11. How to exercise your rights

You may send your request:

• in writing, with a signature, to our address: Muhittin Mahallesi, Fikir Sokak 27/4, İnan Plaza, 59860 Çorlu / Tekirdağ, Türkiye; or
• by e-mail to healthtourism@miradentturkey.com, from an e-mail address you have previously given us.

Please state your name and surname, your contact details, and clearly what you are asking for. So that we do not disclose anyone's data to the wrong person, we may need to confirm your identity before we answer. If your request concerns documents or information held by us, it helps to describe them.

We will respond within thirty days at the latest from the day your request reaches us, free of charge. Where answering requires a separate cost, we may charge the fee set out in the Communiqué on the Procedures and Principles of Application to the Data Controller.

If we reject your request, if you find our answer insufficient, or if we do not answer in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 of the KVKK — within thirty days of receiving our answer, and in any case within sixty days of the date of your application.

12. Changes to this notice

We update this notice when our forms, our service providers or our hosting arrangement change. The version published on our websites is always the current one. Where a change affects the basis on which we process your health data, we will ask for your consent again rather than rely on the consent you gave before.