Data Processing Agreement

This Data Processing Agreement (the "Agreement") sets out, between the clinic using the DentinCloud platform (the "Clinic") and Muhammed Mustafa Vanlı ("DentinCloud"), as an annex to and an integral part of the User Agreement, the terms governing the processing of personal data entered into the Platform.

ARTICLE 1 – ROLES OF THE PARTIES

1.1. The Clinic is the data controller that determines the purposes and means of processing the personal data (including health data) of its patients and employees that it enters into the Platform.

1.2. DentinCloud is the data processor that processes this data solely on the Clinic's instructions and for the purpose of providing the service.

1.3. "Legislation" means Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, "KVKK") and, to the extent applicable, the EU General Data Protection Regulation ("GDPR").

ARTICLE 2 – SUBJECT MATTER AND SCOPE OF PROCESSING

2.1. Categories of data processed: patients' identity and contact details, appointment records, health data such as medical history and treatment records, payment and balance records, and uploaded documents; identity and contact details of the Clinic's employees.

2.2. Data subjects: the Clinic's patients, patients' relatives and the Clinic's employees.

2.3. Purpose: providing the clinic management software service, namely recording, storage, display, reporting and, at the Clinic's request, sending messages to patients.

2.4. Duration: for the term of the User Agreement.

ARTICLE 3 – DENTINCLOUD'S OBLIGATIONS

3.1. To process the data only on the Clinic's instructions and for the purpose of providing the service, and not to use it for its own purposes, sell it or share it with third parties.

3.2. To bind its personnel who access the data to confidentiality obligations.

3.3. To take the technical and organizational measures set out in Article 5.

3.4. To inform the Clinic without delay if it learns that the data has been unlawfully obtained by third parties.

3.5. To provide the Clinic with reasonable assistance in responding to requests from data subjects and in fulfilling its other obligations under the Legislation.

ARTICLE 4 – THE CLINIC'S OBLIGATIONS

4.1. To inform its patients in accordance with the Legislation and, where required, to obtain their explicit consent.

4.2. To enter into the Platform only data it has obtained lawfully.

4.3. To manage user accounts and permissions, and to keep account credentials confidential.

ARTICLE 5 – SECURITY MEASURES

5.1. DentinCloud applies the following measures:

• Each clinic's data is kept in a separate database.
• Access to the Platform is encrypted with HTTPS (TLS).
• User passwords are stored as irreversible hashes.
• Role-based authorization is applied within the clinic; each user can perform only the operations they are authorized for.
• Access to the servers is limited to authorized personnel.

ARTICLE 6 – SUB-PROCESSORS

6.1. The database, document storage, email and the WhatsApp connection service run on servers operated by DentinCloud.

6.3. The Clinic authorizes DentinCloud to use the following sub-processors to provide the service:

• Cloudflare, Inc. (USA): domain name, content delivery, security and bot verification. Platform traffic passes through the Cloudflare network.
• Google LLC (USA): AI assistant (Gemini). Only when a user uses the assistant is the data needed to answer the question transmitted.
• Meta Platforms (WhatsApp): messages sent to patients through the Clinic's own WhatsApp account that the Clinic has connected.
• iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (Türkiye): subscription payments. Only the Clinic's payment information is processed; no patient data is transferred.

6.4. DentinCloud binds its sub-processors to obligations that ensure the same level of protection as this Agreement, and updates this text whenever the list changes.

ARTICLE 7 – TRANSFERS ABROAD

7.1. Transfers to sub-processors located abroad are carried out in accordance with the conditions laid down in Article 9 of the KVKK and the related legislation. The Clinic is responsible for informing its patients about these transfers.

ARTICLE 8 – TERMINATION OF THE AGREEMENT

8.1. When the User Agreement ends, DentinCloud will, upon the Clinic's written request, deliver the data to the Clinic or delete it within a reasonable period. Statutory retention obligations are reserved.

ARTICLE 9 – CONTACT

9.1. Requests under this Agreement should be sent to [email protected].

9.2. Our KEP (registered electronic mail) address for official notices: [email protected]