Privacy Policy and Cookie Policy

This Privacy Policy explains how the personal data of Platform users is collected, processed, stored, and protected by Muhammed Mustafa Vanlı, operating under the DentinCloud brand ("DentinCloud" or the "Company"), within the scope of the Law on the Protection of Personal Data No. 6698 ("KVKK"), the European Union General Data Protection Regulation ("GDPR"), and other applicable data protection laws (including the GDPR where applicable).

SECTION 1 – DATA CONTROLLER

Data Controller: Muhammed Mustafa Vanlı

E-mail: [email protected]

Telephone: ⁦+90 850 304 54 71⁩

Registered Electronic Mail (KEP) Address: [email protected]

SECTION 2 – PERSONAL DATA COLLECTED

2.1. User Identity Information

• First name, last name
• Turkish ID number (only for invoicing transactions)
• Profession information, diploma/specialization certificate information

2.2. Contact Information

• E-mail address
• Telephone number
• Clinic address

2.3. Account Information

• Username
• Encrypted password (hash)
• Account creation date
• Date and time of last login

2.4. Financial Information

• Invoice information (title, tax office, tax number)
• Payment history
• Subscription plan information

Note: Credit card information is not stored by DentinCloud; payment transactions are carried out through PCI DSS-compliant third-party payment infrastructure.

2.5. Usage Data

• Platform usage statistics
• Session durations
• Click and navigation data
• Error reports

2.6. Technical Data

• IP address
• Browser type and version
• Operating system information
• Device information
• Cookie data

2.7. Patient Data (Processed by the User)

The User may process the following data on the Platform on behalf of its own patients:

• Patient identity information (first name, last name, Turkish ID number, date of birth)
• Patient contact information
• Health data (medical history, treatment records, X-rays, photographs)
• Payment information

IMPORTANT: With respect to Patient Data, the User holds the title of data controller, while DentinCloud holds the title of data processor. The User is responsible for personally fulfilling the disclosure and explicit consent obligations under the KVKK, and other applicable data protection laws (including the GDPR where applicable), toward its patients. In the event that patient data stored on the Platform is, for any reason (including cyber attack, technical failure, or force majeure), disclosed, lost, or damaged, DentinCloud cannot be held liable for the damages arising from such situation. The ultimate responsibility for the protection of the data rests with the User in its capacity as data controller.

SECTION 3 – PURPOSES OF PROCESSING PERSONAL DATA

3.1. Purposes of processing User data:

a) Creating and managing the Platform account

b) Providing, maintaining, and improving the Service

c) Carrying out subscription and payment transactions

d) Carrying out invoicing and accounting transactions

e) Providing user support

f) Ensuring Platform security and preventing unauthorized access

g) Fulfilling legal obligations

h) Measuring and reporting service quality

i) Conveying information and updates to the User

j) Sending commercial electronic messages (subject to explicit consent)

3.2. Purpose of processing patient data:

Patient data is processed technically only in accordance with the User's instructions and for the purpose of providing the Service. DentinCloud does not use patient data for its own purposes.

SECTION 4 – LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Within the scope of Articles 5 and 6 of the KVKK, and other applicable data protection laws (including the GDPR where applicable), your personal data is processed based on the following legal grounds:

a) Your explicit consent (KVKK Art. 5/1, Art. 6/2)

b) Necessity for the establishment or performance of a contract (KVKK Art. 5/2-c)

c) Mandatory for the fulfillment of a legal obligation (KVKK Art. 5/2-ç)

d) Having been made public by the relevant person (KVKK Art. 5/2-d)

e) Necessity for the establishment, exercise, or protection of a right (KVKK Art. 5/2-e)

f) Mandatory for the legitimate interests of the data controller (KVKK Art. 5/2-f)

Special categories of personal data, including health data, are processed only with your explicit consent or in cases provided for by law.

SECTION 5 – TRANSFER OF PERSONAL DATA

5.1. Domestic Transfer

Your personal data may be transferred to the following persons/institutions:

• Authorized public institutions and organizations within the scope of legal obligations (courts, public prosecutors' offices, regulatory authorities)
• Contracted financial advisory service providers for invoicing and payment transactions
• Payment infrastructure service providers (PCI DSS-compliant)
• Legal advisory service providers

5.2. Cross-Border Transfer

Where required by the Platform infrastructure, your personal data may be transferred to servers located abroad. This transfer is carried out:

• Within the scope of Article 9 of the KVKK, to countries with adequate protection, or
• Within the scope of your explicit consent, or
• In cases where the data controller has undertaken to provide adequate protection.

Cross-border service providers to which data is transferred:

• Cloud infrastructure services (server hosting)
• E-mail delivery services
• Analytics services

DentinCloud undertakes to provide safeguards compliant with the requirements of the KVKK and, to the extent applicable, the GDPR in cross-border data transfers.

SECTION 6 – DATA SECURITY MEASURES

6.1. Technical Measures:

• Data transmission security with TLS 1.3 / SSL encryption
• Protection of stored data with AES-256 encryption
• Hashing of passwords with the bcrypt/argon2 algorithm
• Two-factor authentication (2FA) support
• Web Application Firewall (WAF) protection
• DDoS protection systems
• Regular penetration tests and security audits
• Automated daily backups (geographically distributed)
• Intrusion detection and prevention systems (IDS/IPS)
• Logging of access records

6.2. Administrative Measures:

• Regular data security training for employees
• Confidentiality agreements
• Access authorization matrix and the principle of least privilege
• Data processing inventory and policies
• Data breach response plan
• Regular internal audit processes
• Data processor agreements (with subcontractors)

SECTION 7 – DATA RETENTION PERIODS

Your personal data is retained for the period required by the purposes of processing and, in any case, for at least the following minimum periods:

• Account information: For the period the account is active + 1 year from the closure of the account
• Financial records and invoices: 10 years pursuant to Tax Procedure Law No. 213
• Usage logs and access records: 2 years pursuant to Law No. 5651
• Patient data: A period to be determined by the User (data controller); in the event the User closes its account, it is permanently deleted within 30 days
• Commercial electronic message consent records: 3 years from the withdrawal of consent
• Cookie data: From the session duration up to a maximum of 2 years, depending on the cookie type

Upon expiry of the retention period, personal data is deleted, destroyed, or anonymized pursuant to Article 7 of the KVKK.

SECTION 8 – COOKIE POLICY

8.1. Mandatory Cookies (Always active)

These are cookies necessary for the basic functions of the Platform to operate. They are used for session management, security, and basic platform functions. These cookies cannot be disabled.

8.2. Analytics Cookies

Used for the purpose of collecting Platform usage statistics and improving the Service. These cookies can be disabled if preferred.

8.3. Functionality Cookies

Used for the purpose of remembering user preferences (language, theme, etc.).

8.4. Cookie Preferences

The User may manage or delete cookies from the browser settings. Disabling mandatory cookies may prevent the Platform from operating properly.

SECTION 9 – RIGHTS OF THE DATA SUBJECT

Pursuant to Article 11 of the KVKK, you have the following rights:

a) To learn whether your personal data is being processed

b) To request information if your personal data has been processed

c) To learn the purpose of processing your personal data and whether it is used in accordance with that purpose

d) To know the third parties to whom personal data is transferred, domestically or abroad

e) To request the correction of personal data in the event that it has been processed incompletely or incorrectly

f) To request the deletion or destruction of personal data within the framework of the conditions provided for in Article 7 of the KVKK

g) To request that the operations carried out pursuant to subparagraphs (e) and (f) be notified to the third parties to whom the personal data has been transferred

h) To object to the occurrence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems

i) To request the indemnification of damages in the event of suffering damage due to the unlawful processing of personal data

METHOD OF APPLICATION:

To exercise the above rights:

• E-mail: Application to [email protected] with identity verification
• KEP: Application via registered electronic mail to [email protected]

Applications are concluded free of charge within 30 (thirty) days at the latest. In the event that the operation requires an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

SECTION 10 – DATA BREACH NOTIFICATION

10.1. In the event that a personal data breach is detected, DentinCloud:

a) Notifies the Personal Data Protection Board within 72 (seventy-two) hours at the latest from the date it detects the breach

b) Informs the affected users as soon as possible

c) Immediately takes the necessary technical and administrative measures to minimize the effects of the breach

d) Reports the breach process and makes the necessary improvements to prevent similar breaches in the future

SECTION 11 – POLICY CHANGES

11.1. DentinCloud reserves the right to update this Privacy Policy.

11.2. Significant changes are notified at least 30 (thirty) days before they enter into force, by e-mail and/or through the Platform.

11.3. Your continued use of the Platform after the updated policy enters into force shall mean that you accept the changes.

Last updated: 01.01.2025