Privacy and Cookies Policy
How CityDent Istanbul Dental Clinic collects, uses, shares and protects your personal and health data — under the Turkish Law No. 6698 and, for patients in the European Union, the GDPR.
Version 2.0 · In force from 29 July 2026 · CityDent Istanbul
This policy explains how CityDent Istanbul Dental Clinic collects, uses, shares and protects your personal data when you visit our website, contact us or receive treatment from us. It also explains the cookies we use and the choices you have.
We process personal data under the Turkish Law on the Protection of Personal Data No. 6698 (“Law” or “KVKK”). Because we also offer our services to patients located in the European Union, we apply the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) to those patients as well.
Who We Are
The data controller responsible for your personal data is:
Özel CityDent Ağız ve Diş Sağlığı Polikliniği
Cumhuriyet Caddesi No: 32, Kat: 1, Taksim – Şişli, 34367 Istanbul, Türkiye
Telephone: +90 212 238 46 72 · WhatsApp: +90 545 677 69 53
E-mail: support@citydentistanbul.com
Trade registry / MERSIS no: to be completed
The Personal Data We Collect
- Identity and contact data: name, date of birth, country of residence, telephone number, e-mail address.
- Health data: your dental and medical history, complaints, intraoral photographs, panoramic X-rays and other images, diagnoses, treatment plans and treatment records.
- Enquiry and communication data: the content of your messages sent through the contact form, WhatsApp, e-mail or telephone, and our replies.
- Financial data: invoice details, payment method and payment records. We do not store full card numbers — card payments are handled by the payment institution.
- Travel data: where we arrange it, your flight, transfer and accommodation details.
- Usage data: IP address, device and browser type, pages viewed, referring source, date and time of visit, and cookie identifiers.
Why We Use Your Data, and on What Legal Basis
| Purpose | Basis under KVKK | Basis under GDPR |
|---|---|---|
| Answering your enquiry and preparing a treatment and price proposal | Art. 5/2-c — necessary for the conclusion of a contract | Art. 6(1)(b) — contract and pre-contractual steps |
| Assessing photographs and X-rays you send us before you travel | Art. 6/2 — your explicit consent | Art. 9(2)(a) — explicit consent |
| Providing dental diagnosis, treatment and aftercare | Art. 6/3 — processing by health professionals bound by a duty of confidentiality | Art. 9(2)(h) with Art. 6(1)(b) |
| Arranging transfer and accommodation | Art. 5/2-c — necessary for a contract | Art. 6(1)(b) |
| Invoicing, accounting and meeting our legal obligations | Art. 5/2-ç — legal obligation | Art. 6(1)(c) |
| Keeping the website secure and preventing fraud | Art. 5/2-ç and 5/2-f | Art. 6(1)(c) and 6(1)(f) — legitimate interests |
| Measuring how the website is used (analytics cookies) | Your explicit consent | Art. 6(1)(a) — consent |
| Advertising, remarketing and measuring campaigns | Your explicit consent | Art. 6(1)(a) — consent |
| Handling complaints and establishing or defending legal claims | Art. 5/2-e | Art. 6(1)(f) — legitimate interests |
Health Data
Health data is a special category of personal data and receives additional protection. We process it only to plan and deliver your treatment, and only staff who need it for your care can access it. Where we rely on your explicit consent — for example to review images you send before your visit, or to use before-and-after photographs — you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. We never publish patient images without separate, specific written consent.
Cookies and Similar Technologies
Cookies are small text files placed on your device when you visit a website. We also use local storage and session storage, which work in a similar way. Strictly necessary cookies are set as soon as you arrive, because the site cannot work without them. All other cookies — analytics and marketing — are set only after you accept them in the cookie banner. You can change or withdraw your choice at any time through the cookie settings link on the site, or by clearing cookies in your browser.
| Cookie or technology | Category | Purpose | Duration |
|---|---|---|---|
| PHPSESSID, wordpress_test_cookie | Strictly necessary | Maintains your session and checks that your browser accepts cookies | Session |
| wp-wpml_current_language | Strictly necessary | Remembers the language version you selected | 1 day |
| Cookie consent record | Strictly necessary | Stores your cookie choices so that we do not ask you again | 6–12 months |
| elementor | Strictly necessary | Allows the page layout to be displayed correctly | Session |
| _ga, _ga_<id> (Google Analytics 4) | Analytics | Distinguishes visitors and measures how the site is used | Up to 2 years |
| _fbp (Meta Pixel) | Marketing | Measures advertising performance and enables remarketing | 3 months |
| _gcl_au (Google Ads) | Marketing | Measures conversions generated by our adverts | 3 months |
| Local and session storage | Functional | Keeps interface preferences on your own device | Until you clear it |
Before publishing: confirm this table against a current cookie scan of the live site. Analytics and advertising rows must be removed if those tools are not actually installed.
Who We Share Your Data With
- Health service providers: laboratories, imaging centres and, where a treatment requires it, partner clinics and specialists.
- Suppliers acting for us: hosting and IT maintenance, e-mail and messaging platforms, translation and call-centre services, all bound by written confidentiality and data protection terms.
- Travel partners: hotels and transfer companies, only where you ask us to arrange these.
- Payment and financial institutions: banks and payment service providers, and our accountants.
- Public authorities: courts, the Ministry of Health and other authorities, where we are legally required to disclose.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
International Transfers
We are established in Türkiye, so if you are in the EU your data will be transferred outside the European Economic Area. Türkiye is not covered by a European Commission adequacy decision.
Where we receive your data in order to arrange and provide the treatment you have requested, that transfer is necessary for the performance of your contract with us (GDPR Art. 49(1)(b)); where it relates to your medical care, we also rely on your explicit consent given after being informed of the risks (Art. 49(1)(a)). Some of our suppliers are located in the EU or the United States; those transfers are made under Standard Contractual Clauses or an equivalent safeguard. You can ask us for a copy of the safeguards in place.
How Long We Keep Your Data
| Data | Retention period | Reason |
|---|---|---|
| Patient file, clinical records and images | … years after your last treatment | Turkish health legislation |
| Enquiries that do not lead to treatment | 2 years from last contact | Legitimate interest |
| Invoices and accounting records | 10 years | Turkish Commercial Code Art. 82 |
| Tax records | 5 years | Tax Procedure Law |
| Website traffic logs | 1–2 years | Law No. 5651 |
| Cookie and marketing consent records | 3 years after withdrawal | Evidence that consent was given |
When a period ends, we delete, destroy or anonymise the data at the first periodic deletion cycle.
How We Protect Your Data
We use encrypted connections (TLS), role-based access control, logging, up-to-date anti-malware, regular backups and confidentiality undertakings signed by all staff. Clinical records are held in systems that only authorised health personnel can open. If a breach occurs that is likely to result in a risk to you, we will notify the competent authority and, where required, you.
Your Rights
Under Article 11 of the Law, and Articles 15 to 22 GDPR where they apply to you, you may:
- ask whether we hold data about you, and request a copy of it;
- ask us to correct data that is inaccurate or incomplete;
- ask us to delete your data, or restrict how we use it;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- ask us to transmit the data you gave us to another controller in a machine-readable format (portability);
- withdraw any consent you have given, at any time;
- object to a decision based solely on automated processing. We do not make treatment decisions by automated means.
How to Exercise Them
Write to support@citydentistanbul.com or to our postal address above. We reply free of charge and within thirty days at the latest under the Law, and within one month under the GDPR. We may ask you for information to confirm your identity before we act.
Complaints
If you are not satisfied with our response you may complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr). If you are in the EU, you may also complain to the supervisory authority of the country where you live or work.
Representative in the European Union
Our representative designated under Article 27 GDPR, whom EU data subjects may contact on all matters relating to this policy, is:
Name, address and e-mail of the EU representative — to be completed before this page is published. If no representative is appointed, this entire section must be removed rather than left blank.
Children
We treat patients under 18 only with the consent and in the presence of a parent or legal guardian, and we collect the child’s data from that parent or guardian. Our website is not directed at children, and we do not knowingly collect children’s data through it.
Changes to This Policy
We may update this policy when our services, our systems or the law change. The version and date shown at the top of the page always indicate which text is in force. If a change materially affects you, we will tell you before it takes effect.
Contact
For any question about this policy, or about how we handle your personal data, write to support@citydentistanbul.com or call +90 212 238 46 72. You can also reach us through our contact page.