Privacy Policy

This Confidentiality and Personal Data Protection Agreement is entered into between Dr. Kuyumcu Dental Clinic (Address: Plevne Bulvarı No:19, Emek 1 Apt. Floor:3, Apartment:7, Alsancak / İzmir, Türkiye) and ........................................................, from whom services are obtained in the field of ........................................................

For the purposes of this Agreement, Dr. Kuyumcu Dental Clinic shall be referred to as the “SERVICE RECIPIENT”, and ........................................................ shall be referred to as the “SERVICE PROVIDER.”

1. Confidentiality and Protection of Personal Data

The SERVICE PROVIDER agrees, represents and undertakes that, while processing any information, documents or personal data disclosed to, accessed by or otherwise obtained by the SERVICE PROVIDER in connection with the services provided to the SERVICE RECIPIENT, it shall comply with all applicable legislation concerning personal data protection and confidentiality of health data, particularly the Turkish Personal Data Protection Law No. 6698 (“KVKK”), as well as professional ethical rules applicable to healthcare services and any other relevant regulations.

The SERVICE PROVIDER shall take all necessary technical and administrative measures to prevent unlawful processing of or access to personal data and to ensure that such data is stored securely.

2. Confidentiality of Patient and Health Data

The SERVICE PROVIDER shall not use, reproduce, disclose, publish, transfer to third parties or otherwise make accessible, outside the intended purpose and without a written instruction from the SERVICE RECIPIENT or another valid legal basis, any data accessed or learned within the scope of the service relationship, including:

• Identification information of patients and their relatives,
• Contact information,
• Health and treatment information,
• Radiographic images,
• Clinical photographs and videos,
• Patient records,
• Appointment and communication records,
• Financial and invoicing information,
• Special categories of personal data.

This obligation shall continue after termination of the service relationship.

3. Use of Information Solely for Service Purposes

The SERVICE PROVIDER may use personal data and confidential information provided to it only to the extent necessary for performing the services on behalf of the SERVICE RECIPIENT and only for the purposes determined by the SERVICE RECIPIENT.

The SERVICE PROVIDER may not use such data for its own commercial activities, advertising, marketing, portfolio purposes, references or any other purpose without the knowledge of the SERVICE RECIPIENT and without satisfying the applicable legal requirements.

4. Digital Assets and Trade Secrets

This Agreement applies not only to patient personal data but also to all confidential information and assets belonging to or used by the SERVICE RECIPIENT, including:

• Website and website infrastructure,
• Domain names and digital accounts,
• Software and administration panels,
• Social media accounts,
• Digital advertising accounts,
• Visual and content archives,
• Design and corporate identity materials,
• Databases,
• Technical documentation,
• User accounts and access permissions,
• Business processes,
• Institutional information and methods relating to treatment processes,
• Financial and commercial information,
• Pricing and business models,
• Any other information constituting a trade secret or confidential business information.

The SERVICE PROVIDER may not disclose such information to third parties or use it for its own benefit or for the benefit of any other person or organization without the written consent of the SERVICE RECIPIENT.

5. Usernames, Passwords and Access Credentials

Where usernames, passwords, access keys or similar digital credentials are provided to the SERVICE PROVIDER for the performance of the services, such credentials may be used only for the relevant service.

The SERVICE PROVIDER agrees and undertakes to:

• Not disclose access credentials to unauthorized third parties,
• Prevent unauthorized access,
• Store access credentials securely,
• Inform the SERVICE RECIPIENT without undue delay upon becoming aware of any suspected or actual unauthorized access.

6. Subcontractors and Third Parties

The SERVICE PROVIDER may not transfer personal data or confidential information belonging to the SERVICE RECIPIENT to subcontractors or third parties unless such transfer is necessary for the performance of the service and is made with the knowledge of the SERVICE RECIPIENT and in compliance with applicable legal requirements.

Where a third-party service provider is required, the SERVICE PROVIDER shall be responsible for ensuring that the necessary personal data protection conditions and security measures are observed within the scope of its own obligations.

7. Personal Data Breaches

If the SERVICE PROVIDER becomes aware of any loss, unauthorized access, disclosure, alteration, deletion or unlawful processing of personal data, the SERVICE PROVIDER shall notify the SERVICE RECIPIENT without undue delay.

The SERVICE PROVIDER shall cooperate with the SERVICE RECIPIENT in limiting the effects of the incident, investigating the breach and implementing the necessary technical and administrative measures.

8. Termination of the Service Relationship

Upon termination of the service relationship for any reason, the SERVICE PROVIDER shall, in accordance with the instructions of the SERVICE RECIPIENT:

• Return relevant documents and records,
• Return or transfer digital files,
• Return or delete patient data,
• Return or delete photographs and videos,
• Return or disable passwords and access credentials,
• Return or delete database copies,
• Return or securely delete other confidential information,

and shall terminate its access to the SERVICE RECIPIENT’s systems.

Where there is no legal obligation requiring continued retention, the SERVICE PROVIDER shall securely delete or destroy copies remaining in its possession.

9. Duration of Confidentiality Obligations

Obligations relating to patient confidentiality, personal data protection, trade secrets and confidential information shall continue after termination of the service relationship for as long as the nature of the relevant information and applicable law require such protection.

10. Liability

The SERVICE PROVIDER acknowledges that it shall be responsible, within the scope of applicable law, for any legal, administrative or criminal consequences arising from a breach of the obligations set out in this Agreement or from unlawful processing of personal data attributable to the SERVICE PROVIDER.

Where the SERVICE RECIPIENT or data subjects suffer direct loss as a result of a breach caused by the fault of the SERVICE PROVIDER, the SERVICE PROVIDER shall be responsible for such loss in accordance with the general provisions of applicable law.

11. Applicable Legislation

For matters not expressly regulated under this Agreement, the provisions of:

• Turkish Personal Data Protection Law No. 6698 (KVKK),
• Applicable secondary legislation,
• Healthcare legislation,
• Turkish Code of Obligations,
• Turkish Commercial Code,
• And other applicable legislation

shall apply.

12. Jurisdiction

Without prejudice to mandatory jurisdiction rules under applicable law, İzmir Courts and Enforcement Offices shall have jurisdiction over disputes arising from the interpretation or implementation of this Agreement.

13. Entry into Force

This Agreement has been read and accepted by the parties and has been executed in two original copies on …… / …… / 2026. Each party has received one copy.

Dr. Kuyumcu Dental Clinic
Plevne Bulvarı No:19, Emek 1 Apt. Floor:3, Apartment:7, Alsancak / İzmir, Türkiye
Telephone: (0232) 421 90 70
Website: drkuyumcu.com
E-mail: akinkuyumcu@yahoo.com