Data Controller

In accordance with the Law on the Protection of Personal Data (KVKK No. 6698) and relevant international data privacy regulations, your personal data is processed by the healthcare institution identified below in its capacity as Data Controller.

Scope of the Policy

This privacy policy applies to the following categories of individuals:

• Visitors navigating the ON7 Clinic website,
• Individuals submitting contact or online appointment request forms,
• Patients reaching out via telephone, instant messaging, or email,
• Patients and prospective patients requesting treatment options and pricing information,
• Individuals interacting with our clinic via digital communication channels.

Categories of Personal Data Processed

Identity and Contact Details

Full name, phone number, email address, postal address, and communication preferences.

Appointment and Request Records

Requested dental treatment, preferred clinician, appointment date/time preferences, subject of inquiry, message contents, and submission timestamps.

Health and Clinical Data

Where provided voluntarily by the individual or necessary for executing dental healthcare services: symptoms, previous dental history, diagnoses, radiological imaging, laboratory findings, and treatment plans.

Digital Footprint and Technical Security Data

IP address, browser and operating system details, access timestamps, traffic records, error logs, and website interaction metrics.

Legal and Compliance Records

Formal applications, requests, feedback, correspondence with official authorities, and documentation regarding dispute resolution.

Purposes of Processing Personal Data

• Receiving and managing appointment inquiries and contact requests,
• Communicating with existing patients and prospective patients,
• Coordinating clinician availability and personalized treatment planning,
• Administering and delivering oral and dental healthcare services,
• Conducting clinical examinations, diagnostic workflows, and post-treatment follow-ups,
• Managing patient records and chronological appointment histories,
• Evaluating inquiries, suggestions, feedback, and complaints,
• Enhancing service quality and elevating patient satisfaction,
• Maintaining website security and operational stability,
• Preventing unauthorized access, fraudulent activity, and technical abuse,
• Fulfilling statutory healthcare and administrative obligations,
• Establishing, exercising, and defending legal claims,
• Delivering informational newsletters and announcements where explicit consent has been granted.

Legal Grounds for Data Processing

Personal data is processed based on one or more of the following legal grounds set forth in Article 5 and Article 6 of Law No. 6698:

• Explicit provision under national legislation,
• Direct necessity for the establishment or performance of a contract or service agreement,
• Fulfillment of legal obligations to which the data controller is subject,
• Establishment, exercise, or defense of a legal right,
• Legitimate interests pursued by the data controller, provided it does not harm fundamental rights and freedoms,
• Explicit consent obtained from the data subject where legally required.

Special categories of personal data (health data) are processed strictly for the purposes of medical diagnosis, provision of care, treatment execution, and healthcare management by healthcare professionals under confidentiality obligations.

Methods of Data Collection

• Website contact, consultation, and appointment booking forms,
• Telephone conversations and email correspondence,
• Instant messaging channels (e.g., WhatsApp) and social media platforms,
• In-clinic patient intake forms, physical registration, and diagnostic records,
• Cookies, server logs, and automated digital tracking systems,
• Direct declarations made by the patient or their legal representative,
• Authorized public healthcare registries and institutions.

Data is collected via electronic, digital, and physical means in a manner that is proportionate, limited, and strictly relevant to the intended processing purpose.

Transfer of Personal Data

Subject to appropriate data security safeguards and limited strictly to the relevant scope of transfer, your personal data may be shared with the following recipient groups:

• Authorized clinic personnel, dentists, and dental specialists,
• Certified dental laboratories and specialized healthcare partners,
• Information technology providers, hosting companies, and cybersecurity partners,
• Certified public accountants, legal advisors, auditors, and consultants,
• Payment processing gateways and banking institutions,
• Private health insurance companies (upon request and authorization),
• Competent judicial bodies and regulatory public authorities as mandated by law.

Cross-Border Data Transfers

Where email hosting, cloud backup, web analytics, security tools, or social media communication channels utilize servers located outside the country, personal data may involve cross-border transfers.

All international data transfers are conducted in compliance with statutory requirements, appropriate standard contractual clauses, or explicit user consent where mandated.

Use of Cookies

Our website may utilize the following categories of cookies:

• Strictly Necessary Cookies: Essential for core website navigation and security,
• Functional Cookies: Remember user preferences and interface customizations,
• Analytical Cookies: Measure traffic, visitor behavior, and platform performance,
• Marketing Cookies: Deliver relevant promotional campaigns and track advertising efficacy.

Non-essential analytical and marketing cookies are activated strictly based on user preference and consent, which can be managed at any time via your browser settings or our cookie consent manager.

Data Retention and Disposal

Personal data is retained strictly for the duration necessary, taking into account:

• The ongoing necessity for the designated processing purpose,
• Statutory retention periods mandated for medical and dental patient files,
• Fiscal, tax, and commercial statutory limitation requirements,
• Applicable legal dispute and statutory limitation periods,
• Directives issued by competent health and regulatory authorities.

Upon expiration of the retention timeline or elimination of the underlying processing justification, personal data is deleted, destroyed, or irreversibly anonymized in accordance with our data retention schedule.

Data Security Measures

ON7 Clinic implements robust technical and administrative security measures to prevent unlawful data processing, accidental loss, and unauthorized access.

• Granular role-based access control and user authorization protocols,
• Enforced strong password guidelines and multi-factor authentication,
• Encrypted cloud backups and routine software patch management,
• Firewalls, anti-malware protections, and network monitoring tools,
• Comprehensive audit logging and access tracking systems,
• Strict confidentiality agreements signed with all staff members,
• Periodic security audits of external vendors and processors.

Rights of the Data Subject

Under Article 11 of Law No. 6698 and applicable data protection regulations, you are entitled to:

• Learn whether your personal data is being processed,
• Request detailed information if your personal data has been processed,
• Understand the purpose of processing and verify if data is used accordingly,
• Know the third-party recipients to whom data has been transferred domestically or abroad,
• Request correction of incomplete or inaccurate personal data,
• Request deletion or destruction of data under statutory conditions,
• Request notification of corrections/deletions to third-party recipients,
• Object to adverse outcomes produced exclusively via automated analysis,
• Claim compensation for damages incurred due to unlawful processing.

How to Exercise Your Rights

You can submit your data privacy requests to ON7 Clinic in writing or via registered email.

Your application should include the following information:

• Full legal name and surname,
• Contact information and verification details,
• Clear explanation of the specific request or inquiry,
• Preferred channel for receiving our formal response.

Personal Data of Minors

Personal data of minor patients is processed exclusively through their parent or authorized legal guardian and strictly to the extent necessary for delivering pediatric dental care.

Minors should not independently submit sensitive medical data via online inquiry forms. All appointment and consultation requests on behalf of children must be coordinated by a legal guardian.

Commercial Electronic Communications

Promotional newsletters, announcements, and direct marketing communications are sent only to individuals who have given explicit prior opt-in consent.

Transactional communications—such as appointment reminders, clinical follow-up updates, and direct responses to patient inquiries—are administrative in nature and managed separately from commercial marketing lists.

Third-Party Links and Integrations

Our website may feature links to external platforms, including interactive map providers, social media networks, and third-party websites.

These third-party platforms maintain their own independent privacy and cookie policies. ON7 Clinic assumes no responsibility for the content, security practices, or data handling methods of external websites.

Policy Modifications

This policy may be updated periodically to reflect statutory revisions, decisions by the Data Protection Authority, technological developments, or enhancements in our clinical data workflows.

The revised policy becomes effective immediately upon publication on this website, marked by the updated date at the top of the document.

Contact Information

For any questions regarding our Privacy Policy or to submit a formal data subject inquiry, please contact ON7 Clinic using our official details: