SECTION 1 — PRIVACY NOTICE (GDPR Articles 13–14)
1. Controller and processor: The clinic treating you, whose name is shown at the top of the patient portal and whose legal name and contact details are shown in the consent window ("Clinic") is the Data Controller under the GDPR and Turkish Law No. 6698 (KVKK). PatientPort (Tolunay Yaşar — PatientPort (şahıs işletmesi), info@patientport.com.tr) provides the software platform and acts as Data Processor on the Clinic's behalf.
2. Data we process: identity and contact data (name, passport/ID number, phone, e-mail, country, language, access code); health data (your medical history questionnaire answers, chronic conditions, allergies, previous surgeries, treatment plan and stages, clinician notes, medication and dosage, uploaded medical documents); travel data (flights and the plane ticket you provide, hotel, transfers); financial data (treatment fee, payments, refunds, balance); how you reached the Clinic (e.g. advertising, agency or the name of the person who referred you); portal usage data (notification preferences, your device's push identifier and permission status, your last portal visit, the history of notifications sent to you, language) and, optionally, your review and rating; the treatment plan and price quote the Clinic prepares for you (planned treatments, tooth numbers or body areas, prices, payment plan) and, if you accept it, the record of your acceptance (your name, date-time, IP address). No location data (yours or the driver's) is collected.
3. Source: obtained from you or from an intermediary/agency acting for you and entered by Clinic staff, provided by you in the Patient Portal (questionnaire, review, preferences) and generated automatically while you use the portal (push identifier, session record).
4. Purposes and legal bases: (a) planning and delivering your treatment, physician consultation, medication reminders — Art. 9(2)(h) GDPR (health care by professionals bound by secrecy) and, for processing through the platform and the international transfer described below, your EXPLICIT CONSENT (Art. 9(2)(a)); (b) organising appointments, transfers, accommodation and communicating with you — Art. 6(1)(b) (performance of a contract); (c) payment reconciliation and statutory records — Art. 6(1)(c); (d) portal security and abuse prevention — Art. 6(1)(f) (legitimate interest); (e) push notifications — with the permission you grant on your device; you can turn them off at any time. The portal keeps your session and language/display preference in your device's local storage (strictly necessary); no advertising or analytics cookies are used.
5. Recipients: (a) the partner hotel — name and stay dates only; (b) the assigned driver — name, pick-up time and route only (and, if the Clinic allows it, your phone number for the meeting); drivers can never see medical or billing data; (c) the Clinic's physicians and coordinators involved in your care; (d) the infrastructure providers below; (e) if the Clinic sends your treatment plan to you as a PDF or image through a messaging app or e-mail, the provider of that channel carries the message.
6. International transfers: Your data is stored on servers in Germany (EU) (Supabase). Some service providers used to run the application are headquartered in the United States and may process limited data there: Vercel (web/API infrastructure — transient processing only), Cloudflare (bot verification on the login screen — IP address), OneSignal (push notifications — device push identifier and the notification text; depending on the Clinic's template the text may include your first name, your appointment/transfer time and your medication name and time; your phone number, questionnaire, clinician notes and documents are never sent), e-mail providers (Resend/Brevo — e-mail address and message). Transfers are made under appropriate safeguards (EU Standard Contractual Clauses, Art. 46 GDPR; standard contract under Art. 9 KVKK) and, for health data, with your explicit consent. Encrypted backup copies of your data are kept in Türkiye on a device controlled by PatientPort for no longer than 7 days.
7. Retention: your health and treatment records are kept by the Clinic for the period required by medical-records law (commonly 20 years in Türkiye). PatientPort deletes or anonymises the data within 30 days after the Clinic's subscription ends. System logs are kept for 2 years; your consent records for 10 years. Details: Data Retention and Disposal Policy.
7a. Refer a Friend (only if the Clinic offers it): if you refer someone through the portal, their name, phone number and your note are sent to the Clinic; by referring someone you confirm that you share their details with that person's permission (this confirmation is part of the acknowledgement you tick when you first open the portal). The Clinic contacts them only about this referral and tells them on first contact that their details came from you; if they do not wish to proceed the record is deleted. Details of people who do not become patients are deleted automatically 30 days after being marked "Not this time", otherwise after 1 year. If the person becomes a patient and completes their first visit, the reward set by the Clinic is added to your balance and you are notified once an authorised Clinic staff member (manager or coordinator) approves it; a reward that is not approved is not shown to you; the Clinic may pay it to you by cash or bank transfer or deduct it from a future payment; you only see the referral status and the reward amount, never their health data. Legal basis: Art. 6(1)(b) and 6(1)(f) GDPR / KVKK Art. 5(2)(c) and (f).
7b. Treatment plan and price quote: if the Clinic prepares a treatment plan for you, you can see it in your portal and download it as a PDF. The "Accept" button only records that you accept the price quote; the acceptance is stored with your name, date-time and IP address, and an accepted plan cannot be changed afterwards. It is not informed consent to a medical procedure: the Clinic informs you and asks for your consent separately before treatment, and accepting the quote does not oblige you to have the treatment. Prices and terms in the plan are the Clinic's. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract), Art. 9(2)(h) (planning your care) and Art. 6(1)(f) / KVKK Art. 5(2)(e) (keeping evidence of the agreement).
8. Your rights (Art. 15–22 GDPR; Art. 11 KVKK): access and a copy of your data, rectification, erasure ("right to be forgotten", subject to statutory medical-record retention), restriction, portability, objection, and the right not to be subject to solely automated decisions (the platform makes none). You may withdraw your consent at any time without affecting the lawfulness of processing before withdrawal; withdrawal stops processing of your health data through the platform, while the Clinic keeps your treatment records in its own archive as required by law.
9. How to exercise your rights and complain: contact the Clinic at the address/e-mail above or via Care Guide → Data Protection in the portal; the Clinic responds within 30 days. You may lodge a complaint with the Turkish Personal Data Protection Authority (www.kvkk.gov.tr) and, if you are in the EU/EEA or UK, with your local supervisory authority. Requests sent directly to PatientPort are forwarded to the Clinic within 3 working days.
10. If you are under 18, this notice is addressed to your parent or legal guardian, who provides consent on your behalf.
11. Language: the Patient Portal can be displayed in Turkish, English, German and Russian. The binding versions of this notice are Turkish and English; texts shown in other languages in the portal are provided for information.
SECTION 2 — EXPLICIT CONSENT DECLARATION (separate, unticked checkbox)
☐ I have read and understood the Privacy Notice above; if I refer someone through Refer a Friend, I will share their details only with their permission. (acknowledgement)
☐ I FREELY GIVE MY EXPLICIT CONSENT to the processing of my SPECIAL-CATEGORY HEALTH DATA — including my questionnaire answers, allergies, medical and surgical history, treatment plan, clinician notes and medication — by the Clinic through the PatientPort platform for the purpose of planning and delivering my treatment, and to its transfer to the service providers listed in section 6. I understand that I can withdraw this consent at any time in the portal or by contacting the Clinic.
These boxes are never pre-ticked; the medical questionnaire does not open until they are ticked. Your consent is recorded with date-time, text version (v1.8), IP address and device information and kept by the Clinic as evidence.