Explicit Consent Text for the Processing of Health Data

Explicit Consent Text for the Processing of Health Data

This text is addressed to you by Miradent Özel Sağlık Hizmetleri Sanayi ve Ticaret Anonim Şirketi, operating under the name Miradent Oral and Dental Health Polyclinic, in its capacity as data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

Throughout this text, “explicit consent” is the English equivalent of the term açık rıza used in the KVKK. Under the Law, explicit consent is valid only if it meets three conditions together: it must relate to a specific subject matter, it must be based on information given to you beforehand, and it must be declared with free will. This text therefore covers one specific subject matter only, tells you what will happen before you decide, and is not a condition for receiving service from us.

This consent applies to both of our websites, www.miradentturkey.com and www.miradent.com.tr. The two domains run on the same installation, and submissions from either of them reach the same address.

What this text is, and what it is not

• It is not a blanket approval of any and all processing. Its scope is limited to the two forms listed in section 1 and to the data listed there.
• It does not replace our privacy notice. General information about how we process personal data, your rights and how to apply to us is set out in our Clarification Text, published at /en/about-us/protection-and-processing-of-personal-data-clarification-text/. This consent text is intended to be read together with it, and the information on which your decision is based is given in both documents.
• It is not a diagnosis, a promise of treatment, or a service contract.

1. What this consent covers

Your consent is requested for one purpose only: the processing of the health data you yourself send to us through two specific forms on our website. Health data is a special category of personal data under Article 6 of the KVKK, and under that Article such data may not be processed without your explicit consent unless one of the exceptions listed there applies.

Alongside this health data, each of these two forms also asks for your name and surname, e-mail address and telephone number (all required) and your message, so that we can identify your submission and reply to you. Because you send these details together with your health data, your consent also covers the linking of your health data to them.

The explicit consent box appears on each of these two forms separately, and the consent you give covers only the submission you are making at that moment. If you later use the other form, or send a second submission, your consent is requested again.

2. Purpose of processing

The health data you send through these two forms is processed solely in order to:

• review the image or the complaint information you have sent,
• form a preliminary assessment of your dental condition and respond to your enquiry,
• contact you about that assessment and, where you wish, about a treatment plan or an appointment.

A preliminary assessment made in this way is not a diagnosis. It rests only on what you have sent us and does not replace an examination at the polyclinic.

This data is not used for advertising, promotion or profiling, it is not used to send you commercial electronic messages, and it is not sold or rented to third parties.

3. What happens to your submission

When you submit one of these two forms, the content of the form is sent as an e-mail message to healthtourism@miradentturkey.com. A radiographic file you upload is written temporarily to the server, attached to that e-mail, and deleted from the server after the e-mail has been sent. The directory used for this temporary storage is closed to web access.

Please note that deleting the file from the server does not mean your submission disappears: the e-mail itself, including any attached image, remains in the polyclinic’s mailbox, because that is where your submission is read and answered. The people who see your health data are the Miradent staff with access to that mailbox and the dentist who makes the assessment. We keep the submission only for as long as the purpose described in section 2 requires, and we delete or destroy it once that purpose has been exhausted or you withdraw your consent, unless a law requires us to keep it for a defined period.

In addition, our server records keep your IP address, the date and time of the submission, and browser information. These server records are kept for the security and traceability of the system; they are not processed on the basis of this consent (see section 5).

4. Storage outside Türkiye, and what this consent does not authorise

The server hosting our websites www.miradentturkey.com and www.miradent.com.tr is physically located in the United States of America (Manassas, Virginia; the hosting infrastructure belongs to Leaseweb USA). Both domains run on the same installation. This means that data you enter into our forms is stored abroad on a continuous basis.

Please note carefully: this transfer abroad is not based on, and cannot be based on, your consent. Following the 2024 amendment to Article 9 of the KVKK, a transfer of this kind — continuous and systematic rather than one-off — may not be grounded on explicit consent. It must rest on one of the safeguards set out in that Article, such as an adequacy decision, binding corporate rules or a standard contract. Giving or withholding the consent requested in this text therefore has no effect on that transfer, and your signature or tick here must not be read as permission for it. The transfer is addressed separately, under Article 9, and not by this document.

We state the transfer here so that you can decide in full knowledge of it. If the form asks you to confirm that you have been informed about this storage abroad, that confirmation is an acknowledgement that you have been informed — it is not a legal basis for the transfer, and it is separate from the consent you give for your health data.

5. Processing that is not based on this consent

Most of what we process does not depend on this consent, and withdrawing it does not stop that processing. In particular:

• Online Appointment form (/en/about-us/online-appointment/ · /tr/hakkimizda/online-randevu/) — name and surname, e-mail, telephone and message. This form contains no health data field. It is processed under Article 5/2-c of the KVKK (necessity for the establishment or performance of a contract) and Article 5/2-f (legitimate interest).
• Contact form (/en/contact/ · /tr/contact/) — name and surname, e-mail, telephone, subject and message. No health data field. Same legal bases as above.
• The identity and contact details you give on the two health-data forms, to the extent they are needed to answer you, likewise rest on Articles 5/2-c and 5/2-f.
• Server records (IP address, date and time, browser information) rest on Article 5/2-ç (compliance with a legal obligation) and Article 5/2-f.
• Cookies. Cookies strictly necessary for the website to function rest on Article 5/2-f. Statistics cookies (Google Analytics 4) and cookies set by embedded external content (Google Maps) require your consent, but that consent is given and withdrawn separately through the cookie preference panel on the website, not through this text.
• Google reCAPTCHA is used to protect our forms against automated submissions, and its verification is performed on our server as part of form security. It rests on Article 5/2-f (legitimate interest), and the _GRECAPTCHA cookie it sets belongs to the strictly necessary category. reCAPTCHA does not see your radiographic image or your tooth selections; it only confirms that the submission was made by a person.
• Marketing, promotion and commercial electronic messages. This consent contains no permission of that kind.
• Patient records created when you attend the polyclinic in person, during examination, diagnosis and treatment. Those records are processed under the health legislation, independently of these web forms and of this text.

Your consent under this text is confined to the health data described in section 1. It does not extend to any other category of data, any other purpose, or any other form.

6. Withdrawing your consent

You may withdraw this consent at any time, without giving a reason and without charge. You do not have to justify your decision, and withdrawal does not affect your ability to receive dental services from us by other means, such as contacting the polyclinic by telephone or in person. Withdrawing is no harder than giving consent: we do not require a particular form, format or wording.

You may withdraw your consent by:

• sending a message to healthtourism@miradentturkey.com, or
• submitting a written request in person or by post to Muhittin Mahallesi, Fikir Sokak 27/4, İnan Plaza, 59860 Çorlu / Tekirdağ, Türkiye, or
• telephoning us on +90 282 651 37 43, +90 282 652 87 76 or +90 549 590 22 00. A withdrawal given by telephone is valid on its own; we record it ourselves, and you do not have to confirm it in writing afterwards.

Whichever channel you use, telling us which form you used and roughly when you sent it helps us find your submission, but it is not a condition of withdrawal. Writing from the e-mail address you gave on the form also makes your submission easier to locate; it is likewise not required.

Once we receive your withdrawal, we stop processing the health data covered by this consent and delete or destroy it, unless we are required by law to keep it for a defined period. Withdrawal takes effect for the future; it does not retroactively make unlawful the processing that was carried out while your consent was in force.

If you decide not to give this consent in the first place, do not submit the X-ray or the tooth and complaint selection through the website. You may still contact us through the contact form, the appointment form, by telephone or in person. Not giving consent has no adverse consequence for you.

7. Your rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information about the processing, to learn its purpose and whether the data is used in line with that purpose, to know the third parties to whom it is transferred in Türkiye or abroad, to request the correction of incomplete or inaccurate data, to request its erasure or destruction where the conditions in Article 7 are met, to require that the correction, erasure or destruction be notified to third parties to whom the data was transferred, to object to a result produced solely by automated analysis to your detriment, and to claim compensation for damage arising from unlawful processing.

You may exercise these rights using the contact details in section 6. We answer your application at the latest within thirty days, as required by Article 13 of the KVKK. If your application is rejected, you find our answer insufficient, or you receive no answer in time, you may lodge a complaint with the Personal Data Protection Authority under Article 14 of the KVKK.

8. Declaration of consent

By ticking the explicit consent box on the form, you declare the following:

I have read and understood the information above. I give my explicit consent to Miradent Oral and Dental Health Polyclinic processing, for the purposes stated above, the health data consisting of the radiographic image I upload and/or the tooth and complaint information I select. I understand that this consent is limited to that health data, that it is not a condition of receiving service, that it does not cover the storage of data abroad described in section 4, and that I may withdraw it at any time.

The explicit consent box is separate from the box by which you confirm that you have read the privacy notice. Reading the privacy notice and consenting to the processing of your health data are two different things, and you may do the first without doing the second.