Privacy & Data Protection

Who we are

This site is operated by Özel Sevil SS Ağız ve Diş Sağlığı Polikliniği, trading as Sevil Smile Clinic, a dental clinic based at Etiler, Nisbetiye Cd. No:91, Beşiktaş, Istanbul 34337, Turkey. For any privacy question, contact us at [email protected]. We are the data controller for the information described below.

What we collect

The only personal data this site actively collects is what you submit through our contact form:

• Your name and email address.
• The message you write, which may describe your dental treatment needs — this can be health information, a special category of data under GDPR Article 9 and KVKK Article 6.
• Photos, X-rays, scans, PDFs or other dental records you choose to attach to your enquiry.
• Your IP address and the time of submission, recorded automatically for spam and abuse prevention.

We do not operate a patient portal, do not use a database to store form submissions (each enquiry is emailed directly to our clinic inbox), and do not require you to create an account to browse this site.

US visitors should also read our separate Consumer Health Data Privacy notice.

Why we collect it, and our legal basis

We use your name, email and message to respond to your enquiry and, if you ask us to, to prepare a treatment plan. Our legal bases are:

• GDPR Article 6(1)(b) — taking steps at your request before entering into a treatment arrangement, for the name and email you give us; and
• GDPR Article 9(2)(a) — your explicit consent, given by ticking the consent box on our form, for any health information contained in your message.
• Under KVKK, health data may be processed by us as a party bound by a duty of confidentiality (a healthcare provider) for the purpose of managing diagnosis and treatment services, and in any event we ask for your explicit consent (m.6) before you submit the form.

Where your data goes

This site is hosted on a server located in Turkey and served through Cloudflare’s content delivery network. Form submissions are sent by email to our clinic inbox, also hosted in Turkey. We do not sell, rent, or share your data with advertisers.

Many visitors to this site are located in the United States, Canada, the UK or the EU. If you are located in the EU or UK, GDPR applies to us in relation to your data because we offer services to you. Turkey does not currently have an EU adequacy decision, which means the level of legal data protection in Turkey has not been formally assessed as equivalent to the EU’s. In practice, we limit what we ask for to the minimum needed to respond to your enquiry, and we recommend you do not include more health detail than necessary in your first message — a treatment plan can be refined once we are in direct contact. If this matters to your decision to contact us, you are welcome to ask us questions about our data handling before you submit any information.

How long we keep it

We keep enquiry data only for as long as necessary to respond, manage requested follow-up and protect the enquiry channel. If you proceed to treatment, records are retained for the periods required by applicable Turkish healthcare, legal and tax rules. If you do not proceed, we delete or anonymise the enquiry when it is no longer needed for those purposes. The period therefore depends on whether the enquiry becomes a patient record. You may ask us to delete it sooner, subject to legal exceptions.

Your rights

Under GDPR (Articles 15–21) and KVKK (Article 11), you can ask us to:

• confirm what personal data we hold about you and give you a copy (access);
• correct inaccurate or incomplete data (rectification);
• delete your data, where there is no legal reason for us to keep it (erasure);
• restrict or object to how we use your data;
• receive your data in a portable format; and
• withdraw your consent at any time, without affecting anything already done.

To use any of these rights, email us at [email protected] with your request. We will acknowledge it promptly, explain any identity verification needed and respond within the period required by the law that applies to the request.

Cookies and analytics

Google Tag Manager and Google Analytics 4 remain blocked until you select Accept analytics. Rejecting leaves analytics storage denied; advertising storage remains denied in either case. Our click-to-load YouTube and Google Maps frames contact those providers only after you choose to play a video or load the map. The full technology list and withdrawal control are in our Cookie Policy.

Security

The site is served over HTTPS with TLS 1.2 or higher. Our contact form is protected against automated spam and abuse with a honeypot field and a submission rate limit. This is a static website with no visitor database — the only record of your enquiry is the email it generates to our clinic inbox.

Changes to this policy

We may update this policy as our practices change. The effective date at the top of this page tells you when it was last revised. We encourage you to review it periodically.