Privacy Policy

Privacy Policy

VTC Sağlık Hizmetleri Sanayi ve Ticaret A.Ş. (Vitrin Clinic) – Clarification Text on the Protection and Processing of Personal Data

Last updated: 22 October 2026

VTC Sağlık Hizmetleri Sanayi ve Ticaret A.Ş. ("Vitrin Clinic", "we") provides dental care to patients from Türkiye and abroad at our clinic in Istanbul, on vitrinclinic.com and its language versions, and through our phone, WhatsApp, e-mail and social media channels.

As data controller, we prepared this Clarification Text under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to explain how we process your personal data. We share your personal data with third parties only where the law allows.

Data controller

·        Company: VTC Sağlık Hizmetleri Sanayi ve Ticaret A.Ş.

·        Health facility: Özel Vitrin Clinic Ağız ve Diş Sağlığı Polikliniği

·        Authorization: International Health Tourism Authorization Certificate No. ST-4320, issued by the Republic of Türkiye Ministry of Health on 13.11.2024

·        Address: İkitelli OSB Mah., Süleyman Demirel Bulvarı, Demirciler Sanayi Sitesi No: 4/1, İç Kapı No: 2, Başakşehir / İstanbul, Türkiye

·        Phone / WhatsApp: +90 545 103 6000

·        E-mail: [email protected]

·        Data protection requests: [email protected]

·        KEP (registered e-mail): [email protected]

1. Categories of Personal Data We Process

2. Why We Process Your Personal Data

·        A. Diagnosis, treatment and care: Examination, diagnosis, treatment planning, dental procedures, making and fitting prostheses, supplying medicines and materials, aftercare and follow-up. Final clinical decisions are made by licensed dentists.

·        B. Free consultations and remote communication: Answering your questions, giving a preliminary assessment from the photos and X-rays you send, explaining treatment options and planning appointments. Remote exchanges are not a final diagnosis and do not replace an in-person examination.

·        C. Health tourism and travel logistics: Arranging airport, hotel and clinic transfers, booking accommodation, supporting visa applications (including invitation letters), interpreting and coordination.

·        D. Online payments, legal and administrative obligations: Taking online payments, invoicing and refunds; notifications to the Ministry of Health, the Provincial Health Directorate, the Social Security Institution (SGK) and other authorities (for example through e-Nabız); tax and accounting duties; keeping patient files for the periods required by law.

·        E. Patient relations and service quality: Appointment reminders by SMS, phone, WhatsApp and e-mail, satisfaction surveys, handling requests and complaints, and maintaining our coordination standards.

·        F. Promotion and marketing (only with your explicit consent): Personalised treatment suggestions, news about our services and campaigns, and sharing success stories, before-and-after images and testimonials. We ask for separate consent for each of these, and you can withdraw it at any time.

3. How We Collect Your Data and Our Legal Grounds

We collect your data, partly or fully by automated means, through our clinic; vitrinclinic.com and its language versions, including forms and the online payment page; our patient-coordination team and call centre; e-mail, SMS and WhatsApp; our social media accounts (Facebook, Instagram, TikTok, X, LinkedIn, YouTube); and authorised business partners.

We process your data on the following legal grounds under KVKK Articles 5 and 6:

·        Expressly provided for by law (Art. 5/2-a): Ministry of Health regulations, the Tax Procedure Law, the Turkish Commercial Code and related legislation.

·        Physical impossibility (Art. 5/2-b): Protecting the life or physical integrity of a person who cannot give consent, such as an unconscious patient.

·        Performance of a contract (Art. 5/2-c): Providing the treatment and services you agreed to, including appointments and online payments.

·        Legal obligation (Art. 5/2-ç): Notification duties, record retention and data security obligations.

·        Establishing, exercising or protecting a right (Art. 5/2-e): Using records in a legal dispute.

·        Legitimate interests (Art. 5/2-f): Appointment management, clinic security including CCTV, and improving our processes, provided this does not harm your fundamental rights and freedoms.

·        Medical diagnosis and treatment (Art. 6/3): Health data is processed for medical diagnosis, treatment and care by dentists and healthcare staff bound by professional confidentiality.

·        Explicit consent (Art. 5/1 and Art. 6): Marketing, sharing images and testimonials, and transfers abroad that do not rely on another legal ground.

4. Who We Share Your Data With

We share your data only as far as needed for the purposes above:

·        Public authorities: The Ministry of Health, the Provincial Health Directorate, law enforcement, courts, enforcement offices, tax offices and SGK, where required by law.

·        Medical partners: Dental laboratories, imaging and diagnostic centres and consulting specialists.

·        Payment institutions and banks: The payment institution and banks we work with, to process online payments and refunds.

·        Service providers: IT, database and server providers, financial advisers, lawyers and translation offices.

·        Tourism and logistics partners: Contracted hotels and transfer companies, which receive only the identity, contact and arrival details they need.

·        Recipients abroad: Your insurer, where applicable and at your request, and global technology providers such as Google, Meta and WhatsApp, whose servers may be outside Türkiye. Transfers abroad are made under KVKK Article 9: to countries with an adequacy decision, with appropriate safeguards such as standard contracts notified to the Personal Data Protection Authority, or in the occasional cases listed in Article 9/6, including with your explicit consent.

Your mobile number and SMS opt-in are never shared with or sold to third parties for their own marketing. We use them only for the messages you asked for or agreed to receive.

5. Data Security, Patient Privacy and Confidentiality

·        Confidentiality and authorised access: Only staff who need your records for their work can access them. Access rights are role-based and reviewed regularly, and staff must keep information confidential during and after their employment.

·        Accurate and complete medical records: We take reasonable steps to keep your records up to date and to protect them from unauthorised change, deletion or disclosure.

·        Access monitoring and audit logs: Our systems require individual sign-ins, and access to them may be logged and monitored.

·        Physical, administrative and technical safeguards: Controlled premises, secure systems and data transmission, encryption where appropriate, backups, antivirus software, firewalls and periodic security reviews.

·        Online payment security: Online payments are processed by our payment institution and protected by SSL and 3D Secure. Your card number, expiry date and security code never reach Vitrin Clinic's servers and are not stored.

·        Staff confidentiality and training: Everyone with access to personal data follows confidentiality duties and receives privacy training. Suppliers are vetted and bound by data protection obligations in their contracts.

·        Your privacy at every stage of care: We protect your privacy from registration to record-keeping, and use your data only as the law allows or as you have consented.

·        Handling data breaches: We have procedures to detect, assess and respond to data breaches. Where required, we notify the Personal Data Protection Board within 72 hours and inform the people affected.

·        Continuous improvement: We review our measures regularly, based on risk assessments, audits, incident reports and new technology.

6. How Long We Keep Your Data

At the end of each period, your data is deleted, destroyed or anonymised under our Personal Data Retention and Destruction Policy.

7. Your Rights as a Data Subject (KVKK Article 11)

You have the right to:

·        Learn whether your personal data is processed

·        Request information if it has been processed

·        Learn the purpose of processing and whether your data is used for that purpose

·        Know the third parties in Türkiye or abroad to whom your data is transferred

·        Ask for incomplete or inaccurate data to be corrected

·        Ask for your data to be deleted or destroyed under the conditions in KVKK Article 7

·        Ask for corrections and deletions to be notified to the third parties who received your data

·        Object to a result against you that arises solely from automated analysis of your data

·        Claim compensation if you suffer damage because of unlawful processing

8. How to Exercise Your Rights

You can send your request in Turkish, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, by one of these methods:

·        In writing, in person with proof of identity or through a notary, to İkitelli OSB Mah., Süleyman Demirel Bulvarı, Demirciler Sanayi Sitesi No: 4/1, İç Kapı No: 2, Başakşehir / İstanbul, Türkiye

·        By registered electronic mail (KEP) to [email protected]

·        By e-mail to [email protected] from the e-mail address registered in our system, with the subject line "Request for Information under the Personal Data Protection Law"

Your application should include your name and surname, signature, T.R. identity number (or passport number and nationality for foreign nationals), address, e-mail or phone number, and a clear description of your request.

We will respond within 30 days at the latest, free of charge. If the response involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.

Vitrin Clinic Cookie Policy

Effective date: 22 October 2026

1. Introduction and Purpose

vitrinclinic.com uses cookies, pixels, local storage and similar technologies to improve your experience, measure the site's performance and show relevant content. This policy explains what these technologies are and how you can manage them. How we process your personal data is explained in the Clarification Text above.

2. What Is a Cookie?

A cookie is a small text file that is saved in your browser when you visit a website. It lets the site work properly, remember your choices and measure how it is used.

3. Types of Cookies We Use

·        A. Strictly necessary cookies: Keep the site working and secure, for example page navigation, the consultation form, online payment steps and saving your cookie choices. They are not used for marketing and do not need your consent.

·        B. Analytics and performance cookies: Show us how visitors use the site, such as traffic sources and popular pages, using aggregated data. We use Google Analytics 4. They run only with your consent.

·        C. Functional cookies: Remember your choices, such as language, and enable features like the live chat or WhatsApp widget. They run only with your consent.

·        D. Targeting and advertising cookies: Help us show you relevant ads on other websites and social platforms and measure their results. We use Meta Pixel, Google Ads and TikTok Pixel. They are switched on only if you choose "Accept All" or enable them under "Manage Preferences".

4. Cookies Used on Our Website

Data collected through analytics and advertising cookies may be transferred to the providers' servers abroad. This transfer is based on your cookie consent.

5. Managing Your Cookie Preferences

·        Accept All: allows all cookie categories.

·        Manage Preferences: lets you switch analytics and marketing cookies on or off separately.

·        Decline: allows only strictly necessary cookies.

You can change your choice at any time through the "Cookie Settings" link in the footer of every page.

You can also delete or block cookies in your browser settings: in Chrome, Settings > Privacy and security; in Firefox, Settings > Privacy & Security; in Safari, Settings > Privacy; in Edge, Settings > Cookies and site permissions. If you block strictly necessary cookies, some parts of the site, such as the payment page, may not work.

6. Contact

For questions about this Cookie Policy or your personal data, write to [email protected].