1. PURPOSE AND SCOPE

This Privacy Policy has been prepared to determine the rights and obligations of DENTSOFT TEKNOLOJİ YAZILIM VE DANIŞMANLIK HİZMETLERİ A.Ş. (hereinafter referred to as "DentSoft") and all relevant persons who have a business relationship with DentSoft (hereinafter referred to as "Customer" or "Data Subject") regarding the collection, storage, processing, use and sharing of personal data within the scope of the Personal Data Protection Law No. 6698 dated 24/03/2016 (hereinafter referred to as "KVKK").

The main purpose of KVKK is to protect the privacy of private life and fundamental rights and freedoms of individuals in the processing of personal data, and to regulate the obligations of natural and legal persons who process personal data.

DentSoft may update this Privacy Policy when necessary in order to comply with KVKK. The current version is published on DentSoft's official website and all parties can follow their rights and responsibilities through this text.

2. DEFINITIONS AND ABBREVIATIONS

Explicit consent: Consent that is related to a specific subject, based on information and expressed with free will.

Personal data: Any information relating to an identified or identifiable natural person.

Processing of personal data: Any operation performed on personal data, whether wholly or partly by automated means or by non-automated means provided that it is part of a data recording system, such as collection, recording, storage, alteration, reorganization, transfer, disclosure, acquisition, classification, or blocking of processing.

Board: Personal Data Protection Board.

Data controller: The natural or legal person who determines the purposes and means of processing personal data.

DentSoft / Company: DENTSOFT TEKNOLOJİ YAZILIM VE DANIŞMANLIK HİZMETLERİ A.Ş.

Customer / Data subject: The natural person whose personal data is processed.

KVKK: Personal Data Protection Law No. 6698 dated 24/03/2016.

3. COLLECTION OF EXPLICIT CONSENT

DentSoft may request an Explicit Consent Form from customers, customer representatives, or third parties when required by the services it provides. The purpose of obtaining explicit consent is to fulfill contractual rights and obligations, comply with relevant legal regulations, and provide services completely and accurately.

When the customer or data subject checks the "I Accept" option in the Explicit Consent Form, they are deemed to have accepted the processing and sharing of their information within the scope of KVKK. Confidentiality provisions remain valid even after the contract ends.

Persons who do not wish to give explicit consent may choose the "I Do Not Accept" option. In this case, DentSoft can only provide mandatory and limited services within the scope of the contract.

4. SHARING OF PERSONAL DATA

DentSoft collects, processes, stores and shares personal data only to the extent permitted by relevant laws and regulations.

Personal data may be processed for the following purposes:

• Providing products and services
• Conducting technical support processes
• Increasing customer satisfaction
• Conducting notification and information processes
• Sales and marketing activities
• Improving service quality
• Making improvements for user needs
• Analysis, reporting and statistical studies

Personal data may be shared with the following parties:

• Regulatory and supervisory public institutions
• Other legally authorized public institutions and organizations
• DentSoft's subsidiaries, affiliates, business partners
• Companies providing services in areas such as software, security, storage, data center
• Independent audit firms and consulting companies

DentSoft is obliged to keep transaction records for certain periods in accordance with relevant legislation. Pursuant to Article 7 of KVKK, processes regarding the deletion, destruction or anonymization of personal data are carried out within the scope of the "Regulation on Deletion, Destruction or Anonymization of Personal Data".

Requests for deletion or destruction by the personal data owner are fulfilled after the legal retention period expires. During this period, personal data is processed only when necessary and is not shared with third parties.

5. RIGHTS OF THE DATA SUBJECT

The customer or data subject has the following rights by applying to DentSoft:

• To learn whether their personal data is being processed
• To request information about it if it has been processed
• To learn the purpose of processing and whether it is used in accordance with the purpose
• To know the third parties to whom personal data is transferred
• To request correction or completion of data
• To request deletion or destruction of data
• To request that these transactions be notified to third parties to whom data has been transferred
• To object to results arising from analysis by automated systems
• To claim compensation in case of damage due to processing contrary to KVKK

All requests are evaluated in accordance with KVKK and the data subject is responded to within the legal period.

6. META PLATFORMS (WHATSAPP, INSTAGRAM, FACEBOOK) INTEGRATION

The DentSoft clinic management software allows clinics, our customers, to connect their own WhatsApp Business, Instagram and Facebook accounts to DentSoft through the official interfaces provided by Meta Platforms, Inc. This integration is optional and is activated only by the permission the account-owning clinic grants to DentSoft through Meta.

The following data is processed within the scope of the integration:

• Identifiers of the accounts connected by the clinic (WhatsApp Business account ID, phone number ID, page and account IDs) and the access tokens issued by Meta
• The content, time and delivery status (sent, delivered, read, failed) of messages sent and received between the clinic and the people it messages
• The phone number of the person messaged, and the profile name and account ID shared by Meta
• Message templates created by the clinic and their Meta approval status

This data is processed solely to enable the clinic to communicate with its patients (appointment reminders, notifications and messages written by the clinic), to display incoming messages on the clinic's screen and to operate the service technically. For correspondence with patients, the clinic is the data controller and DentSoft acts as a data processor on the clinic's instructions.

Data obtained from Meta platforms is not sold or rented, is not used for advertising or profiling, and is not shared with third parties for these purposes. To be delivered, messages are necessarily sent through the infrastructure of Meta Platforms, Inc. and are subject to Meta's own privacy policy at that stage.

Media files such as photos, audio and documents are not stored on DentSoft servers; they are retrieved from Meta on demand when a clinic user wants to view them. Message contents and delivery statuses are kept while the integration is active; technical error logs are kept for no more than 30 days.

The clinic can remove the integration at any time from DentSoft settings or from its Meta Business account. When the integration is removed, the access tokens are deleted and no new data is received from Meta. For details on data deletion: Data Deletion Instructions

7. DENTSOFT CONTACT INFORMATION

You can submit your requests within the scope of KVKK to DentSoft in writing.

DENTSOFT TEKNOLOJİ YAZILIM VE DANIŞMANLIK HİZMETLERİ A.Ş.

Address:
Flora Residence, Küçükbakkalköy Mahallesi,
Vedat Günyol Caddesi, Defne Sk No: 1,
Floor: 20, D:2001, 34750 Ataşehir / İstanbul

Website: https://www.dentsoft.com.tr/

E-mail: [email protected]

After identity verification is provided, your requests are processed and evaluated in accordance with KVKK.