GDPR Data Protection Notice

This notice explains how Miradent processes your personal data when you visit our websites or send us a form, and what rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and is addressed in particular to visitors and patients who are in the European Union or the European Economic Area.

Miradent is established in Türkiye and also processes personal data under Turkish Personal Data Protection Law No. 6698 (“KVKK”). Where both sets of rules apply, we apply whichever gives you the stronger protection.

This notice covers both of our websites, www.miradentturkey.com and www.miradent.com.tr. They run from the same installation, the same database and the same server, so the processing described here is the same on both.

Last updated: 10 November 2026.

1. Who is responsible for your data

The controller of your personal data is:

• Miradent Özel Sağlık Hizmetleri Sanayi ve Ticaret Anonim Şirketi, operating as Miradent Oral and Dental Health Polyclinic
• Address: Muhittin Mahallesi, Fikir Sokak 27/4, İnan Plaza, 59860 Çorlu / Tekirdağ, Türkiye
• Telephone: +90 282 651 37 43 · +90 282 652 87 76 · +90 549 590 22 00
• E-mail: healthtourism@miradentturkey.com

You can use the e-mail address above for any question about this notice or to exercise the rights described in section 9.

2. Representative in the European Union

Article 27 GDPR requires a controller that is not established in the Union, but offers goods or services to people in the Union, to designate a representative in writing in a Member State where those people are. The exemption in Article 27(2) applies only where the processing is occasional, does not include the processing of special categories of data on a large scale, and is unlikely to result in a risk to the rights and freedoms of individuals.

Our websites address patients living in the European Union, and our forms are designed to receive data concerning health. We therefore do not assume that this exemption covers us, and the designation of a representative is likely to be required for our activities. That designation has not yet been made. It is an outstanding item, and this notice will be updated with the representative’s name and address once it is in place.

Until this notice names a representative, please direct all data protection requests to the controller’s address and e-mail address given in section 1.

3. What personal data we process

We collect personal data directly from you, through the forms on our websites, and automatically through our web server and the cookies described in section 6. We do not buy personal data and we do not collect it from third-party sources.

Special category data (Article 9 GDPR)

The X-ray images you upload and the tooth and symptom selections you make are data concerning health and therefore special categories of personal data under Article 9(1) GDPR. Processing of such data is prohibited unless one of the conditions in Article 9(2) applies. Please read sections 4 and 7 before you upload an X-ray image or describe a complaint, and send us only what is necessary for your enquiry.

If you prefer not to send health data through the website, you may contact us by telephone or e-mail and send clinical material later, once a care relationship has been established.

4. Why we process your data and on what legal basis

Why we rely on your explicit consent for health data

Article 9(2)(h) GDPR permits the processing of health data for the purposes of medical diagnosis and the provision of health care by a professional subject to an obligation of secrecy. When you fill in a form on our website, you are not yet our patient and no care relationship exists, so we do not rely on that provision for the website forms. Instead, we ask for your explicit consent under Article 9(2)(a) GDPR.

Consent is only valid if it is specific, informed and freely given. For that reason, your consent to the processing of health data is asked for in a separate, optional consent box on the forms that can receive health data, with its own consent text, and not through the box by which you confirm that you have read this notice. Confirming that you have read an information notice is not consent, and we do not treat it as consent.

You are never required to send us health data in order to use the website or to contact us. If you withdraw your consent, we stop the processing that was based on it; withdrawal does not affect the lawfulness of processing carried out before you withdrew it. Section 9 explains how to withdraw.

5. Who receives your data

• Miradent staff who handle enquiries and appointments. Every form submission is delivered as an e-mail to healthtourism@miradentturkey.com and is read there by our own personnel. Clinical material is reviewed by our dental professionals.
• Our hosting provider. Our websites and the e-mail notifications are processed on a server operated by Leaseweb USA in Manassas, Virginia, United States (see section 7). The provider acts as a processor and has access to the data stored on that server for the purpose of operating it.
• Google (Google Ireland Limited and Google LLC), for three services we use: Google Analytics 4 (measurement identifier G-KCQ13XCRDX), Google reCAPTCHA on our forms, and the Google Maps map embedded on our contact and address pages. Each of these services causes data such as your IP address and device and browser information to be sent to Google, which may process it outside the European Economic Area, including in the United States.

Our websites contain ordinary links to social media accounts (Instagram, LinkedIn, Facebook, Viber). These are links only; they do not embed third-party code in our pages and they transmit nothing until you click them. We do not use Google Tag Manager, and we do not use any Yandex service.

We do not sell your personal data and we do not share it for third-party advertising. We disclose data to public authorities only where we are legally obliged to do so.

6. Cookies

Cookies and similar technologies are placed on the basis of Article 5(3) of Directive 2002/58/EC, as implemented in your Member State. Strictly necessary cookies are needed to deliver the website you asked for and are set without consent; the processing of the data they generate rests on Article 6(1)(f) GDPR. Statistics cookies and the cookies set by the embedded map are placed only after you consent, and you can change or withdraw that choice at any time through the cookie settings on the website.

We do not yet state the storage period of each individual cookie in the table above. Those periods will be added to this table, and in the meantime you can inspect and delete cookies at any time in your browser.

7. Transfers outside the European Economic Area

You should read this section carefully before you send us personal data, and especially before you upload an X-ray image.

• Where the data goes. Our websites, our database and the mechanism that sends form notifications all run on a server located in Manassas, Virginia, in the United States of America. This means that everything you enter into a form, including any X-ray image, is transmitted to and stored on a server in the United States, at least until the notification e-mail has been sent. Miradent itself, which reads those notifications, is established in Türkiye. Both are countries outside the European Economic Area, so every use of our forms involves a transfer of personal data to third countries within the meaning of Chapter V (Articles 44 to 50) of the GDPR.
• No adequacy decision covers this transfer. Under Article 45 GDPR, a transfer may take place without further authorisation if the Commission has decided that the third country ensures an adequate level of protection. Türkiye is not the subject of an EU adequacy decision. For the United States, the Commission’s adequacy decision of 10 July 2023 covers only organisations that are certified under the EU–U.S. Data Privacy Framework; we are not in a position to state that our hosting arrangement is covered by that certification, so you should assume that it is not.
• The hosting transfer: what we can and cannot say. Because the websites and the mail mechanism themselves run in the United States, the transfer of your name, e-mail address, telephone number and message is continuous and systematic, not occasional. A transfer of that kind requires an Article 46 safeguard, and it cannot properly be based on your consent or on an Article 49 derogation. We do not have such a safeguard in place today, and we will not cite one that we cannot show you. We therefore tell you plainly that this transfer currently lacks a Chapter V mechanism we can rely on, and we treat that as the most serious of our outstanding items.
• The health data you choose to send. For the X-ray image or the tooth and symptom selections, which you send to us on a single, individual occasion, we ask in addition for your explicit consent to the transfer, given after you have been informed of the risks set out in this section, under Article 49(1)(a) GDPR. We rely on Article 49(1)(a) only for that individual clinical material, because the derogation is intended for occasional, non-repetitive transfers; it is not, and we do not present it as, a basis for the continuous hosting described in the previous point.
• The same problem under Turkish law. Article 9 of Law No. 6698, as amended in 2024, likewise does not allow a continuous transfer abroad to be based on explicit consent: it requires an adequacy decision, a standard contract, binding corporate rules or an undertaking. For special categories of data the requirements are stricter still. The outstanding item described above therefore exists under both sets of rules, and the stronger requirement is the one we must meet.
• What we are doing about it. We do not currently claim to have standard contractual clauses or any other Article 46 safeguard in place with our hosting provider, nor a completed transfer impact assessment. Putting appropriate Article 46 safeguards in place, or moving the hosting of these services into the European Economic Area, is a known outstanding item and we are working on it. We will update this section when the position changes.
• What the risk means for you. In a country without an adequacy decision, the legal protections and remedies available to you may be weaker than those guaranteed in the European Economic Area. Public authorities in the destination country may be able to obtain access to data under local law, and you may have no equivalent right of redress against them. For the United States this concerns, in particular, government access to data held by communications and hosting providers.
• Google. Transfers arising from Google Analytics, reCAPTCHA and the embedded map are governed by Google’s own terms and transfer mechanisms. These services are loaded, or operate, on the basis described in sections 4 and 6, and you can prevent the statistics and map transfers entirely by declining those cookie categories.
• Your choice. If you do not wish your personal data to be transferred on this basis, please do not use the website forms. You can reach us by telephone on the numbers in section 1, and we will agree another way to exchange any clinical material.

8. How long we keep your data

We state only what we can confirm.

• Uploaded X-ray files. An uploaded file is written to a temporary directory on the server, attached to the notification e-mail and then deleted from the server. Since 10 November 2026 that directory is also closed to web access, and deletion takes place whether or not the e-mail was sent successfully.
• Form content in our mailbox. The notification e-mail, including any attached X-ray image, remains in our e-mail account and, where you become a patient, in your patient record.
• Server records and cookies. Server records are kept for security and fault diagnosis. Cookie lifetimes are set by us or, for Google cookies, by Google.

The criteria we apply are these: correspondence is kept for as long as your enquiry, and any treatment relationship arising from it, requires; where you become a patient, your data is kept for as long as the health legislation applicable to us requires it to be kept; and data processed on the basis of your consent is deleted when you withdraw that consent, unless a legal obligation requires us to keep it longer.

Miradent has not yet published specific retention and destruction periods for these categories, and we will not state a figure here that we cannot stand behind. A retention and destruction policy is being prepared, and this section will be completed with the specific periods once it is adopted. In the meantime, you may ask us at any time how long we hold data relating to you, and you may ask us to erase it under section 9.

9. Your rights

In relation to your personal data you have the following rights under the GDPR:

• Access (Article 15) — to be told whether we process data about you and to receive a copy of it, together with information about the purposes, recipients, retention and transfers.
• Rectification (Article 16) — to have inaccurate data corrected and incomplete data completed.
• Erasure (Article 17) — to have your data deleted, including where it is no longer necessary for the purpose it was collected for or where you withdraw the consent on which it was based.
• Restriction of processing (Article 18) — to have us limit our use of your data, for example while we check whether it is accurate.
• Data portability (Article 20) — to receive the data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller, where the processing is based on your consent or on a contract and is carried out by automated means.
• Objection (Article 21) — to object to processing based on our legitimate interests under Article 6(1)(f). Where you object, we stop that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Automated decision-making (Article 22) — not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. We do not take such decisions about you. Your form submissions, including X-ray images and symptom selections, are reviewed by people.
• Withdrawal of consent (Articles 7(3) and 9(2)(a)) — to withdraw, at any time and as easily as you gave it, any consent you have given, including your explicit consent to the processing of health data and your explicit consent to the transfer described in section 7. It is enough to write to the e-mail address below; you do not have to give a reason. Withdrawal does not affect the lawfulness of processing carried out before it.
• Notification obligation (Article 19) — to be informed of the recipients to whom we have communicated a rectification, erasure or restriction, where you ask us for that information.

To exercise any of these rights, write to healthtourism@miradentturkey.com or to the postal address in section 1. We answer without undue delay and in any event within one month of receiving your request, and we will tell you if we need to extend that period as permitted by Article 12(3) GDPR. We may ask you for information needed to confirm your identity, so that we do not disclose your data to someone else. Exercising these rights is free of charge, except in the cases provided for in Article 12(5) GDPR.

10. Complaints

If you consider that our processing of your personal data infringes the GDPR, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place where you believe the infringement occurred. You also have the right to an effective judicial remedy under Articles 78 and 79 GDPR.

Because Miradent is established in Türkiye, you may in addition apply to us directly under Turkish Personal Data Protection Law No. 6698 and, if you are not satisfied with our answer, complain to the Turkish Personal Data Protection Authority.

We would ask you to contact us first, at the address in section 1, so that we have the chance to resolve the matter. This is a request, not a condition: you may go to a supervisory authority at any time without contacting us first.

11. Is it obligatory to give us your data

You are under no statutory or contractual obligation to provide any of the data described in this notice. However, some fields must be filled in before a form can be submitted:

• On the “Send your X-ray results” and “Which tooth is my discomfort in” forms, your name, e-mail address and telephone number are required fields. On the online appointment form, your name, e-mail address and message are required. Without a name and a way of reaching you we cannot identify you or reply.
• On the “Send your X-ray results” form, uploading a file is also a required field, because the whole purpose of that form is the review of an image. If you do not wish to upload an X-ray image through the website, please use another form, or telephone us instead.
• Consent to the processing of health data, and consent to the transfer described in section 7, are never required fields. If you do not give them, you can still use the website and still contact us.
• If you decline statistics or external content cookies, the website continues to work; only the measurement and the embedded map are affected.

12. Security

We take technical and organisational measures appropriate to the risk, as required by Article 32 GDPR. Our forms are protected against automated abuse by Google reCAPTCHA, which is verified on our server and not only in your browser. Uploaded X-ray files are written to a directory that is not accessible from the web and are deleted from the server once the notification e-mail has been processed, whether or not sending succeeded. We limit access to form notifications to the staff who need them in order to answer you.

These measures do not cure the transfer problem described in section 7. Security measures protect data against unauthorised access; they do not provide the Chapter V safeguard that a transfer outside the European Economic Area requires.

13. Changes to this notice

We will update this notice when our processing changes or when the outstanding items identified in sections 2, 6, 7 and 8 are resolved. The date at the top shows when this version was issued. Where a change materially affects you, and in particular where it concerns the transfers described in section 7, we will seek your consent again rather than rely on the consent you gave under an earlier version.