Privacy Policy & GDPR Notice
How the Smile Studio collects, uses and protects your personal data, and the rights you have under the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK).
Last updated: 22 October 2026
Who we are
The data controller for this website and for the care we provide is:
Dr. Sahand Taheri Smile Studio (Uzm. Dr. Sahand Taheri Muayenehanesi), Kültür Mah. Esra Sok. No:5, 34340 Beşiktaş / İstanbul, Türkiye · info@drsahandtaheri.com · +90 544 354 06 09
Because we treat patients from the European Union and the United Kingdom, we apply the standards of the EU GDPR and UK GDPR in addition to Turkish law (KVKK). Turkish-language information under KVKK Article 10 is available on the Turkish version of this website.
What data we collect
- Contact details: name, phone or WhatsApp number, email address, country.
- Enquiry details: the treatment you are interested in, your message, and photographs or X-rays you choose to send.
- Health data: medical history, dental records, X-rays, scans and photographs needed to plan and provide treatment. This is a special category of data and receives additional protection.
- Appointment and travel information: dates, preferred times and, if you ask us to help, arrival details.
- Website data: technical information such as device type, browser, pages visited and approximate location, collected through cookies only as described in our Cookie Policy.
Why we use it and our legal basis
| Purpose | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|
| Answering your enquiry and arranging a consultation | Steps at your request before a contract, Art. 6(1)(b) | Art. 5(2)(c) |
| Assessing photographs and planning treatment | Explicit consent, Art. 9(2)(a); provision of health care, Art. 9(2)(h) | Art. 6(3) – processing by persons under a duty of confidentiality for medical diagnosis and treatment |
| Providing treatment and keeping medical records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c); health care, Art. 9(2)(h) | Art. 5(2)(a), (ç) and Art. 6(3) |
| Analytics and improving the website | Consent, Art. 6(1)(a) | Explicit consent, Art. 5(1) |
| Security and preventing misuse of the website | Legitimate interests, Art. 6(1)(f) | Art. 5(2)(f) |
Health data and advertising
Health data is used only to plan and provide your care. We never share health data with advertising platforms, and we do not use the content of your messages or photographs for marketing.
Who we share data with
- Dental laboratories that make your veneers, crowns or aligners, receiving only the scans and instructions they need.
- Service providers acting on our instructions: website hosting, secure email and patient management software.
- WhatsApp (Meta Platforms Ireland Ltd.) if you choose to contact us on WhatsApp. Messages are end-to-end encrypted; WhatsApp's own privacy policy applies to your use of the app.
- Authorities such as the Ministry of Health, where Turkish law requires it.
We do not sell personal data.
International transfers
The studio is located in Türkiye. When you send us data from the EU or UK, it is transferred to Türkiye, a country without an EU adequacy decision. Transfers take place because they are necessary to provide the care you request (GDPR Art. 49(1)(b)) or on the basis of your explicit consent (Art. 49(1)(a)). Where service providers transfer data abroad, we use standard contractual clauses as required by GDPR and by KVKK Article 9 as amended in 2024.
How long we keep it
- Enquiries that do not lead to treatment: up to 2 years from the last contact, then deleted.
- Medical and dental records: for the period required by Turkish health legislation.
- Accounting records: 10 years, as required by Turkish commercial and tax law.
- Analytics data: up to 14 months.
Your rights
Under GDPR (Articles 15–22) and KVKK (Article 11) you can ask to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent at any time without affecting earlier processing. Some medical records must be kept by law even if you ask for deletion.
Send requests to info@drsahandtaheri.com. We reply within one month (GDPR) and no later than 30 days (KVKK).
Complaints
You can complain to the Turkish Personal Data Protection Authority (KVKK) at kvkk.gov.tr, or to the data protection authority in the EU country where you live or work. In the UK, contact the Information Commissioner's Office (ico.org.uk).
Security
We use encrypted connections, access controls and confidentiality obligations for all staff and providers. Please do not send sensitive information through public social media comments.
Changes to this policy
We update this policy when our services or the law change. The date at the top shows the latest version.
Contact us at info@drsahandtaheri.com or +90 544 354 06 09.
