UDENTIVA 스마트 치과 관리 플랫폼
Georgia
Start Free
Sign In Start Free
Georgia

Privacy Policy

Effective date: 5 July 2026 · Version: 2.0

This Privacy Policy describes the practices of Arı Bulut Depolama Bilişim ve Ticaret A.Ş. (the "Company", "we", "us") regarding the personal data processed in connection with the UDENTIVA platform (the "Service"). This Policy applies to the clinic representatives who purchase the Service, to Authorized Users, to visitors of our website, and to individuals who contact us.

Important distinction: With respect to the patient data that clinics enter into the Platform, the relevant clinic is the Data Controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), while the Company acts as a Data Processor. The processing of such data is governed by the Data Processing Addendum (DPA) between the clinic and us, together with the clinic's own privacy and information notices. This Privacy Policy, by contrast, principally concerns the data that the Company processes in its own capacity as data controller (for example, customer/contact information and website visitor data).

1. Data Controller

Company details:

Arı Bulut Depolama Bilişim ve Ticaret A.Ş. Güldallar İş Merkezi, Akçaburgaz, Hadımköy Yolu Cd. No:84, 34522 Esenyurt/İstanbul, Turkey Email: [email protected] · Telephone: +90 (212) 886 52 79

2. Personal Data We Process

The principal categories of data we process in our capacity as data controller are:

3. Purposes of Processing

We process your personal data for the following purposes:

4. Legal Bases (KVKK Article 5)

We process your data on the legal bases of the establishment/performance of a contract, compliance with a legal obligation, the establishment, exercise or protection of a right, our legitimate interests provided that they do not harm your fundamental rights and freedoms, and, where required, your explicit consent.

5. Transfer of Data and Data Localization

Your personal data may be transferred, solely for the purposes set out above, to the following parties:

Transfers are carried out in accordance with Articles 8 and 9 of the KVKK.

Data localization: Your data is hosted in Turkey. In accordance with the Regulation on Personal Health Data (Articles 15-16) and the Regulation on Health Information Management Systems (Article 16), the personal health data on the Platform is kept exclusively within the country and is not transferred abroad. None of our sub-processors may host health data outside Turkey.

6. Retention Periods and Disposal

We retain your personal data for the period required by the purpose of processing and for the limitation/retention periods prescribed by the relevant legislation (e.g., tax, commercial, contractual). Retention and disposal are carried out within the framework of the "Regulation on the Deletion, Destruction or Anonymization of Personal Data" No. 30224 dated 28/10/2017.

The targeted retention periods for the categories of data processed on the Platform are, in summary, as follows: health information for 30 years from the death of the relevant individual; imaging/radiography records for 40 years from the date they are processed; financial records for at least 10 years; access/transaction logs for at least 5 years. Data whose maximum period has expired and that is not subject to a legal retention obligation or a legal hold is deleted, destroyed or anonymized under a periodic disposal approach carried out every six months (June/December). The fully automated production implementation of the periodic disposal process is on our roadmap; until then, disposal is carried out in a controlled and documented manner. For details, see Article 9 of the DPA.

7. Data Security

To safeguard your data, in line with Article 12 of the KVKK and the Personal Data Security Guide, we apply reasonable technical and administrative measures, including: row-level tenant isolation (RLS — fail-closed), argon2id password hashing, encryption in transit and at rest, role-based access control (RBAC), two-factor authentication (2FA), append-only audit logging, masking of sensitive fields (national ID number/health data), network (loopback) isolation, regular backups and access controls. TS ISO/IEC 27001 certification and regular penetration-test reporting are on our roadmap. Nevertheless, we remind you that the absolute security of data transmitted over the internet cannot be guaranteed.

8. Cookies

Cookies are used on our website and on the Platform. For details, please refer to the Cookie Policy document.

9. Data Subject Rights (KVKK Article 11)

Under the KVKK, you have the right to: learn whether your data is being processed, request information about it, learn the purpose of processing, request rectification, request erasure/destruction, learn the parties to whom the data has been transferred, data portability, object to results reached against you through automated systems, and request compensation for damages.

To exercise these rights, you may apply to [email protected] or to the postal address above. Applications are concluded within 30 days at the latest.

10. Changes

This Policy may be updated. Material changes are announced via the Platform or the website. The current version is always published on this page.

11. Relevant Legislation