Privacy and personal data

This website provides information about the clinic operated by the company listed below and receives contact enquiries.

Operating company

SAATÇİ GRUP SAĞLIK HİZMETLERİ LİMİTED ŞİRKETİ

Clinic

Özel Mustafa Saatçi Ağız ve Diş Sağlığı Polikliniği

Clinic address

Bağlarbaşı Mahallesi Feyzullah Caddesi No: 10/A, Maltepe / İstanbul

Tax office

KÜÇÜKYALI

Tax identification number

7352207784

The form sends an appointment or contact enquiry to the clinic. Submitting it does not confirm an appointment. Dates, times and preparation are agreed separately with the clinic.

• The form asks for your full name, phone number, email address and country.
• The form language, submission time and selected information/permission boxes are stored with the enquiry.
• The form does not request medical reports, X-rays, identity documents or payment details. Ask the clinic for an appropriate method before sharing such documents through general contact channels.

Contact-button clicks and successfully saved forms are counted in aggregate by day, website language and broad page type. These statistics do not store names, phone numbers, email addresses, health information, IP addresses, visitor identifiers, search text or full page addresses. Counts are kept on this website’s own server and are not sent to third-party analytics or advertising platforms. Page views are counted in aggregate by day, website language, broad page category, broad referral category and screen-width group. Full URLs, search terms, advertising click identifiers and visitor profiles are not stored. The source is kept only in the current tab’s memory. Page-view counters are deleted by a daily routine after 365 days.

This measurement uses no cookies or browser storage. Page views and button clicks are not counted when Do Not Track or Global Privacy Control is enabled. Successful form totals are calculated when an enquiry is saved.

Clicks on the home, about, treatments, contact and first blog listing pages are also counted in aggregate by day, language, screen-width group and approximate position cells within a page section. Cells in the same layout are combined; a section layout fingerprint separates different layouts and is not a visitor identifier. Forms, typed text, search results, expanded language/mobile menus, patient records and administration pages are excluded. No screen recording, session replay or mouse movement is captured. Heatmap data is not sent to third parties and is deleted from this website’s server after 90 days by the daily routine. This measurement also uses no cookies or browser storage and respects Do Not Track / Global Privacy Control.

Contact enquiries are saved in the website database and displayed in an administration panel that requires sign-in. This allows the clinic to read your enquiry and contact you. The form does not subscribe you to a marketing newsletter.

Enquiry access is limited to authorised clinic users handling requests and authorised technical service providers whose duties require access. Access credentials are not public; the administration panel requires authorisation.

The site uses HTTPS. Request limits use IP addresses to help prevent abuse; the web server and security services may process connection and request logs.

Hetzner is used for hosting and Cloudflare for traffic security and content delivery. These services may involve processing on infrastructure outside Türkiye. This technical explanation does not certify the legal basis for international data transfers.

Names, contact details, country and enquiry records submitted through the website form are subject to an upper retention limit of 365 days from submission. This is the organisation’s policy for website enquiries, not a statutory maximum for all personal data. Records may be erased earlier when their purpose ends or the conditions for erasure are met.

Once the period expires, the record is no longer shown in the administration panel and its email notification is not taken from the delivery queue. Daily maintenance erases expired enquiries and associated notification records. Access-restricted database backups are removed on a 14-day cycle, so erasure of a backup copy may be completed later than erasure of the live record.

The time, reason and number of erased records are kept in an operational audit record for at least three years, without the form’s name, phone number or email address. This policy covers website enquiries. Examination and treatment files and copies in the clinic’s email inbox are subject to separate processing and retention arrangements.

For system recovery, an encrypted copy of the database, uploaded files and necessary application settings is also kept in the technical service provider’s access-restricted Google Drive storage. These additional backups are removed on a 14-day cycle; the decryption key is not uploaded to the same Drive storage.

This page explains website contact enquiries, aggregate usage counts and technical security operations. Patient information processed during examination, diagnosis and treatment, and other data processing within the clinic, fall outside the scope of this page.

You can contact the company about the legal basis for processing your data, retention periods, who can access it and transfer details. Reading a privacy notice and giving explicit consent to processing are separate actions.

You may contact the company to exercise your rights under Article 11 of Türkiye's Personal Data Protection Law (KVKK). Explain which record or processing activity your enquiry concerns. If identity verification is needed, ask the company for a secure method.

• Ask whether your data is processed and obtain information about its use.
• Request correction of incomplete or inaccurate information, or deletion or destruction when the legal conditions are met.
• Ask about third parties receiving your data and exercise your other rights under the law.

Written requests can be addressed to the company's full legal name at the clinic address below. Phone and email are general contact channels; the nature of a request may require a legally appropriate submission and identity verification method.

When you close an announcement or open its guide, only the announcement identifier and your dismissal preference are kept in session storage so it does not reopen during that browser-tab session. This preference is not sent to the server and contains no personal, health or visitor identifier data. It is not used for advertising measurement. Dismissing a new announcement replaces the previous preference; the record is limited to the tab session.

All authorised patient coordinators and dentists can access operational patient cards. Dentists manage their own appointments and follow-ups and can view planned procedure names. Patient fees and payments are accessible to coordinators and the main administrator; overall financial and performance reports are restricted to the main administrator. Access and changes are logged. A role change ends existing sessions.

The panel may hold your name, telephone, email, country/city, communication language, enquiry channel, coordinator, contact outcome, communication note, follow-up date and appointment details. Contact details and notes in patient cards are encrypted; staff access requires additional verification. When a coordinator opens a telephone, WhatsApp or email link, the relevant provider’s own data handling terms also apply.

Operational patient cards without fee or payment records enter the daily deletion routine 365 days after the last contact or appointment activity, unless a future open appointment or follow-up exists. Cards with fee or payment records follow a separate retention policy covering five full calendar years after the year of the latest financial activity; deletion is held while a receivable remains open. This is not a universal legal maximum or a medical-record retention period. Financial records still within their retention conditions cannot be permanently deleted through the panel; archiving is not erasure. Other eligible records may be deleted earlier by an administrator, including linked web enquiries when the patient card is erased. Security event records are retained for approximately three years and rotating database backups for up to 14 days.

Authorised clinic staff may track the selected procedure, quantities, agreed fees and discounts, currency, actual receipts and refunds in the internal panel. These details are linked to the patient card, accessed through individual accounts and additional verification; procedure details and amounts are stored encrypted. Treatment search terms are processed only in the browser to find catalogue entries and are not sent to an external AI or advertising service. Search does not produce a diagnosis.

When a form is submitted, only a broad enquiry channel, such as Google advertising or social media, may be attached. Link markers are reduced to this broad category in page memory while the page is open. Raw advertising click identifiers, search terms, visitor identifiers and full referring addresses are not stored for this purpose. This feature uses no cookies or persistent browser storage and does not send patient data to advertising platforms. Automatic source classification is disabled when the browser’s Do Not Track or Global Privacy Control preference is enabled.

Only after you select “Allow”, the first-party saatci_visit cookie is used to calculate active visits and daily average/longest active time. It contains a random code, is sent only to /api/visit-activity and expires 30 minutes after the last measurement. A new code is issued on a new day. Tabs in the same browser count together; other browsers or devices may count as separate visits.

The local browser entry saatci-visit-preference stores only your allow/decline choice, notice version and a 180-day expiry time; it contains no visitor identifier. You can withdraw permission through “Visit measurement preferences” in the footer. Declining does not restrict site services. Duration is not measured when Do Not Track or Global Privacy Control is enabled.

The server stores a hash of the cookie code, consent notice version, day, first/last measurement times and total active milliseconds. The measurement table contains no name, contact or health information, patient record, page URL, form contents, IP or device fingerprint. Records are not linked with other counters or patient records, and are not sent to external analytics companies. Short-lived request limits and existing infrastructure security logs are separate.

Session records enter deletion after 48 hours since the last measurement; cleanup runs hourly while traffic is present and in the daily routine. Daily totals without identifiers enter deletion after 90 days. Copies in existing restricted, rotating database backups may remain for up to 14 days. Withdrawal removes the current session cookie and its associated server session record; anonymous aggregate statistics remain.

Active time counts only while the page is visible and in the foreground, and stops after one minute without interaction. Screen and keyboard contents are not recorded. The live figure approximates consenting visits measured in the last 60 seconds; it is not an exact count of people or patients.

Embedded posts on our Instagram page do not load until you choose “Open posts”. Your browser then connects directly to Instagram/Meta servers. Your IP address and browser details may be sent to that service, and Instagram may use its own cookies. Patient records and information entered into our forms are not added to this connection.

Your choice is not stored permanently. You can remove the embedded content by closing the posts or leaving the page. Cookies previously set by Instagram can be managed in your browser settings. Likes, comments and other interactions are subject to Instagram’s own terms.