ask.dentist Privacy Policy

1. Introduction & Operating Entity

ask.dentist (including the primary domain https://ask.dentist, subdomains, clinical and administrative portals, mobile applications, and all affiliated digital telemedicine coordination services) is owned, operated, and legally administered by:

Rehabtürk is committed to safeguarding patient confidentiality and personal data in strict compliance with the European Union General Data Protection Regulation (GDPR - Regulation (EU) 2016/679), the Turkish Personal Data Protection Law (KVKK - Law No. 6698), the US Health Insurance Portability and Accountability Act (HIPAA) security standards, and the Google API Services User Data Policy.

2. Information We Collect

We collect only information necessary to deliver clinical triage, doctor consultations, appointment booking, and authorized educational media publishing:

2.1 Personal & Identity Information

• Identifiers: Full name, date of birth, gender, nationality, country of residence, passport or national ID (required solely by certified clinics for cross-border healthcare registration).
• Contact Details: Verified email address, telephone/mobile number, and language preference.
• Account Authentication: Encrypted user credentials, Firebase Auth UID, and Two-Factor Authentication (2FA) verification metadata.

2.2 Health Data & Dental Clinical Records (Protected Health Information - PHI)

• Clinical Symptoms: Chief dental complaint, pain severity, medical history, allergies, systemic conditions, and prior dental treatments.
• Diagnostic Radiographs & Imaging: Intraoral photographs, facial smile photos, digital panoramic X-rays, periapical X-rays, and 3D CBCT scans submitted for clinical review.
• Treatment Proposals: Preliminary AI triage evaluations, licensed dentist diagnostic notes, cost quotations, and clinical treatment roadmaps.

2.4 Meta (Facebook/Instagram) & TikTok Developer APIs

When dental clinics link their Meta or TikTok accounts, we store securely encrypted OAuth tokens solely to publish authorized dental educational posts, reels, and clinical transformations.

2.5 Technical & Device Information

• IP address, browser type and version, device hardware specifications, operating system, and anonymized diagnostic logs.

3. How We Use Collected Information

We process information exclusively for lawful healthcare and service delivery purposes:

• Clinical Triage: Connecting prospective patients with verified, licensed dentists and clinics in Turkey for diagnostic opinions and treatment estimates.
• AI-Assisted Dental Analysis: Assisting clinicians via private, enterprise Google Gemini and OpenAI endpoints configured with zero-training retention guarantees.
• Travel & Logistics Management: Arranging ground airport transfers and hotel stays through licensed Turkish tourism partners upon patient booking.
• Authorized Social Publishing: Uploading approved educational videos to YouTube, Meta, and TikTok upon explicit doctor action.
• Operational Communications: Delivering appointment reminders, SMS verification OTP codes, and emergency treatment updates.

4. Legal Grounds for Processing (GDPR & KVKK)

• Explicit Consent (GDPR Art. 9(2)(a) & KVKK Art. 6): For processing sensitive health imagery, X-rays, and medical history.
• Contractual Performance (GDPR Art. 6(1)(b)): For facilitating clinic reservations, appointments, and platform operations.
• Legal Compliance (GDPR Art. 6(1)(c)): Fulfilling medical documentation obligations under Turkish Ministry of Health health tourism legislation.

5. Data Sharing & Third-Party Protections

ask.dentist NEVER sells, rents, leases, or trades personal or medical data to third-party advertisers or commercial brokers.

Data is shared solely on a strict need-to-know basis with:

• Attending Dental Clinics: Certified dental practitioners and medical staff actively evaluating your case.
• Certified Cloud Infrastructure: Google Cloud Platform and Firebase (EU and US secure regions, ISO 27001, SOC 2, and HIPAA BAA certified).
• Communication Gateways: Agora (encrypted WebRTC telemedicine video calls) and Syronica CPaaS (transactional SMS OTP delivery).

6. SMS Communications & Opt-Out Policy

By registering an account on ask.dentist, users consent to receive operational and transactional SMS messages (such as login verification OTPs, appointment confirmations, and consultation updates).

• Consent is obtained explicitly prior to dispatching any SMS communication.
• Consent is not a condition of purchase.
• Users may opt out of SMS messages at any time by replying STOP to any message received.
• Standard message and data rates may apply.
• No Mobile Sharing: Mobile phone numbers and text messaging originator opt-in data will never be shared with or sold to third parties or affiliates for marketing or promotional purposes.

7. Data Security & Storage

• Encryption in Transit: All data transmitted to or from ask.dentist is encrypted using TLS 1.3.
• Encryption at Rest: All stored database documents, patient radiographs, and credentials are encrypted using AES-256.
• Access Protection: Mandatory Two-Factor Authentication (2FA) and Role-Based Access Controls (RBAC) enforced on all staff and clinical dashboards.

8. Data Retention & Right to Erasure

• Account Lifetime: Personal and account information is retained for the active lifetime of your account.
• Medical Record Statutory Retention: Pursuant to Turkish Ministry of Health regulations, international health tourism treatment records are archived for the mandatory statutory period (up to 10 years).
• Immediate Account & Data Deletion: You have the absolute right to request deletion of your account and personal records. You can execute immediate deletion at https://ask.dentist/data-deletion or by contacting privacy@ask.dentist.

9. Your Legal Rights & Google Permissions Revocation

Under GDPR, KVKK, and international privacy laws, you possess the right to:

• Access, inspect, and receive a copy of your personal and health records.
• Correct inaccurate or incomplete information.
• Withdraw consent previously provided for data processing or SMS alerts.
• Revoke Google Account Access: You can revoke ask.dentist's permissions to your Google and YouTube account at any time via the official Google Account Permissions Manager.

10. Contact Information & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy, our data practices, or your legal rights, please contact our Data Protection Office: