Dentalendar — Data Processing Agreement

Last updated: October 13, 2026

This Data Processing Agreement (the “Agreement”) sets out the rights and obligations of the clinic that has a workspace in the Dentalendar app (the “Clinic”, the data controller) and nisotab (“nisotab”, the data processor) regarding the processing of personal data by nisotab on the Clinic’s behalf. It is an annex to and an integral part of the Terms of Use. The clinic owner accepts this Agreement on the Clinic’s behalf in the App, when creating the clinic or by ticking the box on the acceptance screen and tapping “Accept and continue”. The acceptance is recorded with the version, time, accepting person and clinic. The person accepting represents that they are authorized to act for and bind the Clinic; if they are not, they are personally liable for any resulting damage.

1. Parties

Data controller: the dental practice, polyclinic, clinic or company set up in the App and named on the acceptance screen.

Data processor:

• Name: nisotab
• Address: İstanbul, Türkiye
• Email: support@nisotab.com

2. Definitions

• Law: the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and its secondary legislation; where the Clinic or data subjects are in the European Economic Area and to the extent applicable, Regulation (EU) 2016/679 (“GDPR”).
• Board: the Turkish Personal Data Protection Board.
• Clinic Data: all personal data entered into the App by the Clinic and its team members or created in the App on the Clinic’s behalf (including patient records, health data, photos, financial and practice records, change history and access logs).
• Data subject: the natural person to whom Clinic Data relates.
• Sub-processor: a third party that nisotab uses to provide the Service and that may process Clinic Data (Annex 2).
• Data breach: unlawful acquisition of Clinic Data by others, or its loss, corruption or exposure to unauthorized access.

3. Subject Matter, Scope and Duration

• Subject matter and purpose: providing the Service — hosting and storing Clinic Data, displaying it to the Clinic’s authorized users and syncing it across devices, backing it up, sending notifications, and deleting it on the Clinic’s instructions.
• Data subjects: patients, their guardians and relatives; the Clinic’s staff and team members; people invited to the Clinic; suppliers and persons named in expense and inventory records.
• Data categories: identity, contact details, national ID or passport number, insurance, appointments, financial records (charges, payments, refunds, balances), images and, as special categories of personal data, health data (medical history, treatment and tooth records, intraoral photos, signed consent forms and signature images), and security records (change history, patient file access log).
• Duration: this Agreement remains in force for as long as the Clinic uses the Service; termination is governed by Section 10.

4. Instructions

• nisotab processes Clinic Data only on the Clinic’s documented instructions. The use of the App by the Clinic and its team members (adding, changing and deleting records, team and permission settings), this Agreement and the Terms of Use are the Clinic’s complete and final instructions. Additional instructions apply only if agreed in writing, at the Clinic’s cost.
• The Clinic is responsible for the lawfulness of its instructions and of the data entered into the App. If nisotab considers an instruction unlawful, it will inform the Clinic and is not required to follow it.
• nisotab may process Clinic Data other than on instructions where required by law; in that case it will inform the Clinic in advance unless the law prohibits this.

5. The Clinic’s Obligations

1. As the data controller, the Clinic is solely responsible for all obligations arising from the Law and health legislation, in particular: a valid legal basis under KVKK Arts. 5 and 6 (GDPR Arts. 6 and 9); informing patients and other data subjects (KVKK Art. 10; GDPR Arts. 13–14), including that their data is processed on cloud infrastructure in data centers abroad and by the sub-processors in Annex 2; obtaining and proving explicit consent where required; registration with the Data Controllers’ Registry (VERBİS) where required; responding to data subject requests; complying with Board decisions; retention and destruction policies; the Regulation on Personal Health Data and the rules applicable to its health facility; and professional secrecy and patient rights.
2. The Clinic enters into the App only data that it has obtained lawfully and is entitled to process, and is responsible for its accuracy.
3. The Clinic gives team members only the permissions they need, removes departing staff without delay, and ensures that its staff are bound by confidentiality. Team members’ actions in the App are attributable to the Clinic.
4. The Clinic ensures screen locks, up-to-date operating systems and strong passwords on its devices, and changes passwords and signs out sessions when a device is lost or stolen. The Clinic is responsible for breaches in environments under its control (devices; documents, receipts, photos and screenshots exported or shared from the App; email and messaging apps).
5. Determining legal retention periods, deleting data whose period has expired using the App’s deletion functions, and keeping its own copies of records it must retain by law are the Clinic’s responsibility.
6. Ready-made texts in the App (consent forms, medical history questions, procedure lists and the like) are samples; the Clinic is responsible for checking their legal and medical adequacy and adapting them where needed.

6. nisotab’s Obligations

1. nisotab does not use Clinic Data for its own purposes and does not sell or rent it, or use it for advertising, profiling or training AI models.
2. Confidentiality: nisotab ensures that persons who may access Clinic Data are bound by confidentiality. Clinic Data is accessed only for the Clinic’s support requests, security incidents, troubleshooting or legal obligations, and only as needed.
3. Security: nisotab implements the appropriate technical and organizational measures listed in Annex 1 (KVKK Art. 12; GDPR Art. 32), taking into account the state of the art, the costs of implementation and the nature of the data. Measures may be updated provided the level of protection is not reduced.
4. Data subject requests: nisotab forwards requests made directly to it to the Clinic without delay and does not respond to them unless the law requires. The App’s viewing, correction and deletion functions enable the Clinic to respond; further assistance is provided to a reasonable extent and at the Clinic’s cost.
5. Data breaches: nisotab notifies the Clinic without undue delay, where possible within 72 hours, after becoming aware of a data breach affecting Clinic Data, in the App or by email to the registered address. The notice includes, to the extent known, the nature of the breach, the categories of data and data subjects affected, its likely consequences and the measures taken or proposed. Notifying the Board, other supervisory authorities and data subjects is the Clinic’s obligation as the data controller; nisotab provides reasonable assistance. A notice or assistance is not an acknowledgment of fault by nisotab.
6. Information and audits: no more than once a year and with 30 days’ written notice, the Clinic may request reasonable information and documents on nisotab’s compliance with this Agreement; nisotab responds with written explanations and summary documents. On-site audits may take place only at the request of the Board or another competent authority, or on a concrete suspicion of a breach; on a reasonable date, during business hours, in line with the security and confidentiality rules of nisotab and its sub-processors, and at the Clinic’s cost. For sub-processors’ facilities, audits are satisfied by their published independent audit reports and certifications.
7. Requests from authorities: nisotab informs the Clinic of requests from competent authorities concerning Clinic Data unless the law prohibits this.

7. Sub-processors

1. The Clinic grants general authorization for the sub-processors listed in Annex 2.
2. nisotab enters into agreements with sub-processors imposing data protection obligations substantially equivalent to those in this Agreement (including the sub-processors’ standard data processing agreements).
3. New or replacement sub-processors are announced at least 15 days before they take effect, by updating Annex 2 and notifying in the App or by email. The Clinic may object within that period on concrete data protection grounds; if the objection cannot be resolved within a reasonable time, the Clinic’s sole remedy is to stop using the Service and delete the clinic.
4. Subject to mandatory provisions of applicable law, liability for sub-processors’ acts is governed by Section 11 of the Terms of Use.

8. International Transfers

1. Clinic Data is stored in data centers in the European Union (Frankfurt, Germany). Some sub-processors may process limited data in the United States or on global infrastructure (Annex 2).
2. The Clinic instructs nisotab to carry out the transfers described in Annex 2. Transfers are made in accordance with KVKK Art. 9 and, where applicable, Chapter V of the GDPR, relying on appropriate safeguards, primarily standard contracts; nisotab notifies the Board of the standard contracts it is party to within the statutory period.
3. Informing data subjects about international transfers and obtaining their consent where the law requires it is the Clinic’s obligation.

9. Liability and Indemnity

1. Each party is liable for breaches of its own obligations under this Agreement and the law.
2. The Clinic indemnifies nisotab against all data subject claims, damages, administrative fines, court costs and reasonable legal fees arising from its processing as the data controller, in particular from the lack of a legal basis or consent, failure to inform, VERBİS registration, unanswered data subject requests, unlawful instructions, team members’ acts and breaches in environments under its control. Amounts nisotab is required to pay for these reasons are recoverable from the Clinic together with statutory interest from the date of payment.
3. Where the parties are jointly liable towards data subjects or authorities (KVKK Art. 12(2)), liability between the parties is allocated according to which party’s breach caused the damage. nisotab’s liability between the parties is limited to damage directly caused by its own breach of this Agreement and to the limits in Section 11 of the Terms of Use, except in cases of intent or gross negligence.

10. Termination, Return and Deletion

1. This Agreement ends automatically when the clinic is deleted or the Service ends.
2. Before termination, the Clinic can view and save its data using the App’s functions. If nisotab discontinues the Service, Clinic Data is provided on written request made within 30 days of the announcement, in a commonly used machine-readable format (for example JSON / CSV and photo files).
3. When a clinic is deleted, Clinic Data is deleted from the live system immediately, photos shortly afterwards (usually within an hour), and from backups within 7 days at the latest, except data that must be retained by law.
4. Before deleting a clinic, the Clinic is responsible for copying health and financial records it must retain by law to its own systems.

11. Precedence and Other Terms

On matters of personal data protection, this Agreement takes precedence over the Terms of Use. On all other matters (limitation of liability, changes, notices, evidence, governing law and jurisdiction) the Terms of Use apply. This Agreement may be changed following the procedure in the Terms of Use; changes are announced in the App and the clinic owner is asked to accept again. If the Turkish text and another language differ, the Turkish text prevails.

Annex 1: Technical and Organizational Measures

• Access control: role and permission based access; permissions are enforced on the server, on every request, by row-level security rules. Clinics are isolated from each other: a user of one clinic cannot see another clinic’s data.
• Encryption: TLS in transit; encryption at rest (AES-256) by the hosting provider.
• Authentication: passwords stored only as secure hashes; email verification; rate limits on sign-in emails; session tokens in the device’s secure storage (Keychain / Keystore).
• Photos and files: private storage; permission check on every access; automatic removal of files whose record is deleted.
• In-app protection: optional Face ID / fingerprint lock and screenshot blocking; no patient names in push notifications; email addresses and long numbers masked in error reports.
• Accountability: change history and patient file access log that users cannot alter.
• Backups and continuity: daily backups by the hosting provider (7 days).
• Organizational measures: least privilege; restricted access to administrative accounts with multi-factor authentication; confidentiality obligations; automated tests for database security rules; incident response and breach notification process.

Annex 2: Sub-processors

Questions: support@nisotab.com