Privacy Policy
Last updated: September 8, 2026
Note: The Turkish version at /gizlilik-politikasi/ is the governing text for Turkish clinics; this English version is provided for convenience.
This document (the “Policy”) explains how personal data is processed in connection with Plecio (the “Service”). The Service is operated by Plecio (“Provider”, “we”).
Because the Provider is based in the TRNC, its own processing as a data controller is subject to the TRNC’s Law No. 89/2007 on the Protection of Personal Data. Because our Customers operate in Turkey, Turkey’s Law on Protection of Personal Data No. 6698 (“KVKK”) — which applies to how the Customer processes its own patients’ data — is also referenced below.
Plecio is software used by dental practices and healthcare organizations (“Customer”) to manage their own patients’ (“Patient”) data. This Policy covers two distinct data relationships: (A) data about the Customer and its Users, and (B) Patient Data the Customer enters into the Service.
1. Controller / Processor Relationship
(A) For Customer and User data (account holder practice, staff name, email, login records, etc.), the Provider is the data controller, subject to the TRNC’s Law No. 89/2007.
(B) For Patient Data, the Customer (practice) is the data controller. The Provider acts only as a data processor, processing this data solely on the Customer’s instructions. Patient notices and consent are the Customer’s responsibility; patients should contact their own practice directly.
2. Data Controller Identity (for Customer/User Data)
- Name: Plecio
- Address: Nicosia (Lefkoşa), TRNC
- Email: hello@plecio.com
3. Categories of Personal Data Processed
3.1. Customer and User Data
- Identity and contact information (name, email, phone)
- Account and authentication data (password hash, session logs, IP address)
- Billing information (practice name, tax details; card details are processed by the payment provider, not stored by us)
- Service usage data (usage logs, preference settings, language choice)
3.2. Patient Data (entered by the Customer; the Customer is the data controller)
- Identity and contact information
- Appointment and visit history
- Clinical notes, tooth chart, treatment information, and special category personal data (health data)
- Clinical photos and documents
- Payment and balance information
3.3. Landing Page Visitor Data
- Name, email, and message content submitted via contact/demo request forms
- Basic analytics/cookie data (see Section 8)
4. Purposes and Legal Bases
| Purpose | Data Category | Legal Basis |
|---|---|---|
| Account creation, authentication, subscription management | Customer/User | Necessary for performance of a contract, as data controller — TRNC Law No. 89/2007 |
| Billing and statutory record-keeping | Billing data | Legal obligation — TRNC Law No. 89/2007 |
| Providing the Service (appointments, clinical notes, tooth chart, files, payment tracking) | Patient Data | Processed as processor on the Customer’s instruction; at the Customer level, KVKK Art. 5/2-c and, for special category data, explicit consent under KVKK Art. 6 |
| Security, fraud prevention, error monitoring | Usage logs | Legitimate interest — TRNC Law No. 89/2007 |
| Responding to demo requests, marketing communication | Contact form data | Explicit consent or pre-contractual communication — TRNC Law No. 89/2007 |
5. Recipients of Personal Data
To provide the Service, data is shared, to a limited extent, with the following sub-processors, each bound by data-security agreements:
- Cloudflare R2 — file/photo/document storage (hosted in the EU)
- Brevo — email delivery (notifications, password reset, etc.)
- Sentry — technical error monitoring
- Contabo — application/server hosting
- Competent public authorities — only upon lawful request
The Provider does not share or sell data to third parties beyond those listed above for marketing purposes.
6. International Transfers
Because the Customer is based in Turkey, the Provider is based in the TRNC, and our file storage infrastructure is hosted in the European Union, Patient Data leaves Turkey in two separate hops: (i) Turkey → TRNC (the Provider’s access as data processor), and (ii) Turkey → EU (file storage). As data controller, the Customer must address both transfers under KVKK’s rules on international data transfer (Article 9). The Provider will provide reasonable assistance to the Customer in putting the appropriate legal mechanism in place (an undertaking, explicit consent, or another suitable safeguard).
7. Retention
- Patient Data is retained for as long as the Customer’s subscription is active, and for the 30-day export window provided under the Terms following termination, after which it is deleted or anonymized (subject to any mandatory statutory retention periods).
- Billing records are retained for the period required under applicable TRNC tax record-keeping rules.
- Backups are stored AES-256 encrypted and rotated regularly.
8. Cookies
plecio.com currently uses only cookies necessary for core site functionality; no analytics or tracking tool is in use. The app.plecio.com application uses strictly necessary authentication cookies for session management. This Policy will be updated if that changes.
9. TRNC Registration/Licensing Obligation
Because the Provider is based in the TRNC, Turkey’s VERBİS (Data Controllers’ Registry) does not apply to the Provider. Instead, whether a registration or license obligation arises under the TRNC’s Law No. 89/2007 and the Fee and License Regulation issued under its Article 37 (in force since 2024) must be assessed separately; see the TRNC Personal Data Protection Board (kvkk.gov.ct.tr) for guidance.
10. Data Subject Rights
For patients (KVKK Art. 11): because the Customer (practice) is the data controller for Patient Data, rights such as learning whether data is processed, requesting information, and requesting correction or deletion should be directed to the relevant practice first. The Provider, as data processor, provides reasonable assistance to the Customer in fulfilling such requests.
For Customers/Users (TRNC Law No. 89/2007): for Customer/User data the Provider processes directly as controller, data subjects have the rights recognized under the TRNC’s Law No. 89/2007, including the right to request information, correction, deletion, and to object to processing. Requests may be submitted in writing to hello@plecio.com.
11. Data Security
Data is protected through access controls, encryption (in transit and at rest), per-tenant data isolation (multi-tenant architecture), and regular encrypted backups. No system is 100% secure. In the event of a breach: for a breach affecting Patient Data, the Customer, as data controller, will notify Turkey’s Personal Data Protection Authority under KVKK Article 12, with the Provider’s reasonable assistance; for a breach affecting Customer/User data, the Provider, as data controller, will notify the TRNC Personal Data Protection Board under the TRNC’s Law No. 89/2007.
12. Changes
This Policy may be updated. Material changes are announced via in-app notice or email.
13. Contact
Questions about this Policy: hello@plecio.com