Istanbul Hair Restoration
Get Your Free Consultation

Privacy Policy

Last updated: July 15, 2026

This policy explains what personal data we collect when you use this website and our consultation service, why we collect it, who receives it, and the rights you have over it. We have written it to be read, not skimmed — it is short by legal-document standards because we collect little and do little with it.

  1. 1. Who is responsible for your data

    The data controller is [COMPANY LEGAL NAME], [REGISTERED ADDRESS], [COUNTRY] ("we", "us"). We operate this website and an independent patient consultation and coordination service for medical travel. You can reach us through any contact channel listed on this website.

    We are not a medical provider. Where your data is processed by the partner hospital's medical team for your assessment or treatment, the hospital processes that data as a healthcare provider under its own legal obligations.

  2. 2. What data we collect

    • Identity and contact data — your name, email address, WhatsApp/phone number, and country of residence, as you provide them in the consultation form or in messages to us.
    • Health data — your self-assessed hair-loss stage and, if you choose to send them, photographs of your scalp and hair. This is special-category data under Article 9 GDPR and is treated with corresponding care.
    • Communication data — the content of messages you exchange with us by email, WhatsApp, or the website form.
    • Request metadata — which page of our site your inquiry came from and the language you used, so we can respond appropriately.
    • Technical data — minimal server and security logs generated by our hosting infrastructure. We do not use advertising trackers and do not build behavioral profiles.

  3. 3. Why we process it, and on what legal basis

    • To prepare your free assessment and coordinate your treatment — for health data, on the basis of your explicit consent (Art. 9(2)(a) GDPR), given when you submit the form or send photos; for other data, because processing is necessary for steps you request prior to entering a contract (Art. 6(1)(b) GDPR).
    • To answer your questions and stay in contact during and after treatment — Art. 6(1)(b) and our legitimate interest in providing responsive service (Art. 6(1)(f)).
    • To keep the website secure and understand aggregate usage — our legitimate interest (Art. 6(1)(f)), using data that does not identify you personally.
    • We do not use your data for third-party advertising, and we never sell it.

  4. 4. Special protection for your photos and health data

    Photos you send exist for exactly one purpose: preparing your assessment and, if you proceed, your treatment. They are shared only with the partner hospital's medical team. They are never published, never used in marketing, and never shared with anyone else without your separate, explicit, written consent.

    You may withdraw your consent at any time with effect for the future. Withdrawing consent means we can no longer provide or continue the assessment and coordination, and we will delete your health data unless a legal obligation requires retention.

  5. 5. Who receives your data

    • The partner hospital in Istanbul, Türkiye — its medical team receives your health data and relevant identity data to prepare your assessment and, if you book, to provide treatment.
    • Service providers acting on our instructions (processors) — website hosting and content delivery, and database hosting for consultation requests. These providers may not use your data for their own purposes.
    • Public authorities — only where the law obliges us to disclose.
    • Nobody else. We do not sell, rent, or trade personal data, and we do not share it with advertisers.

  6. 6. International transfers

    To provide the service, your data is transferred to the partner hospital in Türkiye. Türkiye is not covered by an EU adequacy decision. The transfer of your assessment data takes place on the basis of your explicit consent after being informed (Art. 49(1)(a) GDPR): by requesting an assessment, you ask us to share your data with the hospital, understanding that data protection law in Türkiye may differ from that of your home country and that the hospital additionally handles your data under its own healthcare confidentiality obligations.

    Our infrastructure providers may process data in the European Union and/or other jurisdictions under recognized safeguards such as the EU Standard Contractual Clauses or applicable adequacy frameworks.

  7. 7. How long we keep it

    • Consultation requests that do not lead to treatment: deleted no later than [24] months after our last contact with you, or immediately upon your request.
    • Data of patients whose treatment we coordinated: kept as long as needed to support you through the result period and thereafter only as required by statutory retention obligations.
    • You can request deletion at any time through any contact channel on this site — no form, no justification needed.

  8. 8. Your rights

    To exercise any right, contact us through any channel on this website. We respond within one month.

    • Access — ask what data we hold about you and receive a copy.
    • Rectification — have inaccurate data corrected.
    • Erasure — have your data deleted ("right to be forgotten").
    • Restriction — limit how we process your data while a question is resolved.
    • Portability — receive the data you provided in a common machine-readable format.
    • Objection — object to processing based on legitimate interests.
    • Withdrawal of consent — at any time, with effect for the future, without affecting the lawfulness of prior processing.
    • Complaint — lodge a complaint with a data-protection supervisory authority, in particular the one where you live or work.

  9. 9. Security

    We apply technical and organizational measures appropriate to the sensitivity of the data: encrypted connections (TLS) for all data in transit, access restricted to the people who need it for your case, and database-level access controls that block public access to stored requests. No internet service can promise absolute security, but we minimize both what we collect and who can see it.

  10. 10. Cookies and analytics

    This website does not use advertising cookies, cross-site trackers, or any technology that requires a cookie consent banner. If we measure site usage, we do so with privacy-respecting, aggregate analytics that do not identify individual visitors or build profiles.

    To understand how the site is used — for example, at which step people leave the consultation form — we store a random, anonymous identifier in your browser's session storage. It holds no personal data, is not shared across sites, and is erased when you close the tab. It only lets us count anonymous steps in aggregate; it never identifies you.

  11. 11. Age limit

    This website and our services are directed at adults. We do not knowingly collect data from anyone under 18. If you believe a minor has submitted data to us, contact us and we will delete it.

  12. 12. No automated decision-making

    We make no decisions about you by purely automated means. Every assessment is prepared by people — specifically, by the partner hospital's medical team.

  13. 13. Changes to this policy

    When we change this policy, we update it here with a new date at the top. If a change materially affects how your data is handled, we will make that change prominent rather than silent.

  14. 14. Contact

    For anything related to your data — questions, requests, complaints — contact [COMPANY LEGAL NAME] through any channel listed on this website.