Privacy Notice under the Turkish Personal Data Protection Law (KVKK)

This notice is given under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"). It tells you in plain words how your personal data is processed when you use the forms, the hair analysis or the chat assistant on sercanaslanturkey.com (the "Site"). For visitors in the European Union or the United Kingdom, the matching rules of the General Data Protection Regulation ("GDPR") are also named. The Privacy Policy and the Cookie Policy give more detail.

1. Data controller

Your personal data is processed by Sercan Aslan Turkey (the "Clinic"), a doctor-led hair, dental and aesthetic clinic in Istanbul, Türkiye. The Clinic is the data controller under KVKK Article 3 and GDPR Article 4(7). Our official company details are shown in the "Data Controller" box on this page. Contact: hello@sercanaslanturkey.com.

2. Which personal data we process

• Identity and contact data: name, e-mail address, phone or WhatsApp number, country, preferred language.
• Request data: the treatment you are interested in, your answers in the hair analysis, your message.
• Health data (special category): health-related answers (for example about medication) and the photos you choose to upload.
• Chat data: the messages and files you send to the chat assistant and the contact details you share there.
• Technical and marketing data: IP address, browser type, page address, the address of the page or website you came from and campaign codes (utm codes, ad click IDs) sent with a form; cookie data as explained in the Cookie Policy.
• Consent records: date, time, IP address and browser of the consent you give in a form.

3. Why we process it

• to answer your request and prepare your free evaluation,
• to inform you about treatments and plan your consultation in your language,
• to let a doctor do a pre-assessment with your answers and photos,
• to answer you through the chat assistant and hand the chat to a consultant when needed,
• to contact you by e-mail, SMS, WhatsApp and phone, including with offers and campaigns,
• to measure our ads, including sharing coded contact details with Meta (section 6),
• to keep the Site secure and prevent spam and abuse,
• to meet our legal duties (for example under health and tax law) and protect our legal rights.

4. How we collect it and on what legal basis

We collect your data electronically through the Site's forms, the hair analysis, the chat assistant and cookies, and through our forms on Facebook or Instagram (Meta lead forms) if you fill them in there. The legal bases are:

• Your explicit consent (KVKK Articles 5(1) and 6; GDPR Articles 6(1)(a) and 9(2)(a)). The single consent box in each form covers: contacting you, including offers and campaigns; sharing your contact details in coded form with advertising partners such as Meta, which may be located abroad; and, in the hair analysis, your health-related answers and photos. Cookies other than necessary ones rely on your choice in the cookie banner.
• Steps you ask for before a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)): answering your request and preparing your evaluation.
• Legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)): records required by health and tax law.
• Establishing, using or protecting a right (KVKK Art. 5(2)(e)): keeping proof of requests and consents.
• Legitimate interest (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)): Site security, spam protection and technical operation.

5. Health data and photos

Photos and health-related answers are special category data (KVKK Article 6, GDPR Article 9). Uploading photos is optional; you can get an answer without them. They are processed with your explicit consent. Photos are kept in our own storage on our servers in Türkiye, can be opened only by authorised staff through the admin panel and are not sent to our CRM, to Meta, to Google or to the AI provider. A summary of your answers, which can include health-related answers, is sent to our CRM (Doktor365, Türkiye) so the team can reply to you.

6. Who receives your data and transfers abroad

Your data is shared only as far as needed, under KVKK Articles 8 and 9, with:

• Doktor365 (Türkiye), our CRM: contact details and a summary of your form answers.
• Meta Platforms (Ireland and USA): server-side ad measurement (see below), the Meta Pixel if you accept marketing cookies, and WhatsApp messages.
• Google (Ireland and USA): Google Tag Manager, Google Analytics and Google Ads, as explained in the Cookie Policy.
• Microsoft (USA): Microsoft Clarity, only with analytics consent.
• Anthropic (USA): the artificial intelligence behind the chat assistant; it receives your chat messages.
• Cloudflare (USA): Turnstile security check on the forms.
• Resend (USA) for e-mails and Netgsm (Türkiye) for SMS.
• Sentry (USA): error reports, if switched on.
• An encrypted backup storage provider, if we keep backup copies outside our own server.
• Public authorities and courts, when the law requires it.

Server-side sharing with Meta: when you send a form with the consent box ticked, our server sends Meta (Meta Platforms Ireland Ltd. and Meta Platforms, Inc., USA) your e-mail address, phone number, name and country in coded (SHA-256 hashed) form, a coded request number, your IP address and browser information, Meta click IDs if present, the page address, the treatment area of your request and an estimated value of it, so that our ads can be measured. This is based on the consent box in the form and also happens if you rejected marketing cookies in the cookie banner.

Our own servers are in Türkiye. Providers in the USA or other countries receive data under KVKK Article 9 (for example on the basis of standard contracts notified to the Personal Data Protection Authority, or your explicit consent where the law allows it) and, where the GDPR applies, under GDPR Chapter V.

7. How long we keep it

We keep your data for the period set in our data retention policy. At the moment this is up to 10 years after we receive it, the longest period under Turkish commercial and tax law, unless a law requires a longer period (for example for medical records). When the period ends, the data is deleted, destroyed or made anonymous automatically.

8. Your rights (KVKK Article 11)

You have the right to:

• learn whether your personal data is processed and, if so, ask for information about it,
• learn the purpose of the processing and whether the data is used for that purpose,
• know the third parties in Türkiye or abroad to whom your data is transferred,
• ask for incomplete or wrong data to be corrected,
• ask for your data to be deleted or destroyed under KVKK Article 7,
• ask that the correction, deletion or destruction be reported to the third parties who received the data,
• object to a result against you that comes only from automated analysis of your data,
• claim compensation for damage caused by unlawful processing.

Under the GDPR you also have the rights to restrict processing, to object, to data portability and to withdraw consent at any time.

9. How to apply

Send your request in writing to hello@sercanaslanturkey.com, or use another method set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer free of charge within 30 days at the latest. If we reject your request, answer late or you find the answer insufficient, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). If you are in the EU or the UK, you can also complain to your local data protection authority.

10. Medical information

The content of the Site and the chat assistant's answers are general information, not medical advice. Treatment decisions are made only after a doctor has examined you. Results differ from person to person and no result is guaranteed.