Privacy Notice under the Turkish Personal Data Protection Law (KVKK)

This Privacy Notice is provided pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 («KVKK») and informs visitors of sercanaslanturkey.com (the «Site») about how their personal data is processed when they use the Site's forms, the hair-analysis wizard or the chat assistant. For visitors located in the European Union or the United Kingdom, cross-references to the General Data Protection Regulation («GDPR») are included.

1. Data Controller

Your personal data is processed by Sercan Aslan Türkiye (the «Clinic»), a surgeon-led hair transplant, dental and aesthetic clinic based in Istanbul, Türkiye, serving international health-tourism patients. The Clinic acts as the data controller within the meaning of KVKK Article 3 and GDPR Article 4(7).

For any question or request concerning your personal data, you can contact the Clinic at hello@sercanaslanturkey.com.

2. Categories of Personal Data Processed

Depending on which features of the Site you use, the following categories of personal data are processed:

• Identity and contact data: full name, e-mail address, phone number, country and preferred language (collected via the contact/lead forms and the hair-analysis wizard).
• Enquiry and pre-assessment data: your structured answers about hair loss and treatment goals, and any optional free-text message you provide.
• Special-category (health) data: photographs of your scalp/hair that you upload optionally and only with your explicit consent (see Section 5).
• Chat data: your conversations with the AI-powered chat assistant on the Site, including any contact details you share during the conversation.
• Technical data: country derived from your IP address and your browser type.
• Advertising and analytics data (only if you grant the relevant consent in the cookie banner): advertising/analytics identifiers (Meta Pixel, Google Analytics 4 / Google Tag Manager) and campaign attribution parameters (UTM parameters, click IDs).

3. Purposes of Processing

Your personal data is processed only for the following purposes:

• Receiving, assessing and responding to your enquiry, and providing the free preliminary assessment / hair analysis.
• Informing you about treatment options and conducting the consultation process in your preferred language.
• Enabling the physician's preliminary review of photographs you upload with your explicit consent.
• Answering your questions through the chat assistant and, where needed, handing the conversation over to clinic consultants.
• Keeping the Site secure (including Cloudflare Turnstile bot protection), operating it and improving service quality.
• Measuring advertising campaigns and performing analytics on Site usage, only where you have granted the relevant consent in the cookie banner.
• Complying with legal obligations, in particular under Turkish health and tax legislation, and protecting legal rights.

4. Legal Bases

Your personal data is processed on the legal bases set out in KVKK Articles 5 and 6; the corresponding GDPR provisions are indicated for EU/UK visitors:

• KVKK Art. 5(2)(c) / GDPR Art. 6(1)(b), necessity for the establishment or performance of a contract: processing your identity, contact, enquiry and chat data to provide the preliminary assessment and consultation you request.
• KVKK Art. 5(2)(ç) / GDPR Art. 6(1)(c), compliance with a legal obligation: retention and evidentiary duties arising in particular from Turkish health and tax legislation.
• KVKK Art. 5(2)(f) / GDPR Art. 6(1)(f), legitimate interests: keeping the Site secure, preventing abuse and maintaining technical operation (IP-derived country, browser type, Turnstile bot protection), provided your fundamental rights and freedoms are not overridden.
• KVKK Art. 5(1) / GDPR Art. 6(1)(a), explicit consent: marketing and analytics cookies, advertising identifiers and campaign attribution parameters, only where you grant the relevant category in the cookie banner.
• KVKK Art. 6 / GDPR Art. 9(2)(a), explicit consent for special-category data: your scalp/hair photographs, which constitute health data, are processed solely on the basis of your explicit consent.

5. Special-Category Data: Photographs

Uploading photographs during the hair analysis is entirely optional; you can complete the forms and receive a response from the Clinic without uploading any photo. Scalp/hair photographs are health data (special-category personal data under KVKK Article 6 and GDPR Article 9) and are processed only with your explicit consent.

Your photographs are stored encrypted in the Clinic's own object storage hosted in the European Union and are viewable only by authorised clinic staff. They are never transferred to third-party customer relationship management (CRM) systems.

You may withdraw your explicit consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. AI-Powered Chat Assistant

The live chat on the Site is provided by an AI-powered assistant. In line with Article 50 of the EU Artificial Intelligence Act, the assistant clearly identifies itself as an AI, and you may request to speak with a human consultant at any time.

Chat conversations may be reviewed by clinic consultants for quality assurance and to follow up on your enquiry. Contact details you share in the chat are stored so that the Clinic can respond to you; a short data-protection notice is displayed in the chat when contact details are first shared.

7. Recipients and International Transfers

Your personal data is disclosed only to the recipients listed below, strictly for the stated purposes, in accordance with KVKK Articles 8 and 9. Transfers outside Türkiye are carried out with appropriate safeguards under KVKK Article 9 and, where the GDPR applies, under appropriate safeguards within the meaning of GDPR Chapter V (including Standard Contractual Clauses):

• Doktor365 (Türkiye, CRM/patient-management provider): your contact details and form summaries are shared so that the sales/consultation team can respond to you; your photographs are never shared.
• Resend (outside Türkiye, transactional e-mail delivery provider): to deliver e-mails to you; transfers outside Türkiye are safeguarded by Standard Contractual Clauses.
• Cloudflare (outside Türkiye, Turnstile bot protection): processes limited technical data as a processor to protect the public forms against abuse.
• Hosting provider (data centre located in the European Union): hosting of the Site and its systems.
• Meta Platforms and Google (outside Türkiye): only if you grant the Marketing and/or Analytics consent in the cookie banner, for advertising measurement and analytics purposes.

8. How Data Is Collected; Cookies

Your personal data is collected electronically and by automated means through the Site's contact/lead forms, the hair-analysis wizard, the chat assistant, and cookies and similar technologies.

The Site uses a consent management platform (cookie banner) offering category-level choices. All non-essential categories are OFF by default and are activated only with your consent. You can change your choices or withdraw consent at any time via the «Cookie settings» link in the Site footer. Records of your consent (what was consented to, when, and via which surface) are retained as proof.

The cookie categories in use are listed below; the current list of cookies in each category is shown inside the cookie banner:

• Strictly necessary: session and security cookies (including the cookie storing your consent choice, web-chat session continuity, and staff login on the admin area). No consent is required for these.
• Analytics: Google Analytics 4 (via Google Tag Manager), activated only with your consent.
• Marketing: Meta Pixel, activated only with your consent.

9. Retention

Your personal data is kept only for as long as required for the purposes stated above, subject to retention obligations under applicable law, in particular Turkish health and tax legislation. At the end of these periods, your data is deleted, destroyed or anonymised.

Consent records are retained for the legally required proof period.

10. Your Rights

Under KVKK Article 11, and, for EU/UK visitors, under Chapter III of the GDPR, you have the following rights with respect to your personal data:

• To learn whether your personal data is processed, and to request information about such processing (right of access),
• To learn the purpose of processing and whether your data is used in line with that purpose,
• To know the third parties to whom your data is transferred, in Türkiye or abroad,
• To request rectification of incomplete or inaccurate data,
• To request erasure or destruction of your data under the conditions set out in KVKK Article 7 (right to erasure),
• To request that rectification, erasure or destruction be notified to third parties to whom the data has been transferred,
• To object to a result arising to your detriment from analysis of your data exclusively by automated systems, and, under the GDPR, to object to processing and to request restriction of processing,
• Where the GDPR applies, to receive your data in a structured, commonly used, machine-readable format (data portability),
• To claim compensation for damage arising from unlawful processing of your data.

11. How to Exercise Your Rights; Complaints

You can submit requests concerning your rights to hello@sercanaslanturkey.com. Applications under the KVKK are answered free of charge as soon as possible and within thirty (30) days at the latest.

If your application is rejected, you find the response insufficient, or you receive no response in time, you have the right to lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu). If you are located in the EU/UK, you may also lodge a complaint with your local supervisory authority.

12. Medical Information Disclaimer

The content on the Site is provided for general information purposes only and does not constitute medical advice. Decisions about treatment are made only after a clinical assessment by the physician. Treatment results vary from person to person; no outcome is guaranteed.