Privacy Policy

At Sercan Aslan Türkiye (the "Clinic"), we take the privacy and security of your personal data seriously. This Privacy Policy (the "Policy") explains what data we collect through sercanaslanturkey.com and through which channels, the purposes for which we process it, with whom we share it, and how you can exercise your rights.

1. Introduction and Scope

This Policy governs the processing of personal data collected through the website sercanaslanturkey.com (the "Site"). The Site is operated by Sercan Aslan Türkiye (the "Clinic"), a surgeon-led hair transplant, dental and aesthetic clinic in Istanbul serving international health-tourism patients. For the purposes of this Policy, the Clinic is the data controller.

The Policy applies to visitors across all language versions of the Site (13 locales) and has been prepared in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, for visitors located in the European Union, the EU General Data Protection Regulation ("GDPR").

This Policy complements, and does not replace, the KVKK Information Notice (Aydınlatma Metni) published separately on the Site; please consult that notice for the detailed disclosures required under the KVKK. Additional information and explicit-consent texts relating to medical treatment are provided separately at the relevant stage.

2. What Data We Collect, and Through Which Channels

Your personal data is collected through the Site via the following channels:

• Contact and enquiry forms: full name, e-mail address, phone number, country, preferred language and, if you wish, a free-text message.
• Hair-analysis wizard: in addition to the contact details above, structured answers about your hair loss and treatment goals.
• Optional photo uploads: photographs of your scalp and hair area (see Section 3 for details).
• Web chat: your conversations with the AI assistant and any contact details you share in the chat (see Section 4 for details).
• Technical data: limited technical information such as the country derived from your IP address and your browser type.
• Only if you grant the Marketing category in the cookie banner: advertising and analytics identifiers (Meta Pixel, Google Analytics 4 / Google Tag Manager) and campaign attribution parameters (UTM parameters and click IDs).
• Security verification: Cloudflare Turnstile runs on the public forms to prevent bot traffic; in this context, Cloudflare processes limited technical data as a processor.

3. Hair-Analysis Photos, Special Category Data

Photographs of your scalp and hair area constitute health data and are therefore special category personal data under the GDPR (özel nitelikli kişisel veri under the KVKK). Uploading photos is entirely optional, and your photos are collected only with your explicit consent; you can contact us and request a preliminary assessment without uploading any photos. The following safeguards apply to your photos:

• Photos are stored encrypted in the Clinic's own object storage hosted in the European Union.
• Photos can be viewed only by authorised Clinic staff.
• Photos are never transferred to third-party CRMs or marketing systems under any circumstances.
• You may withdraw your explicit consent at any time; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4. AI-Assisted Web Chat

The live chat on the Site is operated by an AI-powered digital assistant. The assistant clearly identifies itself as an AI, and you may request to speak with a human consultant at any time. This disclosure is made in accordance with the transparency obligation under Article 50 of the EU Artificial Intelligence Act.

Chat conversations may be reviewed by Clinic consultants in order to respond accurately and completely to your enquiry. Contact details you share in the chat (such as your name, phone number or e-mail address) are stored so that we can respond to you; when contact details are first shared in the chat, a one-sentence KVKK notice is displayed within the conversation.

5. Purposes of Processing and Legal Bases

Your photos, as health data, are processed only on the basis of your explicit consent under Article 9(2)(a) of the GDPR and Article 6 of the KVKK. Analytics and marketing technologies run only on the basis of the consent you give via the cookie banner. Responding to your enquiries, taking steps prior to entering into a contract, and securing the Site rely on Articles 6(1)(b) and 6(1)(f) of the GDPR and the corresponding legal grounds under Article 5 of the KVKK. Statutory retention relies on compliance with a legal obligation. Within this framework, your personal data is processed for the following purposes:

• Responding to your enquiries and communicating with you in your preferred language,
• Carrying out a preliminary assessment based on your hair-analysis wizard answers and, where you have given explicit consent, your photos, and planning the consultation process,
• Ensuring the security of the Site and preventing bot traffic and abuse,
• Where you have granted Marketing consent, ad measurement, analytics and campaign attribution,
• Complying with the legal obligations to which we are subject (for example, health and tax legislation).

6. Cookies, Pixels and Consent Management

When you first visit the Site, a cookie banner (consent management platform) is shown allowing you to make category-level choices. All non-essential categories are OFF by default; no analytics or marketing technology runs without your consent.

The current list of cookies in use is available in the detail view of the cookie banner. You can change or withdraw your choices at any time via the "Çerez tercihleri / Cookie settings" link in the page footer. Records of the consents you give (what was consented to, when, and via which surface) are retained as proof. The categories in use are:

• Strictly necessary: session and security cookies (including the cookie storing your consent choice, web-chat session continuity, and staff login on the admin area). This category is required for the Site to function and is not subject to consent.
• Analytics: Google Analytics 4 (via Google Tag Manager), runs only with your consent.
• Marketing: Meta Pixel, runs only with your consent.

7. Recipients and Processors

Your personal data is never sold. Your data is shared only with the recipients below, strictly for the purposes stated and under the necessary contractual safeguards:

• Doktor365 (a CRM / patient-management provider established in Türkiye): your contact details and form summaries are shared so that the sales and consultation team can respond to you; your photos are never shared.
• Resend (transactional e-mail delivery provider): for delivering service e-mails; any transfers outside Türkiye are safeguarded by Standard Contractual Clauses (SCCs).
• Cloudflare (Turnstile bot protection): processing of limited technical data on the forms, acting as a processor.
• Hosting provider: the Site and our systems are hosted in a data centre located in the European Union.
• Meta Platforms and Google: only where you grant Marketing consent in the cookie banner, for ad-measurement and analytics purposes.

8. International Data Transfers

Part of our service infrastructure (hosting and photo storage) is located in the European Union. Cross-border transfers are carried out in accordance with the conditions set out in Article 9 of the KVKK and the safeguards provided for in Chapter V of the GDPR.

Transfers outside Türkiye in connection with transactional e-mail delivery are safeguarded by Standard Contractual Clauses. Data transfers to Meta Platforms and Google rely solely on your Marketing consent and cease once you withdraw that consent.

9. Data Security

We apply appropriate technical and organisational measures to prevent unlawful processing of and unauthorised access to your personal data:

• Special category data (scalp/hair photos) is stored encrypted.
• Access to data is limited to authorised Clinic staff who need it to perform their duties; the admin area is protected by staff login.
• Data is hosted in a data centre located in the European Union.
• Public forms are protected against bot traffic and abuse by Cloudflare Turnstile.

10. Retention Periods

Your personal data is retained only for as long as necessary for the purposes for which it was collected, or for as long as required by the legal obligations to which we are subject (for example, retention periods laid down in Turkish health and tax legislation); at the end of these periods, the data is deleted, destroyed or anonymised. Consent records are retained for the legally required proof period.

11. Your Rights as a Data Subject

Under Article 11 of the KVKK and Chapter III of the GDPR, you have the following rights in relation to your personal data:

You can submit your requests to hello@sercanaslanturkey.com. Applications under the KVKK are answered within thirty (30) days at the latest. You also have the right to lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu); data subjects covered by the GDPR may additionally complain to the supervisory authority in their own country.

• The right to access your personal data and to learn whether it is being processed,
• The right to have incomplete or inaccurate data rectified,
• The right to request erasure or destruction of your data,
• The right to request restriction of processing,
• The right to object to processing,
• The right to data portability, where applicable.

12. Age Limit, Medical Disclaimer, Changes and Contact

Our services are intended for persons aged 18 and over. We do not knowingly collect personal data from anyone under 18; if we become aware of such a case, the relevant data is deleted.

The content on the Site is provided for general information purposes only and does not constitute medical advice. Treatment decisions are made only after a clinical assessment by the physician; results vary from person to person and no outcome is guaranteed.

Any changes to this Policy will be published on this page, and the publication date will be updated for material changes. For any questions or requests regarding our privacy practices, you can reach us at hello@sercanaslanturkey.com.