Skip to content
HairDentalAesthetic
Sercan Aslan Turkey
Legal documents

Privacy Policy

Last updated: 6 October 2026

Data Controller

The details below identify the data controller responsible for your personal data.

Legal name
Sercan Aslan

This Privacy Policy explains in plain words what personal data Sercan Aslan Turkey (the "Clinic", "we") collects through the website sercanaslanturkey.com (the "Site"), why we use it, who receives it, where it is stored and what your rights are. It applies to every language version of the Site. It is written under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, for visitors in the European Union, the EU General Data Protection Regulation ("GDPR"). The KVKK Notice and the Cookie Policy on this Site give more detail on some points.

1. Who is responsible for your data

The Clinic is the data controller. Our official company details (legal name, registration numbers and address) are shown in the "Data Controller" box on this page. For any question about your data, write to hello@sercanaslanturkey.com.

2. What data we collect

  • Forms (contact form, consultation forms, campaign page forms): your name, e-mail address, phone or WhatsApp number, country, preferred language, the treatment you are interested in and, if you write one, your message.
  • Hair analysis: the same contact details plus your answers about your hair loss and your goals. Some answers can be health data, for example whether you take medication.
  • Photos: photos of your scalp, hair or teeth that you choose to upload. Photos are health data. Uploading them is optional.
  • Chat: what you write to our chat assistant, files you attach and any contact details you share there.
  • Technical data sent with a form: your IP address, your browser type, the address of the page, the address of the page or website you came from, campaign codes in those addresses (such as utm codes or ad click IDs from Meta or Google) and the time. We use them to protect the forms, to see which ad or page brought the request and as proof of your consent.
  • Cookies and similar tools: see section 8 and the Cookie Policy.
  • Meta lead forms: if you fill in one of our forms inside Facebook or Instagram, Meta sends us the details you entered there.

3. Why we use your data and on what legal basis

  • To answer your request, prepare your free evaluation and plan a possible treatment. Basis: steps you ask for before a contract (KVKK Art. 5(2)(c), GDPR Art. 6(1)(b)) and your consent in the form.
  • To contact you by e-mail, SMS, WhatsApp and phone, including offers and campaigns. Basis: your consent in the form (KVKK Art. 5(1), GDPR Art. 6(1)(a)).
  • To measure our ads together with advertising partners such as Meta (see section 6). Basis: your consent in the form.
  • To let a doctor look at your photos and health-related answers for a pre-assessment. Basis: your explicit consent (KVKK Art. 6, GDPR Art. 9(2)(a)).
  • To keep the Site and the forms safe and to stop spam and abuse. Basis: our legitimate interest (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)).
  • To follow the law (for example health and tax rules) and to protect our legal rights. Basis: legal obligation and the establishment or defence of a right (KVKK Art. 5(2)(ç) and (e), GDPR Art. 6(1)(c) and (f)).

4. One consent box in every form

Every form on the Site has one box that you must tick before you send it. By ticking it you confirm that you have read this Policy and the KVKK Notice, and you agree that:

  • your details are used to answer your request and to prepare your evaluation;
  • the Clinic may contact you by e-mail, SMS, WhatsApp and phone, including with offers and campaigns;
  • your contact details are shared in coded (hashed) form with advertising partners such as Meta, which may be located outside Türkiye, to measure our ads (see section 6).

In the hair analysis the box also covers your health-related answers and your photos. We keep a record of your consent (date, time, IP address and browser). You can withdraw your consent at any time by writing to hello@sercanaslanturkey.com. Withdrawing does not affect what was done before.

5. Chat assistant (artificial intelligence)

The chat assistant on the Site ("Leo") is a computer program that uses artificial intelligence (AI). It is not a person and not a doctor, and its answers can contain mistakes. Your messages are sent to our AI provider (see section 7) so that the assistant can answer. Clinic consultants can read the chat, take it over and contact you. You can ask to talk to a person at any time. Photos and files you attach in the chat are kept in our own storage and are not sent to the AI provider.

6. Sharing with Meta to measure our ads

When you send a form on the Site with the consent box ticked, our server sends a "Lead" event to Meta (the company behind Facebook and Instagram) through Meta's Conversions API. This is done by our server, not by your browser. So it also happens if you rejected marketing cookies in the cookie banner: the legal basis is the consent box in the form, not the cookie banner. The event contains:

  • your e-mail address, phone number, first name, last name and country, each turned into a code (SHA-256 hash) before sending. A hash is a one-way code: Meta cannot read your details from it, but it can compare it with the codes of its own users;
  • a coded reference number of your request;
  • your IP address and browser information;
  • Meta's click and browser IDs (fbclid, _fbc, _fbp), if the page address or your browser has them;
  • the page address, the treatment area of your request (hair, dental or aesthetic) and an estimated value of the request.

Meta uses this to tell us how many requests came from our ads and to show our ads to people who are more likely to be interested. Meta Platforms Ireland Ltd. and Meta Platforms, Inc. (USA) process it under their own terms and privacy policy (facebook.com/privacy/policy) and may store it in the USA and other countries. After you withdraw your consent, we do not send new events about you.

7. Who receives your data

We do not sell your data. We share it only with the service providers below, and only as far as each one needs it for its job. Some of them receive data only after the related service is switched on (for example e-mail or SMS sending).

  • Doktor365 (Türkiye), our patient and sales management system (CRM): your contact details and a summary of your form answers. For the hair analysis this summary can include health-related answers. Photos are not sent; the CRM only gets a note that photos exist, with a link to our own admin panel.
  • Meta Platforms (Ireland and USA): ad measurement as described in section 6; the Meta Pixel in your browser if you accept marketing cookies; WhatsApp messages when we write to you on WhatsApp.
  • Google (Ireland and USA): Google Tag Manager, Google Analytics and Google Ads in your browser (see section 8). If we switch on server-side measurement for Google Analytics, our server also sends Google a "lead" event with the random analytics ID of your browser, without your name, e-mail or phone.
  • Microsoft (USA): Microsoft Clarity, which records how pages are used, only if you accept analytics cookies.
  • Anthropic (USA): provides the artificial intelligence behind the chat assistant and receives your chat messages. If we change the AI provider, we will update this list.
  • Cloudflare (USA): Turnstile, a security check on our forms that stops bots.
  • Resend (USA): sends our e-mails to you.
  • Netgsm (Türkiye): sends our SMS messages to you.
  • Sentry (USA): error reports from the Site and our server, if switched on. They can contain technical data such as an IP address and a page address.
  • Backup storage: if we keep a copy of our backups outside our own server, it is stored encrypted with a cloud storage provider.
  • Public authorities and courts, when the law requires it.

8. Cookies, Google Consent Mode and the cookie banner

The cookie banner lets you accept or reject analytics, marketing and personalization cookies. They are off until you accept them. Google's tags load on every page in "Consent Mode": until you accept, they do not use cookies, but they can still send Google basic signals without cookies, for example that a page was viewed, the page address, the time, your IP address and browser type. Google uses these signals to estimate visits and ad results. The Meta Pixel and Microsoft Clarity load only after you accept the related category. Your cookie choice is stored only in your browser. The Cookie Policy lists the cookies we use.

Important: the cookie banner only controls cookies in your browser. It does not control what happens to the details you send in a form. That is covered by the consent box in the form (sections 4 and 6).

9. Where your data is stored and transfers abroad

Our website, database and file storage (including photos and chat attachments) run on servers in a data centre in Türkiye. If you are in the European Union, this means your data is processed in Türkiye, a country outside the EU. Some providers in section 7 (Meta, Google, Microsoft, Anthropic, Cloudflare, Resend, Sentry) are based in, or store data in, the USA or other countries. Transfers abroad are made under Article 9 of the KVKK (for example on the basis of standard contracts notified to the Turkish Personal Data Protection Authority, or your explicit consent where the law allows it) and, for visitors in the EU, under Chapter V of the GDPR.

10. How we protect your data

  • The Site uses encrypted connections (HTTPS).
  • Only authorised Clinic staff can see your data, through a password-protected admin panel where each person gets only the access their role needs.
  • Photos and files are kept in our own storage on our servers. They are not on public links; staff open them through the admin panel.
  • Our database backups are encrypted.
  • The forms are protected against spam and abuse.

No system is completely safe. If a data breach affects you, we will inform you and the authorities as the law requires.

11. How long we keep your data

We keep request, contact, chat and photo data for the period set in our data retention policy. At the moment this is up to 10 years after we receive it, which is the longest period Turkish commercial and tax law asks for. When the period ends, the data is deleted or made anonymous automatically. If a law requires us to keep something longer (for example medical records after a treatment), we keep it for that period. You can ask us to delete your data earlier (section 12); we do so unless the law requires us to keep it.

12. Your rights

Under Article 11 of the KVKK and Chapter III of the GDPR you can:

  • ask whether we process your data and get a copy of it,
  • ask why we process it and who receives it, in Türkiye or abroad,
  • ask us to correct wrong or incomplete data,
  • ask us to delete it,
  • object to processing or ask us to limit it,
  • withdraw your consent at any time,
  • receive your data in a common, machine-readable format (data portability under the GDPR),
  • object to a result that is against you and comes only from automated processing,
  • ask for compensation if unlawful processing caused you damage.

Write to hello@sercanaslanturkey.com. We answer free of charge within 30 days at the latest. You can also complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) and, if you are in the EU, to the data protection authority of your country.

13. Age limit, medical information and changes

Our services are for people aged 18 and over. We do not knowingly collect data from anyone under 18; if we find such data, we delete it.

The Site and the chat assistant give general information only. They are not medical advice. Treatment decisions are made only after a doctor has examined you. Results differ from person to person and no result is guaranteed.

We may update this Policy. The date of the last update is shown on this page.