Personal Data Protection Notice

Data controller

Data controller: Cankat Pilavcı Saç Ekimi Kliniği. Address: Levent, Tekirler Sokak No:7, 34330 Beşiktaş, İstanbul, Türkiye. Telephone: +90 532 542 18 72. Email: info@cankatpilavci.com.

Personal data processed

• Identity data: first name, surname, age range, sex
• Contact data: telephone, WhatsApp number, email, address
• Health data (special category): history of hair loss, photographs of the scalp, medical history, medication taken
• Transaction security data: IP address, cookie records, browser information
• Visual data: before/after photographs, subject to your consent

Purposes of processing

• Assessing free preliminary analysis requests and responding to you
• Appointment planning, treatment process and follow-up
• Delivering the health service and keeping medical records
• Meeting statutory retention, reporting and audit obligations
• Where you have given explicit consent: promotional, satisfaction and communication activities

Legal grounds

Your personal data is processed under Article 5 of Law No. 6698 on the grounds of the establishment and performance of a contract, legal obligation and legitimate interest. Your special category health data is processed under Article 6/3 for the protection of public health and the delivery of diagnosis, treatment and care services, by health personnel bound by a duty of confidentiality, or on the basis of your explicit consent.

Transfers

Your data may be transferred only to the extent the service requires: to contracted laboratory and anaesthesia service providers, IT infrastructure providers, and authorised public institutions. Transfers abroad are made only with your explicit consent or where the conditions of Article 9 of Law No. 6698 are met.

Retention periods

Medical records are kept for at least 20 years as required by the applicable legislation; contact and enquiry records for 10 years from the end of the relationship; cookie records for the period stated in the cookie policy. At the end of the period the data is deleted, destroyed or anonymised.

Your rights (Article 11)

• To learn whether your personal data is processed and to request information about it
• To learn the purpose of processing and whether it is used in line with that purpose
• To know the third parties to whom it is transferred in Türkiye or abroad
• To request correction if it is incomplete or inaccurate
• To request its erasure or destruction
• To object to a result reached against you through analysis by automated systems
• To claim compensation for damage arising from unlawful processing

How to apply

You may send your requests by email to info@cankatpilavci.com or in writing to our clinic address. Applications are concluded free of charge within 30 days at the latest.

For patients in the UK and the EU (UK GDPR / GDPR)

The clinic is based in Türkiye and processes personal data primarily under Turkish Law No. 6698 (KVKK). Where we offer treatment to people in the United Kingdom or the European Union, the UK GDPR or the EU GDPR applies in addition, under Article 3(2). The points below apply alongside those set out above.

Legal bases under the GDPR

• Entering into and performing the treatment agreement: Article 6(1)(b)
• Statutory retention and reporting obligations: Article 6(1)(c)
• Your consent, for example for photographs or information: Article 6(1)(a)
• Health data: Article 9(2)(a) (explicit consent) and 9(2)(h) (health care provided by staff bound by a duty of confidentiality)

Transfer to a third country

Türkiye is a third country with no adequacy decision from the European Commission or the UK government. When you send us your data to enquire about or undergo treatment, it is processed in Türkiye. The basis for that transfer is your explicit consent under Article 49(1)(a); before you give it, you are informed of the possible risks of a transfer made without an adequacy decision and without appropriate safeguards.

You can withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it, nor the statutory retention obligations for treatment already provided.

Your rights under the GDPR

• Access to the data processed (Article 15)
• Rectification of inaccurate data (Article 16)
• Erasure (Article 17), where no retention obligation applies
• Restriction of processing (Article 18)
• Data portability (Article 20)
• Objection to processing (Article 21)
• Withdrawal of a consent given (Article 7(3))

Right to complain to a supervisory authority

Independently of any request to us, Article 77 gives you the right to lodge a complaint with a supervisory authority — usually the authority where you habitually live, where you work, or where the alleged infringement took place. In the United Kingdom that is the Information Commissioner's Office (ICO); in the EU it is the data protection authority of your member state.

Please send GDPR requests to info@cankatpilavci.com. They are answered within one month; for complex requests that period can be extended by two months under Article 12(3), and we will tell you if it is.

Contact

For any request relating to this text, write to info@cankatpilavci.com or call +90 532 542 18 72.