Privacy Policy & Personal Data Notice

1. Data controller and contact details

Aliyuva Clinic determines the purposes and means of processing described in this notice and acts as the data controller.

2. Personal data we collect

Depending on how you interact with us, we may process:

• Identity and contact data: name, telephone/WhatsApp number, email address, country code, country and preferred language.
• Consultation and transaction data: treatment interest, preferred appointment date/time, questions, messages, quotations, reservation, transfer, accommodation or product-order requests.
• Health and sensitive data you choose to provide: information about hair, scalp, beard, eyebrows, teeth or medical history, photographs, videos, reports and test results.
• Technical data: IP address, browser, device, operating system, visited page, timestamp, language preference, cookies and security/error logs.
• Marketing data: communication preferences, consent and opt-out records, only where a separate optional marketing choice is provided.

3. How we collect data

We collect data directly from you through website forms, Meta/Facebook/Instagram instant forms, telephone, email, WhatsApp and documents or media you send. We also collect limited technical data through cookies, server logs and security systems. If another person provides information on your behalf, they must be authorised to do so.

4. Purposes and legal bases

We process personal data only for specified and legitimate purposes, including:

• Receiving and answering consultation, appointment, quotation and service requests; taking steps before entering into or performing a contract.
• Carrying out a preliminary assessment and coordinating an appropriate healthcare professional or provider.
• Storing the website request in the restricted WordPress administration area and sending a notification to the clinic’s authorised email account.
• Operating, securing, backing up and troubleshooting the website and preventing misuse.
• Complying with legal obligations and establishing, exercising or defending legal claims.
• Sending promotional communications only where separate, freely given consent or another valid legal basis exists.

Under KVKK, processing may rely on steps necessary for a contract, legal obligations, establishment or protection of a right, legitimate interests that do not override your rights, or explicit consent where required. Under the GDPR, corresponding bases may include Articles 6(1)(a), 6(1)(b), 6(1)(c) and 6(1)(f).

Health data are special-category data. Preliminary health information or photographs are processed only with explicit consent or another condition expressly permitted by KVKK Article 6 and, where applicable, GDPR Article 9. Consent may be withdrawn at any time without affecting earlier lawful processing.

5. Meta, Facebook and Instagram lead forms

When you submit an instant form on Facebook or Instagram, Meta processes the form interaction under its own terms and privacy policy and makes your responses available to Aliyuva Clinic. We may receive your name, telephone number, email address, country, preferred language, treatment interest and answers you voluntarily provide.

We use lead-form data to respond to your request, provide general service information, arrange a consultation and prepare an indicative plan or quotation. Submission of a consultation form does not automatically enrol you in marketing. Marketing permission, if requested, is separate and optional.

Please do not enter detailed medical history or upload health documents through an advertising lead form. Sensitive health information should be shared only through the official channel provided after contact and after the relevant notice/consent process.

Aliyuva Clinic does not sell lead data. Contact or health data are not uploaded to a customer-list or custom audience unless a valid legal basis, required transparency and an applicable opt-out/consent mechanism have first been established.

6. Recipients and disclosures

We disclose data only where necessary and proportionate to:

• Authorised Aliyuva Clinic staff and patient coordinators.
• Doctors, dentists and authorised healthcare providers involved in assessment or treatment and subject to confidentiality duties.
• Website hosting, email, backup, information-security and technical-support providers acting under appropriate instructions.
• Transfer, accommodation or interpreter providers where you request those services.
• Payment, accounting, legal and audit providers where relevant.
• Courts, regulators and public authorities where disclosure is legally required.

We do not sell or rent personal data.

7. International transfers and third-party services

WhatsApp/Meta, YouTube/Google, Google Maps, Google Fonts and social-media services may process IP address, device information, cookies, messages or files outside Türkiye. International transfers must rely on a mechanism permitted by KVKK Article 9 and, where applicable, GDPR Chapter V, such as an adequacy decision, appropriate safeguards, standard contractual clauses or a legally available derogation. Explicit consent is obtained where it is the applicable basis.

When you leave our site or activate third-party content, that provider’s privacy terms also apply. Non-essential maps, videos, analytics or advertising technologies should not be activated before the required preference or consent is recorded.

8. Cookies and similar technologies

• Language cookie (al_lang): remembers the selected language for one year.
• WordPress and security cookies: support sessions, form security and misuse prevention.
• WooCommerce functional cookies: may preserve cart or account state when store functions are used.
• Third-party media or maps: may process technical data after the content is activated.
• Analytics or advertising cookies: used only after an appropriate consent/preference mechanism is implemented.
• Meta preference (al_marketing_consent, browser local storage): records your advertising choice, notice version and choice/expiry timestamps for up to 180 days. It does not contain form answers or health information. Cookie preferences in the footer lets you accept, reject or withdraw this choice. Rejecting does not prevent use of the site.

Meta Pixel (ID 1663101304021621) measures PageView events on public pages of our production website and Lead events when you click a WhatsApp contact button, only after you accept advertising cookies. A Lead event records the click, not whether you sent a message or became a patient. The Pixel does not load when you reject or have not chosen. Account, cart, checkout and administrative pages are excluded.

After your advertising consent, Meta Pixel may send page-view and WhatsApp-click events, page and referrer URLs, IP address, browser/device details and advertising identifiers to Meta for advertising measurement. Page addresses can show which treatment information a visitor viewed. Meta may associate these with its own user information and set cookies such as _fbp and _fbc. See Meta’s privacy policy at https://www.facebook.com/privacy/policy/.

This integration does not read or send consultation form answers, names, email addresses, phone numbers or WhatsApp message text as event parameters. Automatic event configuration is disabled; only PageView and WhatsApp-click Lead events are sent. Language, Meta click ID and validated UTM campaign parameters are allowed in page addresses; other query parameters prevent loading. This technical configuration does not itself establish legal compliance or approval by Meta.

The preference control applies only to this Meta Pixel integration. It is not a consent manager for all embedded maps, videos or other third-party services. Withdrawing consent stops this integration, clears accessible first-party Meta cookies and reloads a page if the Pixel has already loaded; it does not erase data already received by Meta.

9. Retention

• Unsuccessful consultation/contact requests: up to two years after the last contact.
• Pre-assessment health data, photographs and videos that do not become part of a patient relationship: up to six months after assessment.
• Patient records: for the periods required by applicable healthcare law and the responsible healthcare provider.
• Server and security logs: up to 12 months, unless needed for an incident or legal claim.
• Language cookie: one year.
• Marketing data: until consent is withdrawn or the purpose ends; evidence of consent/opt-out may be kept for the applicable legal period.

At the end of the applicable period, data are deleted, destroyed or anonymised unless a legal obligation or claim requires limited further retention.

10. Your rights

Subject to applicable law, you may ask whether we process your data; request access, correction, deletion or restriction; learn the purposes and recipients; object to certain processing or solely automated outcomes; request data portability where available; withdraw consent; and seek compensation where unlawful processing causes loss.

• Email your request with the subject “Personal Data Request” to the address below.
• Describe the right you wish to exercise and provide enough information to verify your identity. Do not email a full identity-document copy unless specifically and securely requested.
• KVKK requests are answered as soon as possible and no later than 30 days. GDPR requests are normally answered within one month.
• You may complain to the Turkish Personal Data Protection Board or, where applicable, your local data-protection authority.

11. Security, children and policy updates

We use proportionate technical and organisational measures such as access restrictions, secure connections, updates, backups and confidentiality controls. No internet transmission is completely risk-free; use only our official channels when sending health information.

The site is not directed to children. A person under 18 should not submit health information, photographs or documents without a parent or legal guardian.

We may update this notice when law, services or technology changes. The current version is published on this page with its effective date. Materially new purposes are notified before the new processing begins and new consent is obtained where required.