Data Protection Law and Privacy Policy

Effective Date / Last Updated: June 15, 2026

istanbulkasekimi.com, is an informational and service website operated by the Medlook Dr. Handan Yavuz Clinic. All personal data you share through our website is processed and protected by Medlook Dr. Handan Yavuz Clinic, acting as the data controller, in compliance with the Personal Data Protection Law No. 6698 (“KVKK”) and relevant legislation.

1. Data Controller

In accordance with the Personal Data Protection Law No. 6698, the data controller for your personal data collected through istanbulkasekimi.com is the organization whose details are provided below:

Data Controller: Medlook Dr. Handan Yavuz Clinic
Address: 59 Abdi İpekçi St., 4th Floor, Apt. 4, Nişantaşı, 34367 Şişli, Istanbul
Phone: +90 212 230 10 80 — +90 533 193 91 71
Email: info@medlook.com.tr
Website: istanbulkasekimi.com

Our clinic places great importance on protecting the personal data of its patients, visitors, employees, and other individuals with whom it interacts, in accordance with the principles of superior service quality, respect for individual rights, transparency, and integrity. Patient privacy and the careful and proper handling and safeguarding of all personal data pertaining to our patients are our top priorities.

2. Definitions

Explicit Consent: Consent that is informed and freely given regarding a specific matter.

Personal Data: Any information relating to an identified or identifiable natural person (first name, last name, Turkish ID number, email address, phone number, address, date of birth, etc.).

Sensitive Personal Data: Data related to race, ethnic origin, political opinion, philosophical beliefs, religion, denomination, or other beliefs; attire; membership in associations, foundations, or trade unions; health; sexual life; criminal convictions; and security measures; as well as biometric and genetic data. The health information you provide in your requests regarding eyebrow transplants and cosmetic procedures falls under this category.

Processing of Personal Data: Any operation involving the collection, recording, storage, modification, transmission, classification, or restriction of access to data, whether performed in whole or in part by automated or non-automated means.

Contact Person: A natural person whose personal data is processed.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller (e.g., a hosting company, a digital marketing agency).

Destruction: The erasure, destruction, or anonymization of personal data.

3. Categories of Personal Data Processed

Through istanbulkasekimi.com and as part of our outpatient clinic activities, the following categories of personal data may be processed, depending on the service provided:

Identification Information: Identification information such as first and last name, Turkish ID number, and date of birth.
Contact Information: Phone number, email address, mailing address, and information provided via the contact form or WhatsApp.
Health Education (Advanced Level): Information related to the medical service to be provided, such as eyebrow hair loss, eyebrow transplantation, current health status, past treatments, and photo/visual evaluation.
Audio/Video Recording: Photos you share for evaluation purposes, and security camera footage from outpatient clinic visits.
Transaction Security Information: The IP address, cookie data, browser, and device information generated during your visit to our site.
Financial Information: Billing and payment records related to service fees.
Marketing Knowledge: Website usage habits, campaign/communication preferences.

4. Method of Collecting Personal Data

Your personal data is collected through contact and appointment forms on istanbulkasekimi.com, cookies, phone calls, WhatsApp, email, social media channels, and verbal and written communications within the clinic, as well as through automated and non-automated means in both physical and digital environments.

5. Purposes of Processing Personal Data

The personal data we collect may be processed for the following purposes:

The provision of medical diagnosis, treatment, and care services (including eyebrow transplants and related cosmetic procedures),
Scheduling appointments and informing patients about their appointments,
To address your questions, requests, and complaints regarding healthcare services,
Preventive medicine, planning and management of health care financing,
Verification of your identity and a pre-service assessment,
Ensuring billing and financial reconciliation regarding service fees,
Compliance with legal and regulatory obligations,
Measuring patient satisfaction and improving service quality,
Taking the necessary technical and administrative measures to ensure data security,
Subject to your explicit consent, to carry out promotional, campaign, and informational activities,
Measuring website performance and improving the user experience.

6. Legal Grounds for the Processing of Personal Data

Your personal data is processed based on one or more of the following legal grounds specified in Articles 5 and 6 of the Personal Data Protection Law:

The existence of the data subject's explicit consent,
as expressly provided by law,
Being directly related to the formation or performance of a contract,
It is necessary for the data controller to be able to fulfill its legal obligations,
provided that it is necessary for the legitimate interests of the data controller and does not infringe upon the fundamental rights and freedoms of the data subject,
It is necessary for the establishment, exercise, or protection of a right.

Health-related your special category personal data; processed by individuals bound by a duty of confidentiality for the purposes of protecting public health, providing preventive medicine, medical diagnosis, treatment, and care services, as well as planning and managing the financing of health services. For any other uses (such as sharing your before-and-after images for promotional purposes), additionally your explicit consent is taken.

7. Transfer of Personal Data

Your personal data will be shared, within the scope of the purposes specified above and the conditions set forth in Articles 8 and 9 of the Personal Data Protection Law (KVKK), with: authorized public institutions and organizations such as the Ministry of Health and its affiliated units, the Social Security Institution, private insurance companies, the Public Prosecutor’s Office, and courts; as well as to laboratories and healthcare institutions with which we collaborate for medical diagnosis, and to our suppliers from whom we receive consulting and support services (hosting, digital marketing, call centers, etc.), within the legal limits.

Your personal data may be transferred abroad subject to your explicit consent in connection with the use of cookie and analytics services based outside Turkey (such as Google, Meta, etc.); otherwise, your personal data will not be shared with entities outside Turkey.

istanbulkasekimi.com uses cookies to improve the user experience, analyze website traffic, and conduct marketing activities. Cookies are small text files stored in your browser during your visit.

Types of cookies used

Essential Cookies: This is required for the site's basic functions to work; it cannot be disabled.
Performance/Analytics Cookies: It measures website usage using tools like Google Analytics and helps improve the site.
Marketing/Targeting Cookies: It uses tools like the Meta (Facebook/Instagram) Pixel and Google Ads to ensure that ads tailored to your interests are displayed.
Functional Cookies: It remembers your preferences (language, form data, etc.).

You can always accept, reject, or delete cookies through your browser settings. Disabling cookies may affect the functionality of certain parts of the site.

9. Retention and Destruction of Personal Data

Your personal data is retained for the period required by applicable legislation or necessary for the purpose for which it was processed. When the purpose justifying retention no longer applies or the statutory retention period expires, your data will be deleted, destroyed, or anonymized upon your request or on our own initiative. The necessary actions are carried out during the first periodic destruction period (6-month intervals) following the date on which the obligation to destroy the data arises.

Data / Process	Retention Period	Disposal Period
Personal Health Records	For the period specified in the relevant regulations	During the first scheduled disposal period following the expiration of the retention period
Identification Data	For the period specified in the relevant regulations	During the first scheduled disposal period following the expiration of the retention period
Drafting Contracts	10 years from the expiration of the contract	During the first scheduled disposal period following the expiration of the retention period
Contact / Appointment Form Records	Two years from the end of the relationship	During the first scheduled disposal period following the expiration of the retention period
Cookies and Website Usage Data	Session duration by cookie type – up to 24 months	automatically at the end of the period
Camera Footage	In accordance with the relevant regulation, at least 2 months	During the first scheduled disposal period following the expiration of the retention period

10. Technical and Administrative Measures Taken

In accordance with Article 12 of the Personal Data Protection Law (KVKK), our clinic takes the necessary measures—in line with technological capabilities and implementation costs—to ensure the security of your personal data:

Strong password policies and access authorization for computer and email accounts,
Confidentiality training for employees and confidentiality obligations stipulated in employment contracts,
A regular backup infrastructure,
The use of SSL/TLS encryption on the website,
Preparing an inventory of personal data processing and fulfilling the duty to provide information,
Only authorized employees and supplier personnel may access the data.

11. Your Rights as a Data Subject

Pursuant to Article 11 of the KVKK, you have the following rights regarding your personal data, which you may exercise by contacting the data controller:

To find out whether your personal data is being processed,
Request information regarding this, if it has been processed,
The right to know the purpose of the processing and whether it is being used in accordance with that purpose,
Knowing the third parties to whom it is transferred, whether domestically or abroad,
Request that it be corrected if it is incomplete or has been processed incorrectly,
Requesting that it be deleted or destroyed,
The right to request that third parties to whom your data has been disclosed be notified of any corrections, deletions, or erasures,
To object to a decision made solely through automated systems that is unfavorable to you,
Request compensation for the damages you have suffered as a result of an unlawful act.

12. Application Process

To exercise the rights listed above, please submit your requests by sending a written petition to our outpatient clinic address or by verifying your identity info@medlook.com.tr You may submit your request to us by email. Your requests will be processed free of charge within thirty (30) days at the latest, depending on the nature of the request. If the process incurs additional costs, a fee based on the rate set by the Personal Data Protection Board may be charged.

Contact

Medlook Dr. Handan Yavuz Clinic
59 Abdi İpekçi St., 4th Floor, Apt. 4, Nişantaşı, 34367 Şişli, Istanbul
Phone: +90 212 230 10 80 — +90 533 193 91 71
Email: info@medlook.com.tr

This Policy is deemed to have taken effect upon its publication on the website. Our clinic reserves the right to update this text as deemed necessary.