KVKK Disclosure

Within the scope of this Disclosure Text, your personal data is processed by Horizon Hair Treatment Clinic acting as the data controller. The contact and registration details of our Clinic are set out below.

Your personal data is processed for the following purposes, to the extent that one or more of the processing conditions set out in Article 5 of the KVKK apply:

• Receiving, confirming and managing your appointment requests;
• Conducting hair analysis, trichoscopy examinations and any other clinical assessments required;
• Diagnosis, treatment planning and determining the most suitable hair-health treatment for you (FUE, DHI, PRP, mesotherapy, low-level laser therapy, etc.);
• Administering the treatment, monitoring the process and carrying out post-treatment follow-up;
• Evaluating your online consultation requests and responding to them;
• Sharing necessary information with our physicians and clinicians during the provision of healthcare; coordinating the care team;
• Contacting you for appointment reminders, treatment follow-up notifications and clinic announcements;
• Patient safety, internal quality processes, patient satisfaction surveys and handling of complaints;
• Fulfilling obligations under health legislation, KVKK and other applicable laws, and responding to requests from competent public authorities;
• Analysing treatment outcomes in anonymised or aggregated form for internal clinical quality studies.

Your personal data is processed in a manner that is connected with, limited to and proportionate to the purposes for which it is collected, and is retained for no longer than is necessary for those purposes.

As required for the provision of healthcare services, your personal data in the following categories is processed:

Under Article 6 of the KVKK, data concerning health and data concerning sexual life are considered “special category personal data”. The following data we process within the scope of hair health:

• your health data (medical history, diagnosis, treatment notes, laboratory results, trichoscopy images),
• your photographs (hair-analysis images and before/after images),

fall within the special category. This data is processed only where you have provided your explicit consent within the meaning of Article 6/3 of the KVKK. Health data is not processed without obtaining your explicit consent for the provision of healthcare services.

Within the scope of this Disclosure Text, the data subjects whose personal data is processed are:

• Patients: All individuals examined at our Clinic for hair analysis, treatment or follow-up;
• Online consultation applicants: Those who request a consultation through our website without having visited the Clinic;
• Website visitors: Users of our website whose data is collected through cookies and the contact form;
• Patient companions and relatives: Only where limited to the patient’s treatment and within the scope of the patient’s explicit consent, individuals whose contact information is collected;
• Supplier and partner representatives: Individuals whose corporate contact data is processed to the extent necessary for the conduct of Clinic operations.

Your personal data may be transferred, in order to fulfil the purposes described in this Disclosure Text, to the following recipient categories within the framework of Articles 8 and 9 of the KVKK:

• Physicians and clinicians administering treatment: Uzm. Dr. Ali Sahillioğlu, Uzm. Dr. Nagihan Sahillioğlu and members of the treatment team;
• Laboratory and medical-imaging partners: Accredited laboratories in Turkey from which we obtain blood tests, biopsy or dermatoscopic examinations;
• Email and communication service provider: The platform used to send appointment reminders, consultation replies and Clinic announcements (e.g. Google Workspace Ireland);
• Hosting and cloud-infrastructure providers: Servers hosting the website, appointment system and patient records (e.g. Vercel Inc., AWS EU region);
• Payment service providers: Only for the purpose of completing a payment transaction; no credit card details are stored on our systems;
• Legally competent authorities: In cases of legal obligation, limited sharing with the Ministry of Health, the KVKK Authority, judicial or law-enforcement authorities;
• Software and infrastructure suppliers: CRM, appointment-management software, translation services (for international patients) and similar service providers.

As our Clinic serves international patients, your personal data may be transferred abroad in accordance with Article 9 of the KVKK. Cross-border transfers are made either to recipients located in countries offering adequate protection, or on the basis of your explicit consent.

The main scenarios for transfer abroad are:

• Conducting the consultation process and sharing the treatment plan for international patients;
• Using email, file-storage and hosting infrastructure with providers located abroad (e.g. European Union region);
• Transmitting data to overseas servers via post-treatment follow-up communication channels (e.g. WhatsApp) with the patient’s explicit consent;
• Using overseas tools for internal quality analysis of anonymised or aggregated data.

In each case of cross-border transfer, the category of data transferred, the recipient, the purpose and the safeguarding method are recorded. International patients are informed in detail about these transfers at the time of their initial consultation request, and their explicit consent is obtained.

Under Articles 4 and 5 of the KVKK, your personal data is retained for as long as necessary for the purpose of processing; once that purpose ceases to apply, data for which retention periods under applicable legislation have expired is deleted, destroyed or anonymised in accordance with Article 7 of the KVKK.

Once retention periods expire, personal data is destroyed through secure physical and digital deletion procedures.

Under Article 11 of the KVKK, you have the following rights in relation to the processing of your personal data:

1. The right to be informed whether your personal data is being processed;
2. The right to request information if it has been processed;
3. The right to know the purpose of processing and to monitor whether it is being used in line with that purpose;
4. The right to request correction if your data is incomplete or inaccurately processed;
5. The right to request deletion or destruction where the conditions set out in Article 7 of the KVKK are met;
6. The right to know the third parties to whom your data has been transferred;
7. The right to object to a result arising against you from the exclusive analysis of your data by automated systems;
8. The right to request compensation for damages suffered as a result of unlawful processing of your personal data.

To exercise the rights listed above, you may submit a KVKK Request Form to info@horizonhairclinic.com or to our Clinic’s physical address. Your requests will be concluded free of charge within 30 days at the latest, in accordance with Article 13 of the KVKK.

You may submit any questions regarding this Disclosure Text, and any requests concerning your personal data, through the following channels:

Your requests are evaluated under Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Application to the Data Controller.