Privacy Policy

Horizon Hair Treatment Clinic is a private medical institution based in the Şişli district of Istanbul, specialised in hair health and hair restoration. Our clinic delivers both surgical and non-surgical hair treatments to international standards, under the supervision of dermatologists and physical medicine & rehabilitation specialists.

In this policy, the terms "data subject" and "patient" refer to any natural person who contacts us through our website, online consultation form, booking system, email or telephone. The personal data of all patients — whether they travel from within Türkiye or abroad — is processed according to the principles set out in this document.

As the "data controller" under KVKK, Horizon Hair Treatment Clinic is primarily responsible for the collection, processing and storage of your personal data. If you wish to contact us, see the contact section at the end of this text, or write directly to info@horizonhairclinic.com.

We collect only the personal data that is necessary to provide our services. Depending on the collection channel — website forms, online consultation requests, booking records, telephone calls or in-clinic procedures — different categories of data may be gathered.

The categories of personal data we may process, with examples, are listed below:

• Identity data: name, surname, date of birth, gender, nationality, passport or ID card details (for international patients).
• Contact data: email address, phone number, WhatsApp number, residential address, travel information.
• Health data (special category personal data): hair loss history, family hair loss pattern, chronic conditions, current medication, allergies, previously received treatments.
• Visual data: photos of the hair and scalp, trichoscopy (dermoscopy) images, before/after records.
• Technical data: IP address, browser type, visit timestamps, cookie data, on-site interaction logs.
• Financial data: payment method, billing address, package or service purchased (card numbers are never stored on our systems).

We process your personal data only for specific, explicit and legitimate purposes. A summary of why each category of data is collected is provided below:

Booking and consultation: To receive your appointment request, respond to your online consultation, and direct you to the right specialist, we process your identity and contact data.

Treatment planning and delivery: To design a personalised treatment plan based on your hair analysis, manage your session schedule, and deliver the treatment as medically required, we use your health and visual data.

Follow-up and outcome monitoring: To track your healing progress after treatment, record outcomes, and recommend further treatment where necessary, we process your before/after photos and follow-up examination data.

Service quality and legal obligations: To measure patient satisfaction, evaluate complaints, and meet the record-keeping requirements set out by health legislation and Ministry of Health inspections, we retain relevant records.

Under Articles 5 and 6 of KVKK, we process your personal data on the following legal grounds:

Explicit consent: The photos and health information you provide through our online consultation form are processed on the basis of your explicit consent. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing that has already taken place where retention is required by law.

Performance of a contract: We must process your identity, contact and payment information in order to establish and perform your booking and treatment agreement.

Legal obligation: We are required by Ministry of Health regulations, tax law and professional disciplinary rules to retain patient records for specific periods.

Legitimate interest: We must process technical data to improve service quality, ensure security, prevent fraud and maintain clinic operations.

Health data is treated as special category personal data and is processed only on the basis of your explicit consent or where processing is necessary to protect your health. Health data is never used for marketing purposes.

We share your personal data with third parties only for the purposes explicitly described in this policy, and only where necessary. We never sell or rent your data for marketing purposes.

Recipients with whom your data may be shared include:

• Treating doctors and clinical staff (physician, nurse, assistant) — only the information necessary for your treatment.
• Partner laboratories and medical imaging centres — for blood tests or trichoscopy analysis.
• Call centre and booking software providers — for appointment management; only identity and contact data.
• Payment service providers (banks, virtual POS) — to process payments; card details are never stored by us.
• Public authorities (Ministry of Health, KVKK Board, courts) — where there is a legal obligation or official request.

Because our clinic serves international patients, your personal data may, in certain cases, be transferred outside of Türkiye. Where this occurs, appropriate safeguards are implemented in accordance with Article 9 of KVKK.

The principal situations in which international transfers take place are: processing the consultation requests of patients resident abroad through overseas email and cloud service providers; the CRM tool we use for international patient coordination; and, where needed, collaborations with overseas medical laboratories.

For these transfers we prefer service providers located in countries deemed adequate by the KVKK Board. Otherwise, we enter into Standard Data Protection Contracts with recipients to ensure adequate protection. In every cross-border transfer, your data is used solely for treatment or coordination purposes.

We retain your personal data only for as long as the purpose of collection is fulfilled and our legal retention obligations continue. Once these periods end, the data is securely deleted or anonymised.

Our retention periods are as follows:

• Appointment records and patient file: 5 years from the date of treatment (the retention period required by the Ministry of Health for patient records).
• Online consultation photos: 12 months after your consultation request; automatically deleted thereafter.
• Before/after outcome images: Retained for up to 24 months after treatment completion; may then be retained in anonymised form as illustrative examples.
• Financial records and invoices: 5 years, in line with the Turkish Tax Procedure Law.
• Technical logs and site interaction data: 12 months; anonymised thereafter.
• Data for which you granted marketing consent: Deleted within 30 days of you withdrawing consent.

Under Article 11 of KVKK, you have the following rights in relation to your personal data:

• The right to be informed whether your personal data is being processed.
• The right to request information if it has been processed.
• The right to learn the purpose of processing and whether the data has been used in line with that purpose.
• The right to request correction if your data is incomplete or inaccurate.
• The right to request deletion or destruction under Article 7 of KVKK.
• The right to know whether your data has been transferred to third parties.
• The right to withdraw consent for data processed on the basis of your explicit consent.
• The right to object to processing by automated systems and to claim compensation if you suffer damage.

Our website uses cookies to improve your browsing experience. Cookies are small text files that your browser stores on your device.

Necessary cookies are required for the site to function and cannot be disabled. Analytics and performance cookies are enabled only with your explicit consent. You may change your cookie preferences at any time through the banner shown on your first visit, or via the "Cookie preferences" link in our footer.

Detailed information about our use of cookies — including cookie categories, retention periods and third-party service providers — is available in our Cookie Policy.

We continuously update the technical and organisational measures that protect your personal data. These measures are implemented in line with Article 12 of KVKK and the relevant Personal Data Protection Standards Guidelines.

Our technical measures include TLS 1.3 encryption across all web traffic, AES-256 encryption for databases and backup storage, isolated private storage for patient photos, role-based access control with two-factor authentication, regular vulnerability scanning and annual penetration testing.

On the organisational side, all staff receive KVKK and data security training; access rights are restricted under the principle of least privilege; access to patient images is logged; and a procedure is in place to notify the KVKK Board within 72 hours in the event of a suspected data breach.

This Privacy Policy may be revised from time to time in response to changes in legislation, technological developments or updates to our clinic activities. Where material changes are made, we will publish the updated policy on our website and, where appropriate, notify you by email.

The effective date of the policy is indicated at the top of this page as "Last updated". Your ongoing treatment or booking with us is governed by the most current version of this policy. If you require an earlier version of the policy, please contact us.

If you have any questions about this Privacy Policy, the processing of your personal data or your rights, please do not hesitate to contact us. KVKK-related applications will be responded to within 30 days.

Data controller: Horizon Hair Treatment Clinic. You can reach us through the channels below: