Privacy Notice
Last updated: 3 October 2026
This notice explains how your personal data is processed when you use the assessment form on the Menza Clinic website or contact us via WhatsApp or phone, in line with Turkey’s Personal Data Protection Law No. 6698 (“KVKK”). Where you are in the EU/UK, we also apply the principles of the GDPR / UK GDPR.
1. Data controller
Data controller: [Veri sorumlusunun adı / unvanı]
Address: [Tebligat adresi]
Email: menzahairclinic@gmail.com
2. Data we process
- Identity and contact: your name, WhatsApp/phone number and country code.
- Health data (special category): the hair and scalp photos you upload, the hair loss stage you select and anything you write in the note field.
- Source of your visit: how you reached the site (e.g. campaign tags, the page you landed on). Kept only for your browsing session and attached only to a request you submit yourself.
- Security: an irreversible hash of your IP address to prevent abuse. The IP address itself is not stored.
- Consent record: the date and time you gave your explicit consent.
3. Why we process it
- To carry out your hair transplant pre-assessment: estimating graft needs, reviewing the donor area and recommending a plan.
- To send you the assessment and package information via WhatsApp or phone, and answer your questions.
- To prevent misuse of the form (spam, repeated submissions).
- To understand which channels bring requests, in aggregate (only with the cookie consent you give — see the cookie policy).
Your photos are never published on the website or social media without your separate written permission, and your data is never sold.
4. Legal basis
Photos are health data and are processed only on the basis of your explicit consent (KVKK Art. 6; GDPR Art. 9(2)(a)). Contact details are processed because they are necessary to respond to your request before entering into a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)) and on your consent. The IP hash is kept on the basis of our legitimate interest in security (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
5. Who we share it with
- Hosting and database provider with servers in the European Union (Frankfurt, Germany): form data and photos are stored in an access-restricted store.
- Our web operations and technical support partner, to run the website and form.
- WhatsApp (Meta), if you choose to message us there.
- Analytics and advertising providers (Google, Microsoft, Meta) — only if you accept the related cookies; they never receive your form contents or photos.
Some providers are outside Turkey; transfers are made on the basis of your explicit consent and/or the standard contractual clauses published by the Turkish Personal Data Protection Authority (KVKK Art. 9). New-request notifications never contain your name, number or photos — only a reference number.
6. How long we keep it
Assessment data is kept for up to 1 year from your request and then deleted or anonymised, or earlier if you ask. If you go on to have treatment, the retention periods required by health legislation apply.
7. Your rights
You can ask us whether your data is processed; request information about it; learn its purpose; know who it was shared with in Turkey or abroad; have it corrected or deleted; object to decisions made solely by automated processing; and claim compensation for unlawful processing (KVKK Art. 11; equivalent GDPR rights apply). You can withdraw your consent at any time — your photos and form data will then be deleted.
8. How to contact us
Send your request with information that lets us verify your identity to menzahairclinic@gmail.com (mentioning your MZ-… reference speeds things up). We respond free of charge within 30 days. You may also complain to the Turkish Personal Data Protection Authority or, in the EU/UK, your local supervisory authority.