Privacy Policy

Hairmedico.com is a health tourism website owned and operated by Lea Estetik Sağlık ve Turizm Anonim Şirketi. The Hairmedico brand belongs to Dr. Arslan Musbeh. Lea Estetik Sağlık ve Turizm Anonim Şirketi offers health tourism, patient consultancy, consultation and organisation services under the Hairmedico brand.

Within the scope of Personal Data Protection Law No. 6698 ("KVKK") and, to the extent applicable, the EU General Data Protection Regulation ("GDPR"), the data controller of personal data collected through Hairmedico.com is:

Lea Estetik Sağlık ve Turizm Anonim Şirketi
Health tourism brand: Hairmedico
Brand owner: Dr. Arslan Musbeh
Address: Levent Mah., Ebulula Mardin Cad. No:53, 34330 Beşiktaş/İstanbul, Türkiye
Phone/WhatsApp: +90 541 234 50 85
Email: [email protected]
Website: https://hairmedico.com/

The terms "Hairmedico", "we", "the company" and "the clinic" in this policy refer to Lea Estetik Sağlık ve Turizm Anonim Şirketi with respect to the processing of personal data.

This policy covers personal data processing activities carried out through the following channels:

• Hairmedico.com and all language versions,
• Contact and consultation forms,
• Free hair analysis forms,
• Photo and document upload areas,
• E-mail, phone and WhatsApp conversations,
• Appointment and treatment-planning processes,
• Patient support and post-operative follow-up processes,
• Cookies, analytics and security technologies,
• Marketing communications, where the user has separately consented.

Third-party websites and platforms are subject to their own privacy policies.

3.1. Identity and contact information: name and surname; age or date of birth; gender; country and residence; spoken or preferred language; email address; phone/WhatsApp number; preferred method of contact.

3.2. Health and consultation information: hair loss status and history; hair colour and type; previous hair or beard transplant details; approximate graft count from previous procedures; chronic or infectious disease information; heart disease, high blood pressure, diabetes or epilepsy information; medication in use; allergy and skin-condition information; previous surgeries; planned treatment timing; photographs of hair, hairline, vertex, donor area, face or beard; and any other health information voluntarily disclosed in messages or documents. Health information and photographs submitted for medical evaluation are treated as special-category personal data.

3.3. Patient relations and transaction information: consultation requests; appointment and meeting records; pre-evaluation notes; price quotes and treatment plans; accommodation and transfer preferences; pre- and post-operative communication records; request and complaint records.

3.4. Financial information: payment and billing information; payment and collection records; bank or payment-institution transaction references; refund and cancellation records. Hairmedico does not store complete card details directly — card payments are processed through the secure systems of authorised payment institutions.

3.5. Visual and audio data: hair, scalp, face and donor-area photographs sent for consultation; video recordings voluntarily sent by the user; online-consultation recordings, where prior notice and the necessary permission exist; clinic-security camera recordings; before-and-after photographs and patient testimonials, where separate permission has been given.

3.6. Technical and process-security data: IP address; browser, device and operating-system information; site login, logout and form-submission records; visited pages and traffic source; approximate location derived from IP address; cookie identifiers and preferences; security, error and server logs; suspicious-transaction and abuse records; date and time of site access.

Your personal data may be collected electronically or physically through: website forms; photo and document upload areas; WhatsApp, phone and e-mail communication; in-person or online consultations; appointment and patient-tracking systems; CRM and clinical record systems; cookies and server logs; representatives you have authorised; and health institutions and service providers involved in your treatment.

Your personal data may be processed to: respond to enquiries; carry out a preliminary evaluation for hair transplantation or restoration; assess suitability of your health condition for the requested procedure; enable Dr. Arslan Musbeh to review the information and photographs submitted; prepare a personalised treatment recommendation and approximate graft estimate; plan consultations and appointments; provide treatment and price offers; carry out patient relations and health-tourism processes; organise treatment, accommodation and transfer; provide pre-operative information and post-operative follow-up; maintain patient and health records; fulfil legal, medical and financial obligations; manage requests, complaints and disputes; secure the website and information systems; prevent fraud, abuse and cyber-attacks; measure website performance where cookie consent has been given; and, where separate marketing consent has been given, send campaign and treatment information.

Online hair analysis is a preliminary evaluation only. It does not replace an in-person medical examination or a definitive diagnosis.

Depending on the nature of the processing, your data may be processed on the following legal bases: carrying out pre-contractual steps at your request; establishing or performing a contract; fulfilling the data controller's legal obligations; establishing, exercising or defending a legal claim; the data controller's legitimate interest, provided your fundamental rights and freedoms are not harmed; planning and delivery of health services and medical-record obligations; explicit consent for health data, photographs and necessary international transfers; and separate explicit consent for optional marketing communications.

Fulfilling the duty to inform and obtaining explicit consent are separate steps.

Health information and photographs submitted for medical evaluation are: used only for consultation and treatment-planning purposes; reviewed by Dr. Arslan Musbeh and authorised staff who need access for their role; never shared with unauthorised persons outside the treatment team; stored with the security measures required for special-category personal data; and never used for advertising or social-media purposes under the consent given for a consultation.

Specific, separate and explicit permission is obtained before any before-and-after photographs are published on the website, social media, in training materials or in promotional material. Declining this permission does not affect the provision of consultation or treatment services.

Your personal data may be shared, only to the extent necessary, with: Dr. Arslan Musbeh; authorised Hairmedico staff; healthcare professionals involved in your treatment; authorised hospitals, medical centres or health institutions; CRM, hosting, e-mail and technical-infrastructure providers; cyber-security and backup service providers; payment institutions; hotel, transfer and travel providers, at your request; legal, accounting, insurance and audit service providers; public authorities, courts and competent bodies where legally required; and analytics/advertising providers, where the necessary consent has been given.

Hairmedico does not sell your personal data. Service providers are required to process data only for the specified services and to apply appropriate confidentiality and security measures.

Where WhatsApp, Google, Meta, YouTube, Trustpilot, cloud services or similar international platforms are used, some personal data may be processed outside Türkiye or the European Economic Area.

Where an overseas transfer is required, it relies on adequacy decisions, standard contractual clauses, binding corporate rules, safeguards recognised under KVKK, explicit consent, or another lawful transfer mechanism, as applicable. Patients who prefer not to use WhatsApp can reach Hairmedico by e-mail or phone instead.

Personal data is kept no longer than necessary for the purpose of processing and any legal obligation.

Where a legal dispute, audit or official request exists, relevant records may be kept for the additional period required.

Once the legal and operational grounds for processing no longer apply, personal data is securely deleted, irreversibly destroyed, or anonymised so it can no longer be linked to a specific person. Hairmedico reviews data whose retention period has expired at regular intervals and acts in line with its data-retention and destruction procedures. Records subject to a statutory retention obligation cannot be deleted before that period expires; their use is restricted to the lawful retention purpose only.

Hairmedico applies appropriate technical and administrative measures to prevent unlawful processing and unauthorised access, which may include: role- and authority-based access control; restricted access to health data; confidentiality obligations for staff and service providers; personal-data-security training for staff; strong password and account-security practice; secure connections and encryption for data transfers; logging of server, CRM and file access; up-to-date security software and attack protection; regular backups; review of supplier and data-processor agreements; regular audits of processing activities; up-to-date authorisation and access lists; and investigation and, where necessary, notification of data breaches to affected individuals and competent authorities.

Only staff who need access for their role can access personal data. No transmission of data over the internet can be guaranteed to be entirely risk-free.

Under Article 11 of KVKK and, to the extent applicable, GDPR, you may have the right to: learn whether your personal data is being processed; request information about processed data; learn the purposes for which it is used; learn the third parties it is transferred to; request correction of incomplete or inaccurate data; request deletion or destruction where legal conditions are met; request restriction of processing; request data portability, where applicable; object to decisions made solely by automated systems that produce legal effects concerning you; object to direct marketing; withdraw your explicit consent; seek compensation for damage caused by unlawful processing; and lodge a complaint with the competent data-protection authority.

Withdrawing consent does not invalidate processing lawfully carried out before the withdrawal.

You can submit requests about your personal data through:

Lea Estetik Sağlık ve Turizm Anonim Şirketi
Levent Mah., Ebulula Mardin Cad. No:53, 34330 Beşiktaş/İstanbul, Türkiye
Email: [email protected]

Your request should include your full name, information to help verify your identity, your contact details, and a clear description of what you are asking for.

Requests are finalised as soon as possible and, at the latest, within 30 days, depending on their nature. Where the request involves an additional cost, the fee set by the Personal Data Protection Board may apply.

Treatment news, events, campaigns and offers are sent only where a valid legal basis or separate marketing consent exists.

Marketing consent is optional, is not a condition of consultation or treatment, is separate from consent to health-data processing, is never pre-ticked on the form, and can be withdrawn at any time. Appointment, consultation, treatment-planning and post-operative-care messages are not marketing communications. To withdraw marketing consent, contact [email protected].

16.1. Necessary cookies — required for site security, form processing, language selection and remembering cookie preferences.

16.2. Preference cookies — remember language, region and interface preferences.

16.3. Analytics cookies — generate statistics on visitor numbers, traffic source and page performance; activated only after consent where legally required.

16.4. Advertising cookies — may be used to measure ad campaigns, build audiences or present personalised ads; never activated without the required consent.

Depending on which features are active on the site, the following services may be used: Cloudflare (security, performance and traffic management); Google Analytics (visitor and performance measurement, where permitted); Google Tag Manager / Google Tag Gateway (tag and measurement management); Google Maps (map display); YouTube (video content); Trustpilot (patient reviews); WhatsApp (user-initiated communication); and Meta and Google advertising services (campaign measurement, where the necessary consent exists).

Providers that are not in use are not listed in the cookie inventory. The current inventory states the name, provider, purpose, category, first- or third-party nature, legal basis and retention period of each cookie.

The cookie notice presents Accept all, Reject all and Manage preferences with equal visibility. Non-essential analytics and advertising cookies do not run without consent. You can change your preferences at any time via the Manage Cookies link at the bottom of the site.

Hairmedico's services are not directed at children acting without a parent or legal guardian. Persons under 18 should not submit health information, photographs or consultation requests without the knowledge and necessary permission of a parent or legal guardian.

The website may link to third-party websites and platforms. Hairmedico does not control how these sites process personal data. We recommend reviewing the relevant privacy policy before sharing information with a third-party platform.

This policy may be updated as Hairmedico's services, the technologies used, or legal obligations change. The current version and last-update date are published on this page. Significant changes may also be announced through appropriate communication channels.

For questions about this privacy policy, your personal data, or your rights:

Lea Estetik Sağlık ve Turizm Anonim Şirketi – Hairmedico
Levent Mah., Ebulula Mardin Cad. No:53, 34330 Beşiktaş/İstanbul, Türkiye
Email: [email protected]
Phone/WhatsApp: +90 541 234 50 85
Website: https://hairmedico.com/