Privacy Policy
Last updated: 20 October 2026
This policy explains how Natural Hair Turkey collects and uses your personal data when you visit naturalhairturkey.com or contact us. It is also our information notice under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the EU General Data Protection Regulation ("GDPR") and the UK GDPR.
1. Who we are
Natural Hair Turkey is the hair restoration brand of Natural Clinic. The data controller is Natural Estetik ve Sağlık Hizmetleri Anonim Şirketi, Ataköy 7-8-9-10. Kısım Mah. Çobançeşme E-5 Yan Yol Cad. Avrupa Residence-Office No:8 Kat:8 Daire:33, 34158 Bakırköy/İstanbul, Türkiye (Bakırköy Tax Office, tax no. 6300714041).
You can contact us about your data at [email protected], by phone on +90 531 546 10 05, or by post to the address above.
2. What data we collect
When you send an enquiry or request a free hair analysis:
- your name, email address and phone number;
- the treatment you are interested in and the message you write to us;
- any health information you choose to share, such as your hair loss history, medical conditions or medication;
- technical details of your enquiry: the language and address of the page you used, the website or campaign that referred you, and the date, time and version of the consent you gave.
When you contact us by phone, email or WhatsApp: the content of our conversation and anything you send us, including photos of your scalp or hair. Our patient coordinators often continue the conversation on WhatsApp, where you may send photos for your assessment.
When you browse our website: technical data such as your IP address, browser and device type, pages visited and how you arrived at our site. Analytics data is collected only if you accept analytics cookies (see our Cookie Policy).
We do not knowingly collect data from anyone under 18. Our services are intended for adults.
3. Why we use your data and our legal basis
| Purpose | Data used | Legal basis (GDPR / UK GDPR) | Legal basis (KVKK) |
|---|---|---|---|
| Responding to your enquiry and preparing your free assessment | Contact details, enquiry content, technical details | Steps at your request before entering into a contract (Art. 6(1)(b)) | Establishment of a contract (Art. 5(2)(c)) |
| Assessing your suitability for treatment | Health information and photos you share | Your explicit consent (Art. 9(2)(a)) | Your explicit consent (Art. 6) |
| Planning your treatment, travel and stay if you go ahead | Contact details, travel details, health information | Contract (Art. 6(1)(b)); explicit consent for health data (Art. 9(2)(a)) | Establishment and performance of a contract (Art. 5(2)(c)); explicit consent for health data (Art. 6) |
| Keeping a record of your consent | Consent date, time and version | Legal obligation and legitimate interest in demonstrating compliance (Art. 6(1)(c), (f)) | Legal obligation (Art. 5(2)(ç)) |
| Website security and fixing errors | Technical data | Legitimate interest (Art. 6(1)(f)) | Legitimate interest (Art. 5(2)(f)) |
| Understanding how our website is used | Analytics data | Your consent (Art. 6(1)(a)) | Your explicit consent (Art. 5(1)) |
| Sending you news or offers | Name, email, phone | Your consent (Art. 6(1)(a)), only if you opt in | Your explicit consent (Art. 5(1)) |
You can withdraw your consent at any time. This does not affect processing carried out before you withdrew it.
4. Who we share your data with
We share your data only as needed for the purposes above:
- Natural Clinic staff involved in answering your enquiry, assessing your case and organising your treatment;
- service providers who process data on our behalf: website hosting (Railway), analytics (Google; Yandex) and messaging (WhatsApp, provided by Meta);
- travel partners such as hotels and transfer companies, only if you book a package that includes them, and only the details they need;
- public authorities where the law requires it.
We do not sell your personal data.
5. International transfers
We are based in Türkiye. Some of our service providers store or process data outside Türkiye, including in the United States and, for Yandex Metrica, in the Russian Federation. Where data is transferred abroad, we rely on the safeguards required by KVKK Article 9 and, where applicable, Chapter V of the GDPR and UK GDPR, such as standard contractual clauses.
6. How long we keep your data
We keep your data only as long as needed for the purposes in this policy and as required by law, including Turkish rules on health records for patients who receive treatment. When it is no longer needed, we delete, destroy or anonymise it.
7. Your rights
You have the right to:
- find out whether we process your data and get a copy of it;
- ask us to correct inaccurate or incomplete data;
- ask us to delete your data or restrict its use;
- object to processing based on our legitimate interest;
- receive the data you gave us in a portable format;
- withdraw your consent at any time;
- learn who we have shared your data with, including recipients abroad;
- object to a result reached solely through automated processing that affects you;
- claim compensation for damage caused by unlawful processing.
To use your rights, email [email protected] or write to our address. We will reply within 30 days.
You also have the right to complain to a data protection authority: in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu); in the EU, the authority in your country; in the UK, the Information Commissioner's Office.
8. How we protect your data
We use technical and organisational measures to protect your data, including encrypted connections, access limited to authorised staff, and secure storage of enquiry records. Photos and health information you send us are not published or used for any other purpose without your separate, written consent.
9. Changes to this policy
We may update this policy. The date at the top shows the latest version. If we make significant changes, we will make them clear on our website.
10. Language
This policy is available in several languages. The English version is the reference text.