Health Data Consent

This notice applies from the date it is published on this page. It is issued to meet the information obligation under Article 10 of Turkish Law 6698 on the Protection of Personal Data. The Turkish version is the authoritative text.

1. Identity of the data controller

Under Turkish Law 6698 on the Protection of Personal Data (“KVKK”), the data controller is CNR Aesthetics, established in Türkiye and operating in Istanbul. You can reach us through the request form on this website or the contact channels published on it.

2. Personal data processed

• Identity — name, surname and, where the service requires it, date of birth, nationality and passport details.

• Contact — telephone, WhatsApp number, e-mail, preferred language.

• Location / travel — your city/country and travel details needed to arrange your appointment and transfer.

• Health (special category) — complaints, symptoms, existing conditions, medication, allergies and any medical documents you share.

• Transaction — the service requested, appointment details, correspondence records.

• Security — IP address, device and browser information, site usage records.

Health data is a special category of personal data under Article 6 KVKK and is processed only with your explicit consent.

3. Purposes of processing

• Receiving, assessing and answering your request.

• Arranging the requested service with licensed health professionals or partner facilities.

• Contacting you for coordination before, during and after the appointment.

• Carrying out payment processes and keeping the records required by law.

• Managing requests and complaints, and establishing or defending legal claims.

• Operating information security processes.

• Sending commercial electronic messages where you have separately opted in.

4. Recipients and the purpose of transfer

• Partner clinics and licensed health professionals — so that the service you requested can be delivered; including health data, to the extent the service requires.

• Suppliers and service providers — for the operation of hosting, database, communication and payment infrastructure.

• Competent public authorities and judicial bodies — to meet obligations arising from legislation and to protect legal claims.

Because of the nature of cloud infrastructure, your personal data may be stored or processed on servers located abroad. Transfers abroad are made in accordance with Article 9 KVKK, relying on whichever safeguard applies to the country concerned — an adequacy decision, the standard contract published by the Board, or another appropriate safeguard. The providers, countries and safeguards relied on are documented in our transfer records and a copy of the relevant safeguard may be requested from us.

5. Method of collection and legal grounds

Your personal data is collected by fully or partly automated means through the request forms on this website, WhatsApp messages, telephone calls, e-mail correspondence, and cookies and similar technologies.

• Non-health data — Article 5/2 KVKK: directly related to the conclusion or performance of a contract; necessary for the controller to fulfil a legal obligation; necessary for the establishment, exercise or protection of a right; and necessary for our legitimate interests, provided your fundamental rights and freedoms are not harmed. Where none of these grounds applies, your explicit consent.

• Health data (special category) — your explicit consent under Article 6 KVKK.

• Commercial electronic messages — your separate opt-in and Law 6563.

To the extent the GDPR applies to data subjects visiting from the European Union, the corresponding grounds are Article 6 GDPR and, for special categories, Article 9 GDPR.

6. Your rights under Article 11 KVKK

By applying to the data controller you have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties to whom it is transferred in Türkiye or abroad; request correction if it is incomplete or inaccurate; request erasure or destruction within the conditions of Article 7 KVKK; request that correction, erasure and destruction be notified to the third parties to whom the data was transferred; object to a result reached to your detriment solely through automated analysis; and claim compensation for damage arising from unlawful processing.

If you are in the European Union, Articles 15 to 22 GDPR give you rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time and to lodge a complaint with a supervisory authority.

7. How to apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request in writing with a wet signature, using a secure electronic signature or mobile signature, or from the e-mail address you have previously notified to us and which is registered in our system. The postal and electronic addresses to be used are published through the request form on this website and the contact channels on it.

Your application must contain your name and surname, and your signature if it is in writing; your Turkish identity number, or for foreign nationals your nationality, passport number or identity number if any; your residential or business address for notification; your e-mail address, telephone and fax number if any; and the subject of your request. Please attach any relevant information and documents.

Your application is concluded free of charge as soon as possible and in any case within thirty days, depending on its nature. If the process entails an additional cost, the fee in the tariff set by the Board may be charged. If your application is rejected, if you find the response insufficient, or if no response is given in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the date of your application.

8. Language and updates

The Turkish version of this notice is the authoritative text; versions in other languages are provided for information, and in the event of a discrepancy the Turkish text applies. The notice is updated when our processing activities or the applicable legislation change; the version published on this page is always the current one.

Frequently asked

Do I have to share my health data?

No — sharing depends on your explicit consent. However, without health information it may not be possible to identify the right partner clinic and procedure for your request. We recommend sharing only what the service requires.

Can I withdraw my consent?

Yes, at any time. Simply tell us through one of the channels in section 1. Withdrawal takes effect for the future: it stops processing from that moment on and does not invalidate processing already carried out lawfully. If an arrangement is under way, we will tell you what the consequences are.

Is my data transferred abroad?

Our website and database run on international cloud infrastructure, so your data may be stored on servers located abroad. Such transfers are made with the safeguards required by Article 9 KVKK; the providers and safeguards relied on are held in the records referred to in section 4.

How quickly will you answer my application?

As soon as possible and in any case within thirty days. Our answer is free of charge as a rule; if the process entails an additional cost, the fee in the tariff set by the Board may be charged.