Privacy Policy
Last updated:
This policy applies from the date it is published on this page. It explains how CNR Aesthetics processes your personal data — including health data — when you contact us or request a service. Please read it together with our Cookie Policy and our Health Data Consent text.
1. Who is responsible for your data
The data controller is CNR Aesthetics, established in Türkiye and operating in Istanbul. You can reach us on data protection matters through the request form on this website or the contact channels published on it.
2. What data we process
We process only the data we need in order to organise the service you ask for:
Identity data — your name and surname; where a service requires it, your date of birth, nationality or passport details.
Contact data — telephone number, WhatsApp number, e-mail address, preferred language.
Location data — your city/country and travel details needed to arrange your appointment and transfer.
Health data — the symptoms, complaints, existing conditions, medication, allergies or documents you choose to share so that the right professional and the right service can be arranged. Health data is a special category of personal data under Article 6 of Turkish Law 6698 (KVKK) and Article 9 GDPR, and receives the additional protection described in section 5.
Transaction data — the service requested, appointment time, and correspondence with our team. Fees and payment are handled as described in section 6 of our Terms of Service.
Technical data — the data automatically produced when you visit our website, such as IP address, device and browser type, and pages viewed. See our Cookie Policy.
We do not ask you to send health data through public channels, and we do not need more health information than the service requires. Please share only what is necessary.
3. How we collect it
The request forms on this website.
WhatsApp messages you send to our published number.
Telephone calls with our coordination team.
E-mail correspondence.
Cookies and similar technologies used on this website.
All of these are channels in which you take the first step. We do not buy contact lists and we do not obtain your data from third parties without telling you.
4. Why we process it
To answer your enquiry and understand what you need.
To organise the requested service with a licensed health professional or partner facility, and to share with them the information they need in order to attend you safely.
To reach you before, during and after the appointment for coordination purposes.
To arrange payment and to keep the records required of us by law.
To handle complaints, requests and disputes, and to establish or defend legal claims.
To keep this website secure and functioning.
To send you commercial messages — only where you have separately opted in, and you may withdraw at any time.
We do not use your health data for marketing, and we do not take decisions about you by automated means alone.
5. Our legal grounds
Turkish law and, for visitors in the European Union, the GDPR require us to name a legal ground for each purpose.
Non-health data — Article 5/2 KVKK and Article 6 GDPR: the processing is necessary for the performance of, or the steps leading to, the arrangement between us; necessary for compliance with our legal obligations; or necessary for our legitimate interests in operating and securing the service. Where none of these applies, we rely on your consent.
Health data — Article 6 KVKK and Article 9 GDPR: we rely on your explicit consent. You give this consent knowingly, for the specific purpose of arranging the service you have requested, and separately from any other permission.
Commercial messages — your separate opt-in.
When you submit a request form, we record which version of these texts you accepted, in which language, together with your separate permission for the processing of health data. Consent is not bundled: refusing marketing messages does not affect your request, and you can withdraw any consent at any time using the contact channels in section 1. Withdrawal takes effect for the future and does not make the earlier processing unlawful.
6. Who we share it with
CNR Aesthetics refers clients to licensed partner clinics in Istanbul for aesthetic and dental procedures, and coordinates the patient journey, including transfers. We do not perform procedures ourselves: examination and procedure are carried out by the licensed professionals of the partner clinic. This means that arranging your service necessarily involves sharing information.
Licensed health professionals and partner facilities — the identity, contact, location and health information they need in order to attend you. They act as independent controllers of the data they collect and record themselves during the medical service.
Our service providers — hosting, database, communication, payment and similar suppliers acting on our instructions. Section 7 explains what this means for the location of your data.
Public authorities and courts — where we are legally obliged to disclose, or where disclosure is necessary to establish, exercise or defend a legal claim.
We do not sell your personal data and we do not share it with third parties for their own marketing.
7. Where your data is stored, and transfers abroad
Our website and database run on international cloud infrastructure. This means that your personal data may be stored or processed on servers located outside Türkiye, and — depending on the region — outside the European Economic Area. The current list of suppliers and hosting regions is kept in our supplier records and can be requested from us.
Transfers abroad are made in accordance with Article 9 KVKK and Chapter V GDPR, using the safeguard applicable to the country concerned — an adequacy decision, the standard contract published by the Turkish Data Protection Authority, or standard contractual clauses. The safeguard relied on for each transfer is documented in our transfer records. You may request a copy of the relevant safeguard using the contact channels in section 1.
8. How long we keep it
We keep each category of data only as long as the purpose that justified collecting it, and afterwards for the period during which the law requires or permits us to keep it. At the end of that period the data is deleted, destroyed or anonymised.
The period applied to each category is set out in our internal retention and destruction schedule, and you may ask us which period applies to a given category. We do not keep personal data indefinitely.
9. How we protect it
We apply technical and organisational measures appropriate to the risk: encrypted transmission, access limited to the personnel who need it, authorisation controls on our systems, and confidentiality obligations for our staff and suppliers. No system can be guaranteed to be completely secure; if a personal data breach occurs that is likely to result in a high risk to you, we will notify you and the competent authority in accordance with the applicable law.
10. Your rights
Under Article 11 KVKK you have the right to learn whether your personal data is being processed; to request information if it has been; to learn the purpose of the processing and whether the data is used in accordance with that purpose; to know the third parties to whom it is transferred, in Türkiye or abroad; to request correction if it is incomplete or inaccurate, and to have that correction notified to the recipients; to request erasure or destruction where the grounds for processing have disappeared, and to have that notified to the recipients; to object to a result reached solely by automated analysis where it produces a detrimental outcome for you; and to claim compensation for damage arising from unlawful processing.
If you are in the European Union, Articles 15 to 22 GDPR additionally give you the right of access, rectification, erasure, restriction of processing, data portability, and the right to object — as well as the right to withdraw your consent at any time and to lodge a complaint with your local supervisory authority.
11. How to exercise your rights
Send your request through the request form on this website or the contact channels published on it. Please state your name and surname, the contact details we can reach you at, and your request clearly, and include the information needed to verify your identity — we cannot act on a request we cannot attribute to you.
We answer as soon as possible and in any case within thirty days under KVKK. For visitors in the European Union, we answer within one month, which may be extended by two further months for genuinely complex requests, in which case we tell you within the first month. Our answer is free of charge; a fee may be charged only where the law allows it.
If you are not satisfied with our answer, you may complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or, in the European Union, to your local supervisory authority.
12. Children
Our services are requested by adults. Where a service is organised for a child, the request is made and the consents are given by the parent or legal guardian, who is responsible for the accuracy of the information provided.
13. Changes to this policy
We may update this policy when our services, our suppliers or the applicable law change. The version published on this page is always the current one. Where a change materially affects how we use your data, we take the steps required by law before it applies to you — including asking for your consent again where consent is the ground we rely on.