GDPR Clarification Text

GDPR Clarification Text

Last Update: 28 March 2025

As Helsa Agency, we would like to inform you about the processing, storage and transfer of your personal data as “Data Controller” within the scope of the Personal Data Protection Law No. 6698 (“GDPR”).

1. Data Controller

Under the Personal Data Protection Law ("GDPR"), your personal data will be processed by Helsa Agency, which is the data controller, in the scope specified below.

Data Controller Information:

2. Processed Personal Data

As Helsa Agency, we can process the following personal data:

• Identity Information: Name, surname, T.C. identity number, passport number, date of birth, gender, marital status
• Contact Information: Phone number, email address, address, country
• Health Information: Health status, medical history, drug use, allergies, hair loss status, hair analysis results, pre-treatment and post-treatment photos
• Financial Information: Bank account information, payment information
• Travel Information: Flight information, accommodation preferences, transfer requests
• Visual and Audio Records: Photos, video recordings, audio recordings
• Digital Tracking Information: IP address, cookies, web site usage data

3. Purpose of Processing Personal Data

Your personal data is processed under the following purposes:

• Provision of hair transplantation and health tourism services
• Assessment of your health status and creation of an appropriate treatment plan
• Organizing appointments with affiliated clinics and doctors
• Organizing travel and accommodation
• Contact activities
• Customer relationship management
• Measurement and improvement of service quality
• Company internal operations
• Fulfillment of legal obligations
• Tracking and fulfillment of legal obligations
• Implementation of information security processes

4. Legal Basis for Processing Personal Data

Your personal data is processed based on the following legal grounds:

• The presence of your explicit consent
• The explicit provision in the law
• The conclusion of a contract or the fulfillment of a legal obligation
• The need to fulfill our legal obligations
• The need to secure a right or use of data
• The need to protect our legitimate interests

Special categories of personal data such as health data are not processed without your explicit consent. However, health data may be processed by individuals or authorized institutions and organizations under the obligation of confidentiality in the context of providing health services.

5. Transfer of Personal Data

Your personal data may be transferred to the following recipients under the following purposes:

• Affiliated Health Institutions: Hospitals, clinics and doctors that will perform hair transplantation and other medical procedures
• Business Partners: Companies providing accommodation, transfer and travel services
• Service Providers: Companies providing support in the fields of information technology, customer relationship management, accounting, law, consulting, etc.
• Public Institutions and Organizations: Public institutions and organizations that request information and documents under the scope of our legal obligations
• Foreign Recipients: Our customers from abroad, our representatives or business partners in your country

In case of transfer of your personal data abroad, the necessary security measures are taken under the scope of Article 9 of the GDPR.

6. Method of Collecting Personal Data

Your personal data is collected through the following channels:

• Contact forms on our website
• E-mail, phone, SMS or other electronic communication channels
• Our social media accounts
• Face-to-face meetings
• Online and offline surveys
• Cookies and other tracking technologies

7. Storage Period of Personal Data

Your personal data is stored for the duration required for the purposes of processing and in accordance with legal storage periods. Storage periods are determined based on the following criteria:

• Relevant legal regulations
• Relevant expiration periods
• Expiration periods for documents that could serve as evidence in potential legal disputes
• Duration of the service relationship

When the purpose of processing your personal data is completed and the legal storage periods expire, your personal data is deleted, destroyed or anonymized.

8. Rights of the Relevant Person

Under Article 11 of the GDPR, you have the following rights regarding your personal data:

1. Learn whether your personal data is being processed
2. Request information about whether your personal data is being processed
3. Learn the purpose of processing your personal data and whether it is used in accordance with that purpose
4. Learn about the third parties to whom your personal data is transferred within the country or abroad
5. Request the correction of your personal data if it is incomplete or incorrect
6. Request the deletion or destruction of your personal data under the conditions specified in Article 7 of the GDPR
7. Request that the third parties to whom your personal data is transferred are notified under the conditions specified in (e) and (f)
8. Object to the use of your personal data for automated decision-making processes that could lead to a disadvantageous outcome for you
9. Request the removal of your personal data if it is processed in violation of the law

9. Application Method

You can apply for the rights specified above by using the following methods:

• E-Mail: kvkk@helsaagency.com securely signed electronically
• Post: "Aşağı Dudullu, Kaptani Derya Sk. No:6 Kat 2, 34664 Ümraniye/İstanbul" with your identity verification documents
• Personal Application: With your identity verification documents

In your application;

• Name, surname and if applicable, signature
• For Turkish citizens, T.C. identity number, for foreigners, nationality, passport number or if applicable, identity number
• Residence or place of work address
• If applicable, electronic post address, phone and fax number
• Request subject

Your application must include the following information:

Your application will be processed free of charge and within the shortest possible time, and within 30 days. However, if the processing requires additional costs, the fees determined by the Personal Data Protection Authority may be charged.

10. Changes to the Clarification Text

As Helsa Agency, we may update this clarification text from time to time. The changes will take effect on the date they are published on our website. If there are significant changes, we will notify you by email. Therefore, we recommend regularly reviewing our clarification text.