Privacy notice | Dr. Grafts

This notice says, in plain words, what happens to your personal data when you use this website, ask us for your free plan, message us or have treatment with us. It follows the EU and UK data protection rules (GDPR) and Türkiye’s data protection law (KVKK).

Who we are

Dr. Grafts is a hair transplant clinic in Istanbul, Türkiye. For anything about your data, write to hello@drgrafts.com or use our contact page.

What we collect, and why

When you browse: our hosting and security provider processes your IP address and browser details to deliver the site and protect it from attacks. Nothing else, unless you accept analytics or marketing cookies; our cookie policy lists them. Legal basis: our legitimate interest in a working, secure website (GDPR Art. 6(1)(f)); analytics and marketing only with your consent.
When you ask for your free plan: your name, your email address or WhatsApp number, your country, your answers about your hair and health, and the photos you send. We use them to assess your hair and send you a plan and a price. Your answers and photos are health information: we use them only with your explicit consent (the text is below) and only for that purpose. Legal basis: your contact details, the steps you asked for before a contract (GDPR Art. 6(1)(b)); your answers and photos, your explicit consent (GDPR Art. 9(2)(a); KVKK Art. 6).
When you message us by WhatsApp or email: your message and contact details, to answer you. Legal basis: the steps you asked for (GDPR Art. 6(1)(b)).
If you book treatment: the details needed for your stay and your care, such as your passport details for the hotel and your medical history for your surgeon. Legal basis: your medical care (GDPR Art. 9(2)(h)) and the records the law requires us to keep (Art. 6(1)(c)).

We never sell your data, and we never use your health information for advertising.

Who sees your data

Your answers and photos are seen only by your surgeon and the coordinator handling your case. Our email and CRM providers receive your contact details and reference number, never your health information. The services that run this website (hosting, forms, security) process data for us under contracts. Analytics and advertising tools run only if you accept them. On pages where you enter health information, Google Analytics, Microsoft Clarity and the Meta Pixel never load; if you accepted analytics, only Plausible (no cookies, hosted in the EU) counts the visit there, and it never receives your answers or photos.

You can talk to us on WhatsApp. Messages, photos and voice notes you send there are end-to-end encrypted, but WhatsApp (Meta) processes the metadata: who wrote to whom, when, and from which number. Your coordinator keeps the chat for as long as we are in contact with you and during your 12 months of follow-up; you can ask us to delete it at any time. If you would rather not use WhatsApp, the free plan form lets you choose email.

We show a patient’s photos on this site or share them privately with other patients only with a separate written consent, given after treatment and never as a condition of it. The consent says where the photos may be used (this site, private WhatsApp messages to people considering treatment); you can withdraw it at any time and we take the photos down. Before any photo is used, all its hidden details (location, camera, date stamps) are removed and the Dr. Grafts mark is laid across it.

Where it is stored, and for how long

Assessment answers and photos are kept in encrypted storage in Türkiye. We keep them for as long as we need them to assess you, plan and carry out your treatment and follow it up, then delete them. If you do not go ahead, you can ask us to delete them at any time. Messages and contact details are kept while we are in contact with you. Records that Turkish law requires us to keep, such as accounting records, are kept for the periods the law sets.

Data sent outside your country

Your data is processed in Türkiye. A few of the services we use are based in the EU or the US; they receive only what they need and are bound by contracts that meet the GDPR and KVKK rules for such transfers: the EU Standard Contractual Clauses (with the UK addendum for UK data) and the standard contracts set under Turkish law. A copy is available from hello@drgrafts.com.

Your rights

You can ask us at any time to see the data we hold about you, correct it, delete it, restrict how we use it or send it to you. You can withdraw your consent, and you can object to how we use your data. We make no decisions about you by automated means alone. Write to hello@drgrafts.com; we answer within one month. You can also complain to the data protection authority in your country, or to Türkiye’s Personal Data Protection Authority (KVKK).

Marketing

We send news and guides only if you tick the separate marketing box, and you can stop them at any time.

Children

Our services are for adults. We do not knowingly collect data from anyone under 18.

By ticking the health box on the free plan form you agree that Dr. Grafts may collect and use the answers and photos you send, which are health information, to assess your hair, plan your treatment, prepare your price and follow up on your treatment; that they are stored in Türkiye and seen by your surgeon and your coordinator; and that you can withdraw this consent at any time by writing to hello@drgrafts.com, after which we stop using them and delete them, unless the law requires us to keep them.

Changes

We update this notice when something changes. The date at the top shows the current version.