Privacy
notice.

Who we are

HEC Turkey organises one-day hair, skin, eye and dental treatment for patients who travel to Istanbul. We are the data controller for the personal data collected on hecturkey.com. Treatment itself takes place at BHT Clinic İstanbul Tema Hastanesi, Atatürk Mah. Aşina Sok. No:38/2, Küçükçekmece, İstanbul, Türkiye.

For anything in this notice, write to info@hecturkey.com.

What we collect

When you send a form: your name, email address and/or phone (WhatsApp) number, the treatment you are interested in, the language of the page, and anything you choose to write in the message field. That message may contain health information, such as photos you describe, conditions or medication.

How you reached us: the advertising parameters in the link you arrived on (utm tags, Google and Meta click identifiers), the website that sent you (for example google.com or instagram.com) and the first page you opened. We use this to know which of our ads and channels bring enquiries.

Technical data: our hosting provider logs IP addresses and browser details of requests to keep the site running and secure.

Why we use it, and on what legal basis

To answer your enquiry and prepare a treatment plan and price: steps you ask for before a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

Health information you choose to share is read only by the specialist team, who are bound by medical confidentiality, to assess whether and how you can be treated (GDPR Art. 9(2)(h); KVKK Art. 6(3)). You also give explicit consent to this when you send the form.

To measure our advertising with Google and Meta: only with your consent, which you can change at any time through “Cookie settings” at the foot of every page (GDPR Art. 6(1)(a); KVKK Art. 5(1)).

To keep records the law requires of a healthcare provider, and to defend legal claims (GDPR Art. 6(1)(c) and (f); KVKK Art. 5(2)(ç) and (e)).

We never send your name, contact details, treatment choice or message to Google or Meta, and we do not sell personal data.

Cookies and similar storage

hec-consent (your browser's local storage): remembers whether you accepted or declined measurement cookies. Kept until you clear it or change your choice.

hec_attr (first-party session cookie): how this visit reached us — the link parameters and referring website above. Deleted when you close the browser. Never sent to a third party.

Google (Analytics and Ads, only after you accept): _ga, _ga_*, _gcl_* and related cookies, for up to 2 years. If you decline, Google receives only cookieless signals without identifiers, which it uses to estimate conversions in aggregate.

Meta pixel (only after you accept): _fbp and related cookies, for up to 90 days. If you decline, the Meta pixel is not loaded at all.

Who receives it

The specialists and patient coordinators who prepare your plan and organise your treatment day at BHT Clinic İstanbul Tema Hastanesi.

Service providers that process data for us under contract: BreedCRM (patient enquiry management), Supabase (database, Frankfurt, Germany) and Render (website hosting, Frankfurt, Germany).

If you message us on WhatsApp, WhatsApp (Meta) handles that conversation under its own terms.

With your consent only: Google (Ireland / USA) and Meta (Ireland / USA) for advertising measurement. Transfers outside Türkiye and the EEA rely on the safeguards those companies offer, such as standard contractual clauses (GDPR Art. 46; KVKK Art. 9).

How long we keep it

Enquiry data is kept for as long as we need it to answer you and follow up on your plan. If you become a patient, medical records are kept for the periods Turkish health law requires. Measurement data is kept by Google and Meta for the periods set in our accounts with them. When a reason to keep data ends, we delete or anonymise it.

Your rights

You can ask what data we hold about you, have it corrected or deleted, restrict or object to its use, receive a copy in a portable format, and withdraw consent at any time without affecting what was done before (GDPR Art. 15–22; KVKK Art. 11).

Write to info@hecturkey.com. We answer within 30 days. You can also complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr) or to the data protection authority of the EU country where you live.

Changes

If we change how we use personal data, we update this page and the date above it.