1. Introduction & Data Controller
Lemon Clinic ("we", "our", or "us"), operating in Istanbul, Türkiye (Fulya & Nişantaşı Medical District), values your privacy. In accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and the General Data Protection Regulation (GDPR) for European Union / international visitors, this Privacy Policy explains what data we collect, why we collect it, how we use it, and your legal rights.
Data Controller Details:
Legal Entity / Trade Name: Lemon Clinic
Registered Address: Fulya & Nişantaşı Medical District, Şişli, Istanbul, Türkiye
Contact Email: info@lemonclinicturkey.com
Phone / WhatsApp: +90 546 214 9919
2. Personal Data We Collect
When you use our website, online graft calculator, consultation forms, or communicate with our patient advisers via WhatsApp, SMS, or email, we may collect the following categories of data:
- Contact Information: Full name, email address, phone number, and preferred messaging handles (WhatsApp, iMessage/SMS, Telegram, Instagram).
- Special Category Health Data: Hair loss photos, medical history questionnaires, graft estimates, and doctor consultation notes. Under KVKK (Art. 6) and GDPR (Art. 9), hair and medical photographs constitute special category personal data (health data) and are processed strictly with your explicit consent.
- Technical & Security Data: Anonymized/salted SHA-256 IP hashes for rate limiting (raw IP addresses are never stored), browser type, device information, and page interaction data collected via cookies and analytics tools (only when consented).
3. Purpose of Processing
Your personal and health data are processed strictly for the following lawful purposes:
- Providing online medical consultations, graft estimations, and surgical recommendations from our licensed hair restoration surgeons.
- Organizing your all-inclusive 4-night Istanbul medical package, including VIP airport transfers, partner hotel accommodation, and clinic appointments.
- Communicating pre-operative instructions, post-operative care guidelines, and 12-month follow-up check-ins.
- Complying with Turkish Ministry of Health regulations and applicable legal obligations.
4. Data Retention & 30-Day Photo Retention Policy
We retain your personal contact data only for as long as necessary to fulfill the consultation purposes outlined in this policy or as required by applicable laws.
30-Day Retention & Lifecycle Deletion for Uploaded Photos: All scalp photographs uploaded through our online AI hair analysis and preview tools are stored in encrypted Google Cloud Storage with client access disabled and are scheduled for automatic deletion after 30 days via our cloud storage lifecycle rules (Delete action at age 30 days; actual removal from underlying storage media and any cloud provider soft-delete/recovery windows is completed asynchronously by Google Cloud Storage lifecycle processing). You may also request earlier manual deletion at any time by contacting info@lemonclinicturkey.com. If you subsequently book an in-person procedure in Istanbul, clinical medical records and in-clinic photographs are collected and maintained separately under Turkish Ministry of Health medical record-keeping regulations with your written clinical consent.
5. Third-Party Service Providers & International Data Transfers
To operate our website, AI evaluation tools, and patient communication infrastructure, we utilize trusted third-party processors bound by data processing agreements and strict confidentiality standards:
- Google Cloud & Firebase: Secure web hosting, Cloud Functions execution, Firestore database management, and encrypted Cloud Storage.
- Cloudflare Turnstile: Privacy-preserving bot and abuse protection on consultation and upload forms.
- Google Gemini API: AI-powered scalp graft estimation and simulation generation (processed securely via encrypted API calls).
- Telegram Bot API: Instant encrypted routing of submitted consultation requests to our clinical patient coordination desk.
- Resend: Transactional email delivery for one-time verification codes when unlocking AI simulation previews.
- Google Analytics & Meta Pixel: Website traffic analysis and conversion measurement (loaded strictly only after you grant optional cookie consent).
Cross-Border Data Transfers (KVKK Art. 9 & GDPR Chapter V): Because the cloud infrastructure and communication providers listed above operate globally distributed servers located outside the Republic of Türkiye and/or the European Economic Area (EEA), using our online consultation forms, AI photo analysis, or optional analytics involves cross-border personal data transfers. Currently, transfers triggered when you submit consultation forms, upload scalp photographs for evaluation, or opt into non-essential cookies are carried out on the basis of your explicit consent and technical safeguards (TLS encryption in transit, encrypted cloud storage with client access disabled, and salted IP hashing). Note that under Turkish Personal Data Protection Law (KVKK) Article 9 (as amended by Law No. 7499), ongoing cross-border transfers to cloud processors where no adequacy decision exists require execution and formal notification of Turkish Standard Contracts (Standart Sözleşme) with the Turkish Personal Data Protection Authority (KVKK) — distinct from EU GDPR Standard Contractual Clauses (SCCs) — which must be completed and verified by the data controller's legal counsel prior to commercial operation.
6. Your Rights (KVKK Art. 11 & GDPR Art. 15–22)
You have the right to request access, correction, deletion, portability, or restriction of your personal data, and to withdraw your consent at any time without affecting the lawfulness of prior processing. To exercise your rights, please contact our Data Protection Desk at info@lemonclinicturkey.com.