Privacy Policy

Last updated: 29 October 2026

Summary

This policy explains which personal data hairpol.com processes when you visit the website, fill in our consultation form or contact us, why we do it, who receives the data and what rights you have. It takes into account the EU and UK General Data Protection Regulation (GDPR) and Turkish Personal Data Protection Law No. 6698 (KVKK).

In short: we use Google Analytics to understand how the website is used. Information you send us through the form, by email, phone or WhatsApp is used to answer your request. We do not sell data, and we do not use advertising pixels such as the Meta (Facebook) pixel on the website.

Who is responsible (data controller)

Hairpol is a trademark of Özel Zen Polikliniği. The controller responsible for this website is:

Hera Sağlık ve Güzellik Hizmetleri Ticaret Anonim Şirketi (“Özel Zen Polikliniği”)
Barbaros Mah. Begonya Sok. No:3J, Nida Kule Kat:B1, 34750 Ataşehir / Istanbul, Türkiye
Tax office Kozyatağı, tax no. 4610890831 · MERSİS no. 0461089083100001
Email: info@hairpol.com · info@zenpoliklinik.com · Phone: +90 549 106 07 47

Özel Zen Polikliniği is a private polyclinic for medical aesthetics, operating under the procedures of the Ministry of Health of the Republic of Türkiye.

What we process, why, and on what legal basis

1. Visiting the website (server logs)

When you open a page, our web server automatically records technical data: IP address, date and time, the page requested, the referring page, browser type and version, operating system and the status of the request. We need this to deliver the website, keep it secure and fix errors.

Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

2. Consultation form (“Free hair analysis”)

Our multi-step form asks for:

• the treatment you are interested in (hair, beard or eyebrow transplant, hair transplant for women, other, not sure yet);
• how long you have been losing hair and which area is most affected;
• your age group and whether you have had a hair transplant before;
• your name, phone number (with country code) and email address;
• an optional message.

Information about your hair loss and previous procedures is health data, a special category of personal data. Please only send what is needed for a first assessment. The form is not intended for people under 18.

We use this data to answer your request, prepare a first assessment and a quote, and contact you about it by phone, email or WhatsApp. Before sending, the form asks you to confirm that your data may be used to contact you about your request.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). For health data: your explicit consent, given by choosing to share this information with us (Art. 9(2)(a) GDPR), and, if you become our patient, the provision of medical diagnosis and treatment by professionals bound by medical confidentiality (Art. 9(2)(h) and (3) GDPR). You can withdraw your consent at any time with effect for the future by writing to info@hairpol.com.

Recipients: form submissions are stored in our website database and passed to StellaMedi, the CRM system our clinic team uses to manage enquiries. Our team also receives an internal notification that a new request has arrived; it contains only the type of request and the page address, not your name, contact details or answers.

3. Contact by email, phone or WhatsApp

When you contact us, we process the information you give us (for example your name, contact details, messages and any photos you send) to reply to you. Legal basis as under section 2.

WhatsApp: the WhatsApp buttons on the website are simple links (wa.me). No data is sent to WhatsApp before you click. After the click, WhatsApp Ireland Limited / Meta Platforms, Inc. privacy policy applies, and data may be transferred to the USA. Please keep this in mind before sending health information or photos via WhatsApp; you can also email us.

When you click a WhatsApp button, our own server receives a short message with the address of the page you clicked on, so our team knows a WhatsApp enquiry is on its way. Your browser stores the time of the click in local storage (key “hp_tg_wa”) so that this message is sent at most once every 30 minutes. Your name or phone number is not transmitted. Legal basis: our legitimate interest in handling enquiries quickly (Art. 6(1)(f) GDPR).

4. Graft calculator

If you use our graft calculator, the values you select (Norwood stage, area, hair type) are sent to our server to calculate an estimate and are kept in your browser for the session (session storage “hairpol_calc”). They are not linked to your name or contact details.

5. Google Analytics 4 and Google Tag Manager

We use Google Analytics 4 (measurement ID G-M9QMT14E73), loaded directly and via Google Tag Manager (GTM-MW4PMF35), to see how visitors use the website: pages viewed, time spent, approximate location (country/city), device and browser, where visitors come from, and certain events such as form submissions, WhatsApp clicks and link clicks. Google Analytics sets cookies (_ga, _ga_<ID>, stored for up to 2 years) and processes your IP address, which Google uses to estimate location and does not store in Analytics. The content of the form (name, contact details, health information) is not sent to Google Analytics.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA. Data may be transferred to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

Legal basis: our legitimate interest in measuring and improving the website (Art. 6(1)(f) GDPR). You can object at any time by blocking or deleting cookies in your browser or by installing Google’s browser add-on: tools.google.com/dlpage/gaoptout.

6. Other cookies and local storage

• WooCommerce source tracking (cookies sbjs_\*): our shop software (WooCommerce) uses the “Sourcebuster” script to remember how you arrived at the website (for example the referring website or a campaign). The session cookie expires at the end of the session, the others after at most 6 months. These cookies are set by our own website and are not shared with third parties.
• Language choice (cookie “hp_lang_choice”, 1 year): remembers the language you selected.
• Staff marker (cookie “hp_staff”): set only on devices of our clinic staff to exclude their visits from statistics; never set for visitors.
• Blog pop-up (local/session storage “hpbm_bekleme”, “hpbm_gosterildi”): remembers when the consultation pop-up on blog articles may be shown again.
• WhatsApp click notice: local storage “hp_tg_wa” (see section 3).

7. Embedded Google content

• Google Maps: a Google map is embedded on our contact page. When the map loads, your browser connects to Google’s servers; Google receives your IP address and may set cookies.
• Google News “preferred source” button: the page footer loads a script from news.google.com for the “Add as preferred source” button. Your IP address and browser data are sent to Google.

Provider: Google Ireland Limited / Google LLC. Legal basis: our legitimate interest in presenting our location and our news content (Art. 6(1)(f) GDPR).

8. Links to social networks and review sites

Our pages contain simple links to Facebook, Instagram, YouTube, X, Trustpilot and Google reviews. These are not embedded plugins: data is only sent to the provider after you click, and its privacy policy then applies. Our reviews are shown as text and images from our own server.

9. Hosting and email

The website is hosted by a hosting provider in Türkiye, which processes data on our behalf. Our email service providers process the emails you send us.

Recipients

• our clinic team (patient coordinators, doctors), where necessary;
• service providers working for us: hosting, email and the StellaMedi CRM system;
• Google (Analytics, Tag Manager, Maps, News script) as described above;
• Meta/WhatsApp, only if you contact us via WhatsApp;
• authorities such as the Ministry of Health of the Republic of Türkiye, courts, and our lawyers, tax advisers and auditors, where legally required.

We do not sell your data.

Transfers outside the EU/UK

We are based in Türkiye. If you use the website from the EU or the UK or send us a request, your data is transferred to Türkiye. There is no adequacy decision for Türkiye. The transfer of your request is necessary to answer it and to take steps at your request before entering into a contract (Art. 49(1)(b) GDPR); for health data we rely on your explicit consent (Art. 49(1)(a) GDPR). Transfers from Türkiye to other countries follow Articles 8 and 9 KVKK.

How long we keep data

We keep personal data only as long as necessary for the purposes described above or as required by law. After that it is deleted, destroyed or anonymised. If you become our patient, medical records are kept for the period required by Turkish health legislation.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation.

Under Article 11 KVKK you can also ask whether your data is processed, for what purpose, and to which third parties in Türkiye or abroad it has been transferred, and request compensation if you suffer damage from unlawful processing.

To exercise your rights, write to info@hairpol.com or info@zenpoliklinik.com, or by post to the address above. We reply free of charge within one month at the latest.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work (in the UK: the Information Commissioner’s Office, ico.org.uk). Under Turkish law you can also contact the Turkish Personal Data Protection Authority (kvkk.gov.tr).

Automated decisions

We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you.

Security

The website uses an encrypted connection (HTTPS). We take technical and organisational measures to protect your data. Please note that email and messengers are not always end-to-end encrypted.

Changes

We update this policy when our website or our data processing changes. The current version is always available on this page.