Privacy notice

• We collect what you send us: your name, country and contact details, and health information only if you give explicit consent.
• We use it to answer your enquiry and plan the next steps with you. We do not sell it, and we do not share it with advertisers.
• We do not set cookies for visitors, and we do not use analytics, advertising or social media trackers.
• You can ask to see, correct or delete your data, and you can withdraw consent at any time.

The data controller is Uzm. Dr. Bilgehan İlker Muayenehanesi, the private medical practice of Op. Dr. Bilgehan İlker, specialist in plastic, reconstructive and aesthetic surgery ('we', 'us').

• Address: Ataköy 7-8-9-10. Kısım Mah., Çobançeşme E-5 Yanyol Cad. No:22, Nef 22 Ataköy D Blok Kat 1 Daire 36, 34158 Bakırköy/İstanbul, Türkiye
• Phone and WhatsApp: +90 542 280 27 51
• E-mail: [e-mail address to be added]
• Representative in the EU (GDPR Article 27): [EU representative to be confirmed]
• Representative in the UK (UK GDPR Article 27): [UK representative to be confirmed]

More details about the practice are in our legal notice. The same information in the format required by Turkish law is in our KVKK information notice.

This notice covers the website, the enquiry forms on it, and enquiries you send us by WhatsApp, phone or e-mail. It does not cover medical records created during an examination or treatment.

This website is intended for patients living outside Türkiye, under Türkiye's international health tourism regulations.

When you send an enquiry form

• Your name and the country you select.
• Your phone number with its country code, your e-mail address, or both. We need at least one of them to reply.
• How you would like us to contact you: WhatsApp, phone or e-mail.
• Only if you give explicit consent: the procedure you are interested in and your message. If you choose 'I do not consent', these fields are switched off, and our server discards them if they arrive anyway.
• Your consent choices: that you have read this notice, that you are 18 or over (or the parent or legal guardian of the person concerned), your answer to the health-information question, whether you want updates, the version of the consent wording, the exact consent text you agreed to, and the date and time.
• The context of your visit: the language version, which form you used, the address of the page where you sent it, the page you came from if your browser shares it, and any campaign parameters in the link you followed (for example utm_source or utm_campaign, or the gclid and fbclid codes that Google and Meta adverts add to links).
• Technical details: a scrambled code made from your IP address (a salted hash; we do not store the address itself with your enquiry) and your browser's user-agent string, which describes the browser and device type.
• Our own notes on the status of your enquiry, for example whether we have contacted you.

The forms have no photo upload, and they do not ask for identity documents or payment details.

When you contact us on WhatsApp, by phone or by e-mail

We receive your phone number or e-mail address, the name shown on your WhatsApp profile, and the messages, photos and documents you choose to send. Photos are optional. We use them only to assess your enquiry, and we never publish them. If you message us through our Instagram or Facebook pages, we receive what you send there.

When you browse the website

Like most websites, our web server keeps technical logs of requests, including the IP address, the date and time, the page requested, the referring page and the browser type. We use them to keep the website running and secure.

We do not set cookies for visitors, and we do not use analytics, advertising or social media tracking tools. A few small items are kept in your browser's session storage while the tab is open; our cookie policy lists them.

Turkish law (KVKK) always applies to us. The GDPR column applies where the EU GDPR or the UK GDPR covers our processing, for example because we offer our services to people living in the EU or the UK.

Where we rely on legitimate interests, those interests are keeping the website secure and knowing how people find us. You can object to this use at any time.

You do not have to give us any personal data. Without your name and a phone number or e-mail address we cannot reply to a form. Health information is optional: if you choose 'I do not consent', you can still send your name and contact details, and we will call or write to you.

• Op. Dr. Bilgehan İlker and the members of her medical team who handle enquiries. They are bound by professional secrecy.
• The licensed hospital where treatment would take place, if treatment is planned, and only as your consent allows: [hospital name to be confirmed].
• Our website hosting provider, which stores the website and enquiries on our behalf: [hosting provider to be confirmed], [server country to be confirmed].
• A customer-relationship management (CRM) system, if we connect one. It would receive a copy of each enquiry automatically: [CRM provider and location to be confirmed].
• WhatsApp (Meta), only if you choose to contact us there. Meta processes your messages and account details under its own terms and privacy policy.
• Public authorities and courts, when the law requires it.

After you send a form, you can choose to continue on WhatsApp. We pre-write a short message with your name and, if you shared it, the procedure you asked about. Nothing goes to WhatsApp unless you open it and press send.

Authorised staff view enquiries in a password-protected panel and can download them as a spreadsheet to follow them up. We do not sell your data or share it with advertising networks.

We are based in Türkiye. When you send us information from another country, it comes directly to us in Türkiye.

Our website server is operated by [hosting provider to be confirmed] in [server country to be confirmed]. Where your data is stored or accessed outside Türkiye, or leaves the EU or the UK for a country without an adequacy decision, we use the safeguards that the law requires: [transfer safeguards to be confirmed].

Services that you choose to use, such as WhatsApp, may process data in several countries under their own safeguards.

• Enquiries, including form data, consent records and our notes: [retention period to be confirmed] after our last contact with you, unless the law requires us to keep them longer.
• WhatsApp conversations and the photos you send: [retention period to be confirmed].
• Server logs: [retention period to be confirmed].
• Your choice to receive updates: until you withdraw it.
• Session-storage items in your browser: until you close the tab.

When a retention period ends, we delete or anonymise the data.

• The whole website uses an encrypted connection (HTTPS).
• Enquiries are stored outside the public part of the web server, and staff view them through a password-protected panel.
• With your enquiry we store a scrambled code instead of your IP address.
• Our server discards health fields unless you have given explicit consent.
• Spam protection runs on our own server, without third-party tools such as reCAPTCHA. A form sent within a couple of seconds of being started is treated as automated and is not stored. If you have not heard from us, please call or message us.

No system is completely secure. If a data breach affects you, we will take the steps that the law requires, including notifying the authorities where necessary.

Depending on the law that applies to you, you can ask us to:

• confirm whether we process your data and give you a copy of it;
• correct data that is wrong or incomplete;
• delete your data, or limit how we use it;
• give you the data you provided in a portable format (GDPR);
• tell you why we process your data, whether we use it only for that purpose, and who has received it in Türkiye or abroad (KVKK);
• tell those recipients about any correction or deletion (KVKK);
• stop using your data on the basis of legitimate interests, and stop sending you updates at any time;
• review a result that is to your disadvantage and was produced only by automated analysis (KVKK). We do not make decisions about you by automated means alone;
• compensate you for damage caused by unlawful processing.

Withdrawing consent. You can withdraw consent at any time, as easily as you gave it, by telling us by phone, WhatsApp, post or e-mail. Withdrawal does not affect processing carried out before it.

Making a request. Contact us using the details under 'Who we are'. We may ask you to confirm your identity. Requests are normally free of charge. We reply within 30 days under KVKK and within one month under the GDPR; for complex requests the GDPR allows two further months, and we will tell you if we need them and why.

Formal applications under Turkish law. You can apply in writing to our postal address (signed, if on paper), by registered electronic mail (KEP), with a secure electronic or mobile signature, or from the e-mail address you have already given us. Please include your name, your nationality and passport or ID number, your address, your contact details and what you are asking for. Our KVKK information notice gives the details.

• Türkiye: the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), kvkk.gov.tr. Under KVKK you apply to us first. If we reject your request, our answer is inadequate or we do not reply in time, you can complain to the Board within 30 days of learning our answer, and in any case within 60 days of your application.
• EU and EEA: the data protection authority in the country where you live or work, or where you believe the infringement took place.
• United Kingdom: the Information Commissioner's Office, ico.org.uk.

This website is for adults. We do not knowingly collect data from anyone under 18. If you are enquiring for someone under 18, you must be their parent or legal guardian.

We update this notice when our services or the law change. The date at the top of the page shows the current version.