Privacy Policy

The controller of the personal data collected through the Services is:

• Company name: ZYNEA CILINIC SAÇ EKİMİ SAĞLIK TURİZM VE TİCARET LİMİTED ŞİRKETİ
• Legal form: Limited Şirket (Turkish equivalent of a limited liability company)
• Registered office: Merkez Mah. Akar Cad. I Tovvers Bomonti No: 3, İç Kapı No: 23, 34381 Şişli / İstanbul, Türkiye
• MERSIS number: 0999149721500001
• Istanbul Commercial Register: 1115930
• Tax number: 9991497215 — Şişli Tax Office (code 034276)
• Share capital: TRY 50,000.00
• Legal representatives (Müdür / Managers): Mr Bekir Karabacak and Mr Nicolas-Louis Paul H. Boel, each authorised to represent the company individually
• Contact email: contact@zyneaclinic.org
• Website: www.zyneaclinic.org

For any question relating to this policy or to the exercise of your rights over your data, you may write to our dedicated data protection contact point:

• By email: privacy@zyneaclinic.org
• By post: Zynea Cilinic — Data Protection Office — Merkez Mah. Akar Cad. I Tovvers Bomonti No: 3 / 23, 34381 Şişli / İstanbul, Türkiye

We collect different categories of data, either directly from you (contact form, online quote, WhatsApp exchanges, remote consultations, pre-operative medical forms, stay at the clinic) or automatically through tracking technologies on our website and applications.

2.1 Identification and contact data

• Title, surname, first name, date and place of birth, nationality.
• Postal address, country of residence, email address, telephone numbers (landline, mobile, WhatsApp).
• Copy of identity document or passport where necessary to organise the medical stay (visa, airport transfer, accommodation).
• User account identifiers (username, encrypted password, preferred language).

2.2 Health data (special category — art. 9 GDPR / art. 6 KVKK)

To enable a hair transplant or any other medical or aesthetic procedure to be performed safely, we may collect and process data concerning your health:

• Medical and surgical history, ongoing treatments, allergies.
• Photographs of the scalp, donor and recipient areas, or treatment area, taken before, during and after the procedure.
• Results of pre-operative laboratory tests (blood count, serology, etc.).
• Diagnosis, treatment plan, transplantation technique (FUE, DHI, sapphire, etc.), number of grafts, intra-operative observations.
• Post-operative follow-up, possible complications, prescriptions and recommendations.

These data are only processed with your express and explicit consent, or on the other legal bases provided for by Article 9(2) GDPR (in particular for preventive medicine, diagnosis, the provision of care or treatment).

2.3 Payment and billing data

• Billing details, amounts, currencies, dates and methods of payment.
• Banking data processed exclusively by our secure payment provider. Zynea does not store payment card numbers.

2.4 Data relating to the stay and medical tourism

• Flight information, arrival and departure dates, flight number.
• Language preferences for support (French, English, Arabic, Turkish, etc.).
• Hotel, room type, specific support needs.
• Specific requests linked to the VIP concierge service for international patients.

2.5 Communication data

• Content of exchanges (WhatsApp, email, contact forms, on-site messaging).
• Any call recordings, subject to prior information and consent.
• Reviews and testimonials you publish.

2.6 Automatically collected data

• Technical data: IP address, browser type and version, operating system, device identifiers.
• Connection and browsing data: pages viewed, visit duration, date and time of connection, traffic source, country.
• Cookies and trackers (see section 8).

Your data are processed for the following purposes, on the following legal bases:

• Performance of the care contract or pre-contractual measures (art. 6(1)(b) GDPR / art. 5(2)(c) KVKK): quotation, booking the procedure, organising the stay, transport, accommodation, treatment, post-operative follow-up, billing.
• Explicit consent (art. 6(1)(a) and 9(2)(a) GDPR / art. 5(1) and 6(2) KVKK): processing of health data, “before/after” photographs, sending marketing communications, placement of non-essential cookies.
• Legitimate interest (art. 6(1)(f) GDPR): improvement of the Services, site security and fraud prevention, audience measurement, patient relationship management and satisfaction, defence of legal claims.
• Legal obligation (art. 6(1)(c) GDPR / art. 5(2)(a) KVKK): keeping the medical record in accordance with Turkish health regulations, retention of invoices, anti-money laundering, response to requests from competent authorities.
• Protection of vital interests (art. 6(1)(d) and 9(2)(c) GDPR): intervention in the event of a medical emergency during the stay.

Your data may be communicated to the following recipients, within the strict limits of what is necessary to perform their tasks and under an obligation of confidentiality:

• Zynea's medical and paramedical staff (doctors, surgeons, nurses, technicians) directly involved in your care.
• Authorised administrative staff (international team, concierge, multilingual customer service, accounting).
• Our partners involved in organising the stay (partner hotels, transfer/transport companies), for the information strictly necessary to perform the service.
• Our technical sub-processors (website host, payment provider, email-sending tool, audience analysis tool, CRM).
• Analysis laboratories and partner establishments where diagnostic needs arise.
• Administrative, health or judicial authorities where required by law.
• Insurance companies and lawyers, where applicable, for the defence of the Clinic's or the patient's rights.

Zynea does not sell your personal data to third parties for commercial purposes.

4.1 Main sub-processors

• Website hosting, content delivery (CDN), web application firewall and anti-DDoS protection: Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA — with European data centres). Cloudflare is certified under the European Commission's Standard Contractual Clauses.
• Patient messaging platform: WhatsApp Business, provided by Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland).

The up-to-date list of sub-processors is available on request at privacy@zyneaclinic.org.

As Zynea is established in the Republic of Türkiye, the processing of your data involves a transfer from your country of residence to Türkiye. To date, the Republic of Türkiye is not the subject of an adequacy decision by the European Commission.

Where your data are collected from the European Economic Area, Zynea frames these transfers using the appropriate safeguards provided for by the GDPR:

• Your explicit consent, given on the basis of prior information about the risks linked to the absence of an adequacy decision (art. 49(1)(a) GDPR);
• The necessity of the transfer for the performance of the care contract concluded at your request (art. 49(1)(b) GDPR);
• The Standard Contractual Clauses (SCCs) adopted by the European Commission on 4 June 2021, incorporated into our sub-processing contracts;
• Additional technical and organisational measures (encryption, pseudonymisation, reinforced access controls).

You may obtain a copy of the safeguards in place by writing to us at privacy@zyneaclinic.org.

Your data are kept for the period strictly necessary for the purposes for which they were collected:

• Prospect data (quotes, contact form without follow-up): 3 years from the last active contact.
• Medical record (including photographs, history, operative reports): 20 years from the last procedure, in accordance with Turkish health regulations and the recommendations applicable to medical and surgical acts.
• Billing data and accounting records: 10 years from the end of the financial year (legal obligation).
• Payment data: not stored by Zynea (handled by the payment provider).
• Cookies: 13 months maximum from their placement.
• Connection logs: 1 year in accordance with applicable regulations.
• Call recordings (where applicable): 6 months maximum.

At the end of these periods, the data are securely deleted or irreversibly anonymised.

In accordance with Articles 15 to 22 GDPR and Article 11 KVKK, you have the following rights:

• Right of access: to obtain confirmation that data concerning you are being processed and to obtain a copy.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure (“right to be forgotten”): to obtain the deletion of your data in the cases provided for by law, subject to our legal obligations to retain the medical record.
• Right to restriction: to request the temporary suspension of processing.
• Right to portability: to receive your data in a structured, commonly used and machine-readable format.
• Right to object: to object to processing based on legitimate interest, or to direct marketing.
• Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.
• Right to define directives regarding the fate of your data after your death.

To exercise these rights, send your request, accompanied by a copy of an identity document, to: privacy@zyneaclinic.org or by post to the registered office. We undertake to respond within a maximum of one month from receipt of the request (30 days under the KVKK).

In the event of an ongoing disagreement, you have the right to lodge a complaint:

• With the CNIL (France) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr;
• Or with the supervisory authority of your country of residence in the European Union;
• Or with the Turkish data protection authority KVKK (Kişisel Verileri Koruma Kurumu) — www.kvkk.gov.tr.

When you browse our Services, cookies and other trackers may be placed on your device. A cookie is a small text file that allows your browser to be recognised on subsequent visits.

8.1 Categories of cookies used

• Strictly necessary cookies: essential to the operation of the site (session, security, language preferences). They do not require consent.
• Audience measurement cookies: allow the site's traffic to be analysed in order to improve its content.
• Functional cookies: allow your experience to be personalised (display preferences, recommendations).
• Advertising cookies: used to offer you advertising tailored to your interests.

8.2 Managing your consent

On your first visit, a cookie banner allows you to accept, refuse or customise the placement of non-essential cookies. You can change your choices at any time via the “Manage cookies” link located at the bottom of each page.

You can also configure your browser to refuse all or part of cookies. Please note, however, that disabling certain cookies may impair the operation of the Services.

Zynea implements appropriate technical and organisational measures to ensure a level of security adapted to the risks, in particular reinforced for health data:

• Encryption of communications via the HTTPS / TLS 1.3 protocol.
• Encryption of passwords and sensitive data at rest (AES-256).
• Systematic pseudonymisation of “before/after” photographs when used for statistical or internal training purposes.
• Strict access control, traceability (logs) and strong authentication of authorised staff.
• Regular encrypted backups and business continuity plan.
• Periodic security audits and penetration testing.
• Internal data breach management procedure compliant with Article 33 GDPR.

In the event of a data breach likely to result in a high risk to your rights and freedoms, Zynea undertakes to inform you as soon as possible, in accordance with Article 34 GDPR and Article 12 KVKK.

Photographs taken as part of your care form an integral part of your medical record and, as such, are kept confidential.

Any use of these photographs for promotional, educational or communication purposes (website, social networks, brochures) is strictly subject to the prior signature of a specific, separate, written consent form, revocable at any time, specifying the media concerned and the duration of use.

You can withdraw this consent at any time in writing at privacy@zyneaclinic.org, without this affecting the quality of medical care.

Zynea's medical Services are not intended for minors, except in special cases and only with the prior written agreement of the holder(s) of parental authority and after a reinforced medical assessment. Any data collected from a minor without such authorisation will be deleted as soon as possible.

This Privacy Policy may be amended at any time to reflect legislative, regulatory, case-law, technical or organisational developments. Any substantial change will be notified to you by email or by a notice displayed on the Services. The effective date is shown at the top of this document. We recommend that you consult this page regularly.

For any question relating to this Privacy Policy or to the processing of your personal data, you may contact us:

• By email: contact@zyneaclinic.org or privacy@zyneaclinic.org
• By post: Zynea Cilinic — Data Protection Office — Merkez Mah. Akar Cad. I Tovvers Bomonti No: 3 / 23, 34381 Şişli / İstanbul, Türkiye
• By telephone / WhatsApp: +32 479 50 50 07