Personal Data Protection and Privacy Notice

This notice explains how your personal data is processed when you visit the royalplasticsurgery.com website, use the contact form or get in touch with the doctor’s team.

1. Data controller

The data controller for this website and for the patient enquiry processes managed by the doctor’s team is Dr. Royal Khankishiyev.

E-mail: info@royalplasticsurgery.com

This notice covers the website and initial contact. Processing carried out by the hospital where treatment takes place, as part of its own patient records and healthcare services, is governed by the separate privacy notices provided by that hospital.

2. Data collected and how it is collected

Your personal data may be collected through the contact form on the website, by e-mail, by phone and through the messaging channels you use, by fully or partly automated means.

Depending on your enquiry, the following may be processed:

• Your name and the contact details you share.
• The procedure you are interested in, your appointment request and your messages.
• Health information, photos and documents you share for a preliminary assessment.
• IP address, access time and technical logs generated while the website operates and is kept secure.

Please do not send personal information unrelated to your request, identity documents or payment card details during initial contact.

3. Purposes of processing and legal grounds

Your data is processed, to the extent necessary for the relevant activity, for the following purposes:

• Providing information about the service you request, arranging appointments and pre-service communication: KVKK Art. 5/2-c, where this is directly related to and necessary for entering into or performing a contract.
• Operating the website and keeping it secure: legitimate interest under KVKK Art. 5/2-f, provided this does not harm your fundamental rights and freedoms.
• Complying with legal obligations: KVKK Art. 5/2-a and Art. 5/2-ç, as applicable.
• Establishing, exercising or defending a right: KVKK Art. 5/2-e, where necessary.

Where processing requires explicit consent, your consent is requested separately. Visiting the website or sending a message does not mean you have given explicit consent to all processing activities.

4. Health data and photos

Information revealing your health condition, medical documents and photos of this nature are special categories of personal data.

Where necessary for medical assessment and healthcare processes and where the legal conditions are met, this data may be processed under KVKK Art. 6/3-e by persons bound by a duty of confidentiality or by authorised institutions. For activities not covered by this or another legal ground, your explicit consent is obtained separately under KVKK Art. 6/3-a.

Access to health data is limited to authorised persons who need it for their duties. Coordinators’ access is limited to the information needed for their tasks.

A preliminary assessment based on photos and messages does not replace an in-person examination and a final medical assessment.

5. Data sharing and services used

Your data may be shared with the authorised medical team in order to respond to your enquiry; with the relevant healthcare institution, limited to the necessary information, if you proceed to treatment; and with competent public authorities or courts where there is a legal obligation.

For accommodation or transfer arrangements you request, only the information required for that service is shared. Health information or medical photos not needed for the arrangement are not sent to these providers.

Service providers may also process certain data in the course of hosting, technical support and messaging services.

Infrastructure used and transfer information:

• Cloudflare, Inc. (USA; global network). Hosting and content delivery (CDN) of the website; forwarding of e-mails sent to info@royalplasticsurgery.com to the doctor’s mailbox. Data processed: IP address, request logs and technical data, e-mail content in transit. Purpose: delivering and securing the website, forwarding e-mail. Retention: technical logs are kept in line with Cloudflare’s short-term retention practice. Processing abroad: USA and other countries where Cloudflare operates.
• Google LLC (USA). The Gmail mailbox that receives e-mails sent to info@royalplasticsurgery.com. Data processed: e-mail content and attachments. Purpose: receiving and replying to your e-mails. Retention: the periods described in section 6. Processing abroad: USA.
• WhatsApp (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.). Messaging with the doctor’s assistants if you choose to write via WhatsApp. Data processed: your phone number, name, messages and the photos you send. Messages are end-to-end encrypted in transit. Purpose: responding to your enquiry and pre-service communication. Retention: the periods described in section 6. Processing abroad: yes.

The website does not use analytics tools, advertising cookies or tracking pixels. Fonts are loaded from the website’s own server; no requests are made to external font services such as Google Fonts.

Transfers abroad take place through the services of these providers and are carried out in accordance with KVKK Art. 9, relying, where required, on the data subject’s explicit consent or on the standard contractual safeguards offered by the providers.

A service provider’s own privacy policy does not replace the data controller’s obligations. Nor does this notice in itself constitute permission to transfer data abroad.

6. Retention and deletion

Your data is kept only for as long as the stated purposes require and within applicable legal retention obligations.

The closing of the enquiry, its conversion into a treatment process, relevant legal obligations and the periods needed to protect a right are taken into account when determining retention periods. Once all conditions for processing cease to exist, the data is deleted, destroyed or anonymised.

If you request deletion, records that must legally be kept will be reviewed and you will be informed of the outcome of your request.

7. Photos, reviews and publication permissions

Photos, videos and messages you send for consultation or treatment are not published on the website or on social media merely because you have sent them to us.

Any publication is assessed separately: to the extent permitted by the relevant legislation, the necessary separate permissions are obtained after explaining the purpose and channels of publication. Consent to treatment is not permission for promotional publication.

A request for information or an appointment does not mean you agree to receive advertising or campaign messages.

8. For patients in the European Union (GDPR)

For visitors in the EU or the European Economic Area, the processing of personal data is also subject to the General Data Protection Regulation (GDPR). The controller is the same: Dr. Royal Khankishiyev.

Legal bases:

• Steps taken at your request before entering into a contract (information, appointments, initial contact): GDPR Art. 6(1)(b).
• Keeping the website secure (legitimate interest): GDPR Art. 6(1)(f).
• Health data and photos: your explicit consent, GDPR Art. 9(2)(a).

Transfers outside the EU rely, where applicable, on the providers’ Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw your consent at any time and lodge a complaint with the supervisory authority of your country. For requests: info@royalplasticsurgery.com.

9. Your rights

Under KVKK Art. 11 you may:

• learn whether your data is processed and, if so, request information about it;
• learn the purpose of processing and whether the data is used in line with that purpose;
• know the third parties in Turkey or abroad to whom your data is transferred;
• request correction of incomplete or inaccurate data;
• request deletion or destruction of the data when the legal conditions are met;
• request that corrections and deletions be notified to third parties to whom the data was transferred;
• object to an outcome against you arising solely from analysis by automated systems;
• claim compensation if you suffer damage due to unlawful processing.

Where processing is based on explicit consent, you may withdraw it. This does not affect the lawfulness of processing before withdrawal.

10. How to apply

You can send requests regarding your rights to the contact details above, using the methods set out in the Communiqué on the Procedures and Principles of Application to the Data Controller (Tebliğ). For e-mail applications, you may use the address you have previously given us and that is registered in our system.

Applications are concluded as soon as possible and within 30 days at the latest. If the request involves additional cost, the fee provided for in the legislation may be charged.

If your application is rejected, the response is insufficient or no response is given in time, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within the legal conditions and time limits.