Data Protection
Privacy Policy
This policy explains, in plain language, what personal data Unal Cakar collects, why, the lawful bases we rely on, who processes it, and the rights you have under both the EU GDPR and Turkish KVKK. It is a plain-language summary and does not form part of any contract.
Who is the data controller
Unal Cakar is an independent, USHAŞ-licensed health-tourism facilitator and patient advocate, based in Istanbul, Türkiye, serving international patients worldwide. We are not a clinic, hospital or medical practice, we do not provide treatment, and we do not give medical advice; all treatment is performed by independent, accredited Turkish clinics and licensed surgeons.
For the purposes of data-protection law — including the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK) — Unal Cakar acts as the data controller for the personal data you share with us directly.
You can reach the data controller about any privacy question at [email protected], by phone or WhatsApp on +90 530 071 93 96, or via Instagram at instagram.com/unalcakar.official.
What personal data we collect
- Your name, email, phone number with country, and the message you write. You provide this so we can understand your enquiry and respond. Providing it is voluntary, but without it we cannot reply to you.
- The same contact details as above, plus health-related information: the hair-loss pattern you select (a Norwood–Ludwig scale). Because this concerns your health, it is treated as special-category data under GDPR Article 9 and sensitive personal data under KVKK Article 6. You are never required to use this calculator.
- If, and only if, you accept analytics cookies, Google Analytics 4 collects standard usage data such as pages viewed, approximate location and device type. Cloudflare Web Analytics collects aggregate, cookieless usage data that does not identify you.
Why we use it, and our lawful basis
- We use your contact details and message to reply to you and, where relevant, to take steps at your request before any engagement. Lawful basis: our legitimate interest in answering enquiries, and pre-contractual steps taken at your request (GDPR Art. 6(1)(f) and 6(1)(b)). We use these details only to respond to you.
- We process the hair-loss pattern you submit solely to give you an indicative estimate and to respond. Because it is special-category health data, we rely on your explicit consent, which you give via a required consent checkbox before submitting (GDPR Art. 9(2)(a); explicit consent under KVKK Art. 6). You may withdraw this consent at any time.
- We use analytics to understand how the site is used and improve it. Google Analytics 4 cookies are set only after you accept them in the consent banner (consent — GDPR Art. 6(1)(a)). Cloudflare Web Analytics is cookieless and aggregate, so it does not require consent.
Third-party processors and what each receives
We do not sell your data. A small number of named providers process data strictly on our behalf, only for the purposes described above.
Web3Forms — form processing
When you submit the consultation form or the graft calculator, Web3Forms (a third-party form-to-email service) processes the data you entered — including any health-related information from the calculator — and delivers it to us by e-mail. It is used only to respond to you.
Google Analytics 4 (Google)
If you accept analytics cookies, Google receives standard analytics usage data via GA4. GA4 runs under Google Consent Mode v2 with consent defaulted to denied, so nothing is sent to Google until you opt in.
Cloudflare Web Analytics
Cloudflare receives cookieless, aggregated usage statistics that do not identify individual visitors. No consent is required for this.
Cloudflare Pages — hosting
The website is hosted on Cloudflare Pages, so Cloudflare processes standard technical data (such as your IP address) as part of securely serving the site to you.
Cookies and consent
When you first visit, a consent banner asks whether you accept analytics cookies. Until you accept, no Google Analytics 4 cookie is set — this is enforced through Google Consent Mode v2, which defaults consent to denied. Cloudflare Web Analytics is entirely cookieless and runs regardless, because it cannot identify you.
You can change or withdraw your analytics consent at any time using the "Cookie settings" link in the website footer. You can also control or block cookies through your browser settings.
International transfers
Unal Cakar is based in Türkiye, and our processors operate internationally. As a result, your personal data may be processed outside the country you live in — for example in Türkiye, the European Economic Area, or elsewhere where a processor such as Google, Cloudflare or Web3Forms operates.
Where data is transferred across borders, it is done under appropriate safeguards recognised by GDPR and KVKK (such as standard contractual clauses or an equivalent mechanism), and only for the purposes described in this policy.
How long we keep your data
We keep your personal data only for as long as needed to respond to your enquiry and to meet any legal or record-keeping obligations. Where an enquiry does not proceed, we keep it for a limited period and then delete or anonymise it.
Analytics data is retained according to the standard retention settings of the analytics providers. You can ask us about retention for your specific case at any time.
Your rights under GDPR and KVKK
- Ask whether we hold data about you and request a copy of it.
- Ask us to correct data that is inaccurate or incomplete.
- Ask us to delete your data where there is no overriding reason to keep it.
- Ask us to restrict, or object to, our use of your data, including processing based on legitimate interest.
- Receive the data you provided in a portable, machine-readable format, where applicable.
- Withdraw consent for health data or analytics at any time. This does not affect processing carried out before you withdrew it.
- Lodge a complaint with your local data-protection authority in the EU/EEA, or with the Turkish Personal Data Protection Authority (KVKK Kurumu).
Children and security
This website and our coordination service are intended for adults. We do not knowingly collect personal data from children; if you believe a child has provided us data, please contact us so we can delete it.
We take reasonable technical and organisational measures to protect your data, and we work only with established processors. No transmission over the internet can be guaranteed perfectly secure, but we limit what we collect, share, and retain to reduce risk.
If you have any question about this policy, or you wish to exercise your rights, contact the data controller, Unal Cakar, at [email protected] — or by phone/WhatsApp on +90 530 071 93 96. We aim to respond as soon as we reasonably can.
This policy is a general summary and may be updated from time to time; the current version always appears on this page. It is a draft pending legal sign-off and does not yet constitute legal advice.
Not sure where to start? Ask me directly.
Send your questions and I'll come back to you personally — free, with an honest, itemised answer.